xmrig | 3fadb0de0fc29c4e02f5b62ea963cc14fd80ccb9a778ebf325e3fb05ac2503e7

Analysis

max time kernel
148s
max time network
143s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/07/2026, 10:40

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-10_0e203ddd7c00e36983115b1708710e4e_blankgrabber_cobalt-strike_glassworm_icedid_stealc.exe
Size 296KB
Sample260710-mqldpsay7s
SHA256 3fadb0de0fc29c4e02f5b62ea963cc14fd80ccb9a778ebf325e3fb05ac2503e7
MD5 0e203ddd7c00e36983115b1708710e4e
SHA1 61b8d4464c4545e8e5033b2521c9217f6421248a
SHA512 52551416b35fb8962c42aaf502deed25245b3f564ffd28878ebc84e0bdd571229fc25788eb09cc8b2f521a85ed16a9b339a41dbdb30f7f790ea019d35b1e760d
SSDEEP 6144:rhHaQDwcucZeZnQmnDLxFPO621YJgFxP0oU:VHaQ0vc4xQmD1FP21VF+
TLSH
T149547D5AF7A511F9E97BC53CC882450AEA727C1547B0EB8F07A00A963F237A05E3E751
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery xmrig miner persistence upx

Malware Config

Signatures

Family: xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

Detects executables packed with SmartAssembly 1 IoCs

resource	yara_rule
behavioral2/memory/5576-27-0x000000000D070000-0x000000000E440000-memory.dmp	INDICATOR_EXE_Packed_SmartAssembly

UPX dump on OEP (original entry point) 6 IoCs

resource	yara_rule
behavioral2/files/0x000c00000001c5e5-12.dat	UPX
behavioral2/memory/5576-20-0x0000000000CC0000-0x0000000002754000-memory.dmp	UPX
behavioral2/memory/5576-35-0x0000000000CC0000-0x0000000002754000-memory.dmp	UPX
behavioral2/memory/2460-38-0x00000000008D0000-0x0000000002364000-memory.dmp	UPX
behavioral2/memory/2460-43-0x00000000008D0000-0x0000000002364000-memory.dmp	UPX
behavioral2/memory/2460-45-0x00000000008D0000-0x0000000002364000-memory.dmp	UPX

XMRig Miner payload 1 IoCs

miner

resource	yara_rule
behavioral2/memory/6108-24-0x0000000140000000-0x0000000140615000-memory.dmp	xmrig

Executes dropped EXE 4 IoCs

pid	Process
5576	SecurityHealthClient.exe
6108	SecurityHealthServer.exe
2052	SecurityHealthServer.exe
2460	ServiceHub.IdentityHost.exe

Power Settings 1 TTPs 28 IoCs

powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.

persistence

Power Settings

T1653

pid	Process
6116	powercfg.exe
6032	powercfg.exe
3052	powercfg.exe
5744	powercfg.exe
5016	powercfg.exe
1880	powercfg.exe
3312	powercfg.exe
5260	powercfg.exe
1756	powercfg.exe
5692	powercfg.exe
5676	powercfg.exe
2172	powercfg.exe
1248	powercfg.exe
2256	powercfg.exe
1116	powercfg.exe
2536	powercfg.exe
5660	powercfg.exe
4784	powercfg.exe
3800	powercfg.exe
4576	powercfg.exe
2920	powercfg.exe
1560	powercfg.exe
5796	powercfg.exe
2892	powercfg.exe
4664	powercfg.exe
4812	powercfg.exe
4388	powercfg.exe
968	powercfg.exe

SmartAssembly .NET packer 1 IoCs

Detects SmartAssembly .NET packer.

resource	yara_rule
behavioral2/memory/5576-27-0x000000000D070000-0x000000000E440000-memory.dmp	SmartAssembly

