3db88db54e3d0e09b43b0cf3a3a20b372471b233642eef10bb20b1f834a221ec

Analysis

max time kernel
150s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240221-en
resource tags

arch:x64arch:x86image:win10v2004-20240221-enlocale:en-usos:windows10-2004-x64system
submitted
22/02/2024, 18:58

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3db88db54e3d0e09b43b0cf3a3a20b372471b233642eef10bb20b1f834a221ec.exe
Size

3.9MB
MD5

89670bbb58f2b067c80a1ee84805d9ec
SHA1

65a1fa96ee387cb939caeb9917469b066e7f2b97
SHA256

3db88db54e3d0e09b43b0cf3a3a20b372471b233642eef10bb20b1f834a221ec
SHA512

22bac98d5c55a969a74355f20004443cfa55f857129d7281f3316f66a052d7b0cfd0ea8da207088136e20ad549f14375660367b4f07c85c3c3e4450331fdf6c1
SSDEEP

49152:l8ZB99yLXBn0nkKgvzOJtYbaCM5WSfZl9/VYEfIYS:dCUKOaCM5fZH9YMIN

Score

7^/10

Malware Config

Signatures

Checks BIOS information in registry 2 TTPs 54 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	explorer.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	cmd.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	explorer.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	svchost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	3db88db54e3d0e09b43b0cf3a3a20b372471b233642eef10bb20b1f834a221ec.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	svchost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	svchost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	explorer.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	explorer.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	svchost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	cmd.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	svchost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	explorer.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	explorer.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	explorer.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	3db88db54e3d0e09b43b0cf3a3a20b372471b233642eef10bb20b1f834a221ec.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	cmd.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	svchost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	svchost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	cmd.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	cmd.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	cmd.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	cmd.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	explorer.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	cmd.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	explorer.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	explorer.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	skypes.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	explorer.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	cmd.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	cmd.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	explorer.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	cmd.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	svchost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	cmd.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	cmd.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	explorer.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	explorer.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	svchost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	explorer.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	explorer.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	svchost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	svchost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	svchost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	svchost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	skypes.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	cmd.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	svchost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	svchost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	explorer.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	cmd.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	explorer.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	svchost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	cmd.exe

Drops startup file 25 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\{05908176-6AD5-4164-B8FF-1D602CC3B78E}.lnk	explorer.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\{05908176-6AD5-4164-B8FF-1D602CC3B78E}.lnk	explorer.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\{05908176-6AD5-4164-B8FF-1D602CC3B78E}.lnk	svchost.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\{05908176-6AD5-4164-B8FF-1D602CC3B78E}.lnk	svchost.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\{05908176-6AD5-4164-B8FF-1D602CC3B78E}.lnk	cmd.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\{05908176-6AD5-4164-B8FF-1D602CC3B78E}.lnk	svchost.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\{05908176-6AD5-4164-B8FF-1D602CC3B78E}.lnk	cmd.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\{05908176-6AD5-4164-B8FF-1D602CC3B78E}.lnk	svchost.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\{05908176-6AD5-4164-B8FF-1D602CC3B78E}.lnk	explorer.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\{05908176-6AD5-4164-B8FF-1D602CC3B78E}.lnk	explorer.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\{05908176-6AD5-4164-B8FF-1D602CC3B78E}.lnk	svchost.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\{05908176-6AD5-4164-B8FF-1D602CC3B78E}.lnk	cmd.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\{05908176-6AD5-4164-B8FF-1D602CC3B78E}.lnk	explorer.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\{05908176-6AD5-4164-B8FF-1D602CC3B78E}.lnk	explorer.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\{05908176-6AD5-4164-B8FF-1D602CC3B78E}.lnk	svchost.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\{05908176-6AD5-4164-B8FF-1D602CC3B78E}.lnk	cmd.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\{05908176-6AD5-4164-B8FF-1D602CC3B78E}.lnk	cmd.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\{05908176-6AD5-4164-B8FF-1D602CC3B78E}.lnk	svchost.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\{05908176-6AD5-4164-B8FF-1D602CC3B78E}.lnk	cmd.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\{05908176-6AD5-4164-B8FF-1D602CC3B78E}.lnk	explorer.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\{05908176-6AD5-4164-B8FF-1D602CC3B78E}.lnk	explorer.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\{05908176-6AD5-4164-B8FF-1D602CC3B78E}.lnk	explorer.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\{05908176-6AD5-4164-B8FF-1D602CC3B78E}.lnk	svchost.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\{05908176-6AD5-4164-B8FF-1D602CC3B78E}.lnk	cmd.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\{05908176-6AD5-4164-B8FF-1D602CC3B78E}.lnk	cmd.exe

Executes dropped EXE 1 IoCs

pid	Process
4148	skypes.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
1228	powershell.exe
1228	powershell.exe
4436	powershell.exe
4436	powershell.exe

Suspicious behavior: MapViewOfSection 64 IoCs

pid	Process
4148	skypes.exe
4148	skypes.exe
4148	skypes.exe
4148	skypes.exe
4148	skypes.exe
4148	skypes.exe
4148	skypes.exe
4148	skypes.exe
4148	skypes.exe
4148	skypes.exe
4148	skypes.exe
4148	skypes.exe
4148	skypes.exe
4148	skypes.exe
4148	skypes.exe
4148	skypes.exe
4148	skypes.exe
4148	skypes.exe
4148	skypes.exe
4148	skypes.exe
4148	skypes.exe
4148	skypes.exe
4148	skypes.exe
4148	skypes.exe
4148	skypes.exe
4148	skypes.exe
4148	skypes.exe
4148	skypes.exe
4148	skypes.exe
4148	skypes.exe
4148	skypes.exe
4148	skypes.exe
4148	skypes.exe
4148	skypes.exe
4148	skypes.exe
4148	skypes.exe
4148	skypes.exe
4148	skypes.exe
4148	skypes.exe
4148	skypes.exe
4148	skypes.exe
4148	skypes.exe
4148	skypes.exe
4148	skypes.exe
4148	skypes.exe
4148	skypes.exe
4148	skypes.exe
4148	skypes.exe
4148	skypes.exe
4148	skypes.exe
4148	skypes.exe
4148	skypes.exe
4148	skypes.exe
4148	skypes.exe
4148	skypes.exe
4148	skypes.exe
4148	skypes.exe
4148	skypes.exe
4148	skypes.exe
4148	skypes.exe
4148	skypes.exe
4148	skypes.exe
4148	skypes.exe
4148	skypes.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1228	powershell.exe
Token: SeDebugPrivilege	4436	powershell.exe

Suspicious use of WriteProcessMemory 62 IoCs

description	pid	Process	procid_target
PID 4884 wrote to memory of 4128	4884	3db88db54e3d0e09b43b0cf3a3a20b372471b233642eef10bb20b1f834a221ec.exe	86
PID 4884 wrote to memory of 4128	4884	3db88db54e3d0e09b43b0cf3a3a20b372471b233642eef10bb20b1f834a221ec.exe	86
PID 4884 wrote to memory of 4148	4884	3db88db54e3d0e09b43b0cf3a3a20b372471b233642eef10bb20b1f834a221ec.exe	88
PID 4884 wrote to memory of 4148	4884	3db88db54e3d0e09b43b0cf3a3a20b372471b233642eef10bb20b1f834a221ec.exe	88
PID 4128 wrote to memory of 1228	4128	cmd.exe	89
PID 4128 wrote to memory of 1228	4128	cmd.exe	89
PID 4148 wrote to memory of 3936	4148	skypes.exe	93
PID 4148 wrote to memory of 3936	4148	skypes.exe	93
PID 4148 wrote to memory of 3440	4148	skypes.exe	95
PID 4148 wrote to memory of 3440	4148	skypes.exe	95
PID 3936 wrote to memory of 4436	3936	cmd.exe	96
PID 3936 wrote to memory of 4436	3936	cmd.exe	96
PID 4148 wrote to memory of 1900	4148	skypes.exe	99
PID 4148 wrote to memory of 1900	4148	skypes.exe	99
PID 4148 wrote to memory of 4928	4148	skypes.exe	100
PID 4148 wrote to memory of 4928	4148	skypes.exe	100
PID 4148 wrote to memory of 1584	4148	skypes.exe	102
PID 4148 wrote to memory of 1584	4148	skypes.exe	102
PID 4148 wrote to memory of 2276	4148	skypes.exe	103
PID 4148 wrote to memory of 2276	4148	skypes.exe	103
PID 4148 wrote to memory of 1692	4148	skypes.exe	106
PID 4148 wrote to memory of 1692	4148	skypes.exe	106
PID 4148 wrote to memory of 4604	4148	skypes.exe	109
PID 4148 wrote to memory of 4604	4148	skypes.exe	109
PID 4148 wrote to memory of 3500	4148	skypes.exe	110
PID 4148 wrote to memory of 3500	4148	skypes.exe	110
PID 4148 wrote to memory of 4904	4148	skypes.exe	111
PID 4148 wrote to memory of 4904	4148	skypes.exe	111
PID 4148 wrote to memory of 3880	4148	skypes.exe	113
PID 4148 wrote to memory of 3880	4148	skypes.exe	113
PID 4148 wrote to memory of 3640	4148	skypes.exe	114
PID 4148 wrote to memory of 3640	4148	skypes.exe	114
PID 4148 wrote to memory of 3696	4148	skypes.exe	115
PID 4148 wrote to memory of 3696	4148	skypes.exe	115
PID 4148 wrote to memory of 392	4148	skypes.exe	117
PID 4148 wrote to memory of 392	4148	skypes.exe	117
PID 4148 wrote to memory of 3592	4148	skypes.exe	118
PID 4148 wrote to memory of 3592	4148	skypes.exe	118
PID 4148 wrote to memory of 2304	4148	skypes.exe	119
PID 4148 wrote to memory of 2304	4148	skypes.exe	119
PID 4148 wrote to memory of 1384	4148	skypes.exe	121
PID 4148 wrote to memory of 1384	4148	skypes.exe	121
PID 4148 wrote to memory of 3112	4148	skypes.exe	122
PID 4148 wrote to memory of 3112	4148	skypes.exe	122
PID 4148 wrote to memory of 1984	4148	skypes.exe	123
PID 4148 wrote to memory of 1984	4148	skypes.exe	123
PID 4148 wrote to memory of 4636	4148	skypes.exe	125
PID 4148 wrote to memory of 4636	4148	skypes.exe	125
PID 4148 wrote to memory of 1540	4148	skypes.exe	126
PID 4148 wrote to memory of 1540	4148	skypes.exe	126
PID 4148 wrote to memory of 3680	4148	skypes.exe	127
PID 4148 wrote to memory of 3680	4148	skypes.exe	127
PID 4148 wrote to memory of 4068	4148	skypes.exe	129
PID 4148 wrote to memory of 4068	4148	skypes.exe	129
PID 4148 wrote to memory of 3284	4148	skypes.exe	130
PID 4148 wrote to memory of 3284	4148	skypes.exe	130
PID 4148 wrote to memory of 4436	4148	skypes.exe	131
PID 4148 wrote to memory of 4436	4148	skypes.exe	131
PID 4148 wrote to memory of 2088	4148	skypes.exe	133
PID 4148 wrote to memory of 2088	4148	skypes.exe	133
PID 4148 wrote to memory of 3040	4148	skypes.exe	134
PID 4148 wrote to memory of 3040	4148	skypes.exe	134

C:\Users\Admin\AppData\Local\Temp\3db88db54e3d0e09b43b0cf3a3a20b372471b233642eef10bb20b1f834a221ec.exe
"C:\Users\Admin\AppData\Local\Temp\3db88db54e3d0e09b43b0cf3a3a20b372471b233642eef10bb20b1f834a221ec.exe"
1⤵
- Checks BIOS information in registry
- Suspicious use of WriteProcessMemory
PID:4884
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c powershell.exe Add-MpPreference -ExclusionPath 'C:\ProgramData\skypes'
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4128
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe Add-MpPreference -ExclusionPath 'C:\ProgramData\skypes'
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1228
- C:\ProgramData\skypes\skypes.exe
  "C:\ProgramData\skypes\skypes.exe" {E4F63D69-CFF2-40AB-8E8A-FBAB039E9F9A}
  2⤵
  - Checks BIOS information in registry
  - Executes dropped EXE
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of WriteProcessMemory
  PID:4148
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c powershell.exe Add-MpPreference -ExclusionPath 'C:\ProgramData\skypes'
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3936
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe Add-MpPreference -ExclusionPath 'C:\ProgramData\skypes'
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4436
- - C:\Windows\explorer.exe
    "C:\Windows\explorer.exe"
    3⤵
    - Checks BIOS information in registry
    - Drops startup file
    PID:3440
- - C:\Windows\system32\svchost.exe
    "C:\Windows\system32\svchost.exe"
    3⤵
    - Checks BIOS information in registry
    - Drops startup file
    PID:1900
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe"
    3⤵
    - Checks BIOS information in registry
    - Drops startup file
    PID:4928
- - C:\Windows\explorer.exe
    "C:\Windows\explorer.exe"
    3⤵
    - Checks BIOS information in registry
    - Drops startup file
    PID:1584
- - C:\Windows\system32\svchost.exe
    "C:\Windows\system32\svchost.exe"
    3⤵
    - Checks BIOS information in registry
    - Drops startup file
    PID:2276
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe"
    3⤵
    - Checks BIOS information in registry
    - Drops startup file
    PID:1692
- - C:\Windows\explorer.exe
    "C:\Windows\explorer.exe"
    3⤵
    - Checks BIOS information in registry
    - Drops startup file
    PID:4604
- - C:\Windows\system32\svchost.exe
    "C:\Windows\system32\svchost.exe"
    3⤵
    - Checks BIOS information in registry
    - Drops startup file
    PID:3500
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe"
    3⤵
    - Checks BIOS information in registry
    - Drops startup file
    PID:4904
- - C:\Windows\explorer.exe
    "C:\Windows\explorer.exe"
    3⤵
    - Checks BIOS information in registry
    - Drops startup file
    PID:3880
- - C:\Windows\system32\svchost.exe
    "C:\Windows\system32\svchost.exe"
    3⤵
    - Checks BIOS information in registry
    - Drops startup file
    PID:3640
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe"
    3⤵
    - Checks BIOS information in registry
    - Drops startup file
    PID:3696
- - C:\Windows\explorer.exe
    "C:\Windows\explorer.exe"
    3⤵
    - Checks BIOS information in registry
    - Drops startup file
    PID:392
- - C:\Windows\system32\svchost.exe
    "C:\Windows\system32\svchost.exe"
    3⤵
    - Checks BIOS information in registry
    - Drops startup file
    PID:3592
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe"
    3⤵
    - Checks BIOS information in registry
    - Drops startup file
    PID:2304
- - C:\Windows\explorer.exe
    "C:\Windows\explorer.exe"
    3⤵
    - Checks BIOS information in registry
    - Drops startup file
    PID:1384
- - C:\Windows\system32\svchost.exe
    "C:\Windows\system32\svchost.exe"
    3⤵
    - Checks BIOS information in registry
    - Drops startup file
    PID:3112
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe"
    3⤵
    - Checks BIOS information in registry
    - Drops startup file
    PID:1984
- - C:\Windows\explorer.exe
    "C:\Windows\explorer.exe"
    3⤵
    - Checks BIOS information in registry
    - Drops startup file
    PID:4636
- - C:\Windows\system32\svchost.exe
    "C:\Windows\system32\svchost.exe"
    3⤵
    - Checks BIOS information in registry
    - Drops startup file
    PID:1540
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe"
    3⤵
    - Checks BIOS information in registry
    - Drops startup file
    PID:3680
- - C:\Windows\explorer.exe
    "C:\Windows\explorer.exe"
    3⤵
    - Checks BIOS information in registry
    - Drops startup file
    PID:4068
- - C:\Windows\system32\svchost.exe
    "C:\Windows\system32\svchost.exe"
    3⤵
    - Checks BIOS information in registry
    - Drops startup file
    PID:3284
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe"
    3⤵
    - Checks BIOS information in registry
    - Drops startup file
    PID:4436
- - C:\Windows\explorer.exe
    "C:\Windows\explorer.exe"
    3⤵
    - Checks BIOS information in registry
    - Drops startup file
    PID:2088
- - C:\Windows\system32\svchost.exe
    "C:\Windows\system32\svchost.exe"
    3⤵
    PID:3040

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\skypes\skypes.exe

Filesize
3.9MB

MD5
89670bbb58f2b067c80a1ee84805d9ec

SHA1
65a1fa96ee387cb939caeb9917469b066e7f2b97

SHA256
3db88db54e3d0e09b43b0cf3a3a20b372471b233642eef10bb20b1f834a221ec

SHA512
22bac98d5c55a969a74355f20004443cfa55f857129d7281f3316f66a052d7b0cfd0ea8da207088136e20ad549f14375660367b4f07c85c3c3e4450331fdf6c1

Download Submit
C:\ProgramData\{A066233A-295A-4130-BC98-2635C3261F6D}\{60A0A7CD-6C14-4F66-903D-AE4FD5E949BD}.bat

Filesize
99B

MD5
c5f2c50f6fd48a7856630ff3642dfd78

SHA1
dc1cf5647b96bc57f412cf967ea540b43e341951

SHA256
d80170422fddf2efc5d4c65b0cdfb1fdd2120c207e6b37373bde01b912a94eb1

SHA512
5b618ba27155e323dcf9995732e8f1f9c2ca26b79d6bf6965709f7eb9415227a90e9550d9757187a1cadd64ec956fc0694f4e4da7b349ff959188436a1983710

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
d85ba6ff808d9e5444a4b369f5bc2730

SHA1
31aa9d96590fff6981b315e0b391b575e4c0804a

SHA256
84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

SHA512
8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
6d3e9c29fe44e90aae6ed30ccf799ca8

SHA1
c7974ef72264bbdf13a2793ccf1aed11bc565dce

SHA256
2360634e63e8f0b5748e2c56ebb8f4aa78e71008ea7b5c9ca1c49be03b49557d

SHA512
60c38c4367352537545d859f64b9c5cbada94240478d1d039fd27b5ecba4dc1c90051557c16d802269703b873546ead416279c0a80c6fd5e49ad361cef22596a

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_fenmzfoi.5uu.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\{05908176-6AD5-4164-B8FF-1D602CC3B78E}.lnk

Filesize
1KB

MD5
c13f1948edf99d35426f00c811b820d6

SHA1
92f1d07618be3659d6e59170be969524ffb9f8d0

SHA256
c3affa6d0abd47047ca20ea555ccde5390bf341900ac526d982b54a704dd3305

SHA512
54ef55015712d7fe5763b25efe4ada996ed63400bf69f26186dfa3f154b30c543b60cf65f250ee16211486fd534f772da28cfcc209b61b9dbd4232b22f9c8966

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\{05908176-6AD5-4164-B8FF-1D602CC3B78E}.lnk

Filesize
1KB

MD5
1b6545500d180cfb28550c96f099e640

SHA1
ff2ece509055f73d69260a3212f85e1143423cbc

SHA256
f3e07b83765934c331df41ff2111eea4ab1a8a838386e76043120b430e21e1d5

SHA512
57de1498415774b403aa5f67d03c32ba6bed85c8b8fc39efa30fe28c76b5462f692e4a871834de06ed7d0a60901605b3a21ac5dba816949847cdda97f3b38125

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\{05908176-6AD5-4164-B8FF-1D602CC3B78E}.lnk

Filesize
1KB

MD5
a428baf5c909da5a43cbf9c87e0f6313

SHA1
b3ec2dd0f51ccdc7b9615106618b4d0cbaa4c928

SHA256
12b6f1553b56e50fe18f04cd93008ff001e472d52bb6fb6c8540eba49344e1ad

SHA512
02f4b9ca0267e5be158b61e0f53ce04c680198274ab1a11ba49bc067ecc7ee6e03e8f44ea45239bcfc1a5cd4788e2c429906baf76c1ad0b9bb710a0f5fa6945a

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\{05908176-6AD5-4164-B8FF-1D602CC3B78E}.lnk

Filesize
1KB

MD5
52ad498197c37dcadb7ee500d34c2fd7

SHA1
dd81fcb2dfa4c50e0ec12bd672956791619414f3

SHA256
7ec7ca5579e123356bb96e0ef0935cad3f47b177220333372c70ae398fa195df

SHA512
fd9b928354720d5372047aabc5671eb98c102051a237d8da947397160cd905ca4dfefee50d88880224dc3d54ea627b69886dcaf71cd43d29621519402fd91b1f

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\{05908176-6AD5-4164-B8FF-1D602CC3B78E}.lnk

Filesize
1KB

MD5
3de397bdb852fc70506c713f0f0c67aa

SHA1
4e21c16417cbb00059472611d5f87d63c26bf174

SHA256
6cf50ddaf62bb1661999d01a1600768628fe6baaf593e569c2a9a12ef02463d8

SHA512
a8f9b814e2f2eb447fc54185b40fd39e65f713c095dbce5a3cfa580d4ee0a67c7ae76925f9b5d015ceef15a74d5a5b77cfd40f28899a1fd3cb25920ce5d9ed74

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\{05908176-6AD5-4164-B8FF-1D602CC3B78E}.lnk

Filesize
1KB

MD5
cb51f13a38493ea6cdeb505ffb94e1cf

SHA1
ea1c2fd282d9aaad7902c97c3c0b45b363d3e78c

SHA256
310c8dfc2635d8a4bf86f8a022d514b4701c17359837b5aa4389edb5835feeea

SHA512
f6039ebe292e4d7aaf9904480c64088e646d435e894ecb163b00f1b9b94cffdeea9869d1b5ae31d68276193b596a40fe0cee66def787664833e7684eec79c313

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\{05908176-6AD5-4164-B8FF-1D602CC3B78E}.lnk

Filesize
1KB

MD5
92a5a1857c6567ac69056a7d927e363b

SHA1
71c3cea5f9bcf331f20294c133a9d1ec4bfb5ef7

SHA256
e7d5aa29e7eb40a4ccc18e0194b7ceb4f096b090394974ab07a525595e7898f8

SHA512
65e554ece73ae5f800ea1644b9121c8c7ebadf8dc065c578986274b92837257b39c4b9c124cf709705a08c7757ff875b71ae4ca54bf31fa88a0b01acb2596b96

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\{05908176-6AD5-4164-B8FF-1D602CC3B78E}.lnk

Filesize
1KB

MD5
43b5146098f1599c361141cb6d012d58

SHA1
6cc3e7281e399e931db8a52c477fe8f60d017308

SHA256
abb350467e47335ff43987bbedf764e0a5f8ae3da0295966103b5d2356cf176e

SHA512
6900c4833a85a0a992895cef39a4a8c6ccadd389881d94ac51138c6e7d55244f533c5f7fbf2d0f5a55c7f35b14777a459213e16c9df6ba839d8ede4fcacd2d34

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\{05908176-6AD5-4164-B8FF-1D602CC3B78E}.lnk

Filesize
1KB

MD5
06b85a299d0cc54ad4694150877a3dea

SHA1
beea66b0a1ae01a8c4486a5ed8edf1e22a349381

SHA256
673fefe44e149c43d8db349e8636a198b6a3c7830cd914bd53cf8c4780ab9a5a

SHA512
cf0ad0774182e2c24e2bb164f9cafe6d174df2c24b80e9d12aab54a84ae01ab1c1e495f528e3e85fa6e3d0a53b974f10f82b12483610586a68d56acbbe019e87

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\{05908176-6AD5-4164-B8FF-1D602CC3B78E}.lnk

Filesize
1KB

MD5
eae788b835d400ff5d848f0ed880549f

SHA1
ebcc58f3911eaded1eeb890a60d6d51071388508

SHA256
3a681544e1614677e1842b66b4ebdce2f4c6cdb770db718ded1fff66928fbb05

SHA512
098166950cf1dc0a3a30ff44f44a3c7a883388a10620c6abd4ff303d1c6066a1143bc7af5d20ca47dfadaa518785a0c4640755435407f9e6acece48a6124057f

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\{05908176-6AD5-4164-B8FF-1D602CC3B78E}.lnk

Filesize
1KB

MD5
e9887eb23a872436887dbbaebcdc8d73

SHA1
89bd3876c58b4ef1c82866e0bf448c5a4c4086c3

SHA256
46fc4a77c7712ee0c910c1c04a625b64f4f9f13242fb096b647a74b246d8ada4

SHA512
58d5ae9bf5a26ee82173a32effdd22c22cdadabb379d845fedf3dd3af265e4395f173ae4ed0dafa8d7b3b64d16c479af3ab10262ed7968de5a650b45564e5ad3

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\{05908176-6AD5-4164-B8FF-1D602CC3B78E}.lnk

Filesize
1KB

MD5
c1083acf3630c95608ae1d8e94568b8e

SHA1
225c2aab45791358dc66f673b4e34ed610588091

SHA256
c0f17be516e9c64efb6e4b8eb5e7a101558ffb9aaccda1d7d1bad9473d239316

SHA512
33af133c3dfd923144e9a2b98cd0697836cb4533ab99cdc84d1f9bfa4d2de5936fcca07494d2ba11b27876531be59d96dfb5cffe83f90614fbb0e1a06a606a5e

Download Submit
memory/1228-25-0x00007FFB10F00000-0x00007FFB119C1000-memory.dmp

Filesize
10.8MB

Download
memory/1228-21-0x0000020213D20000-0x0000020213D30000-memory.dmp

Filesize
64KB

Download
memory/1228-22-0x0000020213D20000-0x0000020213D30000-memory.dmp

Filesize
64KB

Download
memory/1228-20-0x00007FFB10F00000-0x00007FFB119C1000-memory.dmp

Filesize
10.8MB

Download
memory/1228-16-0x000002022E370000-0x000002022E392000-memory.dmp

Filesize
136KB

Download
memory/1584-301-0x00007FFB2F530000-0x00007FFB2F725000-memory.dmp

Filesize
2.0MB

Download
memory/1584-307-0x0000000002E90000-0x000000000327F000-memory.dmp

Filesize
3.9MB

Download
memory/1584-340-0x0000000002E90000-0x000000000327F000-memory.dmp

Filesize
3.9MB

Download
memory/1584-276-0x0000000002E90000-0x000000000327F000-memory.dmp

Filesize
3.9MB

Download
memory/1584-279-0x0000000002E90000-0x000000000327F000-memory.dmp

Filesize
3.9MB

Download
memory/1584-341-0x00007FFB2F530000-0x00007FFB2F725000-memory.dmp

Filesize
2.0MB

Download
memory/1692-454-0x00007FFB2F530000-0x00007FFB2F725000-memory.dmp

Filesize
2.0MB

Download
memory/1692-432-0x0000029926B90000-0x0000029926F7F000-memory.dmp

Filesize
3.9MB

Download
memory/1692-429-0x0000029926B90000-0x0000029926F7F000-memory.dmp

Filesize
3.9MB

Download
memory/1692-459-0x0000029926B90000-0x0000029926F7F000-memory.dmp

Filesize
3.9MB

Download
memory/1692-492-0x0000029926B90000-0x0000029926F7F000-memory.dmp

Filesize
3.9MB

Download
memory/1692-493-0x00007FFB2F530000-0x00007FFB2F725000-memory.dmp

Filesize
2.0MB

Download
memory/1900-124-0x0000023D017E0000-0x0000023D01BCF000-memory.dmp

Filesize
3.9MB

Download
memory/1900-190-0x00007FFB2F530000-0x00007FFB2F725000-memory.dmp

Filesize
2.0MB

Download
memory/1900-189-0x0000023D017E0000-0x0000023D01BCF000-memory.dmp

Filesize
3.9MB

Download
memory/1900-159-0x0000023D017E0000-0x0000023D01BCF000-memory.dmp

Filesize
3.9MB

Download
memory/1900-153-0x00007FFB2F530000-0x00007FFB2F725000-memory.dmp

Filesize
2.0MB

Download
memory/1900-127-0x0000023D017E0000-0x0000023D01BCF000-memory.dmp

Filesize
3.9MB

Download
memory/2276-417-0x0000010F273A0000-0x0000010F2778F000-memory.dmp

Filesize
3.9MB

Download
memory/2276-351-0x0000010F273A0000-0x0000010F2778F000-memory.dmp

Filesize
3.9MB

Download
memory/2276-418-0x00007FFB2F530000-0x00007FFB2F725000-memory.dmp

Filesize
2.0MB

Download
memory/2276-384-0x0000010F273A0000-0x0000010F2778F000-memory.dmp

Filesize
3.9MB

Download
memory/2276-377-0x00007FFB2F530000-0x00007FFB2F725000-memory.dmp

Filesize
2.0MB

Download
memory/2276-353-0x0000010F273A0000-0x0000010F2778F000-memory.dmp

Filesize
3.9MB

Download
memory/3440-63-0x0000000003030000-0x000000000341F000-memory.dmp

Filesize
3.9MB

Download
memory/3440-78-0x0000000003030000-0x000000000341F000-memory.dmp

Filesize
3.9MB

Download
memory/3440-80-0x0000000003030000-0x000000000341F000-memory.dmp

Filesize
3.9MB

Download
memory/3440-85-0x0000000003030000-0x000000000341F000-memory.dmp

Filesize
3.9MB

Download
memory/3440-81-0x0000000003030000-0x000000000341F000-memory.dmp

Filesize
3.9MB

Download
memory/3440-79-0x00007FFB2F530000-0x00007FFB2F725000-memory.dmp

Filesize
2.0MB

Download
memory/3440-71-0x0000000003030000-0x000000000341F000-memory.dmp

Filesize
3.9MB

Download
memory/3440-86-0x0000000003030000-0x000000000341F000-memory.dmp

Filesize
3.9MB

Download
memory/3440-87-0x0000000003030000-0x000000000341F000-memory.dmp

Filesize
3.9MB

Download
memory/3440-113-0x00007FFB2F530000-0x00007FFB2F725000-memory.dmp

Filesize
2.0MB

Download
memory/3440-70-0x0000000003030000-0x000000000341F000-memory.dmp

Filesize
3.9MB

Download
memory/3440-69-0x0000000003030000-0x000000000341F000-memory.dmp

Filesize
3.9MB

Download
memory/3440-72-0x0000000003030000-0x000000000341F000-memory.dmp

Filesize
3.9MB

Download
memory/3440-68-0x0000000003030000-0x000000000341F000-memory.dmp

Filesize
3.9MB

Download
memory/3440-26-0x0000000000DA0000-0x0000000000DA1000-memory.dmp

Filesize
4KB

Download
memory/3440-67-0x0000000003030000-0x000000000341F000-memory.dmp

Filesize
3.9MB

Download
memory/3440-66-0x0000000003030000-0x000000000341F000-memory.dmp

Filesize
3.9MB

Download
memory/3440-27-0x0000000003030000-0x000000000341F000-memory.dmp

Filesize
3.9MB

Download
memory/3440-39-0x0000000003030000-0x000000000341F000-memory.dmp

Filesize
3.9MB

Download
memory/3440-36-0x0000000003030000-0x000000000341F000-memory.dmp

Filesize
3.9MB

Download
memory/3440-40-0x0000000003030000-0x000000000341F000-memory.dmp

Filesize
3.9MB

Download
memory/3440-41-0x0000000003030000-0x000000000341F000-memory.dmp

Filesize
3.9MB

Download
memory/3440-73-0x0000000003030000-0x000000000341F000-memory.dmp

Filesize
3.9MB

Download
memory/3440-37-0x0000000003030000-0x000000000341F000-memory.dmp

Filesize
3.9MB

Download
memory/3440-61-0x0000000003030000-0x000000000341F000-memory.dmp

Filesize
3.9MB

Download
memory/3440-42-0x0000000003030000-0x000000000341F000-memory.dmp

Filesize
3.9MB

Download
memory/3440-34-0x0000000003030000-0x000000000341F000-memory.dmp

Filesize
3.9MB

Download
memory/3440-35-0x0000000003030000-0x000000000341F000-memory.dmp

Filesize
3.9MB

Download
memory/3440-38-0x0000000003030000-0x000000000341F000-memory.dmp

Filesize
3.9MB

Download
memory/3440-59-0x0000000003030000-0x000000000341F000-memory.dmp

Filesize
3.9MB

Download
memory/3440-57-0x0000000003030000-0x000000000341F000-memory.dmp

Filesize
3.9MB

Download
memory/3440-44-0x0000000003030000-0x000000000341F000-memory.dmp

Filesize
3.9MB

Download
memory/3440-45-0x0000000003030000-0x000000000341F000-memory.dmp

Filesize
3.9MB

Download
memory/3440-43-0x0000000003030000-0x000000000341F000-memory.dmp

Filesize
3.9MB

Download
memory/3440-77-0x0000000003030000-0x000000000341F000-memory.dmp

Filesize
3.9MB

Download
memory/3440-76-0x0000000003030000-0x000000000341F000-memory.dmp

Filesize
3.9MB

Download
memory/3440-75-0x0000000003030000-0x000000000341F000-memory.dmp

Filesize
3.9MB

Download
memory/3440-74-0x0000000003030000-0x000000000341F000-memory.dmp

Filesize
3.9MB

Download
memory/3500-579-0x0000024A66E70000-0x0000024A6725F000-memory.dmp

Filesize
3.9MB

Download
memory/3500-581-0x0000024A66E70000-0x0000024A6725F000-memory.dmp

Filesize
3.9MB

Download
memory/3500-612-0x0000024A66E70000-0x0000024A6725F000-memory.dmp

Filesize
3.9MB

Download
memory/3500-645-0x0000024A66E70000-0x0000024A6725F000-memory.dmp

Filesize
3.9MB

Download
memory/3500-605-0x00007FFB2F530000-0x00007FFB2F725000-memory.dmp

Filesize
2.0MB

Download
memory/3500-646-0x00007FFB2F530000-0x00007FFB2F725000-memory.dmp

Filesize
2.0MB

Download
memory/4148-150-0x00007FF757790000-0x00007FF757B7F000-memory.dmp

Filesize
3.9MB

Download
memory/4148-7-0x00007FF757790000-0x00007FF757B7F000-memory.dmp

Filesize
3.9MB

Download
memory/4148-8-0x00007FFB2F530000-0x00007FFB2F725000-memory.dmp

Filesize
2.0MB

Download
memory/4148-155-0x00007FFB2F530000-0x00007FFB2F725000-memory.dmp

Filesize
2.0MB

Download
memory/4436-65-0x00007FFB10F00000-0x00007FFB119C1000-memory.dmp

Filesize
10.8MB

Download
memory/4436-58-0x00007FFB10F00000-0x00007FFB119C1000-memory.dmp

Filesize
10.8MB

Download
memory/4436-60-0x000001D9E47F0000-0x000001D9E4800000-memory.dmp

Filesize
64KB

Download
memory/4436-62-0x000001D9E47F0000-0x000001D9E4800000-memory.dmp

Filesize
64KB

Download
memory/4604-535-0x0000000002D00000-0x00000000030EF000-memory.dmp

Filesize
3.9MB

Download
memory/4604-569-0x00007FFB2F530000-0x00007FFB2F725000-memory.dmp

Filesize
2.0MB

Download
memory/4604-504-0x0000000002D00000-0x00000000030EF000-memory.dmp

Filesize
3.9MB

Download
memory/4604-506-0x0000000002D00000-0x00000000030EF000-memory.dmp

Filesize
3.9MB

Download
memory/4604-529-0x00007FFB2F530000-0x00007FFB2F725000-memory.dmp

Filesize
2.0MB

Download
memory/4604-568-0x0000000002D00000-0x00000000030EF000-memory.dmp

Filesize
3.9MB

Download
memory/4884-0-0x00007FF677680000-0x00007FF677A6F000-memory.dmp

Filesize
3.9MB

Download
memory/4884-2-0x00007FFB2F530000-0x00007FFB2F725000-memory.dmp

Filesize
2.0MB

Download
memory/4884-6-0x00007FF677680000-0x00007FF677A6F000-memory.dmp

Filesize
3.9MB

Download
memory/4884-9-0x00007FFB2F530000-0x00007FFB2F725000-memory.dmp

Filesize
2.0MB

Download
memory/4904-656-0x000001D474F00000-0x000001D4752EF000-memory.dmp

Filesize
3.9MB

Download
memory/4928-265-0x00007FFB2F530000-0x00007FFB2F725000-memory.dmp

Filesize
2.0MB

Download
memory/4928-200-0x000002A960A80000-0x000002A960E6F000-memory.dmp

Filesize
3.9MB

Download
memory/4928-201-0x000002A960A80000-0x000002A960E6F000-memory.dmp

Filesize
3.9MB

Download
memory/4928-226-0x00007FFB2F530000-0x00007FFB2F725000-memory.dmp

Filesize
2.0MB

Download
memory/4928-231-0x000002A960A80000-0x000002A960E6F000-memory.dmp

Filesize
3.9MB

Download
memory/4928-264-0x000002A960A80000-0x000002A960E6F000-memory.dmp

Filesize
3.9MB

Download