hxxps://download[.]newrelic[.]com/install/newrelic-cli/scripts/install[.]ps1

Analysis

max time kernel
243s
max time network
244s
platform
windows10-2004_x64
resource
win10v2004-20231020-en
resource tags

arch:x64arch:x86image:win10v2004-20231020-enlocale:en-usos:windows10-2004-x64system
submitted
31/10/2023, 13:36

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

https://download.newrelic.com/install/newrelic-cli/scripts/install.ps1

Score

10^/10

Malware Config

Extracted

Language

ps1

Source

URLs

ps1.dropper

https://download.newrelic.com/install/newrelic-cli/currentVersion.txt

Signatures

Blocklisted process makes network request 1 IoCs

flow	pid	Process
116	5348	powershell.exe

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File created	C:\Program Files\New Relic\New Relic CLI\newrelic.exe	msiexec.exe

Drops file in Windows directory 8 IoCs

description	ioc	Process
File created	C:\Windows\Installer\SourceHash{E1639138-6FB0-47BF-963E-98531853A123}	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI2C9A.tmp	msiexec.exe
File created	C:\Windows\Installer\e5b29d0.msi	msiexec.exe
File created	C:\Windows\Installer\e5b29cc.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\e5b29cc.msi	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe

Checks processor information in registry 2 TTPs 8 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe

Modifies data under HKEY_USERS 3 IoCs

description	ioc	Process
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\1A\52C64B7E	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1b	msiexec.exe

Modifies registry class 24 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8319361E0BF6FB7469E3893581351A32\SourceList\Media\1 = ";"	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8319361E0BF6FB7469E3893581351A32\Clients = 3a0000000000	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8319361E0BF6FB7469E3893581351A32\PackageCode = "4963F10D23E67AD409F0804B86642054"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8319361E0BF6FB7469E3893581351A32\DeploymentFlags = "3"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\C6E0BF85FE49BFA40A766AADB6711EF0	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8319361E0BF6FB7469E3893581351A32\SourceList	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8319361E0BF6FB7469E3893581351A32\SourceList\Net	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8319361E0BF6FB7469E3893581351A32\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8319361E0BF6FB7469E3893581351A32\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\8319361E0BF6FB7469E3893581351A32	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8319361E0BF6FB7469E3893581351A32\Version = "1"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8319361E0BF6FB7469E3893581351A32\Assignment = "1"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8319361E0BF6FB7469E3893581351A32\AuthorizedLUAApp = "0"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\8319361E0BF6FB7469E3893581351A32\ShortcutsFeature	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8319361E0BF6FB7469E3893581351A32	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8319361E0BF6FB7469E3893581351A32\Language = "1033"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8319361E0BF6FB7469E3893581351A32\AdvertiseFlags = "388"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8319361E0BF6FB7469E3893581351A32\InstanceType = "0"	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-3811856890-180006922-3689258494-1000_Classes\Local Settings	firefox.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\8319361E0BF6FB7469E3893581351A32\FileToInstallFeature	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8319361E0BF6FB7469E3893581351A32\ProductName = "New Relic CLI"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\C6E0BF85FE49BFA40A766AADB6711EF0\8319361E0BF6FB7469E3893581351A32	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8319361E0BF6FB7469E3893581351A32\SourceList\PackageName = "NewRelicCLIInstaller.msi"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8319361E0BF6FB7469E3893581351A32\SourceList\Media	msiexec.exe

NTFS ADS 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\Downloads\install.ps1:Zone.Identifier	firefox.exe

