9b861cc1bc92975018dfb77d71de62a9e1264ebaf926b0de988ee20e9066ca65

Analysis

max time kernel
150s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
17/10/2026, 18:01

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-16_4c5d593ae7371faa4ccc72ec782ace24_amadey_blankgrabber_cobalt-strike_coinminer_glassworm_ic.exe
Size 34.9MB
Sample261017-wmc3laxvbv
SHA256 9b861cc1bc92975018dfb77d71de62a9e1264ebaf926b0de988ee20e9066ca65
MD5 4c5d593ae7371faa4ccc72ec782ace24
SHA1 1bccf5c7a04fa200716d593875f7cffb804bde86
SHA512 43778c3eebcb78d89ba15c985772e5d665894fd7e8bbab33593a6f78e88d11c400b8a52eb9ffda347937ed79b872af2c3c9909f72cd6b2cea91264d15f7580ce
SSDEEP 98304:K9ZSiQfMJP+2yG3P6GCwmIuFbY8pfrfrDMd9:h5fMJP+XG3SGhdspz89
TLSH
T121871A5ABB91CE81F51A82705C6A87D06372FEB84EB1C30B315C772CAF7E2844DE1599
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery execution persistence trojan

Malware Config

Signatures

UAC bypass 3 TTPs 1 IoCs

defense_evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	iMaCMu.exe

Windows security bypass 2 TTPs 6 IoCs

defense_evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Public\paS7MN = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\ProgramData = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users = "0"	reg.exe

Detects executables calling ClearMyTracksByProcess 1 IoCs

resource	yara_rule
behavioral1/memory/3700-691-0x0000000010000000-0x0000000010061000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_ClearMyTracksByProcess

Detects executables containing artifacts associated with disabling Widnows Defender 4 IoCs

resource	yara_rule
behavioral1/memory/3700-671-0x0000000002EF0000-0x00000000036CD000-memory.dmp	INDICATOR_SUSPICIOUS_DisableWinDefender
behavioral1/memory/3700-675-0x0000000002EF0000-0x00000000036CD000-memory.dmp	INDICATOR_SUSPICIOUS_DisableWinDefender
behavioral1/memory/3700-683-0x0000000002EF0000-0x00000000036CD000-memory.dmp	INDICATOR_SUSPICIOUS_DisableWinDefender
behavioral1/memory/3700-714-0x0000000002EF0000-0x00000000036CD000-memory.dmp	INDICATOR_SUSPICIOUS_DisableWinDefender

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000\Control Panel\International\Geo\Nation	x9fPee.exe

Executes dropped EXE 3 IoCs

pid	Process
1308	x9fPee.exe
2320	x9fPee.exe
3700	iMaCMu.exe

Loads dropped DLL 3 IoCs

pid	Process
1308	x9fPee.exe
2320	x9fPee.exe
3700	iMaCMu.exe

Modifies file permissions 1 TTPs 1 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
4596	icacls.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Tencent SecurityHealth = "\"C:\\Users\\Public\\paS7MN\\x9fPee.exe\""	x9fPee.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Alibaba SecurityHealtha = "\"C:\\Program Files (x86)\\iMaCMu\\iMaCMu.exe\""	iMaCMu.exe

Indicator Removal: Clear Persistence 1 TTPs 5 IoCs

Clear artifacts associated with previously established persistence like scheduletasks on a host.

defense_evasion

Clear Persistence

T1070.009

pid	Process
4504	cmd.exe
1208	cmd.exe
528	cmd.exe
3508	cmd.exe
4408	cmd.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\System32\CodeIntegrity\SiPolicy.p7b	x9fPee.exe