UPX packed file 6 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/files/0x000c00000001c5e5-12.dat	upx
behavioral2/memory/5576-20-0x0000000000CC0000-0x0000000002754000-memory.dmp	upx
behavioral2/memory/5576-35-0x0000000000CC0000-0x0000000002754000-memory.dmp	upx
behavioral2/memory/2460-38-0x00000000008D0000-0x0000000002364000-memory.dmp	upx
behavioral2/memory/2460-43-0x00000000008D0000-0x0000000002364000-memory.dmp	upx
behavioral2/memory/2460-45-0x00000000008D0000-0x0000000002364000-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SecurityHealthClient.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ServiceHub.IdentityHost.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2256	powercfg.exe
Token: SeCreatePagefilePrivilege	2256	powercfg.exe
Token: SeShutdownPrivilege	2256	powercfg.exe
Token: SeCreatePagefilePrivilege	2256	powercfg.exe
Token: SeShutdownPrivilege	4388	powercfg.exe
Token: SeCreatePagefilePrivilege	4388	powercfg.exe
Token: SeShutdownPrivilege	4812	powercfg.exe
Token: SeCreatePagefilePrivilege	4812	powercfg.exe
Token: SeShutdownPrivilege	1116	powercfg.exe
Token: SeCreatePagefilePrivilege	1116	powercfg.exe
Token: SeShutdownPrivilege	2536	powercfg.exe
Token: SeCreatePagefilePrivilege	2536	powercfg.exe
Token: SeShutdownPrivilege	1880	powercfg.exe
Token: SeCreatePagefilePrivilege	1880	powercfg.exe
Token: SeShutdownPrivilege	968	powercfg.exe
Token: SeCreatePagefilePrivilege	968	powercfg.exe
Token: SeShutdownPrivilege	3312	powercfg.exe
Token: SeCreatePagefilePrivilege	3312	powercfg.exe
Token: SeShutdownPrivilege	5260	powercfg.exe
Token: SeCreatePagefilePrivilege	5260	powercfg.exe
Token: SeDebugPrivilege	5576	SecurityHealthClient.exe
Token: SeShutdownPrivilege	3052	powercfg.exe
Token: SeCreatePagefilePrivilege	3052	powercfg.exe
Token: SeShutdownPrivilege	6116	powercfg.exe
Token: SeCreatePagefilePrivilege	6116	powercfg.exe
Token: SeShutdownPrivilege	4784	powercfg.exe
Token: SeCreatePagefilePrivilege	4784	powercfg.exe
Token: SeShutdownPrivilege	5660	powercfg.exe
Token: SeCreatePagefilePrivilege	5660	powercfg.exe
Token: SeShutdownPrivilege	6032	powercfg.exe
Token: SeCreatePagefilePrivilege	6032	powercfg.exe
Token: SeShutdownPrivilege	1756	powercfg.exe
Token: SeCreatePagefilePrivilege	1756	powercfg.exe
Token: SeShutdownPrivilege	1756	powercfg.exe
Token: SeCreatePagefilePrivilege	1756	powercfg.exe
Token: SeLockMemoryPrivilege	6108	SecurityHealthServer.exe
Token: SeLockMemoryPrivilege	6108	SecurityHealthServer.exe
Token: SeShutdownPrivilege	5744	powercfg.exe
Token: SeCreatePagefilePrivilege	5744	powercfg.exe
Token: SeShutdownPrivilege	1560	powercfg.exe
Token: SeCreatePagefilePrivilege	1560	powercfg.exe
Token: SeShutdownPrivilege	3800	powercfg.exe
Token: SeCreatePagefilePrivilege	3800	powercfg.exe
Token: SeShutdownPrivilege	4576	powercfg.exe
Token: SeCreatePagefilePrivilege	4576	powercfg.exe
Token: SeShutdownPrivilege	5692	powercfg.exe
Token: SeCreatePagefilePrivilege	5692	powercfg.exe
Token: SeShutdownPrivilege	5676	powercfg.exe
Token: SeCreatePagefilePrivilege	5676	powercfg.exe
Token: SeShutdownPrivilege	2172	powercfg.exe
Token: SeCreatePagefilePrivilege	2172	powercfg.exe
Token: SeShutdownPrivilege	5016	powercfg.exe
Token: SeCreatePagefilePrivilege	5016	powercfg.exe
Token: SeShutdownPrivilege	2920	powercfg.exe
Token: SeCreatePagefilePrivilege	2920	powercfg.exe
Token: SeShutdownPrivilege	5796	powercfg.exe
Token: SeCreatePagefilePrivilege	5796	powercfg.exe
Token: SeShutdownPrivilege	2892	powercfg.exe
Token: SeCreatePagefilePrivilege	2892	powercfg.exe
Token: SeShutdownPrivilege	1248	powercfg.exe
Token: SeCreatePagefilePrivilege	1248	powercfg.exe
Token: SeShutdownPrivilege	4664	powercfg.exe
Token: SeCreatePagefilePrivilege	4664	powercfg.exe
Token: SeLockMemoryPrivilege	2052	SecurityHealthServer.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
6108	SecurityHealthServer.exe
2052	SecurityHealthServer.exe