Opens file in notepad (likely ransom note) 1 IoCs

ransomware

pid	Process
4876	notepad.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
1756	powershell.exe
2064	powershell_ise.exe
2064	powershell_ise.exe
2064	powershell_ise.exe
2064	powershell_ise.exe
5348	powershell.exe
5348	powershell.exe
5348	powershell.exe
5840	powershell_ise.exe
5840	powershell_ise.exe
5840	powershell_ise.exe
5224	msiexec.exe
5224	msiexec.exe
5840	powershell_ise.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	1756	powershell.exe
Token: SeDebugPrivilege	1612	firefox.exe
Token: SeDebugPrivilege	1612	firefox.exe
Token: SeDebugPrivilege	1612	firefox.exe
Token: SeDebugPrivilege	2064	powershell_ise.exe
Token: SeDebugPrivilege	5348	powershell.exe
Token: SeDebugPrivilege	5840	powershell_ise.exe
Token: SeDebugPrivilege	1612	firefox.exe
Token: SeDebugPrivilege	1612	firefox.exe
Token: SeDebugPrivilege	1612	firefox.exe
Token: SeShutdownPrivilege	5192	msiexec.exe
Token: SeIncreaseQuotaPrivilege	5192	msiexec.exe
Token: SeSecurityPrivilege	5224	msiexec.exe
Token: SeCreateTokenPrivilege	5192	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	5192	msiexec.exe
Token: SeLockMemoryPrivilege	5192	msiexec.exe
Token: SeIncreaseQuotaPrivilege	5192	msiexec.exe
Token: SeMachineAccountPrivilege	5192	msiexec.exe
Token: SeTcbPrivilege	5192	msiexec.exe
Token: SeSecurityPrivilege	5192	msiexec.exe
Token: SeTakeOwnershipPrivilege	5192	msiexec.exe
Token: SeLoadDriverPrivilege	5192	msiexec.exe
Token: SeSystemProfilePrivilege	5192	msiexec.exe
Token: SeSystemtimePrivilege	5192	msiexec.exe
Token: SeProfSingleProcessPrivilege	5192	msiexec.exe
Token: SeIncBasePriorityPrivilege	5192	msiexec.exe
Token: SeCreatePagefilePrivilege	5192	msiexec.exe
Token: SeCreatePermanentPrivilege	5192	msiexec.exe
Token: SeBackupPrivilege	5192	msiexec.exe
Token: SeRestorePrivilege	5192	msiexec.exe
Token: SeShutdownPrivilege	5192	msiexec.exe
Token: SeDebugPrivilege	5192	msiexec.exe
Token: SeAuditPrivilege	5192	msiexec.exe
Token: SeSystemEnvironmentPrivilege	5192	msiexec.exe
Token: SeChangeNotifyPrivilege	5192	msiexec.exe
Token: SeRemoteShutdownPrivilege	5192	msiexec.exe
Token: SeUndockPrivilege	5192	msiexec.exe
Token: SeSyncAgentPrivilege	5192	msiexec.exe
Token: SeEnableDelegationPrivilege	5192	msiexec.exe
Token: SeManageVolumePrivilege	5192	msiexec.exe
Token: SeImpersonatePrivilege	5192	msiexec.exe
Token: SeCreateGlobalPrivilege	5192	msiexec.exe
Token: SeRestorePrivilege	5224	msiexec.exe
Token: SeTakeOwnershipPrivilege	5224	msiexec.exe
Token: SeRestorePrivilege	5224	msiexec.exe
Token: SeTakeOwnershipPrivilege	5224	msiexec.exe
Token: SeRestorePrivilege	5224	msiexec.exe
Token: SeTakeOwnershipPrivilege	5224	msiexec.exe
Token: SeRestorePrivilege	5224	msiexec.exe
Token: SeTakeOwnershipPrivilege	5224	msiexec.exe
Token: SeRestorePrivilege	5224	msiexec.exe
Token: SeTakeOwnershipPrivilege	5224	msiexec.exe
Token: SeRestorePrivilege	5224	msiexec.exe
Token: SeTakeOwnershipPrivilege	5224	msiexec.exe
Token: SeRestorePrivilege	5224	msiexec.exe
Token: SeTakeOwnershipPrivilege	5224	msiexec.exe
Token: SeRestorePrivilege	5224	msiexec.exe
Token: SeTakeOwnershipPrivilege	5224	msiexec.exe
Token: SeRestorePrivilege	5224	msiexec.exe
Token: SeTakeOwnershipPrivilege	5224	msiexec.exe
Token: SeRestorePrivilege	5224	msiexec.exe
Token: SeTakeOwnershipPrivilege	5224	msiexec.exe
Token: SeRestorePrivilege	5224	msiexec.exe
Token: SeTakeOwnershipPrivilege	5224	msiexec.exe

Suspicious use of FindShellTrayWindow 4 IoCs

pid	Process
1612	firefox.exe
1612	firefox.exe
1612	firefox.exe
1612	firefox.exe

Suspicious use of SendNotifyMessage 3 IoCs

pid	Process
1612	firefox.exe
1612	firefox.exe
1612	firefox.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
1612	firefox.exe
1612	firefox.exe
1612	firefox.exe
1612	firefox.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1248 wrote to memory of 1612	1248	firefox.exe	113
PID 1248 wrote to memory of 1612	1248	firefox.exe	113
PID 1248 wrote to memory of 1612	1248	firefox.exe	113
PID 1248 wrote to memory of 1612	1248	firefox.exe	113
PID 1248 wrote to memory of 1612	1248	firefox.exe	113
PID 1248 wrote to memory of 1612	1248	firefox.exe	113
PID 1248 wrote to memory of 1612	1248	firefox.exe	113
PID 1248 wrote to memory of 1612	1248	firefox.exe	113
PID 1248 wrote to memory of 1612	1248	firefox.exe	113
PID 1248 wrote to memory of 1612	1248	firefox.exe	113
PID 1248 wrote to memory of 1612	1248	firefox.exe	113
PID 1612 wrote to memory of 1704	1612	firefox.exe	114
PID 1612 wrote to memory of 1704	1612	firefox.exe	114
PID 1612 wrote to memory of 1344	1612	firefox.exe	115
PID 1612 wrote to memory of 1344	1612	firefox.exe	115
PID 1612 wrote to memory of 1344	1612	firefox.exe	115
PID 1612 wrote to memory of 1344	1612	firefox.exe	115
PID 1612 wrote to memory of 1344	1612	firefox.exe	115
PID 1612 wrote to memory of 1344	1612	firefox.exe	115
PID 1612 wrote to memory of 1344	1612	firefox.exe	115
PID 1612 wrote to memory of 1344	1612	firefox.exe	115
PID 1612 wrote to memory of 1344	1612	firefox.exe	115
PID 1612 wrote to memory of 1344	1612	firefox.exe	115
PID 1612 wrote to memory of 1344	1612	firefox.exe	115
PID 1612 wrote to memory of 1344	1612	firefox.exe	115
PID 1612 wrote to memory of 1344	1612	firefox.exe	115
PID 1612 wrote to memory of 1344	1612	firefox.exe	115
PID 1612 wrote to memory of 1344	1612	firefox.exe	115
PID 1612 wrote to memory of 1344	1612	firefox.exe	115
PID 1612 wrote to memory of 1344	1612	firefox.exe	115
PID 1612 wrote to memory of 1344	1612	firefox.exe	115
PID 1612 wrote to memory of 1344	1612	firefox.exe	115
PID 1612 wrote to memory of 1344	1612	firefox.exe	115
PID 1612 wrote to memory of 1344	1612	firefox.exe	115
PID 1612 wrote to memory of 1344	1612	firefox.exe	115
PID 1612 wrote to memory of 1344	1612	firefox.exe	115
PID 1612 wrote to memory of 1344	1612	firefox.exe	115
PID 1612 wrote to memory of 1344	1612	firefox.exe	115
PID 1612 wrote to memory of 1344	1612	firefox.exe	115
PID 1612 wrote to memory of 1344	1612	firefox.exe	115
PID 1612 wrote to memory of 1344	1612	firefox.exe	115
PID 1612 wrote to memory of 1344	1612	firefox.exe	115
PID 1612 wrote to memory of 1344	1612	firefox.exe	115
PID 1612 wrote to memory of 1344	1612	firefox.exe	115
PID 1612 wrote to memory of 1344	1612	firefox.exe	115
PID 1612 wrote to memory of 1344	1612	firefox.exe	115
PID 1612 wrote to memory of 1344	1612	firefox.exe	115
PID 1612 wrote to memory of 1344	1612	firefox.exe	115
PID 1612 wrote to memory of 1344	1612	firefox.exe	115
PID 1612 wrote to memory of 1344	1612	firefox.exe	115
PID 1612 wrote to memory of 1344	1612	firefox.exe	115
PID 1612 wrote to memory of 1344	1612	firefox.exe	115
PID 1612 wrote to memory of 1344	1612	firefox.exe	115
PID 1612 wrote to memory of 1344	1612	firefox.exe	115
PID 1612 wrote to memory of 1344	1612	firefox.exe	115
PID 1612 wrote to memory of 1344	1612	firefox.exe	115
PID 1612 wrote to memory of 1344	1612	firefox.exe	115
PID 1612 wrote to memory of 1344	1612	firefox.exe	115
PID 1612 wrote to memory of 1344	1612	firefox.exe	115
PID 1612 wrote to memory of 1344	1612	firefox.exe	115
PID 1612 wrote to memory of 1344	1612	firefox.exe	115
PID 1612 wrote to memory of 2308	1612	firefox.exe	116
PID 1612 wrote to memory of 2308	1612	firefox.exe	116
PID 1612 wrote to memory of 2308	1612	firefox.exe	116

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -ExecutionPolicy bypass -File https://download.newrelic.com/install/newrelic-cli/scripts/install.ps1
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1756

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4352

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1248
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - Checks processor information in registry
  - Modifies registry class
  - NTFS ADS
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1612
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1612.0.1654508879\1608045854" -parentBuildID 20221007134813 -prefsHandle 1900 -prefMapHandle 1892 -prefsLen 20938 -prefMapSize 232675 -appDir "C:\Program Files\Mozilla Firefox\browser" - {1ac8349f-ee14-47e3-a8e7-39c8274f660f} 1612 "\\.\pipe\gecko-crash-server-pipe.1612" 2032 1faccacf658 gpu
    3⤵
    PID:1704
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1612.1.285684240\1054403348" -parentBuildID 20221007134813 -prefsHandle 2368 -prefMapHandle 2364 -prefsLen 20974 -prefMapSize 232675 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {3ca9779c-10eb-46e1-b2ef-44748d4b22c3} 1612 "\\.\pipe\gecko-crash-server-pipe.1612" 2380 1facc7fcc58 socket
    3⤵
    - Checks processor information in registry
    PID:1344
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1612.2.2098807678\1341746152" -childID 1 -isForBrowser -prefsHandle 3164 -prefMapHandle 2988 -prefsLen 21077 -prefMapSize 232675 -jsInitHandle 1368 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {7ce7f859-2cdc-4299-97ed-f884452b94ed} 1612 "\\.\pipe\gecko-crash-server-pipe.1612" 3020 1fad0998d58 tab
    3⤵
    PID:2308
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1612.3.1994598427\1397511480" -childID 2 -isForBrowser -prefsHandle 1028 -prefMapHandle 1328 -prefsLen 26437 -prefMapSize 232675 -jsInitHandle 1368 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {1f9f75ea-ed3f-4080-a9af-457c46e3a7f0} 1612 "\\.\pipe\gecko-crash-server-pipe.1612" 3680 1fad0a0ca58 tab
    3⤵
    PID:2224
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1612.4.1407509207\1943416095" -childID 3 -isForBrowser -prefsHandle 4180 -prefMapHandle 1688 -prefsLen 26496 -prefMapSize 232675 -jsInitHandle 1368 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {5a3c7516-18b9-42d2-8ca7-09e035221bc3} 1612 "\\.\pipe\gecko-crash-server-pipe.1612" 4280 1fad2027658 tab
    3⤵
    PID:1236
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1612.5.700269118\1689945508" -childID 4 -isForBrowser -prefsHandle 5288 -prefMapHandle 5292 -prefsLen 26577 -prefMapSize 232675 -jsInitHandle 1368 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {0272f568-7e17-43c4-ae4c-383f3731fc51} 1612 "\\.\pipe\gecko-crash-server-pipe.1612" 5308 1fac002d558 tab
    3⤵
    PID:116
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1612.7.71160574\1035322101" -childID 6 -isForBrowser -prefsHandle 5416 -prefMapHandle 5248 -prefsLen 26577 -prefMapSize 232675 -jsInitHandle 1368 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {60ef1896-bf3f-4bcc-86a3-899f7e2f3cd0} 1612 "\\.\pipe\gecko-crash-server-pipe.1612" 5504 1face128558 tab
    3⤵
    PID:3340
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1612.6.1863031548\1423460669" -childID 5 -isForBrowser -prefsHandle 5272 -prefMapHandle 5276 -prefsLen 26577 -prefMapSize 232675 -jsInitHandle 1368 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {a80b9943-5436-4f55-a419-b815a8ba5182} 1612 "\\.\pipe\gecko-crash-server-pipe.1612" 5248 1face125b58 tab
    3⤵
    PID:3552

C:\Windows\System32\WindowsPowerShell\v1.0\powershell_ise.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell_ise.exe" "C:\Users\Admin\Downloads\install.ps1"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2064

C:\Windows\System32\notepad.exe
"C:\Windows\System32\notepad.exe" "C:\Users\Admin\Downloads\install.ps1"
1⤵
- Opens file in notepad (likely ransom note)
PID:4876

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"
1⤵
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5348

C:\Windows\System32\WindowsPowerShell\v1.0\powershell_ise.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell_ise.exe" "C:\Users\Admin\Downloads\install.ps1"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5840
- C:\Windows\system32\msiexec.exe
  "C:\Windows\system32\msiexec.exe" /qn /i C:\Users\Admin\AppData\Local\Temp\NewRelicCLIInstaller.msi
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:5192

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5224

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Config.Msi\e5b29cf.rbs

Filesize
8KB

MD5
e883783cbaae3ab9e4881e80d600864e

SHA1
462d4ee15503d6ae41cfd6f9d0d1e72ec85d8d90

SHA256
f019f8727a1332993481dcce6c2babbba223970dcb326432eac606e835fd5295

SHA512
642c2f4f31fb829b4de5ea41019b6ca9836e9e277c5904a013f8fd440e55fa42047ce7da160973f42d8d80648830f41f9d05867db259cfd3d7094e8ab998dc96

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB

Filesize
471B

MD5
01b9ce813efe124f49534075847fc96d

SHA1
36be0bc8357e8c2408e464354a9c9e629c161f8e

SHA256
28f815ffca4be91b7dfe771a68a7a5a1bc669e7b2838ec4b19f5912b91d54a8c

SHA512
e0955e4ac4e4e80311183ef7653a6c938d40977863a80626cd38b6349d1acb027089124e425ea75b33a22d23142b008c61b5bf5d6a74df4bf3056221eb079eab

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8EC9B1D0ABBD7F98B401D425828828CE_E0C209E3ACB9EBE06C454D5D3A37506F

Filesize
727B

MD5
d27ba2efd045c4859eddea638af5c73b

SHA1
0499a6590da37718a31f423ca447dd6e790f6073

SHA256
ef8c7c1a3b1b60d31af85a41aea42b60be628c2047126a7bc637fcf8f01bf3ad

SHA512
a2177eb6982be2f4a6e5e564830d5e771657d27be92faea6c42efa6a15c89f3ac48c1bc9841d5a0277629e84a2740689c16a8a858d1aeac750e05bcccba6aa9a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141

Filesize
727B

MD5
649ab1ec6627955e76deef26551857fb

SHA1
991ba18ac0faab574ccad1e6b02be2d56f73f63f

SHA256
94860a682896d1d7f6c82d72b62084e939c6d5b7a4646c0321c94b41409ab3d0

SHA512
0cc921ef41c6f159161178e6380ebae02b5f49f69564594df0bb2b9ca7a5b5ada472d9d15a6f7c2d794ce67c7222bf513e1deb227eff862aa170acde3e593af4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB

Filesize
400B

MD5
a562b1f4c6ff12192144f5c2ef1aba5b

SHA1
dc947d557588e0a3cb816e30763047eac642ce7c

SHA256
ca15ac476ae0f19d770e10ace091918d84c20a8f5ce595b8c3321d30b9588069

SHA512
c253cd917451e75611e8d69fa1048b889eb44266cf896d623520fad2d8dbef89ef6f530a239c0750f9fc49d1db6d98fbedd7537b2252e19c6f430cb5722a4f7d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8EC9B1D0ABBD7F98B401D425828828CE_E0C209E3ACB9EBE06C454D5D3A37506F

Filesize
404B

MD5
fe1e2ddff94c4264c127427363610e50

SHA1
d678ec2500dc04658cf6c197b46dacf4f1341e1a

SHA256
d74a500122cccc7940f62c512d91e4e06cad31c3420705e85c6c8ca14c6263ce

SHA512
08c4363c1c2543e0468622d5b5048a5ef160058b34b5c497db70e8b0acef71ce7b6a7d42496688ae81eec02edb1ef1f25dfb64ca87aea15d26d59f5a9df235ee

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141

Filesize
412B

MD5
77714252288d296c8ca124725d4a83a8

SHA1
636b6db90789a7b795d819731f36fefc0b21a0ed

SHA256
b52ee40e3fdc8f67aa04c63fe950590391fe63246f078fe337315994a8637f14

SHA512
2eb97a552ced1853a51cabd1d093f9346f799b174349cc53ee5bb8e0af6c5a1920abc14531960e337e76c69dd32a894d8c339c1e4240834a45cd7186f0e0a4fb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
3KB

MD5
104462704900f94f83a7a816edcdd8e8

SHA1
9b1f0d518221af47065167e2bdb4ffe474849bf4

SHA256
3989e6ced951ff0be273a3f46c955a79d973d68e7aa656d674752accce2d7d14

SHA512
1ba1e0724b12e57e6a19d4dcf8a3d860418f5ac4f9fcd9c450ac0aa63e1a2859ab830e5bce11240a048c63e46e1cac0393465a40294f85816046df1e37d7ca96

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell_ise.exe.log

Filesize
6KB

MD5
d5f3199618894b20b6b620d0a4dbd85a

SHA1
6696d4186ca205dd306329f8a9f42d19f128f7ae

SHA256
6914a945556c709f81a894b311fc52d8b379f8764b389d73b84c76c4c5c11575

SHA512
6706ef8cae3f43a5802996bc5178257c30937780269e4fe0eda18de2613608acf620a32e9e5a33d4a6cf6be263dea4f1848bb16ed28a2fd907d1fd7c73d570f1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache

Filesize
53KB

MD5
6a1d732af6eb2d5e39917fb6d0d3cd40

SHA1
2981e90b27d16f79c07433cd177d5f77b0f26b42

SHA256
fb7e11ee05163c7dbcc973b194c6789afe2d8949c693b2e5b5ae71eb615fd563

SHA512
01750f3b62298f335786bcaddbd127c79c91cde0c2b2200dea8299e0a6ec45287b4cec597dfb556bde0d9ee7ac1227aeb26f05b7ca4859e6633aa202128dfca8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache

Filesize
53KB

MD5
45b3349cd56d5b56feb892ec012b6b6b

SHA1
2149103ee3136979daa139ad0749c0ab9180ec5e

SHA256
bf4b69d9271f4a2f49e84cd1f2127c1b0d178a3e44be9d0d165885de6d44cd6d

SHA512
b39ae94dd800997082b9d85c3bd4cd0761466570b81c11423bc6332a9c6548acc106140bf4b786538fc54ed238a8ed7c1c230c234e86ee2f0bcbd7ea31f15be1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft_Corporation\powershell_ise.exe_StrongName_lw2v2vm3wmtzzpebq33gybmeoxukb04w\3.0.0.0\kqemru4n.newcfg

Filesize
10KB

MD5
884f444ea2c2ea8fac20bc53f1910e9d

SHA1
baeb786c7badf71c870bcaafbea80a048453b11f

SHA256
2c69caddbfe68a861e06d8abd4ddfcd89ba5073422d750d670951bfb9740a944

SHA512
3182e6f1c9ebe1e9f99984b1d6f64fe5eb69181c08ed35bf6a5625222fd6abd605f7f43e3f61fce31552d3be3d7caa343181a15781f52153ef527dfd8083dee5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft_Corporation\powershell_ise.exe_StrongName_lw2v2vm3wmtzzpebq33gybmeoxukb04w\3.0.0.0\user.config

Filesize
10KB

MD5
884f444ea2c2ea8fac20bc53f1910e9d

SHA1
baeb786c7badf71c870bcaafbea80a048453b11f

SHA256
2c69caddbfe68a861e06d8abd4ddfcd89ba5073422d750d670951bfb9740a944

SHA512
3182e6f1c9ebe1e9f99984b1d6f64fe5eb69181c08ed35bf6a5625222fd6abd605f7f43e3f61fce31552d3be3d7caa343181a15781f52153ef527dfd8083dee5

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\f3zxqty5.default-release\activity-stream.discovery_stream.json.tmp

Filesize
23KB

MD5
56c57cb2948566fd3afbe1b4141f3031

SHA1
f10f718a5daf06783c308cae31016b04fad77049

SHA256
6244a474d2512db0d1ec5c08d2cf02b201410c9850f27b2abbb5d7e065712762

SHA512
0fde2402003a1f7cc969c3a45d4cc41ecc4f4cfe7f75dee615a56c3ea68f696b7bf28bfff8e9c6a34e8b395c6e5e9b67bb8e582e494d57305f35abc206540669

Download Submit
C:\Users\Admin\AppData\Local\Temp\NewRelicCLIInstaller.msi

Filesize
7.3MB

MD5
5f3b5256d897e0c62bd0a23dfc83509f

SHA1
fcc2fffccbb99a447cca97621daaafd3bcc8eaf0

SHA256
31601a99892f9b409411bd1cfc307671304c578407974d1d068a735c85b3b6fd

SHA512
03cb7c44ead92d933f9fdade85b307c1b38034b7cf73e8af80ddab66990eac56ed7edf618deeead9b155f87dbcfe64157014ee08d62aa62458f3f39940c7cb74

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_hi40ncxd.eeh.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\f3zxqty5.default-release\prefs-1.js

Filesize
7KB

MD5
baabdccfababae9c1b8c72d148fe6774

SHA1
186b2e9a07643efdc34a958295a7a496657e37d9

SHA256
be4ddbfbd6bbc20ce10966d9fb6309005feb20d283b36ed2250a7ca8238e7d16

SHA512
ce6ae081b8531e3a9167a7e749fab5bd4d8bdd18654827ea73b8779c19d9d3baadd3f76bfc95c3007f1493e4fb34228321661a459a3c69ae38e9ca0070ba8b79

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\f3zxqty5.default-release\prefs-1.js

Filesize
6KB

MD5
1cdf7fe6a20541ec907b4763c8230022

SHA1
39ff340aedb4ccd7b49dcd24185b6af7ffe585e5

SHA256
b580ec57518295ae2625e50a93ddb601b579723c5c24c57a8ebc883c4a198b24

SHA512
5f89ffc7742ceb7a8b6ec27ae9ec07997174ebcfdf9b7adf69dd751de3e75a86629e54cea259e3148aef6394423b34a628beb285e5e2170f5c186363c809a2e1

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\f3zxqty5.default-release\prefs-1.js

Filesize
6KB

MD5
12fcf3d7c3b39cc6b883630a8d35615d

SHA1
47127dc4e888cb5a15883e10f46e2b3c35dca39c

SHA256
217877941d67e1c4573b08f56a8e8492d26313631f57dc4a3eb479ef64c15998

SHA512
49ecc783c8251beb065e6d597137a963b0acdde88b2335ccb8aa1ce1d9d1e02c3bcb9711d121bd549320b4c412ada742bbd2f8f38904ab034e5290ed824af26a

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\f3zxqty5.default-release\sessionCheckpoints.json.tmp

Filesize
259B

MD5
c8dc58eff0c029d381a67f5dca34a913

SHA1
3576807e793473bcbd3cf7d664b83948e3ec8f2d

SHA256
4c22e8a42797f14510228f9f4de8eea45c526228a869837bd43c0540092e5f17

SHA512
b8f7c4150326f617b63d6bc72953160804a3749f6dec0492779f6c72b3b09c8d1bd58f47d499205c9a0e716f55fe5f1503d7676a4c85d31d1c1e456898af77b4

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\f3zxqty5.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
1KB

MD5
0b459fa33b71a694e839ccc7746fbf4d

SHA1
474058bb96eb2759c61600a673a2fc1bcd9fac48

SHA256
965e1c154557ab2c4d5e332809434ff92b8fc84814302124334f29bedd962c2a

SHA512
a3628de764ff07b2681aa0518bd430b5be7cec3ab37c3ba5633bb23ee0cb8af219f3ce1c5c05007cdafbc25e082daaa33ae2ab3f2adf014443fb2145ca9502ee

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\f3zxqty5.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
1KB

MD5
08a3f054a574977ebf41a366368f70ec

SHA1
ae2f17f39996329251729cbbe501dac133fd8b6d

SHA256
22ab08300732529ddb674497ed7902084d395c4ac218ac6a45c54481d2859161

SHA512
b60846c1259c8cf6a7341504b887f5962e98cd1a97ae7f39678a748c55ae7f4661d9ee46428cb5602471f0470ffdd0eaa76bfde169d1e29d1d16ca359b5b935f

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\f3zxqty5.default-release\sessionstore.jsonlz4

Filesize
981B

MD5
e36f9207ba362ffa46fbcca4e0bd155d

SHA1
0fb80d0f60b3147f601e26c6d6fd9bd9be8b6dde

SHA256
8d37305f10a932c7c27fdd78a00d61f60f9776bee08f8de26feaa46d8c0c7d1a

SHA512
609c9425f9680ca8587ad1d66da48cf144a39ceacd39fb7bcbc8855bd6e959974d4382bba1495f80c29679a88dce941d2e661e477feb78430de0608bbbc629f8

Download Submit
C:\Users\Admin\Downloads\BPgSN9y_.ps1.part

Filesize
15KB

MD5
fb198f16c24af233830ab9d2cc378619

SHA1
03b54ec7bc7e4103f7ca28060dbc8d7f693d4486

SHA256
90866d282dc1be65867968d2c0d073ed0a5742b924021187595f74c29138cf12

SHA512
b00e0c178f4359b332e60c0972722acead05d01eb9003ec6d18c6853337b6f02f8cf8e21712f1b0f9745981796e1e13cbd0f0d31d7e342f317c8f495e9e39e8b

Download Submit
C:\Users\Admin\Downloads\install.ps1

Filesize
15KB

MD5
fb198f16c24af233830ab9d2cc378619

SHA1
03b54ec7bc7e4103f7ca28060dbc8d7f693d4486

SHA256
90866d282dc1be65867968d2c0d073ed0a5742b924021187595f74c29138cf12

SHA512
b00e0c178f4359b332e60c0972722acead05d01eb9003ec6d18c6853337b6f02f8cf8e21712f1b0f9745981796e1e13cbd0f0d31d7e342f317c8f495e9e39e8b

Download Submit
C:\Windows\Installer\e5b29d0.msi

Filesize
7.3MB

MD5
5f3b5256d897e0c62bd0a23dfc83509f

SHA1
fcc2fffccbb99a447cca97621daaafd3bcc8eaf0

SHA256
31601a99892f9b409411bd1cfc307671304c578407974d1d068a735c85b3b6fd

SHA512
03cb7c44ead92d933f9fdade85b307c1b38034b7cf73e8af80ddab66990eac56ed7edf618deeead9b155f87dbcfe64157014ee08d62aa62458f3f39940c7cb74

Download Submit
memory/1756-322-0x00007FFFAC830000-0x00007FFFAD2F1000-memory.dmp

Filesize
10.8MB

Download
memory/1756-14-0x0000017874050000-0x0000017874060000-memory.dmp

Filesize
64KB

Download
memory/1756-6-0x0000017873AB0000-0x0000017873AD2000-memory.dmp

Filesize
136KB

Download
memory/1756-13-0x00007FFFAC830000-0x00007FFFAD2F1000-memory.dmp

Filesize
10.8MB

Download
memory/1756-12-0x0000017874050000-0x0000017874060000-memory.dmp

Filesize
64KB

Download
memory/1756-11-0x0000017874050000-0x0000017874060000-memory.dmp

Filesize
64KB

Download
memory/1756-10-0x00007FFFAC830000-0x00007FFFAD2F1000-memory.dmp

Filesize
10.8MB

Download
memory/2064-116-0x000002F4BC680000-0x000002F4BC690000-memory.dmp

Filesize
64KB

Download
memory/2064-117-0x000002F4BC680000-0x000002F4BC690000-memory.dmp

Filesize
64KB

Download
memory/2064-122-0x000002F4BDA00000-0x000002F4BDA26000-memory.dmp

Filesize
152KB

Download
memory/2064-121-0x000002F4BD890000-0x000002F4BD898000-memory.dmp

Filesize
32KB

Download
memory/2064-123-0x00007FFFAC830000-0x00007FFFAD2F1000-memory.dmp

Filesize
10.8MB

Download
memory/2064-124-0x000002F4BC680000-0x000002F4BC690000-memory.dmp

Filesize
64KB

Download
memory/2064-118-0x000002F4BECD0000-0x000002F4BECD8000-memory.dmp

Filesize
32KB

Download
memory/2064-137-0x000002F4BC680000-0x000002F4BC690000-memory.dmp

Filesize
64KB

Download
memory/2064-119-0x000002F4BECE0000-0x000002F4BECE8000-memory.dmp

Filesize
32KB

Download
memory/2064-106-0x000002F4BE9D0000-0x000002F4BE9D8000-memory.dmp

Filesize
32KB

Download
memory/2064-101-0x000002F4BEA70000-0x000002F4BEAA8000-memory.dmp

Filesize
224KB

Download
memory/2064-96-0x000002F4A20B0000-0x000002F4A20E8000-memory.dmp

Filesize
224KB

Download
memory/2064-100-0x000002F4BD0D0000-0x000002F4BD0DE000-memory.dmp

Filesize
56KB

Download
memory/2064-97-0x00007FFFAC830000-0x00007FFFAD2F1000-memory.dmp

Filesize
10.8MB

Download
memory/2064-157-0x00007FFFAC830000-0x00007FFFAD2F1000-memory.dmp

Filesize
10.8MB

Download
memory/2064-98-0x000002F4BC680000-0x000002F4BC690000-memory.dmp

Filesize
64KB

Download
memory/2064-150-0x000002F4BC680000-0x000002F4BC690000-memory.dmp

Filesize
64KB

Download
memory/2064-99-0x000002F4BEA20000-0x000002F4BEA6A000-memory.dmp

Filesize
296KB

Download
memory/5348-171-0x000002253D400000-0x000002253D410000-memory.dmp

Filesize
64KB

Download
memory/5348-265-0x00007FFFAC830000-0x00007FFFAD2F1000-memory.dmp

Filesize
10.8MB

Download
memory/5348-169-0x00007FFFAC830000-0x00007FFFAD2F1000-memory.dmp

Filesize
10.8MB

Download
memory/5348-181-0x000002253D400000-0x000002253D410000-memory.dmp

Filesize
64KB

Download
memory/5348-180-0x000002253D400000-0x000002253D410000-memory.dmp

Filesize
64KB

Download
memory/5348-179-0x00007FFFAC830000-0x00007FFFAD2F1000-memory.dmp

Filesize
10.8MB

Download
memory/5348-176-0x000002253E100000-0x000002253E11E000-memory.dmp

Filesize
120KB

Download
memory/5348-175-0x000002253E180000-0x000002253E1F6000-memory.dmp

Filesize
472KB

Download
memory/5348-170-0x000002253D400000-0x000002253D410000-memory.dmp

Filesize
64KB

Download
memory/5348-173-0x000002253D3B0000-0x000002253D3F4000-memory.dmp

Filesize
272KB

Download
memory/5348-172-0x000002253D400000-0x000002253D410000-memory.dmp

Filesize
64KB

Download
memory/5840-195-0x0000019E7E390000-0x0000019E7E3A0000-memory.dmp

Filesize
64KB

Download
memory/5840-227-0x0000019E7E390000-0x0000019E7E3A0000-memory.dmp

Filesize
64KB

Download
memory/5840-223-0x0000019E7E390000-0x0000019E7E3A0000-memory.dmp

Filesize
64KB

Download
memory/5840-242-0x0000019E7E390000-0x0000019E7E3A0000-memory.dmp

Filesize
64KB

Download
memory/5840-222-0x0000019E7E390000-0x0000019E7E3A0000-memory.dmp

Filesize
64KB

Download
memory/5840-252-0x0000019E7E390000-0x0000019E7E3A0000-memory.dmp

Filesize
64KB

Download
memory/5840-253-0x0000019E7E390000-0x0000019E7E3A0000-memory.dmp

Filesize
64KB

Download
memory/5840-254-0x0000019E7E390000-0x0000019E7E3A0000-memory.dmp

Filesize
64KB

Download
memory/5840-221-0x0000019E7E390000-0x0000019E7E3A0000-memory.dmp

Filesize
64KB

Download
memory/5840-262-0x00007FFFAC830000-0x00007FFFAD2F1000-memory.dmp

Filesize
10.8MB

Download
memory/5840-220-0x00007FFFAC830000-0x00007FFFAD2F1000-memory.dmp

Filesize
10.8MB

Download
memory/5840-219-0x0000019E7E390000-0x0000019E7E3A0000-memory.dmp

Filesize
64KB

Download
memory/5840-213-0x0000019E7E390000-0x0000019E7E3A0000-memory.dmp

Filesize
64KB

Download
memory/5840-211-0x0000019E7E390000-0x0000019E7E3A0000-memory.dmp

Filesize
64KB

Download
memory/5840-196-0x0000019E7E390000-0x0000019E7E3A0000-memory.dmp

Filesize
64KB

Download
memory/5840-194-0x00007FFFAC830000-0x00007FFFAD2F1000-memory.dmp

Filesize
10.8MB

Download