a7977cf04d97a5e8815e8d934f7f47c31519e5893ee73bd228520e0d9e2343ba

Analysis

max time kernel
150s
max time network
140s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
29/10/2026, 23:03

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-28_9830024199e6bed72dfbcac0e5cbc795_icedid.exe
Size 9.0MB
Sample261029-21panscf66
SHA256 a7977cf04d97a5e8815e8d934f7f47c31519e5893ee73bd228520e0d9e2343ba
MD5 9830024199e6bed72dfbcac0e5cbc795
SHA1 d99bd9fbd5a7dd15f1ef8cafa0db40a046df340b
SHA512 7cd6212a91f4eb2daf4c3dfdbdd13c399985b57e98a30c2d00696af591fa01132a007c0c60bc6cb2078a830da7c14fc7d16ec1cf1e24bb87eb28b8ade683e7f5
SSDEEP 98304:XwLJbN4DZrRzKc6AJoSt7MUxzjWesDqcv45nj7Uv1BZ/hbK9Y:XwLJaFrROc6qTsDqcv45nyTTK9
TLSH
T127967E433193EC47964B3866C06FEC715D2C9CAA088EEA7AC43DE2DF9D9A1532C27571
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion trojan

Malware Config

Signatures

Windows security bypass 2 TTPs 6 IoCs

defense_evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	svchost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\system32 = "0"	svchost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Microsoft\windowss = "0"	svchost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes	svchost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes\svchost.exe = "0"	svchost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Roaming = "0"	svchost.exe

Detects executables referencing many IR and analysis tools 20 IoCs

resource	yara_rule
behavioral1/memory/3568-1-0x0000000140000000-0x00000001408EB000-memory.dmp	INDICATOR_SUSPICIOUS_References_SecTools
behavioral1/memory/3568-8-0x0000000140000000-0x00000001408EB000-memory.dmp	INDICATOR_SUSPICIOUS_References_SecTools
behavioral1/memory/3568-7-0x0000000140000000-0x00000001408EB000-memory.dmp	INDICATOR_SUSPICIOUS_References_SecTools
behavioral1/memory/3568-6-0x0000000140000000-0x00000001408EB000-memory.dmp	INDICATOR_SUSPICIOUS_References_SecTools
behavioral1/memory/3568-10-0x0000000140000000-0x00000001408EB000-memory.dmp	INDICATOR_SUSPICIOUS_References_SecTools
behavioral1/memory/3568-17-0x0000000140000000-0x00000001408EB000-memory.dmp	INDICATOR_SUSPICIOUS_References_SecTools
behavioral1/files/0x00080000000248b2-19.dat	INDICATOR_SUSPICIOUS_References_SecTools
behavioral1/memory/3568-9-0x0000000140000000-0x00000001408EB000-memory.dmp	INDICATOR_SUSPICIOUS_References_SecTools
behavioral1/memory/5468-113-0x00007FFDDE400000-0x00007FFDDE422000-memory.dmp	INDICATOR_SUSPICIOUS_References_SecTools
behavioral1/memory/5468-157-0x00007FFDDE400000-0x00007FFDDE422000-memory.dmp	INDICATOR_SUSPICIOUS_References_SecTools
behavioral1/memory/5468-187-0x00007FFDDE400000-0x00007FFDDE422000-memory.dmp	INDICATOR_SUSPICIOUS_References_SecTools
behavioral1/memory/5468-206-0x00007FFDDE400000-0x00007FFDDE422000-memory.dmp	INDICATOR_SUSPICIOUS_References_SecTools
behavioral1/memory/5468-222-0x00007FFDDE400000-0x00007FFDDE422000-memory.dmp	INDICATOR_SUSPICIOUS_References_SecTools
behavioral1/memory/5468-237-0x00007FFDDE400000-0x00007FFDDE422000-memory.dmp	INDICATOR_SUSPICIOUS_References_SecTools
behavioral1/memory/5468-253-0x00007FFDDE400000-0x00007FFDDE422000-memory.dmp	INDICATOR_SUSPICIOUS_References_SecTools
behavioral1/memory/5468-270-0x00007FFDDE400000-0x00007FFDDE422000-memory.dmp	INDICATOR_SUSPICIOUS_References_SecTools
behavioral1/memory/5468-287-0x00007FFDDE400000-0x00007FFDDE422000-memory.dmp	INDICATOR_SUSPICIOUS_References_SecTools
behavioral1/memory/5468-303-0x00007FFDDE400000-0x00007FFDDE422000-memory.dmp	INDICATOR_SUSPICIOUS_References_SecTools
behavioral1/memory/5468-319-0x00007FFDDE400000-0x00007FFDDE422000-memory.dmp	INDICATOR_SUSPICIOUS_References_SecTools
behavioral1/memory/5468-336-0x00007FFDDE400000-0x00007FFDDE422000-memory.dmp	INDICATOR_SUSPICIOUS_References_SecTools

Executes dropped EXE 64 IoCs

pid	Process
5468	Process not Found
1932	windows.exe
6028	dllhost.exe
4260	SearchProtocolHost.exe
2216	SearchFilterHost.exe
2260	WmiPrvSE.exe
6036	dllhost.exe
2996	SearchProtocolHost.exe
2332	SearchFilterHost.exe
1728	WmiPrvSE.exe
3764	dllhost.exe
2664	SearchProtocolHost.exe
1672	SearchFilterHost.exe
2352	WmiPrvSE.exe
6136	dllhost.exe
1560	SearchProtocolHost.exe
3804	SearchFilterHost.exe
3776	WmiPrvSE.exe
3732	dllhost.exe
6100	SearchProtocolHost.exe
4156	SearchFilterHost.exe
5212	WmiPrvSE.exe
5004	dllhost.exe
4064	SearchProtocolHost.exe
32	SearchFilterHost.exe
116	WmiPrvSE.exe
2972	dllhost.exe
3472	SearchProtocolHost.exe
3312	SearchFilterHost.exe
3092	WmiPrvSE.exe
3456	dllhost.exe
5488	SearchProtocolHost.exe
2308	SearchFilterHost.exe
2868	WmiPrvSE.exe
5704	dllhost.exe
768	SearchProtocolHost.exe
3040	SearchFilterHost.exe
4776	WmiPrvSE.exe
4960	dllhost.exe
5168	SearchProtocolHost.exe
1064	SearchFilterHost.exe
2148	WmiPrvSE.exe
2908	dllhost.exe
1924	SearchProtocolHost.exe
2520	SearchFilterHost.exe
2592	WmiPrvSE.exe
1816	dllhost.exe
3476	SearchProtocolHost.exe
5672	SearchFilterHost.exe
5248	WmiPrvSE.exe
5452	dllhost.exe
2252	SearchProtocolHost.exe
2548	SearchFilterHost.exe
2600	WmiPrvSE.exe
2024	dllhost.exe
3896	SearchProtocolHost.exe
3200	SearchFilterHost.exe
5960	WmiPrvSE.exe
3528	dllhost.exe
1768	SearchProtocolHost.exe
2708	SearchFilterHost.exe
5620	WmiPrvSE.exe
2920	dllhost.exe
796	SearchProtocolHost.exe

Loads dropped DLL 64 IoCs

pid	Process
3568	svchost.exe
3568	svchost.exe
3568	svchost.exe
3568	svchost.exe
3568	svchost.exe
3568	svchost.exe
3568	svchost.exe
3568	svchost.exe
3568	svchost.exe
3568	svchost.exe
3568	svchost.exe
3568	svchost.exe
3568	svchost.exe
3568	svchost.exe
3568	svchost.exe
3568	svchost.exe
3568	svchost.exe
3568	svchost.exe
3568	svchost.exe
3568	svchost.exe
3568	svchost.exe
3568	svchost.exe
3568	svchost.exe
3568	svchost.exe
3568	svchost.exe
3568	svchost.exe
3568	svchost.exe
3568	svchost.exe
3568	svchost.exe
3568	svchost.exe
3568	svchost.exe
3568	svchost.exe
3568	svchost.exe
3568	svchost.exe
3568	svchost.exe
3568	svchost.exe
3568	svchost.exe
3568	svchost.exe
3568	svchost.exe
3568	svchost.exe
3568	svchost.exe
3568	svchost.exe
3568	svchost.exe
3568	svchost.exe
3568	svchost.exe
3568	svchost.exe
3568	svchost.exe
3568	svchost.exe
3568	svchost.exe
3568	svchost.exe
3568	svchost.exe
3568	svchost.exe
3568	svchost.exe
3568	svchost.exe
3568	svchost.exe
3568	svchost.exe
3568	svchost.exe
3568	svchost.exe
3568	svchost.exe
3568	svchost.exe
3568	svchost.exe
3568	svchost.exe
3568	svchost.exe
3568	svchost.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules.xml	Process not Found