Suspicious use of WriteProcessMemory 30 IoCs

description	pid	Process	procid_target
PID 5028 wrote to memory of 5576	5028	2026-07-10_0e203ddd7c00e36983115b1708710e4e_blankgrabber_cobalt-strike_glassworm_icedid_stealc.exe	87
PID 5028 wrote to memory of 6108	5028	2026-07-10_0e203ddd7c00e36983115b1708710e4e_blankgrabber_cobalt-strike_glassworm_icedid_stealc.exe	88
PID 6108 wrote to memory of 2256	6108	SecurityHealthServer.exe	89
PID 6108 wrote to memory of 4388	6108	SecurityHealthServer.exe	91
PID 6108 wrote to memory of 4812	6108	SecurityHealthServer.exe	93
PID 6108 wrote to memory of 1116	6108	SecurityHealthServer.exe	95
PID 6108 wrote to memory of 2536	6108	SecurityHealthServer.exe	97
PID 6108 wrote to memory of 1880	6108	SecurityHealthServer.exe	100
PID 6108 wrote to memory of 968	6108	SecurityHealthServer.exe	102
PID 6108 wrote to memory of 3312	6108	SecurityHealthServer.exe	105
PID 6108 wrote to memory of 5260	6108	SecurityHealthServer.exe	107
PID 6108 wrote to memory of 3052	6108	SecurityHealthServer.exe	109
PID 6108 wrote to memory of 6116	6108	SecurityHealthServer.exe	111
PID 6108 wrote to memory of 4784	6108	SecurityHealthServer.exe	113
PID 6108 wrote to memory of 5660	6108	SecurityHealthServer.exe	115
PID 6108 wrote to memory of 6032	6108	SecurityHealthServer.exe	117
PID 2052 wrote to memory of 1756	2052	SecurityHealthServer.exe	120
PID 2052 wrote to memory of 5744	2052	SecurityHealthServer.exe	122
PID 2052 wrote to memory of 1560	2052	SecurityHealthServer.exe	124
PID 2052 wrote to memory of 3800	2052	SecurityHealthServer.exe	126
PID 2052 wrote to memory of 4576	2052	SecurityHealthServer.exe	128
PID 2052 wrote to memory of 5692	2052	SecurityHealthServer.exe	130
PID 2052 wrote to memory of 5676	2052	SecurityHealthServer.exe	133
PID 2052 wrote to memory of 2172	2052	SecurityHealthServer.exe	135
PID 2052 wrote to memory of 5016	2052	SecurityHealthServer.exe	137
PID 2052 wrote to memory of 2920	2052	SecurityHealthServer.exe	139
PID 2052 wrote to memory of 5796	2052	SecurityHealthServer.exe	141
PID 2052 wrote to memory of 2892	2052	SecurityHealthServer.exe	143
PID 2052 wrote to memory of 1248	2052	SecurityHealthServer.exe	145
PID 2052 wrote to memory of 4664	2052	SecurityHealthServer.exe	147

