defendnot | 327b507193a6d9aeb9590b65cd683073d3cb98c8bdea4d0919f4479359cec6f8

Analysis

max time kernel
149s
max time network
147s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
26/09/2026, 14:27

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-26_d12f23e437ada80a0e0c911e11182a30_coinminer_dosia_elex_frostygoop_glassworm_hive_http-brow.exe
Size 12.3MB
Sample260926-rskbmsty4j
SHA256 327b507193a6d9aeb9590b65cd683073d3cb98c8bdea4d0919f4479359cec6f8
MD5 d12f23e437ada80a0e0c911e11182a30
SHA1 cccd3add2d929d293c2fdd1a1959f00e9bbb62a2
SHA512 5f15a00ef26a2a1976a9e8995d4391fbf42596771721c5309b3188ede80bfd43f0333bdc9cc619ee9a1ceaba2c09b1f2e111171ea5e4c4c2472b047a4ddedf84
SSDEEP 196608:gwftyDO5Az52hR2PSogmMOCu/iganeSrbnQ5Z5sTjVY:EOMEHmNFivneUgsdY
TLSH
T123D6AD01FE8B94F1E503493111ABB26F63305E058F29DBDBEB407B6AF9776A11D36209
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery execution defendnot salatstealer hacktool persistence spyware stealer trojan upx

Malware Config

Signatures

Family: Defendnot
Defendnot is a tool designed to disable Microsoft Defender.
hacktool defendnot
Family: salatstealer
SalatStealer is a stealer that takes sceenshot written in Golang.
stealer salatstealer

Detect SalatStealer payload 6 IoCs

resource	yara_rule
behavioral2/memory/2348-190-0x0000000000610000-0x0000000001267000-memory.dmp	family_salatstealer
behavioral2/memory/2348-191-0x0000000000610000-0x0000000001267000-memory.dmp	family_salatstealer
behavioral2/memory/2348-192-0x0000000000610000-0x0000000001267000-memory.dmp	family_salatstealer
behavioral2/memory/2348-193-0x0000000000610000-0x0000000001267000-memory.dmp	family_salatstealer
behavioral2/memory/2348-199-0x0000000000610000-0x0000000001267000-memory.dmp	family_salatstealer
behavioral2/memory/1436-203-0x0000000000A70000-0x00000000016C7000-memory.dmp	family_salatstealer

Detects Defendnot 1 IoCs

resource	yara_rule
behavioral2/files/0x000d00000001c48c-52.dat	family_defendnot

Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs. 6 IoCs

resource	yara_rule
behavioral2/memory/2348-190-0x0000000000610000-0x0000000001267000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs
behavioral2/memory/2348-191-0x0000000000610000-0x0000000001267000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs
behavioral2/memory/2348-192-0x0000000000610000-0x0000000001267000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs
behavioral2/memory/2348-193-0x0000000000610000-0x0000000001267000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs
behavioral2/memory/2348-199-0x0000000000610000-0x0000000001267000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs
behavioral2/memory/1436-203-0x0000000000A70000-0x00000000016C7000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs

Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers 6 IoCs

resource	yara_rule
behavioral2/memory/2348-190-0x0000000000610000-0x0000000001267000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral2/memory/2348-191-0x0000000000610000-0x0000000001267000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral2/memory/2348-192-0x0000000000610000-0x0000000001267000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral2/memory/2348-193-0x0000000000610000-0x0000000001267000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral2/memory/2348-199-0x0000000000610000-0x0000000001267000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral2/memory/1436-203-0x0000000000A70000-0x00000000016C7000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers

Detects executables containing SQL queries to confidential data stores. Observed in infostealers 6 IoCs

resource	yara_rule
behavioral2/memory/2348-190-0x0000000000610000-0x0000000001267000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore
behavioral2/memory/2348-191-0x0000000000610000-0x0000000001267000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore
behavioral2/memory/2348-192-0x0000000000610000-0x0000000001267000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore
behavioral2/memory/2348-193-0x0000000000610000-0x0000000001267000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore
behavioral2/memory/2348-199-0x0000000000610000-0x0000000001267000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore
behavioral2/memory/1436-203-0x0000000000A70000-0x00000000016C7000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore

UPX dump on OEP (original entry point) 9 IoCs

resource	yara_rule
behavioral2/files/0x000f00000001c4b6-187.dat	UPX
behavioral2/memory/2348-189-0x0000000000610000-0x0000000001267000-memory.dmp	UPX
behavioral2/memory/2348-190-0x0000000000610000-0x0000000001267000-memory.dmp	UPX
behavioral2/memory/2348-191-0x0000000000610000-0x0000000001267000-memory.dmp	UPX
behavioral2/memory/2348-192-0x0000000000610000-0x0000000001267000-memory.dmp	UPX
behavioral2/memory/2348-193-0x0000000000610000-0x0000000001267000-memory.dmp	UPX
behavioral2/memory/1436-201-0x0000000000A70000-0x00000000016C7000-memory.dmp	UPX
behavioral2/memory/2348-199-0x0000000000610000-0x0000000001267000-memory.dmp	UPX
behavioral2/memory/1436-203-0x0000000000A70000-0x00000000016C7000-memory.dmp	UPX

Command and Scripting Interpreter: PowerShell 1 TTPs 6 IoCs

Run Powershell to get system information as a root user.

execution

PowerShell

T1059.001

pid	Process
2152	powershell.exe
1232	powershell.exe
2152	powershell.exe
2772	powershell.exe
2872	powershell.exe
1936	powershell.exe

Downloads MZ/PE file 1 IoCs

flow	pid	Process
3	4836	updater_pIttzRsW.exe

Executes dropped EXE 8 IoCs

pid	Process
2148	defendnot-loader.exe
4836	updater_pIttzRsW.exe
3544	defendnot-loader.exe
5184	748743_msvcp140_5696dd7a71.exe
3244	updater_gbHGjrpq.exe
5064	updater_oyQhnkzn.exe
2348	updater_QqtlWxuJ.exe
1436	2026-09-26_d12f23e437ada80a0e0c911e11182a30_coinminer_dosia_elex_frostygoop_glassworm_hive_http-brow.exe

Loads dropped DLL 2 IoCs

pid	Process
3372	Taskmgr.exe
1528	Taskmgr.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2251218687-1689653882-3767565116-1000\Software\Microsoft\Windows\CurrentVersion\Run\ibrowser = "\"\\\\?\\C:\\Users\\Admin\\AppData\\Local\\Packages\\Extensions\\1F03C5F441F9DB56ACD8D78F1EE72BE3B7F87FC271FDECE24DEA4AE661DAD7B1-agent\\ibrowser.exe\""	updater_pIttzRsW.exe

Enumerates connected drives 3 TTPs 7 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

ioc	Process
\??\F:\	powershell.exe
\??\F:\	powershell.exe
\??\F:\	updater_oyQhnkzn.exe
\??\F:\	powershell.exe
\??\F:\	powershell.exe
\??\F:\	powershell.exe
\??\F:\	updater_pIttzRsW.exe

UPX packed file 9 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/files/0x000f00000001c4b6-187.dat	upx
behavioral2/memory/2348-189-0x0000000000610000-0x0000000001267000-memory.dmp	upx
behavioral2/memory/2348-190-0x0000000000610000-0x0000000001267000-memory.dmp	upx
behavioral2/memory/2348-191-0x0000000000610000-0x0000000001267000-memory.dmp	upx
behavioral2/memory/2348-192-0x0000000000610000-0x0000000001267000-memory.dmp	upx
behavioral2/memory/2348-193-0x0000000000610000-0x0000000001267000-memory.dmp	upx
behavioral2/memory/1436-201-0x0000000000A70000-0x00000000016C7000-memory.dmp	upx
behavioral2/memory/2348-199-0x0000000000610000-0x0000000001267000-memory.dmp	upx
behavioral2/memory/1436-203-0x0000000000A70000-0x00000000016C7000-memory.dmp	upx

Drops file in Windows directory 8 IoCs

description	ioc	Process
File opened for modification	C:\Windows\pcyBbArQ\ctx.bin	defendnot-loader.exe
File opened for modification	C:\Windows\SERVIC~1\LOCALS~1\AppData\Local\Temp\MpCmdRun.log	MpCmdRun.exe
File opened for modification	C:\Windows\pcyBbArQ\defendnot-loader.pdb	2026-09-26_d12f23e437ada80a0e0c911e11182a30_coinminer_dosia_elex_frostygoop_glassworm_hive_http-brow.exe
File opened for modification	C:\Windows\pcyBbArQ\defendnot.pdb	2026-09-26_d12f23e437ada80a0e0c911e11182a30_coinminer_dosia_elex_frostygoop_glassworm_hive_http-brow.exe
File opened for modification	C:\Windows\pcyBbArQ\extra-strip.bat	2026-09-26_d12f23e437ada80a0e0c911e11182a30_coinminer_dosia_elex_frostygoop_glassworm_hive_http-brow.exe
File opened for modification	C:\Windows\pcyBbArQ\defendnot.dll	2026-09-26_d12f23e437ada80a0e0c911e11182a30_coinminer_dosia_elex_frostygoop_glassworm_hive_http-brow.exe
File opened for modification	C:\Windows\pcyBbArQ\defendnot-loader.exe	2026-09-26_d12f23e437ada80a0e0c911e11182a30_coinminer_dosia_elex_frostygoop_glassworm_hive_http-brow.exe
File created	C:\Windows\pcyBbArQ\ctx.bin	defendnot-loader.exe

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3704	cmd.exe

Modifies trusted root certificate store through registry 1 TTPs 2 IoCs

A root certificate was added, modified, or removed in the trusted certificate store registry paths.

defense_evasion

Install Root Certificate

T1553.004

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 6b000000010000002000000096bcec06264976f37460779acf28c5a7cfe8a3c0aae11a8ffcee05c0bddf08c614000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e80f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f631900000001000000100000002fe1f70bb05d7c92335bc5e05b984da620000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827	748743_msvcp140_5696dd7a71.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 5c0000000100000004000000001000001900000001000000100000002fe1f70bb05d7c92335bc5e05b984da60f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f63030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e814000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e6b000000010000002000000096bcec06264976f37460779acf28c5a7cfe8a3c0aae11a8ffcee05c0bddf08c620000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827	748743_msvcp140_5696dd7a71.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 8 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	updater_QqtlWxuJ.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	2026-09-26_d12f23e437ada80a0e0c911e11182a30_coinminer_dosia_elex_frostygoop_glassworm_hive_http-brow.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	updater_pIttzRsW.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	updater_oyQhnkzn.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	updater_oyQhnkzn.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	748743_msvcp140_5696dd7a71.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	748743_msvcp140_5696dd7a71.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	updater_QqtlWxuJ.exe

System Location Discovery: System Language Discovery 1 TTPs 8 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	updater_QqtlWxuJ.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	748743_msvcp140_5696dd7a71.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-26_d12f23e437ada80a0e0c911e11182a30_coinminer_dosia_elex_frostygoop_glassworm_hive_http-brow.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-26_d12f23e437ada80a0e0c911e11182a30_coinminer_dosia_elex_frostygoop_glassworm_hive_http-brow.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe

Kills process with taskkill 15 IoCs

defense_evasion

pid	Process
2436	taskkill.exe
708	taskkill.exe
3096	taskkill.exe
2428	taskkill.exe
700	taskkill.exe
4632	taskkill.exe
4796	taskkill.exe
4588	taskkill.exe
1744	taskkill.exe
4424	taskkill.exe
2456	taskkill.exe
2912	taskkill.exe
4892	taskkill.exe
2332	taskkill.exe
6024	taskkill.exe

Modifies system certificate store 2 TTPs 4 IoCs

defense_evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1CBCA5DB2D52A7F693B674DE5F05A1D0C957DF0	748743_msvcp140_5696dd7a71.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1CBCA5DB2D52A7F693B674DE5F05A1D0C957DF0\Blob = 0f00000001000000300000000b043572c899dec43efd590cfce610cf443a6315925ebfe589f7506907e44824608489581c7ca0e041458514cf157614090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c06200000001000000200000004ff460d54b9c86dabfbcfc5712e0400d2bed3fbc4d4fbdaa86e06adcd2a9ad7a0b00000001000000180000005300650063007400690067006f00200045004300430000001400000001000000140000003ae10986d4cf19c29676744976dce035c663639a1d0000000100000010000000280cf6042c30a2646644ba7286a3aa97030000000100000014000000d1cbca5db2d52a7f693b674de5f05a1d0c957df02000000001000000930200003082028f30820215a00302010202105c8b99c55a94c5d27156decd8980cc26300a06082a8648ce3d040303308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374204543432043657274696669636174696f6e20417574686f72697479301e170d3130303230313030303030305a170d3338303131383233353935395a308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374204543432043657274696669636174696f6e20417574686f726974793076301006072a8648ce3d020106052b81040022036200041aac545aa9f96823e77ad5246f53c65ad84babc6d5b6d1e67371aedd9cd60c61fddba08903b80514ec57ceee5d3fe221b3cef7d48a79e0a3837e2d97d061c4f199dc259163ab7f30a3b470e2c7a1339cf3bf2e5c53b15fb37d327f8a34e37979a3423040301d0603551d0e041604143ae10986d4cf19c29676744976dce035c663639a300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff300a06082a8648ce3d040303036800306502303667a11608dce49700411d4ebee16301cf3baa421164a09d94390211795c7b1dfa64b9ee1642b3bf8ac209c4ece4b14d023100e92a61478c524a4b4e1870f6d644d66ef583ba6d58bd24d95648eaefc4a24681886a3a46d1a99b4dc961dad15d576a18	748743_msvcp140_5696dd7a71.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8	748743_msvcp140_5696dd7a71.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1CBCA5DB2D52A7F693B674DE5F05A1D0C957DF0\Blob = 19000000010000001000000076935b5c5a037216daaf8aac76df42c1030000000100000014000000d1cbca5db2d52a7f693b674de5f05a1d0c957df01d0000000100000010000000280cf6042c30a2646644ba7286a3aa971400000001000000140000003ae10986d4cf19c29676744976dce035c663639a0b00000001000000180000005300650063007400690067006f00200045004300430000006200000001000000200000004ff460d54b9c86dabfbcfc5712e0400d2bed3fbc4d4fbdaa86e06adcd2a9ad7a53000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b060105050703080f00000001000000300000000b043572c899dec43efd590cfce610cf443a6315925ebfe589f7506907e44824608489581c7ca0e041458514cf1576142000000001000000930200003082028f30820215a00302010202105c8b99c55a94c5d27156decd8980cc26300a06082a8648ce3d040303308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374204543432043657274696669636174696f6e20417574686f72697479301e170d3130303230313030303030305a170d3338303131383233353935395a308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374204543432043657274696669636174696f6e20417574686f726974793076301006072a8648ce3d020106052b81040022036200041aac545aa9f96823e77ad5246f53c65ad84babc6d5b6d1e67371aedd9cd60c61fddba08903b80514ec57ceee5d3fe221b3cef7d48a79e0a3837e2d97d061c4f199dc259163ab7f30a3b470e2c7a1339cf3bf2e5c53b15fb37d327f8a34e37979a3423040301d0603551d0e041604143ae10986d4cf19c29676744976dce035c663639a300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff300a06082a8648ce3d040303036800306502303667a11608dce49700411d4ebee16301cf3baa421164a09d94390211795c7b1dfa64b9ee1642b3bf8ac209c4ece4b14d023100e92a61478c524a4b4e1870f6d644d66ef583ba6d58bd24d95648eaefc4a24681886a3a46d1a99b4dc961dad15d576a18	748743_msvcp140_5696dd7a71.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2772	powershell.exe
2772	powershell.exe
2872	powershell.exe
2872	powershell.exe
1232	powershell.exe
1232	powershell.exe
4836	updater_pIttzRsW.exe
4836	updater_pIttzRsW.exe
4836	updater_pIttzRsW.exe
4836	updater_pIttzRsW.exe
4836	updater_pIttzRsW.exe
4836	updater_pIttzRsW.exe
2152	powershell.exe
2152	powershell.exe
2152	powershell.exe
4836	updater_pIttzRsW.exe
4836	updater_pIttzRsW.exe
4836	updater_pIttzRsW.exe
4836	updater_pIttzRsW.exe
4836	updater_pIttzRsW.exe
4836	updater_pIttzRsW.exe
4836	updater_pIttzRsW.exe
4836	updater_pIttzRsW.exe
4836	updater_pIttzRsW.exe
4836	updater_pIttzRsW.exe
4836	updater_pIttzRsW.exe
4836	updater_pIttzRsW.exe
4836	updater_pIttzRsW.exe
4836	updater_pIttzRsW.exe
4836	updater_pIttzRsW.exe
4836	updater_pIttzRsW.exe
4836	updater_pIttzRsW.exe
4836	updater_pIttzRsW.exe
4836	updater_pIttzRsW.exe
4836	updater_pIttzRsW.exe
4836	updater_pIttzRsW.exe
4836	updater_pIttzRsW.exe
4836	updater_pIttzRsW.exe
4836	updater_pIttzRsW.exe
4836	updater_pIttzRsW.exe
4836	updater_pIttzRsW.exe
4836	updater_pIttzRsW.exe
4836	updater_pIttzRsW.exe
4836	updater_pIttzRsW.exe
4836	updater_pIttzRsW.exe
4836	updater_pIttzRsW.exe
4836	updater_pIttzRsW.exe
4836	updater_pIttzRsW.exe
4836	updater_pIttzRsW.exe
4836	updater_pIttzRsW.exe
4836	updater_pIttzRsW.exe
4836	updater_pIttzRsW.exe
4836	updater_pIttzRsW.exe
4836	updater_pIttzRsW.exe
4836	updater_pIttzRsW.exe
4836	updater_pIttzRsW.exe
4836	updater_pIttzRsW.exe
4836	updater_pIttzRsW.exe
4836	updater_pIttzRsW.exe
4836	updater_pIttzRsW.exe
4836	updater_pIttzRsW.exe
4836	updater_pIttzRsW.exe
4836	updater_pIttzRsW.exe
4836	updater_pIttzRsW.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	2772	powershell.exe
Token: SeIncreaseQuotaPrivilege	2772	powershell.exe
Token: SeSecurityPrivilege	2772	powershell.exe
Token: SeTakeOwnershipPrivilege	2772	powershell.exe
Token: SeLoadDriverPrivilege	2772	powershell.exe
Token: SeSystemProfilePrivilege	2772	powershell.exe
Token: SeSystemtimePrivilege	2772	powershell.exe
Token: SeProfSingleProcessPrivilege	2772	powershell.exe
Token: SeIncBasePriorityPrivilege	2772	powershell.exe
Token: SeCreatePagefilePrivilege	2772	powershell.exe
Token: SeBackupPrivilege	2772	powershell.exe
Token: SeRestorePrivilege	2772	powershell.exe
Token: SeShutdownPrivilege	2772	powershell.exe
Token: SeDebugPrivilege	2772	powershell.exe
Token: SeSystemEnvironmentPrivilege	2772	powershell.exe
Token: SeRemoteShutdownPrivilege	2772	powershell.exe
Token: SeUndockPrivilege	2772	powershell.exe
Token: SeManageVolumePrivilege	2772	powershell.exe
Token: 33	2772	powershell.exe
Token: 34	2772	powershell.exe
Token: 35	2772	powershell.exe
Token: 36	2772	powershell.exe
Token: SeDebugPrivilege	2872	powershell.exe
Token: SeIncreaseQuotaPrivilege	2872	powershell.exe
Token: SeSecurityPrivilege	2872	powershell.exe
Token: SeTakeOwnershipPrivilege	2872	powershell.exe
Token: SeLoadDriverPrivilege	2872	powershell.exe
Token: SeSystemProfilePrivilege	2872	powershell.exe
Token: SeSystemtimePrivilege	2872	powershell.exe
Token: SeProfSingleProcessPrivilege	2872	powershell.exe
Token: SeIncBasePriorityPrivilege	2872	powershell.exe
Token: SeCreatePagefilePrivilege	2872	powershell.exe
Token: SeBackupPrivilege	2872	powershell.exe
Token: SeRestorePrivilege	2872	powershell.exe
Token: SeShutdownPrivilege	2872	powershell.exe
Token: SeDebugPrivilege	2872	powershell.exe
Token: SeSystemEnvironmentPrivilege	2872	powershell.exe
Token: SeRemoteShutdownPrivilege	2872	powershell.exe
Token: SeUndockPrivilege	2872	powershell.exe
Token: SeManageVolumePrivilege	2872	powershell.exe
Token: 33	2872	powershell.exe
Token: 34	2872	powershell.exe
Token: 35	2872	powershell.exe
Token: 36	2872	powershell.exe
Token: SeDebugPrivilege	1232	powershell.exe
Token: SeDebugPrivilege	2152	powershell.exe
Token: SeIncreaseQuotaPrivilege	2152	powershell.exe
Token: SeSecurityPrivilege	2152	powershell.exe
Token: SeTakeOwnershipPrivilege	2152	powershell.exe
Token: SeLoadDriverPrivilege	2152	powershell.exe
Token: SeSystemProfilePrivilege	2152	powershell.exe
Token: SeSystemtimePrivilege	2152	powershell.exe
Token: SeProfSingleProcessPrivilege	2152	powershell.exe
Token: SeIncBasePriorityPrivilege	2152	powershell.exe
Token: SeCreatePagefilePrivilege	2152	powershell.exe
Token: SeBackupPrivilege	2152	powershell.exe
Token: SeRestorePrivilege	2152	powershell.exe
Token: SeShutdownPrivilege	2152	powershell.exe
Token: SeDebugPrivilege	2152	powershell.exe
Token: SeSystemEnvironmentPrivilege	2152	powershell.exe
Token: SeRemoteShutdownPrivilege	2152	powershell.exe
Token: SeUndockPrivilege	2152	powershell.exe
Token: SeManageVolumePrivilege	2152	powershell.exe
Token: 33	2152	powershell.exe

Suspicious use of WriteProcessMemory 35 IoCs

description	pid	Process	procid_target
PID 5644 wrote to memory of 2772	5644	2026-09-26_d12f23e437ada80a0e0c911e11182a30_coinminer_dosia_elex_frostygoop_glassworm_hive_http-brow.exe	90
PID 5644 wrote to memory of 2872	5644	2026-09-26_d12f23e437ada80a0e0c911e11182a30_coinminer_dosia_elex_frostygoop_glassworm_hive_http-brow.exe	93
PID 5644 wrote to memory of 2148	5644	2026-09-26_d12f23e437ada80a0e0c911e11182a30_coinminer_dosia_elex_frostygoop_glassworm_hive_http-brow.exe	95
PID 5644 wrote to memory of 1232	5644	2026-09-26_d12f23e437ada80a0e0c911e11182a30_coinminer_dosia_elex_frostygoop_glassworm_hive_http-brow.exe	96
PID 2148 wrote to memory of 3372	2148	defendnot-loader.exe	98
PID 5644 wrote to memory of 4836	5644	2026-09-26_d12f23e437ada80a0e0c911e11182a30_coinminer_dosia_elex_frostygoop_glassworm_hive_http-brow.exe	99
PID 3544 wrote to memory of 1528	3544	defendnot-loader.exe	103
PID 4836 wrote to memory of 4960	4836	updater_pIttzRsW.exe	106
PID 4836 wrote to memory of 2152	4836	updater_pIttzRsW.exe	109
PID 3544 wrote to memory of 3704	3544	defendnot-loader.exe	111
PID 4836 wrote to memory of 2436	4836	updater_pIttzRsW.exe	112
PID 4836 wrote to memory of 2912	4836	updater_pIttzRsW.exe	114
PID 4836 wrote to memory of 5184	4836	updater_pIttzRsW.exe	116
PID 4836 wrote to memory of 4424	4836	updater_pIttzRsW.exe	117
PID 4836 wrote to memory of 708	4836	updater_pIttzRsW.exe	119
PID 4836 wrote to memory of 3096	4836	updater_pIttzRsW.exe	121
PID 4836 wrote to memory of 4796	4836	updater_pIttzRsW.exe	123
PID 4836 wrote to memory of 4892	4836	updater_pIttzRsW.exe	124
PID 4836 wrote to memory of 2332	4836	updater_pIttzRsW.exe	127
PID 4836 wrote to memory of 2456	4836	updater_pIttzRsW.exe	129
PID 5184 wrote to memory of 1936	5184	748743_msvcp140_5696dd7a71.exe	131
PID 4836 wrote to memory of 4588	4836	updater_pIttzRsW.exe	133
PID 4836 wrote to memory of 1744	4836	updater_pIttzRsW.exe	135
PID 4836 wrote to memory of 2428	4836	updater_pIttzRsW.exe	137
PID 4836 wrote to memory of 6024	4836	updater_pIttzRsW.exe	139
PID 4836 wrote to memory of 700	4836	updater_pIttzRsW.exe	141
PID 4836 wrote to memory of 4632	4836	updater_pIttzRsW.exe	143
PID 4836 wrote to memory of 472	4836	updater_pIttzRsW.exe	147
PID 4836 wrote to memory of 472	4836	updater_pIttzRsW.exe	147
PID 4836 wrote to memory of 4576	4836	updater_pIttzRsW.exe	149
PID 4836 wrote to memory of 4576	4836	updater_pIttzRsW.exe	149
PID 5184 wrote to memory of 3244	5184	748743_msvcp140_5696dd7a71.exe	151
PID 5184 wrote to memory of 5064	5184	748743_msvcp140_5696dd7a71.exe	152
PID 5184 wrote to memory of 2348	5184	748743_msvcp140_5696dd7a71.exe	155
PID 2348 wrote to memory of 1436	2348	updater_QqtlWxuJ.exe	157

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\2026-09-26_d12f23e437ada80a0e0c911e11182a30_coinminer_dosia_elex_frostygoop_glassworm_hive_http-brow.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-26_d12f23e437ada80a0e0c911e11182a30_coinminer_dosia_elex_frostygoop_glassworm_hive_http-brow.exe"
1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5644
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command Add-MpPreference -ExclusionPath C:\Users\Admin\AppData\Local\Microsoft
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Enumerates connected drives
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2772
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command Add-MpPreference -ExclusionPath C:\Windows
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Enumerates connected drives
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2872
- C:\Windows\pcyBbArQ\defendnot-loader.exe
  C:\Windows\pcyBbArQ\defendnot-loader.exe --silent
  2⤵
  - Executes dropped EXE
  - Drops file in Windows directory
  - Suspicious use of WriteProcessMemory
  PID:2148
- - C:\Windows\SYSTEM32\Taskmgr.exe
    Taskmgr.exe
    3⤵
    - Loads dropped DLL
    PID:3372
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell -WindowStyle Hidden -Command C:\Users\Admin\AppData\Local\Temp\dn-1553576357.ps1
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Enumerates connected drives
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1232
- C:\Users\Admin\AppData\Local\Microsoft\updater_pIttzRsW.exe
  C:\Users\Admin\AppData\Local\Microsoft\updater_pIttzRsW.exe
  2⤵
  - Downloads MZ/PE file
  - Executes dropped EXE
  - Adds Run key to start application
  - Enumerates connected drives
  - Reads the TCP/IP host and domain name from the registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:4836
- - C:\Windows\system32\getmac.exe
    "getmac" /fo csv /nh
    3⤵
    PID:4960
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell" -NoProfile -NonInteractive -WindowStyle Hidden -Command "Get-CimInstance -Namespace root/SecurityCenter2 -ClassName AntiVirusProduct | Select-Object -ExpandProperty displayName"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Enumerates connected drives
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2152
- - C:\Windows\system32\taskkill.exe
    "taskkill" /F /IM chrome.exe /T
    3⤵
    - Kills process with taskkill
    PID:2436
- - C:\Windows\system32\taskkill.exe
    "taskkill" /F /IM msedge.exe /T
    3⤵
    - Kills process with taskkill
    PID:2912
- - C:\Users\Admin\AppData\Local\Packages\Extensions\1F03C5F441F9DB56ACD8D78F1EE72BE3B7F87FC271FDECE24DEA4AE661DAD7B1-agent\downloads\748743_msvcp140_5696dd7a71.exe
    "\\?\C:\Users\Admin\AppData\Local\Packages\Extensions\1F03C5F441F9DB56ACD8D78F1EE72BE3B7F87FC271FDECE24DEA4AE661DAD7B1-agent\downloads\748743_msvcp140_5696dd7a71.exe"
    3⤵
    - Executes dropped EXE
    - Modifies trusted root certificate store through registry
    - Reads the TCP/IP host and domain name from the registry
    - System Location Discovery: System Language Discovery
    - Modifies system certificate store
    - Suspicious use of WriteProcessMemory
    PID:5184
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command Add-MpPreference -ExclusionPath C:\Users\Admin\AppData\Local\Microsoft
      4⤵
      Command and Scripting Interpreter: PowerShell
      Enumerates connected drives
      System Location Discovery: System Language Discovery
      PID:1936
  - - C:\Users\Admin\AppData\Local\Microsoft\updater_gbHGjrpq.exe
      C:\Users\Admin\AppData\Local\Microsoft\updater_gbHGjrpq.exe
      4⤵
      Executes dropped EXE
      PID:3244
  - - C:\Users\Admin\AppData\Local\Microsoft\updater_oyQhnkzn.exe
      C:\Users\Admin\AppData\Local\Microsoft\updater_oyQhnkzn.exe
      4⤵
      Executes dropped EXE
      Enumerates connected drives
      Reads the TCP/IP host and domain name from the registry
      PID:5064
  - - C:\Users\Admin\AppData\Local\Microsoft\updater_QqtlWxuJ.exe
      C:\Users\Admin\AppData\Local\Microsoft\updater_QqtlWxuJ.exe
      4⤵
      Executes dropped EXE
      Reads the TCP/IP host and domain name from the registry
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2348
    - - C:\Users\Admin\AppData\Local\Mozilla\2026-09-26_d12f23e437ada80a0e0c911e11182a30_coinminer_dosia_elex_frostygoop_glassworm_hive_http-brow.exe
        
        C:\Users\Admin\AppData\Local\Mozilla\2026-09-26_d12f23e437ada80a0e0c911e11182a30_coinminer_dosia_elex_frostygoop_glassworm_hive_http-brow.exe
        5⤵
        Executes dropped EXE
        Reads the TCP/IP host and domain name from the registry
        System Location Discovery: System Language Discovery
        
        PID:1436
- - C:\Windows\system32\taskkill.exe
    "taskkill" /F /IM msedge.exe /T
    3⤵
    - Kills process with taskkill
    PID:4424
- - C:\Windows\system32\taskkill.exe
    "taskkill" /F /IM msedgewebview2.exe /T
    3⤵
    - Kills process with taskkill
    PID:708
- - C:\Windows\system32\taskkill.exe
    "taskkill" /F /IM MicrosoftEdgeUpdate.exe /T
    3⤵
    - Kills process with taskkill
    PID:3096
- - C:\Windows\system32\taskkill.exe
    "taskkill" /F /IM chrome.exe /T
    3⤵
    - Kills process with taskkill
    PID:4796
- - C:\Windows\system32\taskkill.exe
    "taskkill" /F /IM msedge.exe /T
    3⤵
    - Kills process with taskkill
    PID:4892
- - C:\Windows\system32\taskkill.exe
    "taskkill" /F /IM msedge.exe /T
    3⤵
    - Kills process with taskkill
    PID:2332
- - C:\Windows\system32\taskkill.exe
    "taskkill" /F /IM msedgewebview2.exe /T
    3⤵
    - Kills process with taskkill
    PID:2456
- - C:\Windows\system32\taskkill.exe
    "taskkill" /F /IM MicrosoftEdgeUpdate.exe /T
    3⤵
    - Kills process with taskkill
    PID:4588
- - C:\Windows\system32\taskkill.exe
    "taskkill" /F /IM chrome.exe /T
    3⤵
    - Kills process with taskkill
    PID:1744
- - C:\Windows\system32\taskkill.exe
    "taskkill" /F /IM msedge.exe /T
    3⤵
    - Kills process with taskkill
    PID:2428
- - C:\Windows\system32\taskkill.exe
    "taskkill" /F /IM msedge.exe /T
    3⤵
    - Kills process with taskkill
    PID:6024
- - C:\Windows\system32\taskkill.exe
    "taskkill" /F /IM msedgewebview2.exe /T
    3⤵
    - Kills process with taskkill
    PID:700
- - C:\Windows\system32\taskkill.exe
    "taskkill" /F /IM MicrosoftEdgeUpdate.exe /T
    3⤵
    - Kills process with taskkill
    PID:4632
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google/Chrome/Application/chrome.exe"
    3⤵
    PID:472
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google/Chrome/Application/chrome.exe"
    3⤵
    PID:4576

C:\Windows\pcyBbArQ\defendnot-loader.exe
C:\Windows\pcyBbArQ\defendnot-loader.exe
1⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:3544
- C:\Windows\SYSTEM32\Taskmgr.exe
  Taskmgr.exe
  2⤵
  - Loads dropped DLL
  PID:1528
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c pause
  2⤵
  - Executes a command shell one-liner
  PID:3704

C:\Program Files\Windows Defender\MpCmdRun.exe
"C:\Program Files\Windows Defender\MpCmdRun.exe" -wdenable
1⤵
- Drops file in Windows directory
PID:4576

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:1888

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4440

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:3492

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:3808

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:2768

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 15KB
SHA256 0d7cf90c58c0da527c08aec264fb3e23da2c46ca3c033e633d69df7c875ac43c
MD5 05f901145c66d0829f9d6b2950df91b3
SHA1 3139c49e12cf6f7cae9d51ca243e71ae2e01dafd
SHA512 c761e043ca7db3dc6df6c150b4acf4ad00dac252d4f071ff1c81a7c62d94a5e5da52b724eaec4f6c0377936dcc45c60bbfae7a6465afe7a936de3e6536f14aa7
SSDEEP 384:PSEcGpdqbHEc2M84+gF2K0hR2VWOEbDzdC0IIACLF4UXCIJFSqgEZOX9:d/pdqbH/2MP+iQSUNbFC0IIA4SIJFSq+
TLSH
T15962D468323FADCBD89220B45491039BDBF4C09E63B251D99E5BCE3F6855EBA4B501F0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 8ca4d028bf9b16a25e52d85ff382154cad6d3ee2ea7789002206548048a0d46a
MD5 de56c9352ef086242726ec74742a81a2
SHA1 f4baffea96499724eeb56245d1f204cc4d9c4c4a
SHA512 9911aa380e7f7d264414f8ffcf0e7c597819c065297fb855fd6f252a3a02f510f62d9cc5fa6451638c5b45ad4a5b20d6d7901f70fefa1d4ae0d26745767e5182
TLSH
T131216423F3DC8694C899013A10DEAC1036B7C7CB409ECF9B6B85D129A82F699CF61060
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 21KB
SHA256 69df827a6e870587c0596e120491d00d403f989111fb95ac42fe707c2de9ec42
MD5 c20360b585278ecdb4a1afc2f3a8e380
SHA1 41c447135f4fa05870ca5b9fdf9db042b072c40f
SHA512 3b28307e697b0650a8b303e3bc2fde63755ae5378119397fdcc634ea7814cb1204004f69833f4ff2db38a7a4d3b67f9b1562729523c27ea7b965214c8cb4a1b6
SSDEEP 384:v1eBaoT1iBG8W14bB5aunk8T8Oz7BDrr2PntIAgF4QXAWS28PKlgvYbhNzPQlR/p:texZ6G8WilQukrOzB6FIA4fXTd/bhNzU
TLSH
T157A2B478213F6DC7D8D226B410D10AB7FBE4D489DAB611D8BF1BDE2F4C90EB64A60524
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 21KB
SHA256 0b3aab6e5a429deb217dd568ee9ec80aa27276ddcce803bbf43c988a0d8d083c
MD5 60e40b701e720c0e776fcf6ecefc3ea0
SHA1 003e6dcb6edeb6b867356201dc96954109923f1a
SHA512 f59b6035ff36b11f34cac673f9955ee35bd14f92469b0e4cf5455f595ca815186857539da2d55edc393a43a2fe72d5e2e14c1c7ca05c9359a68e8b3187eb2028
SSDEEP 384:P1eBaoT1iBGJRGlbg6UKT+gBooR2PsOEkMzdC0kIACLF4bGKvoDqB1Klgv2HbhgL:NexZ6GJElbg6VT+gOUNZC0kIA4fIoDMx
TLSH
T1A8A20829212F5DCFD99151B410924787FBB8C558EBE252DAEF0FC92F2C8067E5E501E8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

updater_QqtlWxuJ.exe

Path C:\Users\Admin\AppData\Local\Microsoft\updater_QqtlWxuJ.exe
Size 3.4MB
SHA256 18e4b49fd7e15ca846c6346ce58268ff206974eefde55ef5998a2e9cd3b203e2
MD5 4bcf896b2ce2408e8ac04bba1465a488
SHA1 02d86ea709f605fff40c08ebfffa204de4201736
SHA512 7d7d45441619cb9fcf6e5e3981147b1a721d9da5126ba6902af207782294c3f0f5b0f19342acae2a17d6bfd49f5758d4cfb58b88ca32033a057ed387e3a645e7
SSDEEP 98304:ICaZpkH/byuFxzPj5YYzNxI8/OeL/fTOD:ICaUH/byuzj5YYzNxb3O
TLSH
T116F53311896ECB6FF53674B78B12A42A1D41C25EC36B106DF84908135BE8BF77A734CA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

updater_gbHGjrpq.exe

Path C:\Users\Admin\AppData\Local\Microsoft\updater_gbHGjrpq.exe
Size 20.1MB
SHA256 741e7c655058503082bda09b8d8072aeb318545723b12af161ac53d061311b79
MD5 af79e993e7e6cbb41557313a07e664bd
SHA1 e5c89e89239a6ac3a717ff840a83642093c2a61b
SHA512 1a0ed3f071ba272a407321a6c8f9a2dc1fbce4d66286c98df0671115cb778fd1ecdc2b69872209b5af110a3623dc48060dac33bfe232be9c9a6520712419273a
SSDEEP 196608:VvCTMA/BTZpSBzIcjHVzs/5TAYi01QJQ0SYBynrUzcxZs0uK9L44lpKi:UD/BTZpqnY1JJxG0uK9xlpJ
TLSH
T167277E0B779B0DA5DCC23BB5A99F13285B24FC209F5A0ABB774CF23419932D49D1A760
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

updater_oyQhnkzn.exe

Path C:\Users\Admin\AppData\Local\Microsoft\updater_oyQhnkzn.exe
Size 7.0MB
SHA256 f1d117ee7395fe05433281b05c19aeb1123e4af3d0bbe3a13d629102595c3b8c
MD5 55aeea18af742344a7d4a819b9193113
SHA1 5bfabd6a9d6185ec562590737df1e72ec0645e18
SHA512 58013c37a2679fbb06322f579bbaf40a566e66274999fbd0f3fba105cf6d6732887afaa3c123a1c0795e02cc88bcac00282222b91d44b55a338c457f60105ef3
SSDEEP 98304:tVQwYdxoTfdjEd+iXn8IwxfWc5B24pBxphMrEtDuxE4cw0WSUuZbTsH8yyncUcY5:tiKZjVmnFwpjM4J4B0DZbTyBcfAFnG
TLSH
T1BA76CF68E05E2E9BF3719439DA19E8B0CFD56451E33258FBB042ABA54FB33D0247A435
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

updater_pIttzRsW.exe

Path C:\Users\Admin\AppData\Local\Microsoft\updater_pIttzRsW.exe
Size 3.7MB
SHA256 ff0d26663c374bc2935e1ee926ab4c62ac8c74f2e545326b7e469fa0f6472631
MD5 3a397ff3c82ddc5953b73a8375ddf57c
SHA1 a2ef87b25d5605a43126d4c79e8a003f1c890fe6
SHA512 bd57c9e2032db2892091cb758d42cad481409a383af081a51f772f3e1a82d5cb3194387921f5e2a9e2b29a4b65abc43e06105e46beb7e43cd0b542139a0da645
SSDEEP 49152:TUNAQzxLC8C0TbsRpdSh6P1tWyett9DH6+b6EWuaSVJXfRBFtX579iyIeYIU6iE:Tu887TbfEwK+USdBFjXn+
TLSH
T170068D03E69581F9D0AEC078C35B9637EB72B88A1630B6EB17D45B612F23F906B1D315
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

748743_msvcp140_5696dd7a71.exe

Path C:\Users\Admin\AppData\Local\Packages\Extensions\1F03C5F441F9DB56ACD8D78F1EE72BE3B7F87FC271FDECE24DEA4AE661DAD7B1-agent\downloads\748743_msvcp140_5696dd7a71.exe
Size 30.8MB
SHA256 c661f5ccf73bbb004a1ad5cd7e7d3c0e60ad6d62992413b61137e40886d8255f
MD5 b70de86331806aaf750d3c17e2a03491
SHA1 81a087c057dfa24c7ffa3c9182f34fcbe717ee6b
SHA512 c8258082bd75e6b867c06e112de4a03e34fc924acbb4c88039a408061dfefa4fd690975fb14505a81a16af0b931887100f00121c92ebdfb55669ce9b2253d7c6
SSDEEP 393216:eaCkHQfpL4Fisia7wpXrHAmKsYD/BTZpqnY1JJxG0uK9xlpJ:ejvyFF7wpbAm/Y1L/ocT
TLSH
T110679E06BB970CF5DCC22775699B232E5730FC109F198BABFB48B634A8632D45D2A750
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Local\Packages\Extensions\1F03C5F441F9DB56ACD8D78F1EE72BE3B7F87FC271FDECE24DEA4AE661DAD7B1\e0\manifest.json
Size 1KB
SHA256 a68297b6ff8218690abddc5ef63de45cd126695a4e677e3e3a2be087a7c6ac2c
MD5 ac45ab511f5530abc94313434adaf432
SHA1 febec023387908b6be72a9dfba895d886ed1e60e
SHA512 f7aeb6110d091b0ebcd5f19d50588eeb84980fa7fbe80238cb99458d52189709a417c9f3b2e2393b89fe08b66f8b6e87f3881431e1acb452e4f90e796b1d6e05
TLSH
T19D310025D9685C6B03CCAB302DFA4987A50509879D947C1C7ADE800C8FBD61F02FBB9C
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_havlhmcq.zi0.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_havlhmcq.zi0.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

ck_4836_1790432879670930500.bin

Path C:\Users\Admin\AppData\Local\Temp\ck_4836_1790432879670930500.bin
Size 32B
SHA256 34e54ed4704f24a13360823e5c7c5966e670b0a1381336e788278591e654bd45
MD5 49adb858c75111b132d46acbe1de477f
SHA1 6f42acfb0c23bf638b858b8959f78c193a49c20e
SHA512 0ae12399e514bdf3160852c577f6c7a5fb5dc23e61fd90b7fcf81bde17539a91394050b476e065ef791d6467568f19340c87584d189f48122f77c3538c9a285c
MD5 SHA1 SHA512

Submit Download

dn-1553576357.ps1

Path C:\Users\Admin\AppData\Local\Temp\dn-1553576357.ps1
Size 2KB
SHA256 3888ffb268a0251bf49d7b140349006359e457a6e823e1d742da0d3057994578
MD5 4416740f2b112f9a574b79a729c37ee0
SHA1 4f5d2ad1b99f26af5064f5ed03dc5e82714d276d
SHA512 76cebb19d61ccdd0993d02d2709641f2bd2cbd3cd0d3d0fbceaf681a282c26359d01f82857736d98aa9421b9abecb3f77bf0c96364c42b73cfe2320807509127
TLSH
T17D41EF48F699C27055BA5708ED5B0A879C9F243B0202ED2073E9D3CABFE4537C2962C7
MD5 SHA1 SHA512 TLSH

Submit Download

ctx.bin

Path C:\Windows\pcyBbArQ\ctx.bin
Size 132B
SHA256 cf8c05d4e7620cd4ba0a049f96978e9fec37ef4bab51720053cf318a66670014
MD5 6419d9e96a2a134a8dd59401ee0af98e
SHA1 200d2f402a19272649da8de8b6fc5cfd1f6f64c4
SHA512 e011e53a2709a08ecd2a0ffee73db21abe59cb8cea668562da80002b0f01d627e313b862e8c46392af81a1db508f7d76611b2283a7e5f43928a1ea417af732bc
MD5 SHA1 SHA512

Submit Download

defendnot-loader.exe

Path C:\Windows\pcyBbArQ\defendnot-loader.exe
Size 581KB
SHA256 f57a4dd3bd3ce82eaf6d7143e837b3fa59a0accdac76fd3dc053433efdd50e5e
MD5 aa636642fb9c479c7a9763d18862b12e
SHA1 100d02103379ba284c465933394af8b55a90d0b1
SHA512 b03126a3ff4809511388c787bdf6c65f22306840d8b1887924bc5ac0d1e52571cb832771260decbf6e115386aec8bda0b4434086d2b3f07f47f347f768a6db82
SSDEEP 6144:iQbKLBXMhgqo62sYoFJqiE3Wy13avn7aC8xmph0lhSMXlBXBWnlgh7RB9PCn:/1sriq13UaZxmph0lhSMXli4v9m
TLSH
T14BC49D26B7A940F9E1A7C27889930A16EA737C4643516BCF03E44A675F236E04F3FB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

defendnot.dll

Path C:\Windows\pcyBbArQ\defendnot.dll
Size 426KB
SHA256 b0870e105c7ad37fb0bdcb9305279b2943810d55300e8721eb64bdaa588cc84e
MD5 a9283ba8a7afa573b616856fcd00d597
SHA1 904a26e329804812ea42e4a1bb2d62f9eaafcac2
SHA512 81f47b5f5323b099e3c8b2b92576f41cfdde1a3204880f9bf5692dd04b6867ac79dd93c53b830afba5cebd4aeef20a1bee37a4cf57bedfcf67f551ac1f485e5b
SSDEEP 6144:JJnzyCQ6dPBn6KjhoKUpMoAOOLph0lhSMXlBXBWnH7sLBQX1wLj:OCFJUHAOOLph0lhSMXliHoLSXS
TLSH
T11494AE15B7A590B9E16B8274C8570A05EB737C414791EBCF03A4DAB26F237D16B3EB02
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1232-59-0x00000000058C0000-0x0000000005C1B000-memory.dmp

Download

memory/1436-203-0x0000000000A70000-0x00000000016C7000-memory.dmp

Download

memory/1436-201-0x0000000000A70000-0x00000000016C7000-memory.dmp

Download

memory/1936-135-0x00000000704F0000-0x000000007053C000-memory.dmp

Download

memory/2152-121-0x000001EEF4000000-0x000001EEF402A000-memory.dmp

Download

memory/2152-112-0x000001EEF39F0000-0x000001EEF3A12000-memory.dmp

Download

memory/2152-119-0x000001EEF3CB0000-0x000001EEF3D62000-memory.dmp

Download

memory/2152-118-0x000001EEF3A80000-0x000001EEF3A9E000-memory.dmp

Download

memory/2152-120-0x000001EEF3D70000-0x000001EEF3D7A000-memory.dmp

Download

memory/2152-122-0x000001EEF4000000-0x000001EEF4024000-memory.dmp

Download

memory/2348-193-0x0000000000610000-0x0000000001267000-memory.dmp

Download

memory/2348-189-0x0000000000610000-0x0000000001267000-memory.dmp

Download

memory/2348-190-0x0000000000610000-0x0000000001267000-memory.dmp

Download

memory/2348-191-0x0000000000610000-0x0000000001267000-memory.dmp

Download

memory/2348-192-0x0000000000610000-0x0000000001267000-memory.dmp

Download

memory/2348-199-0x0000000000610000-0x0000000001267000-memory.dmp

Download

memory/2772-10-0x0000000005F00000-0x000000000625B000-memory.dmp

Download

memory/2772-7-0x0000000005E90000-0x0000000005EF6000-memory.dmp

Download

memory/2772-15-0x00000000704F0000-0x000000007053C000-memory.dmp

Download

memory/2772-0-0x0000000073C02000-0x0000000073C03000-memory.dmp

Download

memory/2772-18-0x0000000006A10000-0x0000000006A30000-memory.dmp

Download

memory/2772-21-0x0000000073BF0000-0x00000000743AC000-memory.dmp

Download

memory/2772-14-0x0000000073BF0000-0x00000000743AC000-memory.dmp

Download

memory/2772-12-0x0000000006450000-0x000000000649C000-memory.dmp

Download

memory/2772-11-0x0000000006400000-0x000000000641E000-memory.dmp

Download

memory/2772-20-0x0000000007650000-0x00000000076F3000-memory.dmp

Download

memory/2772-22-0x0000000007DB0000-0x000000000842C000-memory.dmp

Download

memory/2772-1-0x0000000004F70000-0x0000000004FA6000-memory.dmp

Download

memory/2772-23-0x0000000007770000-0x000000000778A000-memory.dmp

Download

memory/2772-13-0x0000000007610000-0x0000000007646000-memory.dmp

Download

memory/2772-19-0x0000000073BF0000-0x00000000743AC000-memory.dmp

Download

memory/2772-24-0x00000000077E0000-0x00000000077EA000-memory.dmp

Download

memory/2772-25-0x00000000079E0000-0x0000000007A76000-memory.dmp

Download

memory/2772-6-0x0000000005E20000-0x0000000005E86000-memory.dmp

Download

memory/2772-5-0x0000000005C80000-0x0000000005CA2000-memory.dmp

Download

memory/2772-26-0x0000000073BF0000-0x00000000743AC000-memory.dmp

Download

memory/2772-4-0x0000000073BF0000-0x00000000743AC000-memory.dmp

Download

memory/2772-3-0x0000000005600000-0x0000000005C4A000-memory.dmp

Download

memory/2772-2-0x0000000073BF0000-0x00000000743AC000-memory.dmp

Download

memory/2772-28-0x0000000073BF0000-0x00000000743AC000-memory.dmp

Download

memory/2872-30-0x0000000073BF0000-0x00000000743AC000-memory.dmp

Download

memory/2872-33-0x0000000005B00000-0x0000000005E5B000-memory.dmp

Download

memory/2872-40-0x0000000073BF0000-0x00000000743AC000-memory.dmp

Download

memory/2872-37-0x00000000704F0000-0x000000007053C000-memory.dmp

Download

memory/2872-36-0x0000000073BF0000-0x00000000743AC000-memory.dmp

Download

memory/2872-34-0x0000000073BF0000-0x00000000743AC000-memory.dmp

Download

memory/2872-42-0x0000000073BF0000-0x00000000743AC000-memory.dmp

Download

memory/2872-29-0x0000000073BF0000-0x00000000743AC000-memory.dmp

Download

memory/5064-160-0x0000025E51770000-0x0000025E51DBA000-memory.dmp

Download

memory/5064-161-0x0000025E35110000-0x0000025E35118000-memory.dmp

Download

memory/5064-162-0x0000025E35130000-0x0000025E35138000-memory.dmp

Download

memory/5064-173-0x0000025E37690000-0x0000025E376AE000-memory.dmp

Download

memory/5064-167-0x0000025E51410000-0x0000025E514C2000-memory.dmp

Download

memory/5064-163-0x0000025E35110000-0x0000025E3511A000-memory.dmp

Download

memory/5064-164-0x0000025E36930000-0x0000025E3693A000-memory.dmp

Download