Suspicious use of NtSetInformationThreadHideFromDebugger 1 TTPs 1 IoCs

defense_evasion

Debugger Evasion

T1622

pid	Process
3568	svchost.exe

Suspicious use of SetThreadContext 64 IoCs

description	pid	Process	procid_target
PID 4804 set thread context of 3568	4804	2026-10-28_9830024199e6bed72dfbcac0e5cbc795_icedid.exe	84
PID 3568 set thread context of 4884	3568	svchost.exe	85
PID 3568 set thread context of 1180	3568	svchost.exe	86
PID 3568 set thread context of 6124	3568	svchost.exe	88
PID 3568 set thread context of 4112	3568	svchost.exe	89
PID 3568 set thread context of 6028	3568	svchost.exe	90
PID 3568 set thread context of 4260	3568	svchost.exe	93
PID 3568 set thread context of 2216	3568	svchost.exe	96
PID 3568 set thread context of 2260	3568	svchost.exe	97
PID 3568 set thread context of 6036	3568	svchost.exe	98
PID 3568 set thread context of 2996	3568	svchost.exe	99
PID 3568 set thread context of 2332	3568	svchost.exe	100
PID 3568 set thread context of 1728	3568	svchost.exe	102
PID 3568 set thread context of 3764	3568	svchost.exe	103
PID 3568 set thread context of 2664	3568	svchost.exe	104
PID 3568 set thread context of 1672	3568	svchost.exe	105
PID 3568 set thread context of 2352	3568	svchost.exe	109
PID 3568 set thread context of 6136	3568	svchost.exe	110
PID 3568 set thread context of 1560	3568	svchost.exe	111
PID 3568 set thread context of 3804	3568	svchost.exe	112
PID 3568 set thread context of 3776	3568	svchost.exe	113
PID 3568 set thread context of 3732	3568	svchost.exe	114
PID 3568 set thread context of 6100	3568	svchost.exe	115
PID 3568 set thread context of 4156	3568	svchost.exe	116
PID 3568 set thread context of 5212	3568	svchost.exe	117
PID 3568 set thread context of 5004	3568	svchost.exe	118
PID 3568 set thread context of 4064	3568	svchost.exe	119
PID 3568 set thread context of 32	3568	svchost.exe	120
PID 3568 set thread context of 116	3568	svchost.exe	121
PID 3568 set thread context of 2972	3568	svchost.exe	122
PID 3568 set thread context of 3472	3568	svchost.exe	123
PID 3568 set thread context of 3312	3568	svchost.exe	124
PID 3568 set thread context of 3092	3568	svchost.exe	125
PID 3568 set thread context of 3456	3568	svchost.exe	126
PID 3568 set thread context of 5488	3568	svchost.exe	127
PID 3568 set thread context of 2308	3568	svchost.exe	128
PID 3568 set thread context of 2868	3568	svchost.exe	129
PID 3568 set thread context of 5704	3568	svchost.exe	130
PID 3568 set thread context of 768	3568	svchost.exe	131
PID 3568 set thread context of 3040	3568	svchost.exe	132
PID 3568 set thread context of 4776	3568	svchost.exe	133
PID 3568 set thread context of 4960	3568	svchost.exe	134
PID 3568 set thread context of 5168	3568	svchost.exe	137
PID 3568 set thread context of 1064	3568	svchost.exe	138
PID 3568 set thread context of 2148	3568	svchost.exe	139
PID 3568 set thread context of 2908	3568	svchost.exe	140
PID 3568 set thread context of 1924	3568	svchost.exe	141
PID 3568 set thread context of 2520	3568	svchost.exe	143
PID 3568 set thread context of 2592	3568	svchost.exe	144
PID 3568 set thread context of 1816	3568	svchost.exe	145
PID 3568 set thread context of 3476	3568	svchost.exe	146
PID 3568 set thread context of 5672	3568	svchost.exe	147
PID 3568 set thread context of 5248	3568	svchost.exe	148
PID 3568 set thread context of 5452	3568	svchost.exe	149
PID 3568 set thread context of 2252	3568	svchost.exe	150
PID 3568 set thread context of 2548	3568	svchost.exe	151
PID 3568 set thread context of 2600	3568	svchost.exe	152
PID 3568 set thread context of 2024	3568	svchost.exe	153
PID 3568 set thread context of 3896	3568	svchost.exe	154
PID 3568 set thread context of 3200	3568	svchost.exe	155
PID 3568 set thread context of 5960	3568	svchost.exe	156
PID 3568 set thread context of 3528	3568	svchost.exe	157
PID 3568 set thread context of 1768	3568	svchost.exe	158
PID 3568 set thread context of 2708	3568	svchost.exe	159

Modifies data under HKEY_USERS 13 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe\ULSMonitor	Process not Found
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata	Process not Found
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe\ULSMonitor\ULSTagIds0 = "17110992,504928405,41816131,507286179,7202265,17110988,7153487,504928410,577889346,5804129,17962391,508368333,17962392,41484365,24262478,9179409,3462423,3702920,3700754,3965062,24262474,4297094,7153421,3462365,18716193,7153435,24262477,25036127,24262473,9179410,20502174,6308191,18407617,39125643,539756558,6104718,9179411,51475283,41185282,39389248,539756557,528570079,7202269"	Process not Found
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe\ULSMonitor\ULSCategoriesSeverities = "1329 10,940 10,941 10,942 10,943 10,940 15,1329 15,940 6,944 50,944 10,941 15,942 15,940 50,943 15,944 6,944 15,943 6,1329 50,1329 100,1329 6,941 6,942 6,944 100,940 100"	Process not Found
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesLastModified\officeclicktorun.exe_queried = "1793315024"	Process not Found
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesLastModified\officeclicktorun.exe = "Wed, 28 Oct 2026 14:27:47 GMT"	Process not Found
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe\RulesEndpoint = "https://nexusrules.officeapps.live.com/nexus/rules?Application=officeclicktorun.exe&Version=16.0.12527.20470&ClientId={C7B5A78B-B840-4E82-89C9-3B7CAB4322DF}&OSEnvironment=10&MsoAppId=37&AudienceName=Production&AudienceGroup=Production&AppVersion=16.0.12527.20470&"	Process not Found
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\MICROSOFT\OFFICE\16.0\COMMON\CLIENTTELEMETRY\RULESMETADATA\OFFICECLICKTORUN.EXE\ULSMONITOR	Process not Found
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe	Process not Found
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0	Process not Found
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common	Process not Found
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry	Process not Found
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe	Process not Found

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4804	2026-10-28_9830024199e6bed72dfbcac0e5cbc795_icedid.exe
4804	2026-10-28_9830024199e6bed72dfbcac0e5cbc795_icedid.exe
4804	2026-10-28_9830024199e6bed72dfbcac0e5cbc795_icedid.exe
4804	2026-10-28_9830024199e6bed72dfbcac0e5cbc795_icedid.exe
3568	svchost.exe
3568	svchost.exe
3568	svchost.exe
3568	svchost.exe
5468	Process not Found
5468	Process not Found
3568	svchost.exe
3568	svchost.exe
5468	Process not Found
5468	Process not Found
3568	svchost.exe
3568	svchost.exe
3568	svchost.exe
3568	svchost.exe
3568	svchost.exe
3568	svchost.exe
5468	Process not Found
5468	Process not Found
3568	svchost.exe
3568	svchost.exe
3568	svchost.exe
3568	svchost.exe
5468	Process not Found
5468	Process not Found
3568	svchost.exe
3568	svchost.exe
3568	svchost.exe
5468	Process not Found
3568	svchost.exe
5468	Process not Found
3568	svchost.exe
3568	svchost.exe
3568	svchost.exe
5468	Process not Found
5468	Process not Found
3568	svchost.exe
3568	svchost.exe
3568	svchost.exe
3568	svchost.exe
5468	Process not Found
5468	Process not Found
3568	svchost.exe
3568	svchost.exe
5468	Process not Found
5468	Process not Found
3568	svchost.exe
3568	svchost.exe
3568	svchost.exe
5468	Process not Found
5468	Process not Found
3568	svchost.exe
3568	svchost.exe
5468	Process not Found
5468	Process not Found
3568	svchost.exe
3568	svchost.exe
3568	svchost.exe
3568	svchost.exe
3568	svchost.exe
3568	svchost.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	4804	2026-10-28_9830024199e6bed72dfbcac0e5cbc795_icedid.exe
Token: SeDebugPrivilege	3568	svchost.exe
Token: SeDebugPrivilege	3568	svchost.exe
Token: SeDebugPrivilege	3568	svchost.exe
Token: SeDebugPrivilege	3568	svchost.exe
Token: SeDebugPrivilege	3568	svchost.exe
Token: SeDebugPrivilege	3568	svchost.exe
Token: SeDebugPrivilege	3568	svchost.exe
Token: SeDebugPrivilege	3568	svchost.exe
Token: SeDebugPrivilege	3568	svchost.exe
Token: SeDebugPrivilege	3568	svchost.exe
Token: SeDebugPrivilege	3568	svchost.exe
Token: SeDebugPrivilege	3568	svchost.exe
Token: SeDebugPrivilege	3568	svchost.exe
Token: SeDebugPrivilege	3568	svchost.exe
Token: SeDebugPrivilege	3568	svchost.exe
Token: SeDebugPrivilege	3568	svchost.exe
Token: SeDebugPrivilege	3568	svchost.exe
Token: SeDebugPrivilege	3568	svchost.exe
Token: SeDebugPrivilege	3568	svchost.exe
Token: SeDebugPrivilege	3568	svchost.exe
Token: SeDebugPrivilege	3568	svchost.exe
Token: SeDebugPrivilege	3568	svchost.exe
Token: SeDebugPrivilege	3568	svchost.exe
Token: SeDebugPrivilege	3568	svchost.exe
Token: SeDebugPrivilege	3568	svchost.exe
Token: SeDebugPrivilege	3568	svchost.exe
Token: SeDebugPrivilege	3568	svchost.exe
Token: SeDebugPrivilege	3568	svchost.exe
Token: SeDebugPrivilege	3568	svchost.exe
Token: SeDebugPrivilege	3568	svchost.exe
Token: SeDebugPrivilege	3568	svchost.exe
Token: SeDebugPrivilege	3568	svchost.exe
Token: SeDebugPrivilege	3568	svchost.exe
Token: SeDebugPrivilege	3568	svchost.exe
Token: SeDebugPrivilege	3568	svchost.exe
Token: SeDebugPrivilege	3568	svchost.exe
Token: SeDebugPrivilege	3568	svchost.exe
Token: SeDebugPrivilege	3568	svchost.exe
Token: SeDebugPrivilege	3568	svchost.exe
Token: SeDebugPrivilege	3568	svchost.exe
Token: SeDebugPrivilege	3568	svchost.exe
Token: SeDebugPrivilege	3568	svchost.exe
Token: SeDebugPrivilege	3568	svchost.exe
Token: SeDebugPrivilege	3568	svchost.exe
Token: SeDebugPrivilege	3568	svchost.exe
Token: SeDebugPrivilege	3568	svchost.exe
Token: SeDebugPrivilege	3568	svchost.exe
Token: SeDebugPrivilege	3568	svchost.exe
Token: SeDebugPrivilege	3568	svchost.exe
Token: SeDebugPrivilege	3568	svchost.exe
Token: SeDebugPrivilege	3568	svchost.exe
Token: SeDebugPrivilege	3568	svchost.exe
Token: SeDebugPrivilege	3568	svchost.exe
Token: SeDebugPrivilege	3568	svchost.exe
Token: SeDebugPrivilege	3568	svchost.exe
Token: SeDebugPrivilege	3568	svchost.exe
Token: SeDebugPrivilege	3568	svchost.exe
Token: SeDebugPrivilege	3568	svchost.exe
Token: SeDebugPrivilege	3568	svchost.exe
Token: SeDebugPrivilege	3568	svchost.exe
Token: SeDebugPrivilege	3568	svchost.exe
Token: SeDebugPrivilege	3568	svchost.exe
Token: SeDebugPrivilege	3568	svchost.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4804 wrote to memory of 3568	4804	2026-10-28_9830024199e6bed72dfbcac0e5cbc795_icedid.exe	84
PID 4804 wrote to memory of 3568	4804	2026-10-28_9830024199e6bed72dfbcac0e5cbc795_icedid.exe	84
PID 3568 wrote to memory of 4884	3568	svchost.exe	85
PID 3568 wrote to memory of 1180	3568	svchost.exe	86
PID 3568 wrote to memory of 1932	3568	svchost.exe	87
PID 3568 wrote to memory of 6124	3568	svchost.exe	88
PID 3568 wrote to memory of 4112	3568	svchost.exe	89
PID 3568 wrote to memory of 6028	3568	svchost.exe	90
PID 3568 wrote to memory of 4260	3568	svchost.exe	93
PID 3568 wrote to memory of 2216	3568	svchost.exe	96
PID 3568 wrote to memory of 2260	3568	svchost.exe	97
PID 3568 wrote to memory of 6036	3568	svchost.exe	98
PID 3568 wrote to memory of 2996	3568	svchost.exe	99
PID 3568 wrote to memory of 2332	3568	svchost.exe	100
PID 3568 wrote to memory of 1728	3568	svchost.exe	102
PID 3568 wrote to memory of 3764	3568	svchost.exe	103
PID 3568 wrote to memory of 2664	3568	svchost.exe	104
PID 3568 wrote to memory of 1672	3568	svchost.exe	105
PID 3568 wrote to memory of 2352	3568	svchost.exe	109
PID 3568 wrote to memory of 6136	3568	svchost.exe	110
PID 3568 wrote to memory of 1560	3568	svchost.exe	111
PID 3568 wrote to memory of 3804	3568	svchost.exe	112
PID 3568 wrote to memory of 3776	3568	svchost.exe	113
PID 3568 wrote to memory of 3732	3568	svchost.exe	114
PID 3568 wrote to memory of 6100	3568	svchost.exe	115
PID 3568 wrote to memory of 4156	3568	svchost.exe	116
PID 3568 wrote to memory of 5212	3568	svchost.exe	117
PID 3568 wrote to memory of 5004	3568	svchost.exe	118
PID 3568 wrote to memory of 4064	3568	svchost.exe	119
PID 3568 wrote to memory of 32	3568	svchost.exe	120
PID 3568 wrote to memory of 116	3568	svchost.exe	121
PID 3568 wrote to memory of 2972	3568	svchost.exe	122
PID 3568 wrote to memory of 3472	3568	svchost.exe	123
PID 3568 wrote to memory of 3312	3568	svchost.exe	124
PID 3568 wrote to memory of 3092	3568	svchost.exe	125
PID 3568 wrote to memory of 3456	3568	svchost.exe	126
PID 3568 wrote to memory of 5488	3568	svchost.exe	127
PID 3568 wrote to memory of 2308	3568	svchost.exe	128
PID 3568 wrote to memory of 2868	3568	svchost.exe	129
PID 3568 wrote to memory of 5704	3568	svchost.exe	130
PID 3568 wrote to memory of 768	3568	svchost.exe	131
PID 3568 wrote to memory of 3040	3568	svchost.exe	132
PID 3568 wrote to memory of 4776	3568	svchost.exe	133
PID 3568 wrote to memory of 4960	3568	svchost.exe	134
PID 3568 wrote to memory of 5168	3568	svchost.exe	137
PID 3568 wrote to memory of 1064	3568	svchost.exe	138
PID 3568 wrote to memory of 2148	3568	svchost.exe	139
PID 3568 wrote to memory of 2908	3568	svchost.exe	140
PID 3568 wrote to memory of 1924	3568	svchost.exe	141
PID 3568 wrote to memory of 2520	3568	svchost.exe	143
PID 3568 wrote to memory of 2592	3568	svchost.exe	144
PID 3568 wrote to memory of 1816	3568	svchost.exe	145
PID 3568 wrote to memory of 3476	3568	svchost.exe	146
PID 3568 wrote to memory of 5672	3568	svchost.exe	147
PID 3568 wrote to memory of 5248	3568	svchost.exe	148
PID 3568 wrote to memory of 5452	3568	svchost.exe	149
PID 3568 wrote to memory of 2252	3568	svchost.exe	150
PID 3568 wrote to memory of 2548	3568	svchost.exe	151
PID 3568 wrote to memory of 2600	3568	svchost.exe	152
PID 3568 wrote to memory of 2024	3568	svchost.exe	153
PID 3568 wrote to memory of 3896	3568	svchost.exe	154
PID 3568 wrote to memory of 3200	3568	svchost.exe	155
PID 3568 wrote to memory of 5960	3568	svchost.exe	156
PID 3568 wrote to memory of 3528	3568	svchost.exe	157

C:\Users\Admin\AppData\Local\Temp\2026-10-28_9830024199e6bed72dfbcac0e5cbc795_icedid.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-28_9830024199e6bed72dfbcac0e5cbc795_icedid.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4804
- C:\Windows\system32\svchost.exe
  "C:\Windows\system32\svchost.exe"
  2⤵
  - Windows security bypass
  - Loads dropped DLL
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3568
- - C:\Windows\system32\dllhost.exe
    "C:\Windows\system32\dllhost.exe"
    3⤵
    PID:4884
- - C:\Windows\system32\SearchProtocolHost.exe
    "C:\Windows\system32\SearchProtocolHost.exe"
    3⤵
    PID:1180
- - C:\Users\Admin\AppData\Roaming\windows.exe
    "C:\Users\Admin\AppData\Roaming\windows.exe"
    3⤵
    - Executes dropped EXE
    PID:1932
- - C:\Windows\system32\SearchFilterHost.exe
    "C:\Windows\system32\SearchFilterHost.exe"
    3⤵
    PID:6124
- - C:\Windows\system32\wbem\WmiPrvSE.exe
    "C:\Windows\system32\wbem\WmiPrvSE.exe"
    3⤵
    PID:4112
- - C:\Windows\system32\dllhost.exe
    "C:\Windows\system32\dllhost.exe"
    3⤵
    - Executes dropped EXE
    PID:6028
- - C:\Windows\system32\SearchProtocolHost.exe
    "C:\Windows\system32\SearchProtocolHost.exe"
    3⤵
    - Executes dropped EXE
    PID:4260
- - C:\Windows\system32\SearchFilterHost.exe
    "C:\Windows\system32\SearchFilterHost.exe"
    3⤵
    - Executes dropped EXE
    PID:2216
- - C:\Windows\system32\wbem\WmiPrvSE.exe
    "C:\Windows\system32\wbem\WmiPrvSE.exe"
    3⤵
    - Executes dropped EXE
    PID:2260
- - C:\Windows\system32\dllhost.exe
    "C:\Windows\system32\dllhost.exe"
    3⤵
    - Executes dropped EXE
    PID:6036
- - C:\Windows\system32\SearchProtocolHost.exe
    "C:\Windows\system32\SearchProtocolHost.exe"
    3⤵
    - Executes dropped EXE
    PID:2996
- - C:\Windows\system32\SearchFilterHost.exe
    "C:\Windows\system32\SearchFilterHost.exe"
    3⤵
    - Executes dropped EXE
    PID:2332
- - C:\Windows\system32\wbem\WmiPrvSE.exe
    "C:\Windows\system32\wbem\WmiPrvSE.exe"
    3⤵
    - Executes dropped EXE
    PID:1728
- - C:\Windows\system32\dllhost.exe
    "C:\Windows\system32\dllhost.exe"
    3⤵
    - Executes dropped EXE
    PID:3764
- - C:\Windows\system32\SearchProtocolHost.exe
    "C:\Windows\system32\SearchProtocolHost.exe"
    3⤵
    - Executes dropped EXE
    PID:2664
- - C:\Windows\system32\SearchFilterHost.exe
    "C:\Windows\system32\SearchFilterHost.exe"
    3⤵
    - Executes dropped EXE
    PID:1672
- - C:\Windows\system32\wbem\WmiPrvSE.exe
    "C:\Windows\system32\wbem\WmiPrvSE.exe"
    3⤵
    - Executes dropped EXE
    PID:2352
- - C:\Windows\system32\dllhost.exe
    "C:\Windows\system32\dllhost.exe"
    3⤵
    - Executes dropped EXE
    PID:6136
- - C:\Windows\system32\SearchProtocolHost.exe
    "C:\Windows\system32\SearchProtocolHost.exe"
    3⤵
    - Executes dropped EXE
    PID:1560
- - C:\Windows\system32\SearchFilterHost.exe
    "C:\Windows\system32\SearchFilterHost.exe"
    3⤵
    - Executes dropped EXE
    PID:3804
- - C:\Windows\system32\wbem\WmiPrvSE.exe
    "C:\Windows\system32\wbem\WmiPrvSE.exe"
    3⤵
    - Executes dropped EXE
    PID:3776
- - C:\Windows\system32\dllhost.exe
    "C:\Windows\system32\dllhost.exe"
    3⤵
    - Executes dropped EXE
    PID:3732
- - C:\Windows\system32\SearchProtocolHost.exe
    "C:\Windows\system32\SearchProtocolHost.exe"
    3⤵
    - Executes dropped EXE
    PID:6100
- - C:\Windows\system32\SearchFilterHost.exe
    "C:\Windows\system32\SearchFilterHost.exe"
    3⤵
    - Executes dropped EXE
    PID:4156
- - C:\Windows\system32\wbem\WmiPrvSE.exe
    "C:\Windows\system32\wbem\WmiPrvSE.exe"
    3⤵
    - Executes dropped EXE
    PID:5212
- - C:\Windows\system32\dllhost.exe
    "C:\Windows\system32\dllhost.exe"
    3⤵
    - Executes dropped EXE
    PID:5004
- - C:\Windows\system32\SearchProtocolHost.exe
    "C:\Windows\system32\SearchProtocolHost.exe"
    3⤵
    - Executes dropped EXE
    PID:4064
- - C:\Windows\system32\SearchFilterHost.exe
    "C:\Windows\system32\SearchFilterHost.exe"
    3⤵
    - Executes dropped EXE
    PID:32
- - C:\Windows\system32\wbem\WmiPrvSE.exe
    "C:\Windows\system32\wbem\WmiPrvSE.exe"
    3⤵
    - Executes dropped EXE
    PID:116
- - C:\Windows\system32\dllhost.exe
    "C:\Windows\system32\dllhost.exe"
    3⤵
    - Executes dropped EXE
    PID:2972
- - C:\Windows\system32\SearchProtocolHost.exe
    "C:\Windows\system32\SearchProtocolHost.exe"
    3⤵
    - Executes dropped EXE
    PID:3472
- - C:\Windows\system32\SearchFilterHost.exe
    "C:\Windows\system32\SearchFilterHost.exe"
    3⤵
    - Executes dropped EXE
    PID:3312
- - C:\Windows\system32\wbem\WmiPrvSE.exe
    "C:\Windows\system32\wbem\WmiPrvSE.exe"
    3⤵
    - Executes dropped EXE
    PID:3092
- - C:\Windows\system32\dllhost.exe
    "C:\Windows\system32\dllhost.exe"
    3⤵
    - Executes dropped EXE
    PID:3456
- - C:\Windows\system32\SearchProtocolHost.exe
    "C:\Windows\system32\SearchProtocolHost.exe"
    3⤵
    - Executes dropped EXE
    PID:5488
- - C:\Windows\system32\SearchFilterHost.exe
    "C:\Windows\system32\SearchFilterHost.exe"
    3⤵
    - Executes dropped EXE
    PID:2308
- - C:\Windows\system32\wbem\WmiPrvSE.exe
    "C:\Windows\system32\wbem\WmiPrvSE.exe"
    3⤵
    - Executes dropped EXE
    PID:2868
- - C:\Windows\system32\dllhost.exe
    "C:\Windows\system32\dllhost.exe"
    3⤵
    - Executes dropped EXE
    PID:5704
- - C:\Windows\system32\SearchProtocolHost.exe
    "C:\Windows\system32\SearchProtocolHost.exe"
    3⤵
    - Executes dropped EXE
    PID:768
- - C:\Windows\system32\SearchFilterHost.exe
    "C:\Windows\system32\SearchFilterHost.exe"
    3⤵
    - Executes dropped EXE
    PID:3040
- - C:\Windows\system32\wbem\WmiPrvSE.exe
    "C:\Windows\system32\wbem\WmiPrvSE.exe"
    3⤵
    - Executes dropped EXE
    PID:4776
- - C:\Windows\system32\dllhost.exe
    "C:\Windows\system32\dllhost.exe"
    3⤵
    - Executes dropped EXE
    PID:4960
- - C:\Windows\system32\SearchProtocolHost.exe
    "C:\Windows\system32\SearchProtocolHost.exe"
    3⤵
    - Executes dropped EXE
    PID:5168
- - C:\Windows\system32\SearchFilterHost.exe
    "C:\Windows\system32\SearchFilterHost.exe"
    3⤵
    - Executes dropped EXE
    PID:1064
- - C:\Windows\system32\wbem\WmiPrvSE.exe
    "C:\Windows\system32\wbem\WmiPrvSE.exe"
    3⤵
    - Executes dropped EXE
    PID:2148
- - C:\Windows\system32\dllhost.exe
    "C:\Windows\system32\dllhost.exe"
    3⤵
    - Executes dropped EXE
    PID:2908
- - C:\Windows\system32\SearchProtocolHost.exe
    "C:\Windows\system32\SearchProtocolHost.exe"
    3⤵
    - Executes dropped EXE
    PID:1924
- - C:\Windows\system32\SearchFilterHost.exe
    "C:\Windows\system32\SearchFilterHost.exe"
    3⤵
    - Executes dropped EXE
    PID:2520
- - C:\Windows\system32\wbem\WmiPrvSE.exe
    "C:\Windows\system32\wbem\WmiPrvSE.exe"
    3⤵
    - Executes dropped EXE
    PID:2592
- - C:\Windows\system32\dllhost.exe
    "C:\Windows\system32\dllhost.exe"
    3⤵
    - Executes dropped EXE
    PID:1816
- - C:\Windows\system32\SearchProtocolHost.exe
    "C:\Windows\system32\SearchProtocolHost.exe"
    3⤵
    - Executes dropped EXE
    PID:3476
- - C:\Windows\system32\SearchFilterHost.exe
    "C:\Windows\system32\SearchFilterHost.exe"
    3⤵
    - Executes dropped EXE
    PID:5672
- - C:\Windows\system32\wbem\WmiPrvSE.exe
    "C:\Windows\system32\wbem\WmiPrvSE.exe"
    3⤵
    - Executes dropped EXE
    PID:5248
- - C:\Windows\system32\dllhost.exe
    "C:\Windows\system32\dllhost.exe"
    3⤵
    - Executes dropped EXE
    PID:5452
- - C:\Windows\system32\SearchProtocolHost.exe
    "C:\Windows\system32\SearchProtocolHost.exe"
    3⤵
    - Executes dropped EXE
    PID:2252
- - C:\Windows\system32\SearchFilterHost.exe
    "C:\Windows\system32\SearchFilterHost.exe"
    3⤵
    - Executes dropped EXE
    PID:2548
- - C:\Windows\system32\wbem\WmiPrvSE.exe
    "C:\Windows\system32\wbem\WmiPrvSE.exe"
    3⤵
    - Executes dropped EXE
    PID:2600
- - C:\Windows\system32\dllhost.exe
    "C:\Windows\system32\dllhost.exe"
    3⤵
    - Executes dropped EXE
    PID:2024
- - C:\Windows\system32\SearchProtocolHost.exe
    "C:\Windows\system32\SearchProtocolHost.exe"
    3⤵
    - Executes dropped EXE
    PID:3896
- - C:\Windows\system32\SearchFilterHost.exe
    "C:\Windows\system32\SearchFilterHost.exe"
    3⤵
    - Executes dropped EXE
    PID:3200
- - C:\Windows\system32\wbem\WmiPrvSE.exe
    "C:\Windows\system32\wbem\WmiPrvSE.exe"
    3⤵
    - Executes dropped EXE
    PID:5960
- - C:\Windows\system32\dllhost.exe
    "C:\Windows\system32\dllhost.exe"
    3⤵
    - Executes dropped EXE
    PID:3528
- - C:\Windows\system32\SearchProtocolHost.exe
    "C:\Windows\system32\SearchProtocolHost.exe"
    3⤵
    - Executes dropped EXE
    PID:1768
- - C:\Windows\system32\SearchFilterHost.exe
    "C:\Windows\system32\SearchFilterHost.exe"
    3⤵
    - Executes dropped EXE
    PID:2708
- - C:\Windows\system32\wbem\WmiPrvSE.exe
    "C:\Windows\system32\wbem\WmiPrvSE.exe"
    3⤵
    - Executes dropped EXE
    PID:5620
- - C:\Windows\system32\dllhost.exe
    "C:\Windows\system32\dllhost.exe"
    3⤵
    - Executes dropped EXE
    PID:2920
- - C:\Windows\system32\SearchProtocolHost.exe
    "C:\Windows\system32\SearchProtocolHost.exe"
    3⤵
    - Executes dropped EXE
    PID:796
- - C:\Windows\system32\SearchFilterHost.exe
    "C:\Windows\system32\SearchFilterHost.exe"
    3⤵
    PID:4012
- - C:\Windows\system32\wbem\WmiPrvSE.exe
    "C:\Windows\system32\wbem\WmiPrvSE.exe"
    3⤵
    PID:6032
- - C:\Windows\system32\dllhost.exe
    "C:\Windows\system32\dllhost.exe"
    3⤵
    PID:2396
- - C:\Windows\system32\SearchProtocolHost.exe
    "C:\Windows\system32\SearchProtocolHost.exe"
    3⤵
    PID:4504
- - C:\Windows\system32\SearchFilterHost.exe
    "C:\Windows\system32\SearchFilterHost.exe"
    3⤵
    PID:4940
- - C:\Windows\system32\wbem\WmiPrvSE.exe
    "C:\Windows\system32\wbem\WmiPrvSE.exe"
    3⤵
    PID:4620
- - C:\Windows\system32\dllhost.exe
    "C:\Windows\system32\dllhost.exe"
    3⤵
    PID:5100
- - C:\Windows\system32\SearchProtocolHost.exe
    "C:\Windows\system32\SearchProtocolHost.exe"
    3⤵
    PID:4520
- - C:\Windows\system32\SearchFilterHost.exe
    "C:\Windows\system32\SearchFilterHost.exe"
    3⤵
    PID:824
- - C:\Windows\system32\wbem\WmiPrvSE.exe
    "C:\Windows\system32\wbem\WmiPrvSE.exe"
    3⤵
    PID:4628
- - C:\Windows\system32\dllhost.exe
    "C:\Windows\system32\dllhost.exe"
    3⤵
    PID:4876
- - C:\Windows\system32\SearchProtocolHost.exe
    "C:\Windows\system32\SearchProtocolHost.exe"
    3⤵
    PID:4212
- - C:\Windows\system32\SearchFilterHost.exe
    "C:\Windows\system32\SearchFilterHost.exe"
    3⤵
    PID:4268
- - C:\Windows\system32\wbem\WmiPrvSE.exe
    "C:\Windows\system32\wbem\WmiPrvSE.exe"
    3⤵
    PID:4856
- - C:\Windows\system32\dllhost.exe
    "C:\Windows\system32\dllhost.exe"
    3⤵
    PID:4748
- - C:\Windows\system32\SearchProtocolHost.exe
    "C:\Windows\system32\SearchProtocolHost.exe"
    3⤵
    PID:4848
- - C:\Windows\system32\SearchFilterHost.exe
    "C:\Windows\system32\SearchFilterHost.exe"
    3⤵
    PID:4884
- - C:\Windows\system32\wbem\WmiPrvSE.exe
    "C:\Windows\system32\wbem\WmiPrvSE.exe"
    3⤵
    PID:4900
- - C:\Windows\system32\dllhost.exe
    "C:\Windows\system32\dllhost.exe"
    3⤵
    PID:5236
- - C:\Windows\system32\SearchProtocolHost.exe
    "C:\Windows\system32\SearchProtocolHost.exe"
    3⤵
    PID:4420
- - C:\Windows\system32\SearchFilterHost.exe
    "C:\Windows\system32\SearchFilterHost.exe"
    3⤵
    PID:3132
- - C:\Windows\system32\wbem\WmiPrvSE.exe
    "C:\Windows\system32\wbem\WmiPrvSE.exe"
    3⤵
    PID:3792
- - C:\Windows\system32\dllhost.exe
    "C:\Windows\system32\dllhost.exe"
    3⤵
    PID:1632
- - C:\Windows\system32\SearchProtocolHost.exe
    "C:\Windows\system32\SearchProtocolHost.exe"
    3⤵
    PID:5936
- - C:\Windows\system32\SearchFilterHost.exe
    "C:\Windows\system32\SearchFilterHost.exe"
    3⤵
    PID:1956
- - C:\Windows\system32\wbem\WmiPrvSE.exe
    "C:\Windows\system32\wbem\WmiPrvSE.exe"
    3⤵
    PID:1152
- - C:\Windows\system32\dllhost.exe
    "C:\Windows\system32\dllhost.exe"
    3⤵
    PID:4916
- - C:\Windows\system32\SearchProtocolHost.exe
    "C:\Windows\system32\SearchProtocolHost.exe"
    3⤵
    PID:2388
- - C:\Windows\system32\SearchFilterHost.exe
    "C:\Windows\system32\SearchFilterHost.exe"
    3⤵
    PID:4976
- - C:\Windows\system32\wbem\WmiPrvSE.exe
    "C:\Windows\system32\wbem\WmiPrvSE.exe"
    3⤵
    PID:3268
- - C:\Windows\system32\dllhost.exe
    "C:\Windows\system32\dllhost.exe"
    3⤵
    PID:5396
- - C:\Windows\system32\SearchProtocolHost.exe
    "C:\Windows\system32\SearchProtocolHost.exe"
    3⤵
    PID:5332
- - C:\Windows\system32\SearchFilterHost.exe
    "C:\Windows\system32\SearchFilterHost.exe"
    3⤵
    PID:772
- - C:\Windows\system32\wbem\WmiPrvSE.exe
    "C:\Windows\system32\wbem\WmiPrvSE.exe"
    3⤵
    PID:1500
- - C:\Windows\system32\dllhost.exe
    "C:\Windows\system32\dllhost.exe"
    3⤵
    PID:6064
- - C:\Windows\system32\SearchProtocolHost.exe
    "C:\Windows\system32\SearchProtocolHost.exe"
    3⤵
    PID:1252
- - C:\Windows\system32\SearchFilterHost.exe
    "C:\Windows\system32\SearchFilterHost.exe"
    3⤵
    PID:4028
- - C:\Windows\system32\wbem\WmiPrvSE.exe
    "C:\Windows\system32\wbem\WmiPrvSE.exe"
    3⤵
    PID:912
- - C:\Windows\system32\dllhost.exe
    "C:\Windows\system32\dllhost.exe"
    3⤵
    PID:3704
- - C:\Windows\system32\SearchProtocolHost.exe
    "C:\Windows\system32\SearchProtocolHost.exe"
    3⤵
    PID:5660
- - C:\Windows\system32\SearchFilterHost.exe
    "C:\Windows\system32\SearchFilterHost.exe"
    3⤵
    PID:4984
- - C:\Windows\system32\wbem\WmiPrvSE.exe
    "C:\Windows\system32\wbem\WmiPrvSE.exe"
    3⤵
    PID:4968
- - C:\Windows\system32\dllhost.exe
    "C:\Windows\system32\dllhost.exe"
    3⤵
    PID:436
- - C:\Windows\system32\SearchProtocolHost.exe
    "C:\Windows\system32\SearchProtocolHost.exe"
    3⤵
    PID:5940
- - C:\Windows\system32\SearchFilterHost.exe
    "C:\Windows\system32\SearchFilterHost.exe"
    3⤵
    PID:4456
- - C:\Windows\system32\wbem\WmiPrvSE.exe
    "C:\Windows\system32\wbem\WmiPrvSE.exe"
    3⤵
    PID:1248
- - C:\Windows\system32\dllhost.exe
    "C:\Windows\system32\dllhost.exe"
    3⤵
    PID:2532
- - C:\Windows\system32\SearchProtocolHost.exe
    "C:\Windows\system32\SearchProtocolHost.exe"
    3⤵
    PID:6036
- - C:\Windows\system32\SearchFilterHost.exe
    "C:\Windows\system32\SearchFilterHost.exe"
    3⤵
    PID:3984
- - C:\Windows\system32\wbem\WmiPrvSE.exe
    "C:\Windows\system32\wbem\WmiPrvSE.exe"
    3⤵
    PID:720
- - C:\Windows\system32\dllhost.exe
    "C:\Windows\system32\dllhost.exe"
    3⤵
    PID:5008
- - C:\Windows\system32\SearchProtocolHost.exe
    "C:\Windows\system32\SearchProtocolHost.exe"
    3⤵
    PID:2036
- - C:\Windows\system32\SearchFilterHost.exe
    "C:\Windows\system32\SearchFilterHost.exe"
    3⤵
    PID:4784
- - C:\Windows\system32\wbem\WmiPrvSE.exe
    "C:\Windows\system32\wbem\WmiPrvSE.exe"
    3⤵
    PID:3764
- - C:\Windows\system32\dllhost.exe
    "C:\Windows\system32\dllhost.exe"
    3⤵
    PID:1416
- - C:\Windows\system32\SearchProtocolHost.exe
    "C:\Windows\system32\SearchProtocolHost.exe"
    3⤵
    PID:2664
- - C:\Windows\system32\SearchFilterHost.exe
    "C:\Windows\system32\SearchFilterHost.exe"
    3⤵
    PID:1652
- - C:\Windows\system32\wbem\WmiPrvSE.exe
    "C:\Windows\system32\wbem\WmiPrvSE.exe"
    3⤵
    PID:464
- - C:\Windows\system32\dllhost.exe
    "C:\Windows\system32\dllhost.exe"
    3⤵
    PID:2372
- - C:\Windows\system32\SearchProtocolHost.exe
    "C:\Windows\system32\SearchProtocolHost.exe"
    3⤵
    PID:1868
- - C:\Windows\system32\SearchFilterHost.exe
    "C:\Windows\system32\SearchFilterHost.exe"
    3⤵
    PID:2352
- - C:\Windows\system32\wbem\WmiPrvSE.exe
    "C:\Windows\system32\wbem\WmiPrvSE.exe"
    3⤵
    PID:2320
- - C:\Windows\system32\dllhost.exe
    "C:\Windows\system32\dllhost.exe"
    3⤵
    PID:3808
- - C:\Windows\system32\SearchProtocolHost.exe
    "C:\Windows\system32\SearchProtocolHost.exe"
    3⤵
    PID:1560
- - C:\Windows\system32\SearchFilterHost.exe
    "C:\Windows\system32\SearchFilterHost.exe"
    3⤵
    PID:2160
- - C:\Windows\system32\wbem\WmiPrvSE.exe
    "C:\Windows\system32\wbem\WmiPrvSE.exe"
    3⤵
    PID:3204
- - C:\Windows\system32\dllhost.exe
    "C:\Windows\system32\dllhost.exe"
    3⤵
    PID:312
- - C:\Windows\system32\SearchProtocolHost.exe
    "C:\Windows\system32\SearchProtocolHost.exe"
    3⤵
    PID:5264
- - C:\Windows\system32\SearchFilterHost.exe
    "C:\Windows\system32\SearchFilterHost.exe"
    3⤵
    PID:2276
- - C:\Windows\system32\wbem\WmiPrvSE.exe
    "C:\Windows\system32\wbem\WmiPrvSE.exe"
    3⤵
    PID:5244
- - C:\Windows\system32\dllhost.exe
    "C:\Windows\system32\dllhost.exe"
    3⤵
    PID:1376
- - C:\Windows\system32\SearchProtocolHost.exe
    "C:\Windows\system32\SearchProtocolHost.exe"
    3⤵
    PID:1548
- - C:\Users\Admin\AppData\Roaming\windows.exe
    "C:\Users\Admin\AppData\Roaming\windows.exe"
    3⤵
    PID:5792
- - C:\Windows\system32\SearchFilterHost.exe
    "C:\Windows\system32\SearchFilterHost.exe"
    3⤵
    PID:5212
- - C:\Windows\system32\wbem\WmiPrvSE.exe
    "C:\Windows\system32\wbem\WmiPrvSE.exe"
    3⤵
    PID:1336
- - C:\Windows\system32\dllhost.exe
    "C:\Windows\system32\dllhost.exe"
    3⤵
    PID:5564
- - C:\Windows\system32\SearchProtocolHost.exe
    "C:\Windows\system32\SearchProtocolHost.exe"
    3⤵
    PID:212
- - C:\Windows\system32\SearchFilterHost.exe
    "C:\Windows\system32\SearchFilterHost.exe"
    3⤵
    PID:2724
- - C:\Windows\system32\wbem\WmiPrvSE.exe
    "C:\Windows\system32\wbem\WmiPrvSE.exe"
    3⤵
    PID:204
- - C:\Windows\system32\dllhost.exe
    "C:\Windows\system32\dllhost.exe"
    3⤵
    PID:4032
- - C:\Windows\system32\SearchProtocolHost.exe
    "C:\Windows\system32\SearchProtocolHost.exe"
    3⤵
    PID:116
- - C:\Windows\system32\SearchFilterHost.exe
    "C:\Windows\system32\SearchFilterHost.exe"
    3⤵
    PID:2904
- - C:\Windows\system32\wbem\WmiPrvSE.exe
    "C:\Windows\system32\wbem\WmiPrvSE.exe"
    3⤵
    PID:2472
- - C:\Windows\system32\dllhost.exe
    "C:\Windows\system32\dllhost.exe"
    3⤵
    PID:3472
- - C:\Windows\system32\SearchProtocolHost.exe
    "C:\Windows\system32\SearchProtocolHost.exe"
    3⤵
    PID:5320
- - C:\Windows\system32\SearchFilterHost.exe
    "C:\Windows\system32\SearchFilterHost.exe"
    3⤵
    PID:2916
- - C:\Windows\system32\wbem\WmiPrvSE.exe
    "C:\Windows\system32\wbem\WmiPrvSE.exe"
    3⤵
    PID:3304
- - C:\Windows\system32\dllhost.exe
    "C:\Windows\system32\dllhost.exe"
    3⤵
    PID:5568
- - C:\Windows\system32\SearchProtocolHost.exe
    "C:\Windows\system32\SearchProtocolHost.exe"
    3⤵
    PID:2348
- - C:\Windows\system32\SearchFilterHost.exe
    "C:\Windows\system32\SearchFilterHost.exe"
    3⤵
    PID:2308
- - C:\Windows\system32\wbem\WmiPrvSE.exe
    "C:\Windows\system32\wbem\WmiPrvSE.exe"
    3⤵
    PID:940
- - C:\Windows\system32\dllhost.exe
    "C:\Windows\system32\dllhost.exe"
    3⤵
    PID:5704
- - C:\Windows\system32\SearchProtocolHost.exe
    "C:\Windows\system32\SearchProtocolHost.exe"
    3⤵
    PID:768
- - C:\Windows\system32\SearchFilterHost.exe
    "C:\Windows\system32\SearchFilterHost.exe"
    3⤵
    PID:3040
- - C:\Windows\system32\wbem\WmiPrvSE.exe
    "C:\Windows\system32\wbem\WmiPrvSE.exe"
    3⤵
    PID:4776
- - C:\Windows\system32\dllhost.exe
    "C:\Windows\system32\dllhost.exe"
    3⤵
    PID:4960
- - C:\Windows\system32\SearchProtocolHost.exe
    "C:\Windows\system32\SearchProtocolHost.exe"
    3⤵
    PID:4832
- - C:\Windows\system32\SearchFilterHost.exe
    "C:\Windows\system32\SearchFilterHost.exe"
    3⤵
    PID:2076
- - C:\Windows\system32\wbem\WmiPrvSE.exe
    "C:\Windows\system32\wbem\WmiPrvSE.exe"
    3⤵
    PID:5924
- - C:\Windows\system32\dllhost.exe
    "C:\Windows\system32\dllhost.exe"
    3⤵
    PID:5300
- - C:\Windows\system32\SearchProtocolHost.exe
    "C:\Windows\system32\SearchProtocolHost.exe"
    3⤵
    PID:5168
- - C:\Windows\system32\SearchFilterHost.exe
    "C:\Windows\system32\SearchFilterHost.exe"
    3⤵
    PID:1144
- - C:\Windows\system32\wbem\WmiPrvSE.exe
    "C:\Windows\system32\wbem\WmiPrvSE.exe"
    3⤵
    PID:1184
- - C:\Windows\system32\dllhost.exe
    "C:\Windows\system32\dllhost.exe"
    3⤵
    PID:2632
- - C:\Windows\system32\SearchProtocolHost.exe
    "C:\Windows\system32\SearchProtocolHost.exe"
    3⤵
    PID:2400
- - C:\Windows\system32\SearchFilterHost.exe
    "C:\Windows\system32\SearchFilterHost.exe"
    3⤵
    PID:700
- - C:\Windows\system32\wbem\WmiPrvSE.exe
    "C:\Windows\system32\wbem\WmiPrvSE.exe"
    3⤵
    PID:832
- - C:\Windows\system32\dllhost.exe
    "C:\Windows\system32\dllhost.exe"
    3⤵
    PID:3884
- - C:\Windows\system32\SearchProtocolHost.exe
    "C:\Windows\system32\SearchProtocolHost.exe"
    3⤵
    PID:5216
- - C:\Windows\system32\SearchFilterHost.exe
    "C:\Windows\system32\SearchFilterHost.exe"
    3⤵
    PID:2728
- - C:\Windows\system32\wbem\WmiPrvSE.exe
    "C:\Windows\system32\wbem\WmiPrvSE.exe"
    3⤵
    PID:828
- - C:\Windows\system32\dllhost.exe
    "C:\Windows\system32\dllhost.exe"
    3⤵
    PID:5240
- - C:\Windows\system32\SearchProtocolHost.exe
    "C:\Windows\system32\SearchProtocolHost.exe"
    3⤵
    PID:5308
- - C:\Windows\system32\SearchFilterHost.exe
    "C:\Windows\system32\SearchFilterHost.exe"
    3⤵
    PID:1816
- - C:\Windows\system32\wbem\WmiPrvSE.exe
    "C:\Windows\system32\wbem\WmiPrvSE.exe"
    3⤵
    PID:5592
- - C:\Windows\system32\dllhost.exe
    "C:\Windows\system32\dllhost.exe"
    3⤵
    PID:3476
- - C:\Windows\system32\SearchProtocolHost.exe
    "C:\Windows\system32\SearchProtocolHost.exe"
    3⤵
    PID:5072
- - C:\Windows\system32\SearchFilterHost.exe
    "C:\Windows\system32\SearchFilterHost.exe"
    3⤵
    PID:5696
- - C:\Windows\system32\wbem\WmiPrvSE.exe
    "C:\Windows\system32\wbem\WmiPrvSE.exe"
    3⤵
    PID:1772
- - C:\Windows\system32\dllhost.exe
    "C:\Windows\system32\dllhost.exe"
    3⤵
    PID:6012
- - C:\Windows\system32\SearchProtocolHost.exe
    "C:\Windows\system32\SearchProtocolHost.exe"
    3⤵
    PID:2252
- - C:\Windows\system32\SearchFilterHost.exe
    "C:\Windows\system32\SearchFilterHost.exe"
    3⤵
    PID:2196
- - C:\Windows\system32\wbem\WmiPrvSE.exe
    "C:\Windows\system32\wbem\WmiPrvSE.exe"
    3⤵
    PID:2244
- - C:\Windows\system32\dllhost.exe
    "C:\Windows\system32\dllhost.exe"
    3⤵
    PID:5324
- - C:\Windows\system32\SearchProtocolHost.exe
    "C:\Windows\system32\SearchProtocolHost.exe"
    3⤵
    PID:400
- - C:\Windows\system32\SearchFilterHost.exe
    "C:\Windows\system32\SearchFilterHost.exe"
    3⤵
    PID:3280
- - C:\Windows\system32\wbem\WmiPrvSE.exe
    "C:\Windows\system32\wbem\WmiPrvSE.exe"
    3⤵
    PID:1100
- - C:\Windows\system32\dllhost.exe
    "C:\Windows\system32\dllhost.exe"
    3⤵
    PID:3188
- - C:\Windows\system32\SearchProtocolHost.exe
    "C:\Windows\system32\SearchProtocolHost.exe"
    3⤵
    PID:1944
- - C:\Windows\system32\SearchFilterHost.exe
    "C:\Windows\system32\SearchFilterHost.exe"
    3⤵
    PID:4368
- - C:\Windows\system32\wbem\WmiPrvSE.exe
    "C:\Windows\system32\wbem\WmiPrvSE.exe"
    3⤵
    PID:3012
- - C:\Windows\system32\dllhost.exe
    "C:\Windows\system32\dllhost.exe"
    3⤵
    PID:3876
- - C:\Windows\system32\SearchProtocolHost.exe
    "C:\Windows\system32\SearchProtocolHost.exe"
    3⤵
    PID:4480
- - C:\Windows\system32\SearchFilterHost.exe
    "C:\Windows\system32\SearchFilterHost.exe"
    3⤵
    PID:5596
- - C:\Windows\system32\wbem\WmiPrvSE.exe
    "C:\Windows\system32\wbem\WmiPrvSE.exe"
    3⤵
    PID:2636
- - C:\Windows\system32\dllhost.exe
    "C:\Windows\system32\dllhost.exe"
    3⤵
    PID:4816
- - C:\Windows\system32\SearchProtocolHost.exe
    "C:\Windows\system32\SearchProtocolHost.exe"
    3⤵
    PID:4332
- - C:\Windows\system32\SearchFilterHost.exe
    "C:\Windows\system32\SearchFilterHost.exe"
    3⤵
    PID:4828
- - C:\Windows\system32\wbem\WmiPrvSE.exe
    "C:\Windows\system32\wbem\WmiPrvSE.exe"
    3⤵
    PID:4060
- - C:\Windows\system32\dllhost.exe
    "C:\Windows\system32\dllhost.exe"
    3⤵
    PID:4508
- - C:\Windows\system32\SearchProtocolHost.exe
    "C:\Windows\system32\SearchProtocolHost.exe"
    3⤵
    PID:4616
- - C:\Windows\system32\SearchFilterHost.exe
    "C:\Windows\system32\SearchFilterHost.exe"
    3⤵
    PID:4944
- - C:\Windows\system32\wbem\WmiPrvSE.exe
    "C:\Windows\system32\wbem\WmiPrvSE.exe"
    3⤵
    PID:4444
- - C:\Windows\system32\dllhost.exe
    "C:\Windows\system32\dllhost.exe"
    3⤵
    PID:4412
- - C:\Windows\system32\SearchProtocolHost.exe
    "C:\Windows\system32\SearchProtocolHost.exe"
    3⤵
    PID:4212
- - C:\Windows\system32\SearchFilterHost.exe
    "C:\Windows\system32\SearchFilterHost.exe"
    3⤵
    PID:4268
- - C:\Windows\system32\wbem\WmiPrvSE.exe
    "C:\Windows\system32\wbem\WmiPrvSE.exe"
    3⤵
    PID:4856
- - C:\Windows\system32\dllhost.exe
    "C:\Windows\system32\dllhost.exe"
    3⤵
    PID:3552
- - C:\Windows\system32\SearchProtocolHost.exe
    "C:\Windows\system32\SearchProtocolHost.exe"
    3⤵
    PID:4848
- - C:\Windows\system32\SearchFilterHost.exe
    "C:\Windows\system32\SearchFilterHost.exe"
    3⤵
    PID:4884
- - C:\Windows\system32\wbem\WmiPrvSE.exe
    "C:\Windows\system32\wbem\WmiPrvSE.exe"
    3⤵
    PID:4900
- - C:\Windows\system32\dllhost.exe
    "C:\Windows\system32\dllhost.exe"
    3⤵
    PID:5236
- - C:\Windows\system32\SearchProtocolHost.exe
    "C:\Windows\system32\SearchProtocolHost.exe"
    3⤵
    PID:4276
- - C:\Windows\system32\SearchFilterHost.exe
    "C:\Windows\system32\SearchFilterHost.exe"
    3⤵
    PID:3452
- - C:\Windows\system32\wbem\WmiPrvSE.exe
    "C:\Windows\system32\wbem\WmiPrvSE.exe"
    3⤵
    PID:3132
- - C:\Windows\system32\dllhost.exe
    "C:\Windows\system32\dllhost.exe"
    3⤵
    PID:2084
- - C:\Windows\system32\SearchProtocolHost.exe
    "C:\Windows\system32\SearchProtocolHost.exe"
    3⤵
    PID:1724