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\2026-07-10_0e203ddd7c00e36983115b1708710e4e_blankgrabber_cobalt-strike_glassworm_icedid_stealc.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-10_0e203ddd7c00e36983115b1708710e4e_blankgrabber_cobalt-strike_glassworm_icedid_stealc.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:5028
- C:\ProgramData\amdvirtualization\update\SecurityHealthClient.exe
  "C:\ProgramData\amdvirtualization\update\SecurityHealthClient.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  PID:5576
- C:\ProgramData\amdvirtualization\update\SecurityHealthServer.exe
  "C:\ProgramData\amdvirtualization\update\SecurityHealthServer.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:6108
- - C:\Windows\system32\powercfg.exe
    "C:\Windows\system32\powercfg.exe" /h off
    3⤵
    - Power Settings
    - Suspicious use of AdjustPrivilegeToken
    PID:2256
- - C:\Windows\system32\powercfg.exe
    "C:\Windows\system32\powercfg.exe" -duplicatescheme e9a42b02-d5df-448d-aa00-03f14749eb61
    3⤵
    - Power Settings
    - Suspicious use of AdjustPrivilegeToken
    PID:4388
- - C:\Windows\system32\powercfg.exe
    "C:\Windows\system32\powercfg.exe" /setactive 8c5e7fda-e8bf-4a96-9a85-a6e23a8c635c
    3⤵
    - Power Settings
    - Suspicious use of AdjustPrivilegeToken
    PID:4812
- - C:\Windows\system32\powercfg.exe
    "C:\Windows\system32\powercfg.exe" /change standby-timeout-ac 0
    3⤵
    - Power Settings
    - Suspicious use of AdjustPrivilegeToken
    PID:1116
- - C:\Windows\system32\powercfg.exe
    "C:\Windows\system32\powercfg.exe" /change standby-timeout-dc 0
    3⤵
    - Power Settings
    - Suspicious use of AdjustPrivilegeToken
    PID:2536
- - C:\Windows\system32\powercfg.exe
    "C:\Windows\system32\powercfg.exe" /change hibernate-timeout-ac 0
    3⤵
    - Power Settings
    - Suspicious use of AdjustPrivilegeToken
    PID:1880
- - C:\Windows\system32\powercfg.exe
    "C:\Windows\system32\powercfg.exe" /change hibernate-timeout-dc 0
    3⤵
    - Power Settings
    - Suspicious use of AdjustPrivilegeToken
    PID:968
- - C:\Windows\system32\powercfg.exe
    "C:\Windows\system32\powercfg.exe" /change monitor-timeout-ac 0
    3⤵
    - Power Settings
    - Suspicious use of AdjustPrivilegeToken
    PID:3312
- - C:\Windows\system32\powercfg.exe
    "C:\Windows\system32\powercfg.exe" /change monitor-timeout-dc 0
    3⤵
    - Power Settings
    - Suspicious use of AdjustPrivilegeToken
    PID:5260
- - C:\Windows\system32\powercfg.exe
    "C:\Windows\system32\powercfg.exe" /setacvalueindex scheme_current sub_processor PROCTHROTTLEMIN 100
    3⤵
    - Power Settings
    - Suspicious use of AdjustPrivilegeToken
    PID:3052
- - C:\Windows\system32\powercfg.exe
    "C:\Windows\system32\powercfg.exe" /setacvalueindex scheme_current sub_processor PROCTHROTTLEMAX 100
    3⤵
    - Power Settings
    - Suspicious use of AdjustPrivilegeToken
    PID:6116
- - C:\Windows\system32\powercfg.exe
    "C:\Windows\system32\powercfg.exe" /setdcvalueindex scheme_current sub_processor PROCTHROTTLEMIN 100
    3⤵
    - Power Settings
    - Suspicious use of AdjustPrivilegeToken
    PID:4784
- - C:\Windows\system32\powercfg.exe
    "C:\Windows\system32\powercfg.exe" /setdcvalueindex scheme_current sub_processor PROCTHROTTLEMAX 100
    3⤵
    - Power Settings
    - Suspicious use of AdjustPrivilegeToken
    PID:5660
- - C:\Windows\system32\powercfg.exe
    "C:\Windows\system32\powercfg.exe" /setactive scheme_current
    3⤵
    - Power Settings
    - Suspicious use of AdjustPrivilegeToken
    PID:6032