Drops file in Program Files directory 9 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\iMaCMu\iMaCMu.exe	x9fPee.exe
File created	C:\Program Files (x86)\iMaCMu\XPSPLOG.dll	x9fPee.exe
File created	C:\Program Files (x86)\iMaCMu\image.png	x9fPee.exe
File opened for modification	C:\Program Files (x86)\iMaCMu\iMaCMu.exe	x9fPee.exe
File opened for modification	C:\Program Files (x86)\iMaCMu\XPSPLOG.dll	x9fPee.exe
File opened for modification	C:\Program Files (x86)\iMaCMu\thumbs.db	x9fPee.exe
File opened for modification	C:\Program Files (x86)\iMaCMu	x9fPee.exe
File created	C:\Program Files (x86)\iMaCMu\thumbs.db	x9fPee.exe
File opened for modification	C:\Program Files (x86)\iMaCMu\image.png	x9fPee.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 6 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2168	cmd.exe
4476	cmd.exe
3192	cmd.exe
1260	cmd.exe
3124	cmd.exe
2248	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	2026-10-16_4c5d593ae7371faa4ccc72ec782ace24_amadey_blankgrabber_cobalt-strike_coinminer_glassworm_ic.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	2026-10-16_4c5d593ae7371faa4ccc72ec782ace24_amadey_blankgrabber_cobalt-strike_coinminer_glassworm_ic.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	x9fPee.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	x9fPee.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	iMaCMu.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 5 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
1660	schtasks.exe
5064	schtasks.exe
2360	schtasks.exe
3236	schtasks.exe
4996	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4316	2026-10-16_4c5d593ae7371faa4ccc72ec782ace24_amadey_blankgrabber_cobalt-strike_coinminer_glassworm_ic.exe
4316	2026-10-16_4c5d593ae7371faa4ccc72ec782ace24_amadey_blankgrabber_cobalt-strike_coinminer_glassworm_ic.exe
4316	2026-10-16_4c5d593ae7371faa4ccc72ec782ace24_amadey_blankgrabber_cobalt-strike_coinminer_glassworm_ic.exe
4316	2026-10-16_4c5d593ae7371faa4ccc72ec782ace24_amadey_blankgrabber_cobalt-strike_coinminer_glassworm_ic.exe
4316	2026-10-16_4c5d593ae7371faa4ccc72ec782ace24_amadey_blankgrabber_cobalt-strike_coinminer_glassworm_ic.exe
4316	2026-10-16_4c5d593ae7371faa4ccc72ec782ace24_amadey_blankgrabber_cobalt-strike_coinminer_glassworm_ic.exe
4316	2026-10-16_4c5d593ae7371faa4ccc72ec782ace24_amadey_blankgrabber_cobalt-strike_coinminer_glassworm_ic.exe
4316	2026-10-16_4c5d593ae7371faa4ccc72ec782ace24_amadey_blankgrabber_cobalt-strike_coinminer_glassworm_ic.exe
4316	2026-10-16_4c5d593ae7371faa4ccc72ec782ace24_amadey_blankgrabber_cobalt-strike_coinminer_glassworm_ic.exe
4316	2026-10-16_4c5d593ae7371faa4ccc72ec782ace24_amadey_blankgrabber_cobalt-strike_coinminer_glassworm_ic.exe
4316	2026-10-16_4c5d593ae7371faa4ccc72ec782ace24_amadey_blankgrabber_cobalt-strike_coinminer_glassworm_ic.exe
4316	2026-10-16_4c5d593ae7371faa4ccc72ec782ace24_amadey_blankgrabber_cobalt-strike_coinminer_glassworm_ic.exe
4316	2026-10-16_4c5d593ae7371faa4ccc72ec782ace24_amadey_blankgrabber_cobalt-strike_coinminer_glassworm_ic.exe
4316	2026-10-16_4c5d593ae7371faa4ccc72ec782ace24_amadey_blankgrabber_cobalt-strike_coinminer_glassworm_ic.exe
4316	2026-10-16_4c5d593ae7371faa4ccc72ec782ace24_amadey_blankgrabber_cobalt-strike_coinminer_glassworm_ic.exe
4316	2026-10-16_4c5d593ae7371faa4ccc72ec782ace24_amadey_blankgrabber_cobalt-strike_coinminer_glassworm_ic.exe
4316	2026-10-16_4c5d593ae7371faa4ccc72ec782ace24_amadey_blankgrabber_cobalt-strike_coinminer_glassworm_ic.exe
4316	2026-10-16_4c5d593ae7371faa4ccc72ec782ace24_amadey_blankgrabber_cobalt-strike_coinminer_glassworm_ic.exe
4316	2026-10-16_4c5d593ae7371faa4ccc72ec782ace24_amadey_blankgrabber_cobalt-strike_coinminer_glassworm_ic.exe
4316	2026-10-16_4c5d593ae7371faa4ccc72ec782ace24_amadey_blankgrabber_cobalt-strike_coinminer_glassworm_ic.exe
4316	2026-10-16_4c5d593ae7371faa4ccc72ec782ace24_amadey_blankgrabber_cobalt-strike_coinminer_glassworm_ic.exe
4316	2026-10-16_4c5d593ae7371faa4ccc72ec782ace24_amadey_blankgrabber_cobalt-strike_coinminer_glassworm_ic.exe
4316	2026-10-16_4c5d593ae7371faa4ccc72ec782ace24_amadey_blankgrabber_cobalt-strike_coinminer_glassworm_ic.exe
4316	2026-10-16_4c5d593ae7371faa4ccc72ec782ace24_amadey_blankgrabber_cobalt-strike_coinminer_glassworm_ic.exe
4316	2026-10-16_4c5d593ae7371faa4ccc72ec782ace24_amadey_blankgrabber_cobalt-strike_coinminer_glassworm_ic.exe
4316	2026-10-16_4c5d593ae7371faa4ccc72ec782ace24_amadey_blankgrabber_cobalt-strike_coinminer_glassworm_ic.exe
4316	2026-10-16_4c5d593ae7371faa4ccc72ec782ace24_amadey_blankgrabber_cobalt-strike_coinminer_glassworm_ic.exe
4316	2026-10-16_4c5d593ae7371faa4ccc72ec782ace24_amadey_blankgrabber_cobalt-strike_coinminer_glassworm_ic.exe
4316	2026-10-16_4c5d593ae7371faa4ccc72ec782ace24_amadey_blankgrabber_cobalt-strike_coinminer_glassworm_ic.exe
4316	2026-10-16_4c5d593ae7371faa4ccc72ec782ace24_amadey_blankgrabber_cobalt-strike_coinminer_glassworm_ic.exe
4316	2026-10-16_4c5d593ae7371faa4ccc72ec782ace24_amadey_blankgrabber_cobalt-strike_coinminer_glassworm_ic.exe
4316	2026-10-16_4c5d593ae7371faa4ccc72ec782ace24_amadey_blankgrabber_cobalt-strike_coinminer_glassworm_ic.exe
1308	x9fPee.exe
1308	x9fPee.exe
1308	x9fPee.exe
1308	x9fPee.exe
1308	x9fPee.exe
1308	x9fPee.exe
1308	x9fPee.exe
1308	x9fPee.exe
1308	x9fPee.exe
1308	x9fPee.exe
1308	x9fPee.exe
1308	x9fPee.exe
1308	x9fPee.exe
1308	x9fPee.exe
1308	x9fPee.exe
1308	x9fPee.exe
1308	x9fPee.exe
1308	x9fPee.exe
1308	x9fPee.exe
1308	x9fPee.exe
1308	x9fPee.exe
1308	x9fPee.exe
1308	x9fPee.exe
1308	x9fPee.exe
1308	x9fPee.exe
1308	x9fPee.exe
1308	x9fPee.exe
1308	x9fPee.exe
1308	x9fPee.exe
1308	x9fPee.exe
1308	x9fPee.exe
1308	x9fPee.exe

Suspicious behavior: LoadsDriver 4 IoCs

pid	Process
652	Process not Found
652	Process not Found
652	Process not Found
652	Process not Found

Suspicious use of WriteProcessMemory 24 IoCs

description	pid	Process	procid_target
PID 1308 wrote to memory of 4504	1308	x9fPee.exe	99
PID 4504 wrote to memory of 1660	4504	cmd.exe	101
PID 4504 wrote to memory of 2888	4504	cmd.exe	102
PID 4504 wrote to memory of 2820	4504	cmd.exe	104
PID 2248 wrote to memory of 2336	2248	cmd.exe	108
PID 1308 wrote to memory of 1208	1308	x9fPee.exe	110
PID 1208 wrote to memory of 5064	1208	cmd.exe	113
PID 1208 wrote to memory of 4216	1208	cmd.exe	114
PID 1208 wrote to memory of 2008	1208	cmd.exe	116
PID 1308 wrote to memory of 528	1308	x9fPee.exe	118
PID 528 wrote to memory of 2360	528	cmd.exe	120
PID 2168 wrote to memory of 976	2168	cmd.exe	121
PID 1308 wrote to memory of 3508	1308	x9fPee.exe	122
PID 1308 wrote to memory of 4408	1308	x9fPee.exe	124
PID 528 wrote to memory of 3804	528	cmd.exe	126
PID 3508 wrote to memory of 4996	3508	cmd.exe	127
PID 4408 wrote to memory of 3236	4408	cmd.exe	129
PID 528 wrote to memory of 3788	528	cmd.exe	130
PID 3508 wrote to memory of 2364	3508	cmd.exe	131
PID 4408 wrote to memory of 2132	4408	cmd.exe	132
PID 3508 wrote to memory of 1188	3508	cmd.exe	133
PID 4408 wrote to memory of 4092	4408	cmd.exe	134
PID 4476 wrote to memory of 452	4476	cmd.exe	136
PID 1308 wrote to memory of 3700	1308	x9fPee.exe	137

System policy modification 1 TTPs 1 IoCs

defense_evasion

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	iMaCMu.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\2026-10-16_4c5d593ae7371faa4ccc72ec782ace24_amadey_blankgrabber_cobalt-strike_coinminer_glassworm_ic.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-16_4c5d593ae7371faa4ccc72ec782ace24_amadey_blankgrabber_cobalt-strike_coinminer_glassworm_ic.exe"
1⤵
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
PID:4316

C:\Users\Public\paS7MN\x9fPee.exe
C:\Users\Public\paS7MN\x9fPee.exe
1⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Program Files directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1308
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Public\paS7MN\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:4504
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Public\paS7MN\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1660
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:2888
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:2820
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\ProgramData\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:1208
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\ProgramData\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5064
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:4216
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:2008
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:528
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2360
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:3804
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:3788
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Program Files (x86)\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:3508
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Program Files (x86)\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4996
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:2364
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:1188
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"%USERPROFILE%\Documents\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:4408
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Admin\Documents\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3236
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:2132
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:4092
- C:\Program Files (x86)\iMaCMu\iMaCMu.exe
  "C:\Program Files (x86)\iMaCMu\iMaCMu.exe"
  2⤵
  - UAC bypass
  - Executes dropped EXE
  - Loads dropped DLL
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - System policy modification
  PID:3700
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c vssadmin delete shadows /all /quiet
    3⤵
    - Executes a command shell one-liner
    PID:3192
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\iMaCMu" /inheritance:r
    3⤵
    - Executes a command shell one-liner
    PID:1260
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\iMaCMu" /inheritance:r
      4⤵
      Modifies file permissions
      PID:4596
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c echo.>c:\xxxx.ini
    3⤵
    - Executes a command shell one-liner
    PID:3124

C:\Windows\system32\cmd.exe
cmd.exe /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Public\paS7MN" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2248
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Public\paS7MN" /t REG_DWORD /d 0 /f
  2⤵
  - Windows security bypass
  PID:2336

C:\Windows\system32\cmd.exe
cmd.exe
1⤵
PID:1444

C:\Users\Public\paS7MN\x9fPee.exe
"C:\Users\Public\paS7MN\x9fPee.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2320

C:\Windows\system32\cmd.exe
cmd.exe /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\ProgramData" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2168
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\ProgramData" /t REG_DWORD /d 0 /f
  2⤵
  - Windows security bypass
  PID:976

C:\Windows\system32\cmd.exe
cmd.exe /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4476
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users" /t REG_DWORD /d 0 /f
  2⤵
  - Windows security bypass
  PID:452

C:\Program Files (x86)\iMaCMu\iMaCMu.exe
"C:\Program Files (x86)\iMaCMu\iMaCMu.exe"
1⤵
PID:2508

C:\Program Files (x86)\NKQ6A4f5\5G2wOvjf2.exe
"C:\Program Files (x86)\NKQ6A4f5\5G2wOvjf2.exe"
1⤵
PID:3232

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

File and Directory Permissions Modification

T1222

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Indicator Removal

T1070

Clear Persistence

T1070.009

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

XPSPLOG.dll

Path C:\Program Files (x86)\NKQ6A4f5\XPSPLOG.dll
Size 1.2MB
SHA256 44ab2c554e2f0634b4e73f2f86d46c6796b570ab5a7cf86c54d0c2dd24be4330
MD5 b1659337220c08d17bbaa6943b59c87a
SHA1 951727cfc8f31912e7fe57eb6fc000faf17b4e81
SHA512 ee8e7cebab849c52455f939f7f6e2a1294b538403d7eb30e9234ead33e0f44357e754b5d31b75b7bd5d16adc170a3248911dfee07942484ac310e8d483c6930f
SSDEEP 24576:RTOuWhLK5RyoT9xcjWByWfymm5LQMqKJoyPhNuTXT5u:3KLKP3cCMWmRqKJ1JNST5u
TLSH
T13A5533C6B187A519F65673B16F8DFE2CB4BE98C840ADDC69A4D5708700369FA403C78E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

XPSPLOG.dll

Path C:\Program Files (x86)\NKQ6A4f5\XPSPLOG.dll
Size 768KB
SHA256 7aa6e02be0f301eaaaff34355148bd8dbbbec11ee8443a2a4d2e27e7964890cb
MD5 2458216b9387db0a82bf476d47ded578
SHA1 12f00841dea1aa57d370010c2fd1ec961fbfd7be
SHA512 bcb5f48f727b0fd21a3b14b225be65143a9f41e852901c0324b4f2aff6dbd672e460a30078ee0e68c91638f4d50e21abfe9bea8b807a1a00d5ef53878bed4342
SSDEEP 12288:6Qls2PLOuWhkdNkXDKLReoDhRyoTU0UoRclIp6W6HfSqwkRQnLyWfymj:RTOuWhLK5RyoT9xcjWByWfymj
TLSH
T16EF423C66142552AFE45B2B16F8CFDBC71B9A8E80176DD5CB8C179870473AFA503838B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

XPSPLOG.dll

Path C:\Program Files (x86)\NKQ6A4f5\XPSPLOG.dll
Size 576KB
SHA256 39660ce7f868673af44575d6e48da1c832db453f50764047add1127aa63edd1b
MD5 e7410685d86af27b0bdac202876e439a
SHA1 89617e7a52f95bc0437c2efec57bda7795ed9ca6
SHA512 6a90150b2c72c7ee5b24297024d63ceafbb1bcc86952a978e36190bf92ba183b9179eff9b7af7caf86a7d12d60ea2092e7866c5cbd73bdff59477846db53fa02
SSDEEP 12288:6Qls2PLOuWhkdNkXDKLReoDhRyoTU0UoRclIp6W6HfSf:RTOuWhLK5RyoT9xcjWh
TLSH
T17DC423A22182552FFE4A76710F8CFC6C75F965EC1276CE68A8C5758308BBAF5503818F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

XPSPLOG.dll

Path C:\Program Files (x86)\iMaCMu\XPSPLOG.dll
Size 4.6MB
SHA256 27aebcd0a28106bdab32ee6aa066b98266c9dde82fdece0c4b56272af7195d29
MD5 a1ab4cb8e308136d82e3a53921deb4b6
SHA1 f773cbe16bf9bda00df1b1fc93d08b14d69a9dcb
SHA512 c0b15732fffa9a53b739c4b5552f1ecb9895dd267be579afbbe2095b6588f82ea7e1497cd87adf14498ac3a06980b290dc4cab048419b86eb8237bb424c3ad64
SSDEEP 98304:yCMWmcKfST5t+BceThTHfaCCUqmJPCYvboB1fdmyH:BMWKfU+BcUTHCCCfqCiUffnH
TLSH
T136263349BADB025DD89672704F6AFD7EB2B92CCC4204DC4DD44DE587E8B2729703A90E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

XPSPLOG.dll

Path C:\Program Files (x86)\iMaCMu\XPSPLOG.dll
Size 1.4MB
SHA256 7fcde413f146fb35ac3ca0d2bf529f4123b72fac9c10c33bd0427a878575c590
MD5 e379e2ffd6df48b5b1efea91ff76f803
SHA1 dd8c3c6ebad1a4ec1da7ac5e6b8277d24c7399fb
SHA512 acb5b605d8b82b619bc6dd3a98d0adc42326a110855bc22897bf168188863e59f994ee2a16428e040c3201104d43474ea5b5037c034a5c8725b3ae65fb4ebea9
SSDEEP 24576:RTOuWhLK5RyoT9xcjWByWfymm5LQMqKJoyPhNuTXT5tpB1JA2:3KLKP3cCMWmRqKJ1JNST5ZL
TLSH
T1E0653396B1CB951DEA5573B12F8CFC2CB47E99C841ADCC6998D674874032AEF403878E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

iMaCMu.exe

Path C:\Program Files (x86)\iMaCMu\iMaCMu.exe
Size 145KB
SHA256 6d6ba2bc9ad414837826f7278bc3e0116f1aeda02d0c2284ed65819f5d9180a8
MD5 5251b98614acffe5c856f4039ca03da3
SHA1 c80ed6716e89d4862f28ebbc130ec5aa362db963
SHA512 d750c9adb08d9525ee9948c0c18c96f0c9520068aa4aa24885ac0d98790a6cc0a8ce0e71e1c669acd4623e0aabfc08c11c02be403f275b01aa4277c4ddab3302
SSDEEP 3072:VafgcZGuY2TqWLGzwRC7kll1xtBQDTCCvtzaYPFPR/M:Yz8upLGaPQDnFzaYPFdM
TLSH
T16AE30852B6808460F76A0B311864F9E44A6EED3C1AD0E95FF2787D3A1E311C38A7756F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

image.png

Path C:\Program Files (x86)\iMaCMu\image.png
Size 4.8MB
SHA256 d3461ee0aa7427d30f8c95c1bce56cdd448a9419c580e9f320a4216da4ecc521
MD5 49dadc56e2b9b68651c5577c9dd294d6
SHA1 516c472b621af252d4f3e00bb1fc8399dd1c1771
SHA512 515c18ab6233b07e58a246a13699ca0e2241666f69edb7cb15fc479d26b55bfacd32d4fda78cac73283e993532fa8c5f36499bab04ceceefa84c608e8477f57b
SSDEEP 98304:5/kbbJse0kVnNLHgU4xCdWDI9U85SRewtOOqncq0/bsf8IWkKo5M2w:5MpJ0kVNLAU4xWWDI3ieO+n1yAFWkh5Q
TLSH
T1D936334FE6EFBED9C398F7EA71098A30D63A8FBE1542292560229D14B63D7073293505
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

thumbs.db

Path C:\Program Files (x86)\iMaCMu\thumbs.db
Size 358KB
SHA256 9a6acffcb5dc0c8d3e22cc1a65f2b0d052710cbbe5be7159964654af1a1c6714
MD5 23fabea1adb8517cfd7a95b08bd82549
SHA1 f08cb23456d8c8faf1a0225003ad762c931219c5
SHA512 3d6db59f58bcde82bc16912a87c28c3eb1091b36c32ffe37f629e96af8a9708af8871252610a9521e3278bb4401c2e2306b56ff250d70264f3e0e728b146fd19
SSDEEP 6144:SiACk/u6n9aBOmmD1oQFu0oMOxKnJPWyD9Dcqt1oFsnrqW7mb/:t8u69CghoQxoMTFQqtKFCz7mb/
TLSH
T12174F268E6651EFE0E175FECE04F58AE9A8FD9E302C900252BF1C6D1CA106E4941FD5E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

0DA515F703BB9B49479E8697ADB0B955_A825BDF54036A41AFA74CBF923C33A97

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\0DA515F703BB9B49479E8697ADB0B955_A825BDF54036A41AFA74CBF923C33A97
Size 1KB
SHA256 deaea1d22b6648594da180d08cebab2292302563f1916acee3e8e5da76c0898e
MD5 6cabf4c457be280883bddf2bbc7b3a0a
SHA1 75ece25857004b92a369fdf12edc30895c5c31a4
SHA512 a827d8c6983d597477b5f7581f6eb7c4e7744ed692eefe387abbf63eaa9a634583546dca336e77f6dfa7cf6f4f218a78aa0f7f1966af4b08f0870453a3e5262c
TLSH
T1D531E9BB1FA87983DF298D9825CBF0273DF4E2806DDA049A5115C4995F0C3722F1E91C
MD5 SHA1 SHA512 TLSH

Submit Download

B126FCE2445AEB4D678E59CB88147627_9759CCC75F54A99CEB69AE73B218D5C6

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B126FCE2445AEB4D678E59CB88147627_9759CCC75F54A99CEB69AE73B218D5C6
Size 1KB
SHA256 461d5a9b390ca54a947f82370cdec8ba52232a40eebe62174c5daf8f9f4329a5
MD5 ea0356acb5fa416f1d3a9329b5874597
SHA1 fa0053456e0de24422e812dd06f20b902bcc84c2
SHA512 a51323efa5e56a41101f87c691b6b452a7cbe36add272743ac022bee551c039002e1103ef06f8c279a1300e1f4e67f27cc41f84a1c891418a8d31322c23a77bd
TLSH
T1BC31D8868E791402EF189F3562D5D73FEDF1D2349CE80C51A12DC16A5A05BB75FC1944
MD5 SHA1 SHA512 TLSH

Submit Download

0DA515F703BB9B49479E8697ADB0B955_A825BDF54036A41AFA74CBF923C33A97

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\0DA515F703BB9B49479E8697ADB0B955_A825BDF54036A41AFA74CBF923C33A97
Size 512B
SHA256 44fe51e6950e762e23c0ec982532b392fa2ee6c5bd3fffd16695e1e88e1c47fe
MD5 fe77f1e47785cb04bb9ab1d9d56612ff
SHA1 97aa78e111ad1473a15cfca73d504a63e8f9a8f9
SHA512 fb053882ff3384c3ce322759f9cfc18890122eb16167da2212ec3e7f3afd354f2ba339703eb4b134ab4c9a3b2b7bc880e3860ae76aa3e2707f5648605da51476
TLSH
T1D0F05C180CB9913FF133EE3CDBCA755B9A7BF65A140949A40BE14B08A542B413DA17B9
MD5 SHA1 SHA512 TLSH

Submit Download

B126FCE2445AEB4D678E59CB88147627_9759CCC75F54A99CEB69AE73B218D5C6

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B126FCE2445AEB4D678E59CB88147627_9759CCC75F54A99CEB69AE73B218D5C6
Size 506B
SHA256 dedcaf08a99f18ef839c5e12853d69defa4ca1b263cfaad3303fc07f8b785e2d
MD5 7366b61e1537064bface654e38f1c66f
SHA1 db4e6b563b82f3425ab9a475930666c014f8c04b
SHA512 993b30f1279bfba82451f1c053b47cc1cc2f15990ef44ad19600eb6bca3923b97c2c8ed516c4eef6ea3f489c2c12c22478ab0cee44ab9e1d58f5e764625d079f
TLSH
T13EF05C2D11DA821FF0BFD5B896D236B36E25E622000661BD0AF563045E51E007C01339
MD5 SHA1 SHA512 TLSH

Submit Download

destopbak.ini

Path C:\Users\Public\Music\destopbak.ini
Size 2B
SHA256 dd1e2826c0124a6d4f7397a5a71f633928926c0608b62fb9e615ba778acc39ff
MD5 7e74f75663e5b5a4f3452a4c603ee45d
SHA1 d5114b086b721f2c87ea7152025792958ab4c629
SHA512 2f5d0d45593487bebc2ccf968eaf2a4a3bde1d5a29c7c2b5ad411e041c0d3b7a46be439ed7083093057a96030683b9defbed1a2ef7882b3e64cf3fbc7c9cf12f
MD5 SHA1 SHA512

Submit Download

UxEnhance64.dll

Path C:\Users\Public\paS7MN\UxEnhance64.dll
Size 3.1MB
SHA256 91f9bd75517a742a63ed99ebbbfd97ecddaab87a4a6f1f689a9ee7ecd6e10549
MD5 96fdcd33686ccf32d96b9c35fc4d832c
SHA1 ff26220ff5b995b698380da6636dfc9d1cfaf6f6
SHA512 3b8ff2913624e5a2881c406566885d0ca25cbbf69dd34f53e5a0e96dacd8a0d5083c5dcd4e048c5ec17add14e7c39cbcceb9aee9fbff5a3585977221ed48ac4b
SSDEEP 49152:P9KpI8cBa0kj6BK0x3TiMQclkGo2PXk6rkwuuWG/+WizBedfb77N3SnKrKB++:P9m29xx3Tiqt06ox6+z2rNNrKo+
TLSH
T13DE523E5B6D739F6D023CBF4DA62A1AD70393F505F635C5F3B8929014E62228973A390
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

adoresd.dat

Path C:\Users\Public\paS7MN\adoresd.dat
Size 4.7MB
SHA256 a0cfa5606af03c5666b569ebc6317f8ad5532805c3d34af8391db39188cc922f
MD5 a4adac99dfcb38e0e77726b32934dbc5
SHA1 df75770e6c91fb93b8fdc46f98d8244525997304
SHA512 1bab6c08dc9a45340ffec336d2dd76d789ec44ff169196e185975636e1833961ef606e2b47461f38f024d5514fe04efe060dddd207d4f8c253bb4f84c57ec78b
SSDEEP 98304:6KC/XwuPMlcCGQtZspbohHC0CYxm5YrKjaHhIVyU8zU9VQIr6K:6KClqhi0Cv54K2IVS0VQg
TLSH
T1CF3633C90DC0ED7D61810A8478A91192F6713147E2F1E6E8FD6C7E0AB87FD52E1A3B58
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msadox.tb

Path C:\Users\Public\paS7MN\msadox.tb
Size 8KB
SHA256 6ce9dbd684f75f1902a8262d9fcc5ac9eea4982832ef3846ea7e738b0c74d122
MD5 afb2084ee63d0cf9f0be1d703370ab83
SHA1 28ffb74c9f5fd9836025d662f1312db20813f201
SHA512 e0955b4867f1458fd370c228a41180260b38396307af8fdffc1ce435b47e4d9837a2fbb955e7b93e6a7646fbfb3920997090c5a806ebf39228b75dec46b4d58e
SSDEEP 192:+qbZajnZ45X1q3JXglD+3vR8cwNhIMCGe2y0PQp:+sZqZOXQ3uqvR2Kfzp
TLSH
T1D5029E05D7A20CC7D2116C71CD9EB2F5AB13A1DADA3926719C67D4C167072DD2CE620D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

x9fPee.exe

Path C:\Users\Public\paS7MN\x9fPee.exe
Size 135KB
SHA256 676a2a7b94ca2f8ec76352ee656e4d075bb342bd7ad6efbc7c19c060001eace7
MD5 9ec587911e501b73b7cf09f05d0ae17d
SHA1 5b62403cc9a668c6e5c70ace177fd54fcc4c5936
SHA512 d05468a472373815c46ccb46ec743408365d24982d10d8a23ee0036c28cf3dacd05d74304ef2d4b7118f91ff3f631f676b2e86ddee92a02cf988b0d3c6247847
SSDEEP 3072:MmhXb5pgtiaRENEErO9Uj4OqhhUvB4BNgQaJ:MmjgtiayGErsUKh3To
TLSH
T1D0D38C2776A474F9E1778635C8511A1AE772B8760770CB9F03A442A62F237D19E3EF20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1308-542-0x000001E2C7A20000-0x000001E2C82A7000-memory.dmp

Download

memory/1308-530-0x00007FF84BB90000-0x00007FF84C0AE000-memory.dmp

Download

memory/1308-558-0x000001E2C8780000-0x000001E2C880A000-memory.dmp

Download

memory/1308-557-0x000001E2C8780000-0x000001E2C880A000-memory.dmp

Download

memory/1308-556-0x000001E2C8780000-0x000001E2C880A000-memory.dmp

Download

memory/1308-555-0x000001E2C8780000-0x000001E2C880A000-memory.dmp

Download

memory/1308-554-0x000001E2C58B0000-0x000001E2C58FE000-memory.dmp

Download

memory/1308-564-0x000001E2C7A20000-0x000001E2C82A7000-memory.dmp

Download

memory/1308-563-0x000001E2C7A20000-0x000001E2C82A7000-memory.dmp

Download

memory/1308-545-0x000001E2C7A20000-0x000001E2C82A7000-memory.dmp

Download

memory/1308-544-0x000001E2C7A20000-0x000001E2C82A7000-memory.dmp

Download

memory/1308-543-0x000001E2C7A20000-0x000001E2C82A7000-memory.dmp

Download

memory/1308-529-0x00007FF868B70000-0x00007FF868B72000-memory.dmp

Download

memory/1308-549-0x000001E2C7A20000-0x000001E2C82A7000-memory.dmp

Download

memory/1308-535-0x000001E2C7A20000-0x000001E2C82A7000-memory.dmp

Download

memory/1308-538-0x000001E2C7A20000-0x000001E2C82A7000-memory.dmp

Download

memory/1308-537-0x00007FF868B80000-0x00007FF868B82000-memory.dmp

Download

memory/2320-588-0x000001A723A40000-0x000001A7242C7000-memory.dmp

Download

memory/2320-583-0x00007FF868B80000-0x00007FF868B82000-memory.dmp

Download

memory/2320-584-0x000001A723A40000-0x000001A7242C7000-memory.dmp

Download

memory/2320-592-0x00007FF868B70000-0x00007FF868B72000-memory.dmp

Download

memory/2320-590-0x000001A723A40000-0x000001A7242C7000-memory.dmp

Download

memory/2320-591-0x000001A723A40000-0x000001A7242C7000-memory.dmp

Download

memory/2320-589-0x000001A723A40000-0x000001A7242C7000-memory.dmp

Download

memory/2320-578-0x00007FF84BB90000-0x00007FF84C0AE000-memory.dmp

Download

memory/2320-581-0x000001A723A40000-0x000001A7242C7000-memory.dmp

Download

memory/3700-671-0x0000000002EF0000-0x00000000036CD000-memory.dmp

Download

memory/3700-683-0x0000000002EF0000-0x00000000036CD000-memory.dmp

Download

memory/3700-670-0x00000000005C0000-0x00000000005C1000-memory.dmp

Download

memory/3700-663-0x00000000005A0000-0x00000000005A1000-memory.dmp

Download

memory/3700-675-0x0000000002EF0000-0x00000000036CD000-memory.dmp

Download

memory/3700-664-0x0000000075140000-0x000000007588A000-memory.dmp

Download

memory/3700-682-0x00000000005D0000-0x00000000005E4000-memory.dmp

Download

memory/3700-668-0x0000000002EF0000-0x00000000036CD000-memory.dmp

Download

memory/3700-714-0x0000000002EF0000-0x00000000036CD000-memory.dmp

Download

memory/3700-691-0x0000000010000000-0x0000000010061000-memory.dmp

Download

memory/4316-524-0x00007FF859B60000-0x00007FF859B70000-memory.dmp

Download

memory/4316-523-0x00000000001B0000-0x00000000001BE000-memory.dmp

Download

memory/4316-503-0x00007FF859B60000-0x00007FF859B70000-memory.dmp

Download

memory/4316-0-0x00000000001B0000-0x00000000001BE000-memory.dmp

Download

memory/4316-1-0x00000000001D0000-0x00000000001DC000-memory.dmp

Download