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Debugger Evasion

T1622

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Debugger Evasion

T1622

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

windows.exe

Path C:\Users\Admin\AppData\Local\Microsoft\windowss\windows.exe
Size 56KB
SHA256 643ec58e82e0272c97c2a59f6020970d881af19c0ad5029db9c958c13b6558c7
MD5 f586835082f632dc8d9404d83bc16316
SHA1 010db07461e45b41c886192df6fd425ba8d42d82
SHA512 4a76272011aa2ef210de6e54ccf2b3d8068dfce8a741256562f2423048d94381d6f30ab47d88c37175fb3c7f6efb08bbd8bd8501789cf4e5bb1dff2455be2425
SSDEEP 768:DPLnVeJ+4jnLejsSOQ3DOIKBL4DbNHeDA/YCN8HVvWc9w3Y1P6j3w:DDVeHnLejsT9k1HeGYbVWc9w3gP6jw
TLSH
T1C5436C1FA2E870D0E47AC27499B28249B97175312B11AAFF15E0D1384F72BD0EB39F95
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

windows.cfg

Path C:\Users\Admin\AppData\Roaming\windows.cfg
Size 43B
SHA256 60ac9f39ba94a6aa7a72586c25cd432a6161d6728ec224dc00a2569c028c274d
MD5 0b7ea5b5bf30d3c601612a4d416ff947
SHA1 94a2329dcfa1e3dbf5f4510d5275afb28fa0048e
SHA512 646d5af14ac12f321d75830adacc71c6c28c1db9d17a5a59a6925322c6f421ee7c567e22692b4eeb2ff3a62fcb52f8a6f6d5655e6c7f37c2074148c303ab7269
MD5 SHA1 SHA512

Submit Download

windows.dll

Path C:\Users\Admin\AppData\Roaming\windows.dll
Size 93KB
SHA256 bcbbd446b5ca98b8babf2808781eba934b62dee37a81f112c4df3e6d780a0abc
MD5 d529a92956d42a9eebec37f7fb00c1c6
SHA1 e08487e216b925c0e822134d326fbe58d90b6424
SHA512 7cdb461f7b0596f1623d62fbd4525595894c9a57a542be7e16f60b86c6b347aecbc2a084f5c527afc527638de5c707a27d539bc6e6bad6fc40ee258a0830e5a6
SSDEEP 1536:8MwCyeooqYejRxjtjSzXZ05NPYvwHg5yQMRPH6l1FVl1t9Ndt9Ndtn8GWk/PZgls:8MwbeooBejR7SzJKNQYAvl1FVl1t9Nd
TLSH
T173935B57EF6550ABC455E478C8174A26EBB3F8210301A3DF46E0895A8F577E2BE3C603
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1180-74-0x00007FFDE8330000-0x00007FFDE8525000-memory.dmp

Download

memory/2216-90-0x00007FF6A0760000-0x00007FF6A0771000-memory.dmp

Download

memory/2260-94-0x00007FF6A0760000-0x00007FF6A0771000-memory.dmp

Download

memory/2996-103-0x00007FF6A0760000-0x00007FF6A0771000-memory.dmp

Download

memory/3568-17-0x0000000140000000-0x00000001408EB000-memory.dmp

Download

memory/3568-1-0x0000000140000000-0x00000001408EB000-memory.dmp

Download

memory/3568-10-0x0000000140000000-0x00000001408EB000-memory.dmp

Download

memory/3568-6-0x0000000140000000-0x00000001408EB000-memory.dmp

Download

memory/3568-9-0x0000000140000000-0x00000001408EB000-memory.dmp

Download

memory/3568-7-0x0000000140000000-0x00000001408EB000-memory.dmp

Download

memory/3568-8-0x0000000140000000-0x00000001408EB000-memory.dmp

Download

memory/4112-78-0x00007FF7B1B40000-0x00007FF7B1B51000-memory.dmp

Download

memory/4260-86-0x00007FF6A0760000-0x00007FF6A0771000-memory.dmp

Download

memory/4884-20-0x00007FF7B1B40000-0x00007FF7B1B51000-memory.dmp

Download

memory/5468-54-0x000002207B090000-0x000002207B091000-memory.dmp

Download

memory/5468-25-0x000002207AEC0000-0x000002207AEC1000-memory.dmp

Download

memory/5468-55-0x000002207B0A0000-0x000002207B0A1000-memory.dmp

Download

memory/5468-57-0x000002207B0C0000-0x000002207B0C1000-memory.dmp

Download

memory/5468-53-0x000002207B080000-0x000002207B081000-memory.dmp

Download

memory/5468-52-0x000002207B070000-0x000002207B071000-memory.dmp

Download

memory/5468-51-0x000002207B060000-0x000002207B061000-memory.dmp

Download

memory/5468-50-0x000002207B050000-0x000002207B051000-memory.dmp

Download

memory/5468-49-0x000002207B040000-0x000002207B041000-memory.dmp

Download

memory/5468-48-0x000002207B030000-0x000002207B031000-memory.dmp

Download

memory/5468-47-0x000002207B020000-0x000002207B021000-memory.dmp

Download

memory/5468-46-0x000002207B010000-0x000002207B011000-memory.dmp

Download

memory/5468-45-0x000002207B000000-0x000002207B001000-memory.dmp

Download

memory/5468-44-0x000002207AFF0000-0x000002207AFF1000-memory.dmp

Download

memory/5468-43-0x000002207AFE0000-0x000002207AFE1000-memory.dmp

Download

memory/5468-42-0x000002207AFD0000-0x000002207AFD1000-memory.dmp

Download

memory/5468-41-0x000002207AFC0000-0x000002207AFC1000-memory.dmp

Download

memory/5468-40-0x000002207AFB0000-0x000002207AFB1000-memory.dmp

Download

memory/5468-39-0x000002207AFA0000-0x000002207AFA1000-memory.dmp

Download

memory/5468-38-0x000002207AF90000-0x000002207AF91000-memory.dmp

Download

memory/5468-37-0x000002207AF80000-0x000002207AF81000-memory.dmp

Download

memory/5468-35-0x000002207AF60000-0x000002207AF61000-memory.dmp

Download

memory/5468-34-0x000002207AF50000-0x000002207AF51000-memory.dmp

Download

memory/5468-33-0x000002207AF40000-0x000002207AF41000-memory.dmp

Download

memory/5468-32-0x000002207AF30000-0x000002207AF31000-memory.dmp

Download

memory/5468-31-0x000002207AF20000-0x000002207AF21000-memory.dmp

Download

memory/5468-30-0x000002207AF10000-0x000002207AF11000-memory.dmp

Download

memory/5468-29-0x000002207AF00000-0x000002207AF01000-memory.dmp

Download

memory/5468-28-0x000002207AEF0000-0x000002207AEF1000-memory.dmp

Download

memory/5468-27-0x000002207AEE0000-0x000002207AEE1000-memory.dmp

Download

memory/5468-26-0x000002207AED0000-0x000002207AED1000-memory.dmp

Download

memory/5468-56-0x000002207B0B0000-0x000002207B0B1000-memory.dmp

Download

memory/5468-24-0x000002207AEB0000-0x000002207AEB1000-memory.dmp

Download

memory/5468-23-0x000002207AEA0000-0x000002207AEA1000-memory.dmp

Download

memory/5468-22-0x000002207AE90000-0x000002207AE91000-memory.dmp

Download

memory/5468-58-0x000002207B0D0000-0x000002207B0D1000-memory.dmp

Download

memory/5468-59-0x000002207B0E0000-0x000002207B0E1000-memory.dmp

Download

memory/5468-60-0x000002207B0F0000-0x000002207B0F1000-memory.dmp

Download

memory/5468-61-0x000002207B100000-0x000002207B101000-memory.dmp

Download

memory/5468-62-0x00007FFDE83CD000-0x00007FFDE83CE000-memory.dmp

Download

memory/5468-63-0x000002207B110000-0x000002207B111000-memory.dmp

Download

memory/5468-336-0x00007FFDDE400000-0x00007FFDDE422000-memory.dmp

Download

memory/5468-64-0x000002207B120000-0x000002207B121000-memory.dmp

Download

memory/5468-319-0x00007FFDDE400000-0x00007FFDDE422000-memory.dmp

Download

memory/5468-65-0x000002207B130000-0x000002207B131000-memory.dmp

Download

memory/5468-67-0x000002207B150000-0x000002207B151000-memory.dmp

Download

memory/5468-66-0x000002207B140000-0x000002207B141000-memory.dmp

Download

memory/5468-98-0x00007FFDE83CD000-0x00007FFDE83CE000-memory.dmp

Download

memory/5468-303-0x00007FFDDE400000-0x00007FFDDE422000-memory.dmp

Download

memory/5468-36-0x000002207AF70000-0x000002207AF71000-memory.dmp

Download

memory/5468-113-0x00007FFDDE400000-0x00007FFDDE422000-memory.dmp

Download

memory/5468-287-0x00007FFDDE400000-0x00007FFDDE422000-memory.dmp

Download

memory/5468-157-0x00007FFDDE400000-0x00007FFDDE422000-memory.dmp

Download

memory/5468-187-0x00007FFDDE400000-0x00007FFDDE422000-memory.dmp

Download

memory/5468-206-0x00007FFDDE400000-0x00007FFDDE422000-memory.dmp

Download

memory/5468-222-0x00007FFDDE400000-0x00007FFDDE422000-memory.dmp

Download

memory/5468-237-0x00007FFDDE400000-0x00007FFDDE422000-memory.dmp

Download

memory/5468-253-0x00007FFDDE400000-0x00007FFDDE422000-memory.dmp

Download

memory/5468-270-0x00007FFDDE400000-0x00007FFDDE422000-memory.dmp

Download

memory/6028-82-0x00007FF6A0760000-0x00007FF6A0771000-memory.dmp

Download

memory/6036-266-0x00007FFDE8330000-0x00007FFDE8525000-memory.dmp

Download

memory/6036-144-0x00007FFDE8330000-0x00007FFDE8525000-memory.dmp

Download

memory/6036-99-0x00007FFDE8330000-0x00007FFDE8525000-memory.dmp

Download

memory/6124-77-0x00007FF7B1B40000-0x00007FF7B1B51000-memory.dmp

Download