C:\Users\Public\SecurityHealthServer.exe
C:\Users\Public\SecurityHealthServer.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:2052
- C:\Windows\system32\powercfg.exe
  "C:\Windows\system32\powercfg.exe" /h off
  2⤵
  - Power Settings
  - Suspicious use of AdjustPrivilegeToken
  PID:1756
- C:\Windows\system32\powercfg.exe
  "C:\Windows\system32\powercfg.exe" -duplicatescheme e9a42b02-d5df-448d-aa00-03f14749eb61
  2⤵
  - Power Settings
  - Suspicious use of AdjustPrivilegeToken
  PID:5744
- C:\Windows\system32\powercfg.exe
  "C:\Windows\system32\powercfg.exe" /setactive 8c5e7fda-e8bf-4a96-9a85-a6e23a8c635c
  2⤵
  - Power Settings
  - Suspicious use of AdjustPrivilegeToken
  PID:1560
- C:\Windows\system32\powercfg.exe
  "C:\Windows\system32\powercfg.exe" /change standby-timeout-ac 0
  2⤵
  - Power Settings
  - Suspicious use of AdjustPrivilegeToken
  PID:3800
- C:\Windows\system32\powercfg.exe
  "C:\Windows\system32\powercfg.exe" /change standby-timeout-dc 0
  2⤵
  - Power Settings
  - Suspicious use of AdjustPrivilegeToken
  PID:4576
- C:\Windows\system32\powercfg.exe
  "C:\Windows\system32\powercfg.exe" /change hibernate-timeout-ac 0
  2⤵
  - Power Settings
  - Suspicious use of AdjustPrivilegeToken
  PID:5692
- C:\Windows\system32\powercfg.exe
  "C:\Windows\system32\powercfg.exe" /change hibernate-timeout-dc 0
  2⤵
  - Power Settings
  - Suspicious use of AdjustPrivilegeToken
  PID:5676
- C:\Windows\system32\powercfg.exe
  "C:\Windows\system32\powercfg.exe" /change monitor-timeout-ac 0
  2⤵
  - Power Settings
  - Suspicious use of AdjustPrivilegeToken
  PID:2172
- C:\Windows\system32\powercfg.exe
  "C:\Windows\system32\powercfg.exe" /change monitor-timeout-dc 0
  2⤵
  - Power Settings
  - Suspicious use of AdjustPrivilegeToken
  PID:5016
- C:\Windows\system32\powercfg.exe
  "C:\Windows\system32\powercfg.exe" /setacvalueindex scheme_current sub_processor PROCTHROTTLEMIN 100
  2⤵
  - Power Settings
  - Suspicious use of AdjustPrivilegeToken
  PID:2920
- C:\Windows\system32\powercfg.exe
  "C:\Windows\system32\powercfg.exe" /setacvalueindex scheme_current sub_processor PROCTHROTTLEMAX 100
  2⤵
  - Power Settings
  - Suspicious use of AdjustPrivilegeToken
  PID:5796
- C:\Windows\system32\powercfg.exe
  "C:\Windows\system32\powercfg.exe" /setdcvalueindex scheme_current sub_processor PROCTHROTTLEMIN 100
  2⤵
  - Power Settings
  - Suspicious use of AdjustPrivilegeToken
  PID:2892
- C:\Windows\system32\powercfg.exe
  "C:\Windows\system32\powercfg.exe" /setdcvalueindex scheme_current sub_processor PROCTHROTTLEMAX 100
  2⤵
  - Power Settings
  - Suspicious use of AdjustPrivilegeToken
  PID:1248
- C:\Windows\system32\powercfg.exe
  "C:\Windows\system32\powercfg.exe" /setactive scheme_current
  2⤵
  - Power Settings
  - Suspicious use of AdjustPrivilegeToken
  PID:4664

C:\users\public\ServiceHub.IdentityHost.exe
C:\users\public\ServiceHub.IdentityHost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2460

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Power Settings

T1653

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

SecurityHealthClient.exe

Path C:\ProgramData\amdvirtualization\update\SecurityHealthClient.exe
Size 25.5MB
SHA256 7df74ed5a4c693ab165fe4f505d000dd6845d9551f08bd4ad8ad57a9f5167648
MD5 7a57d62a0f5e4478120d49bbcb421178
SHA1 6ae24c8bcc845464a2f66d923daafa38aba2b8bc
SHA512 ec12d6e1cc8244abc316c1d3eb6ab4a041b0736932ad3268729d8c73347f641cb97048fe1b110664d5efd33e5675dd98f066441606e6e93768c8821131464ecb
SSDEEP 393216:r493v/7Lkwmi0D4utX9wLQ4a4B+k/iLtm8nvGEY0:s93LLkwB0DBR9wL/a48keY8nvG70
TLSH
T16E4733CA1BC4C96395DAC42DD9142A7CC27476F50CAB6E07E193AED9A0C79FDCCA211C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SecurityHealthServer.exe

Path C:\ProgramData\amdvirtualization\update\SecurityHealthServer.exe
Size 11.5MB
SHA256 4d8f42b48506546fd145fe7e56318f8f705ab2c95abd68417d47aac333f539b0
MD5 f6b070983a6fd6cd003f0b200503eec7
SHA1 5e9813bf1a554d2ea3f2a8c76d7c1cab1b1b3537
SHA512 f955ebc738f5171897c64c5bb3270433dd8c151cbead9ea284978303ad475f65ba943a4094f9bd48da07aaf87a29f2b6ac621bdee3a0e721ac61136db571bc65
SSDEEP 49152:zGf4mdzowFsysH/YQgMeRV7v3RSeaMivqiAHHeTxyhc5CVa0grjGLInRXMbQrLe0:zGQm3syspV
TLSH
T12FC61203ECA11DFAC0ADA23145775A5A7B70BC491F2123D72AA0B7792F72BD05D7AB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2052-63-0x00007FF780100000-0x00007FF780CC9000-memory.dmp

Download

memory/2052-44-0x00007FF780100000-0x00007FF780CC9000-memory.dmp

Download

memory/2052-39-0x00007FF780100000-0x00007FF780CC9000-memory.dmp

Download

memory/2460-45-0x00000000008D0000-0x0000000002364000-memory.dmp

Download

memory/2460-43-0x00000000008D0000-0x0000000002364000-memory.dmp

Download

memory/2460-38-0x00000000008D0000-0x0000000002364000-memory.dmp

Download

memory/5028-0-0x00007FF6E0F20000-0x00007FF6E0F70000-memory.dmp

Download

memory/5576-31-0x0000000009CB0000-0x0000000009D26000-memory.dmp

Download

memory/5576-40-0x000000000AA90000-0x000000000AA9A000-memory.dmp

Download

memory/5576-32-0x000000000A0C0000-0x000000000A0DE000-memory.dmp

Download

memory/5576-20-0x0000000000CC0000-0x0000000002754000-memory.dmp

Download

memory/5576-35-0x0000000000CC0000-0x0000000002754000-memory.dmp

Download

memory/5576-29-0x0000000009B10000-0x0000000009BA2000-memory.dmp

Download

memory/5576-28-0x00000000060C0000-0x000000000615C000-memory.dmp

Download

memory/5576-30-0x000000000A170000-0x000000000A72A000-memory.dmp

Download

memory/5576-27-0x000000000D070000-0x000000000E440000-memory.dmp

Download

memory/6108-25-0x0000024D674E0000-0x0000024D67500000-memory.dmp

Download

memory/6108-24-0x0000000140000000-0x0000000140615000-memory.dmp

Download

memory/6108-59-0x00007FF7CBD10000-0x00007FF7CC8D9000-memory.dmp

Download

memory/6108-61-0x00007FF7CBD10000-0x00007FF7CC8D9000-memory.dmp

Download

memory/6108-36-0x00007FF7CBD10000-0x00007FF7CC8D9000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads