ceecefcf9cdd5c58e5b934ae568c241986f85df3ba4648dc925fc93b2243cbf8

Analysis

max time kernel
149s
max time network
129s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
23-05-2024 01:32

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

plpscripts_freeV2/auto_setup_install.bat
Size

2KB
MD5

bdba7ddafbddca1a9bd0ed4646819426
SHA1

9a69db7ab775800ce12e7c05e0193046b6d9ee04
SHA256

160184eb890d9d25418bba37efb2fabedb93b333de9a1fd291e233e750344a15
SHA512

7d46bc1c8723a43fe0b9a8bce21be3abad96b6bba9558bc564b9e6adfc8eebd5c94bae8839f1d4d46654a15a46398ada29aad33d18fc49efe8468d8841c69898

Score

10^/10

discovery execution

Malware Config

Extracted

Language

ps1

Deobfuscated

URLs

exe.dropper

https://www.python.org/ftp/python/3.10.5/python-3.10.5-amd64.exe

Signatures

Blocklisted process makes network request 1 IoCs

Processes:

powershell.exe

flow pid process

6 756 powershell.exe
Downloads MZ/PE file
Executes dropped EXE 2 IoCs

Processes:

python_installer.exepython_installer.exe

pid process

4872 python_installer.exe
3560 python_installer.exe
Loads dropped DLL 1 IoCs

Processes:

python_installer.exe

pid process

3560 python_installer.exe
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Using powershell.exe command.
execution

PowerShell
T1059.001

Processes:

powershell.exe

pid process

756 powershell.exe

flow	pid	process
6	756	powershell.exe

pid	process
4872	python_installer.exe
3560	python_installer.exe

pid	process
3560	python_installer.exe

pid	process
756	powershell.exe

Delays execution with timeout.exe 64 IoCs

evasion

Processes:

timeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exe

pid	process
4852	timeout.exe
1168	timeout.exe
5100	timeout.exe
2068	timeout.exe
232	timeout.exe
4016	timeout.exe
4656	timeout.exe
3320	timeout.exe
4480	timeout.exe
2692	timeout.exe
1720	timeout.exe
3176	timeout.exe
2628	timeout.exe
4076	timeout.exe
3340	timeout.exe
232	timeout.exe
232	timeout.exe
1308	timeout.exe
4888	timeout.exe
4972	timeout.exe
3040	timeout.exe
5036	timeout.exe
1704	timeout.exe
696	timeout.exe
4568	timeout.exe
4744	timeout.exe
3064	timeout.exe
4448	timeout.exe
4904	timeout.exe
3340	timeout.exe
5104	timeout.exe
4264	timeout.exe
4676	timeout.exe
2796	timeout.exe
4172	timeout.exe
2012	timeout.exe
3160	timeout.exe
4080	timeout.exe
2068	timeout.exe
2216	timeout.exe
3572	timeout.exe
2552	timeout.exe
4596	timeout.exe
1984	timeout.exe
4900	timeout.exe
2632	timeout.exe
4084	timeout.exe
3324	timeout.exe
5084	timeout.exe
2136	timeout.exe
2088	timeout.exe
2452	timeout.exe
1272	timeout.exe
3632	timeout.exe
1888	timeout.exe
4900	timeout.exe
4036	timeout.exe
4488	timeout.exe
1364	timeout.exe
3920	timeout.exe
216	timeout.exe
2592	timeout.exe
1476	timeout.exe
4040	timeout.exe

Enumerates processes with tasklist 1 TTPs 64 IoCs

Process Discovery

T1057

Processes:

tasklist.exetasklist.exetasklist.exetasklist.exetasklist.exetasklist.exetasklist.exetasklist.exetasklist.exetasklist.exetasklist.exetasklist.exetasklist.exetasklist.exetasklist.exetasklist.exetasklist.exetasklist.exetasklist.exetasklist.exetasklist.exetasklist.exetasklist.exetasklist.exetasklist.exetasklist.exetasklist.exetasklist.exetasklist.exetasklist.exetasklist.exetasklist.exetasklist.exetasklist.exetasklist.exetasklist.exetasklist.exetasklist.exetasklist.exetasklist.exetasklist.exetasklist.exetasklist.exetasklist.exetasklist.exetasklist.exetasklist.exetasklist.exetasklist.exetasklist.exetasklist.exetasklist.exetasklist.exetasklist.exetasklist.exetasklist.exetasklist.exetasklist.exetasklist.exetasklist.exetasklist.exetasklist.exetasklist.exetasklist.exe

pid	process
1476	tasklist.exe
1336	tasklist.exe
1704	tasklist.exe
2096	tasklist.exe
884	tasklist.exe
4768	tasklist.exe
2640	tasklist.exe
2992	tasklist.exe
1624	tasklist.exe
3036	tasklist.exe
636	tasklist.exe
1532	tasklist.exe
468	tasklist.exe
2032	tasklist.exe
2260	tasklist.exe
2032	tasklist.exe
3700	tasklist.exe
3852	tasklist.exe
1272	tasklist.exe
3044	tasklist.exe
3480	tasklist.exe
4012	tasklist.exe
396	tasklist.exe
2592	tasklist.exe
4416	tasklist.exe
1280	tasklist.exe
4936	tasklist.exe
1272	tasklist.exe
3788	tasklist.exe
2064	tasklist.exe
4044	tasklist.exe
3048	tasklist.exe
2528	tasklist.exe
4888	tasklist.exe
2656	tasklist.exe
3164	tasklist.exe
5004	tasklist.exe
920	tasklist.exe
1484	tasklist.exe
1552	tasklist.exe
1720	tasklist.exe
2608	tasklist.exe
4728	tasklist.exe
2008	tasklist.exe
4044	tasklist.exe
4340	tasklist.exe
4016	tasklist.exe
1312	tasklist.exe
3064	tasklist.exe
3872	tasklist.exe
1308	tasklist.exe
2724	tasklist.exe
972	tasklist.exe
5056	tasklist.exe
2016	tasklist.exe
5116	tasklist.exe
5060	tasklist.exe
1120	tasklist.exe
4728	tasklist.exe
1044	tasklist.exe
4652	tasklist.exe
1948	tasklist.exe
4124	tasklist.exe
3320	tasklist.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

powershell.exe

pid process

756 powershell.exe
756 powershell.exe

pid	process
756	powershell.exe
756	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

powershell.exetasklist.exetasklist.exetasklist.exetasklist.exetasklist.exetasklist.exetasklist.exetasklist.exetasklist.exetasklist.exetasklist.exetasklist.exetasklist.exetasklist.exetasklist.exetasklist.exetasklist.exetasklist.exetasklist.exetasklist.exetasklist.exetasklist.exetasklist.exetasklist.exetasklist.exetasklist.exetasklist.exetasklist.exetasklist.exetasklist.exetasklist.exetasklist.exetasklist.exetasklist.exetasklist.exetasklist.exetasklist.exetasklist.exetasklist.exetasklist.exetasklist.exetasklist.exetasklist.exetasklist.exetasklist.exetasklist.exetasklist.exetasklist.exetasklist.exetasklist.exetasklist.exetasklist.exetasklist.exetasklist.exetasklist.exetasklist.exetasklist.exetasklist.exetasklist.exetasklist.exetasklist.exetasklist.exetasklist.exe

description	pid	process
Token: SeDebugPrivilege	756	powershell.exe
Token: SeDebugPrivilege	972	tasklist.exe
Token: SeDebugPrivilege	2260	tasklist.exe
Token: SeDebugPrivilege	5056	tasklist.exe
Token: SeDebugPrivilege	2592	tasklist.exe
Token: SeDebugPrivilege	4728	tasklist.exe
Token: SeDebugPrivilege	2096	tasklist.exe
Token: SeDebugPrivilege	3320	tasklist.exe
Token: SeDebugPrivilege	1484	tasklist.exe
Token: SeDebugPrivilege	1552	tasklist.exe
Token: SeDebugPrivilege	1312	tasklist.exe
Token: SeDebugPrivilege	884	tasklist.exe
Token: SeDebugPrivilege	2032	tasklist.exe
Token: SeDebugPrivilege	3788	tasklist.exe
Token: SeDebugPrivilege	1308	tasklist.exe
Token: SeDebugPrivilege	1044	tasklist.exe
Token: SeDebugPrivilege	4652	tasklist.exe
Token: SeDebugPrivilege	1476	tasklist.exe
Token: SeDebugPrivilege	4768	tasklist.exe
Token: SeDebugPrivilege	1948	tasklist.exe
Token: SeDebugPrivilege	4728	tasklist.exe
Token: SeDebugPrivilege	5104	tasklist.exe
Token: SeDebugPrivilege	2008	tasklist.exe
Token: SeDebugPrivilege	1624	tasklist.exe
Token: SeDebugPrivilege	2064	tasklist.exe
Token: SeDebugPrivilege	2640	tasklist.exe
Token: SeDebugPrivilege	3700	tasklist.exe
Token: SeDebugPrivilege	4044	tasklist.exe
Token: SeDebugPrivilege	3852	tasklist.exe
Token: SeDebugPrivilege	2528	tasklist.exe
Token: SeDebugPrivilege	1272	tasklist.exe
Token: SeDebugPrivilege	4888	tasklist.exe
Token: SeDebugPrivilege	1336	tasklist.exe
Token: SeDebugPrivilege	4340	tasklist.exe
Token: SeDebugPrivilege	2016	tasklist.exe
Token: SeDebugPrivilege	5116	tasklist.exe
Token: SeDebugPrivilege	2656	tasklist.exe
Token: SeDebugPrivilege	3036	tasklist.exe
Token: SeDebugPrivilege	4416	tasklist.exe
Token: SeDebugPrivilege	5060	tasklist.exe
Token: SeDebugPrivilege	3044	tasklist.exe
Token: SeDebugPrivilege	2724	tasklist.exe
Token: SeDebugPrivilege	3164	tasklist.exe
Token: SeDebugPrivilege	944	tasklist.exe
Token: SeDebugPrivilege	4044	tasklist.exe
Token: SeDebugPrivilege	5004	tasklist.exe
Token: SeDebugPrivilege	636	tasklist.exe
Token: SeDebugPrivilege	2992	tasklist.exe
Token: SeDebugPrivilege	4012	tasklist.exe
Token: SeDebugPrivilege	4016	tasklist.exe
Token: SeDebugPrivilege	1704	tasklist.exe
Token: SeDebugPrivilege	4936	tasklist.exe
Token: SeDebugPrivilege	396	tasklist.exe
Token: SeDebugPrivilege	920	tasklist.exe
Token: SeDebugPrivilege	1120	tasklist.exe
Token: SeDebugPrivilege	1280	tasklist.exe
Token: SeDebugPrivilege	4172	tasklist.exe
Token: SeDebugPrivilege	468	tasklist.exe
Token: SeDebugPrivilege	1532	tasklist.exe
Token: SeDebugPrivilege	2700	tasklist.exe
Token: SeDebugPrivilege	3064	tasklist.exe
Token: SeDebugPrivilege	2032	tasklist.exe
Token: SeDebugPrivilege	1272	tasklist.exe
Token: SeDebugPrivilege	3048	tasklist.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

cmd.exepython_installer.exe

description	pid	process	target process
PID 4412 wrote to memory of 4768	4412	cmd.exe	cacls.exe
PID 4412 wrote to memory of 4768	4412	cmd.exe	cacls.exe
PID 4412 wrote to memory of 756	4412	cmd.exe	powershell.exe
PID 4412 wrote to memory of 756	4412	cmd.exe	powershell.exe
PID 4412 wrote to memory of 4872	4412	cmd.exe	python_installer.exe
PID 4412 wrote to memory of 4872	4412	cmd.exe	python_installer.exe
PID 4412 wrote to memory of 4872	4412	cmd.exe	python_installer.exe
PID 4412 wrote to memory of 4744	4412	cmd.exe	timeout.exe
PID 4412 wrote to memory of 4744	4412	cmd.exe	timeout.exe
PID 4872 wrote to memory of 3560	4872	python_installer.exe	python_installer.exe
PID 4872 wrote to memory of 3560	4872	python_installer.exe	python_installer.exe
PID 4872 wrote to memory of 3560	4872	python_installer.exe	python_installer.exe
PID 4412 wrote to memory of 972	4412	cmd.exe	tasklist.exe
PID 4412 wrote to memory of 972	4412	cmd.exe	tasklist.exe
PID 4412 wrote to memory of 1900	4412	cmd.exe	find.exe
PID 4412 wrote to memory of 1900	4412	cmd.exe	find.exe
PID 4412 wrote to memory of 232	4412	cmd.exe	timeout.exe
PID 4412 wrote to memory of 232	4412	cmd.exe	timeout.exe
PID 4412 wrote to memory of 2260	4412	cmd.exe	tasklist.exe
PID 4412 wrote to memory of 2260	4412	cmd.exe	tasklist.exe
PID 4412 wrote to memory of 212	4412	cmd.exe	find.exe
PID 4412 wrote to memory of 212	4412	cmd.exe	find.exe
PID 4412 wrote to memory of 5036	4412	cmd.exe	timeout.exe
PID 4412 wrote to memory of 5036	4412	cmd.exe	timeout.exe
PID 4412 wrote to memory of 5056	4412	cmd.exe	tasklist.exe
PID 4412 wrote to memory of 5056	4412	cmd.exe	tasklist.exe
PID 4412 wrote to memory of 4332	4412	cmd.exe	find.exe
PID 4412 wrote to memory of 4332	4412	cmd.exe	find.exe
PID 4412 wrote to memory of 2632	4412	cmd.exe	timeout.exe
PID 4412 wrote to memory of 2632	4412	cmd.exe	timeout.exe
PID 4412 wrote to memory of 2592	4412	cmd.exe	tasklist.exe
PID 4412 wrote to memory of 2592	4412	cmd.exe	tasklist.exe
PID 4412 wrote to memory of 4660	4412	cmd.exe	find.exe
PID 4412 wrote to memory of 4660	4412	cmd.exe	find.exe
PID 4412 wrote to memory of 216	4412	cmd.exe	timeout.exe
PID 4412 wrote to memory of 216	4412	cmd.exe	timeout.exe
PID 4412 wrote to memory of 4728	4412	cmd.exe	tasklist.exe
PID 4412 wrote to memory of 4728	4412	cmd.exe	tasklist.exe
PID 4412 wrote to memory of 2476	4412	cmd.exe	find.exe
PID 4412 wrote to memory of 2476	4412	cmd.exe	find.exe
PID 4412 wrote to memory of 1704	4412	cmd.exe	timeout.exe
PID 4412 wrote to memory of 1704	4412	cmd.exe	timeout.exe
PID 4412 wrote to memory of 2096	4412	cmd.exe	tasklist.exe
PID 4412 wrote to memory of 2096	4412	cmd.exe	tasklist.exe
PID 4412 wrote to memory of 4452	4412	cmd.exe	find.exe
PID 4412 wrote to memory of 4452	4412	cmd.exe	find.exe
PID 4412 wrote to memory of 4416	4412	cmd.exe	timeout.exe
PID 4412 wrote to memory of 4416	4412	cmd.exe	timeout.exe
PID 4412 wrote to memory of 3320	4412	cmd.exe	tasklist.exe
PID 4412 wrote to memory of 3320	4412	cmd.exe	tasklist.exe
PID 4412 wrote to memory of 2996	4412	cmd.exe	find.exe
PID 4412 wrote to memory of 2996	4412	cmd.exe	find.exe
PID 4412 wrote to memory of 4084	4412	cmd.exe	timeout.exe
PID 4412 wrote to memory of 4084	4412	cmd.exe	timeout.exe
PID 4412 wrote to memory of 1484	4412	cmd.exe	tasklist.exe
PID 4412 wrote to memory of 1484	4412	cmd.exe	tasklist.exe
PID 4412 wrote to memory of 3984	4412	cmd.exe	find.exe
PID 4412 wrote to memory of 3984	4412	cmd.exe	find.exe
PID 4412 wrote to memory of 4172	4412	cmd.exe	timeout.exe
PID 4412 wrote to memory of 4172	4412	cmd.exe	timeout.exe
PID 4412 wrote to memory of 1552	4412	cmd.exe	tasklist.exe
PID 4412 wrote to memory of 1552	4412	cmd.exe	tasklist.exe
PID 4412 wrote to memory of 3080	4412	cmd.exe	find.exe
PID 4412 wrote to memory of 3080	4412	cmd.exe	find.exe

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\plpscripts_freeV2\auto_setup_install.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:4412

C:\Windows\system32\cacls.exe
"C:\Windows\system32\cacls.exe" "C:\Windows\system32\config\system"
2⤵
PID:4768

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell -command "(New-Object System.Net.WebClient).DownloadFile('https://www.python.org/ftp/python/3.10.5/python-3.10.5-amd64.exe', 'C:\Users\Admin\AppData\Local\Temp\python_installer.exe')"
2⤵
- Blocklisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:756

C:\Users\Admin\AppData\Local\Temp\python_installer.exe
"C:\Users\Admin\AppData\Local\Temp\python_installer.exe"
2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4872

C:\Windows\Temp\{212DF1B3-4710-48F1-99C6-2E1367E33771}\.cr\python_installer.exe
"C:\Windows\Temp\{212DF1B3-4710-48F1-99C6-2E1367E33771}\.cr\python_installer.exe" -burn.clean.room="C:\Users\Admin\AppData\Local\Temp\python_installer.exe" -burn.filehandle.attached=552 -burn.filehandle.self=560
3⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3560

C:\Windows\system32\timeout.exe
timeout /t 2 /nobreak
2⤵
- Delays execution with timeout.exe
PID:4744

C:\Windows\system32\tasklist.exe
tasklist
2⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
PID:972

C:\Windows\system32\find.exe
find /i "python_installer.exe"
2⤵
PID:1900

C:\Windows\system32\timeout.exe
timeout /t 2 /nobreak
2⤵
- Delays execution with timeout.exe
PID:232

C:\Windows\system32\tasklist.exe
tasklist
2⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
PID:2260

C:\Windows\system32\find.exe
find /i "python_installer.exe"
2⤵
PID:212

C:\Windows\system32\timeout.exe
timeout /t 2 /nobreak
2⤵
- Delays execution with timeout.exe
PID:5036

C:\Windows\system32\tasklist.exe
tasklist
2⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
PID:5056

C:\Windows\system32\find.exe
find /i "python_installer.exe"
2⤵
PID:4332

C:\Windows\system32\timeout.exe
timeout /t 2 /nobreak
2⤵
- Delays execution with timeout.exe
PID:2632

C:\Windows\system32\tasklist.exe
tasklist
2⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
PID:2592

C:\Windows\system32\find.exe
find /i "python_installer.exe"
2⤵
PID:4660

C:\Windows\system32\timeout.exe
timeout /t 2 /nobreak
2⤵
- Delays execution with timeout.exe
PID:216

C:\Windows\system32\tasklist.exe
tasklist
2⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
PID:4728

C:\Windows\system32\find.exe
find /i "python_installer.exe"
2⤵
PID:2476

C:\Windows\system32\timeout.exe
timeout /t 2 /nobreak
2⤵
- Delays execution with timeout.exe
PID:1704

C:\Windows\system32\tasklist.exe
tasklist
2⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
PID:2096

C:\Windows\system32\find.exe
find /i "python_installer.exe"
2⤵
PID:4452

C:\Windows\system32\timeout.exe
timeout /t 2 /nobreak
2⤵
PID:4416

C:\Windows\system32\tasklist.exe
tasklist
2⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
PID:3320

C:\Windows\system32\find.exe
find /i "python_installer.exe"
2⤵
PID:2996

C:\Windows\system32\timeout.exe
timeout /t 2 /nobreak
2⤵
- Delays execution with timeout.exe
PID:4084

C:\Windows\system32\tasklist.exe
tasklist
2⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
PID:1484

C:\Windows\system32\find.exe
find /i "python_installer.exe"
2⤵
PID:3984

C:\Windows\system32\timeout.exe
timeout /t 2 /nobreak
2⤵
- Delays execution with timeout.exe
PID:4172

C:\Windows\system32\tasklist.exe
tasklist
2⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
PID:1552

C:\Windows\system32\find.exe
find /i "python_installer.exe"
2⤵
PID:3080

C:\Windows\system32\timeout.exe
timeout /t 2 /nobreak
2⤵
- Delays execution with timeout.exe
PID:3064

C:\Windows\system32\tasklist.exe
tasklist
2⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
PID:1312

C:\Windows\system32\find.exe
find /i "python_installer.exe"
2⤵
PID:744

C:\Windows\system32\timeout.exe
timeout /t 2 /nobreak
2⤵
- Delays execution with timeout.exe
PID:2452

C:\Windows\system32\tasklist.exe
tasklist
2⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
PID:884

C:\Windows\system32\find.exe
find /i "python_installer.exe"
2⤵
PID:4032

C:\Windows\system32\timeout.exe
timeout /t 2 /nobreak
2⤵
- Delays execution with timeout.exe
PID:2692

C:\Windows\system32\tasklist.exe
tasklist
2⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
PID:2032

C:\Windows\system32\find.exe
find /i "python_installer.exe"
2⤵
PID:4348

C:\Windows\system32\timeout.exe
timeout /t 2 /nobreak
2⤵
- Delays execution with timeout.exe
PID:2216

C:\Windows\system32\tasklist.exe
tasklist
2⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
PID:3788

C:\Windows\system32\find.exe
find /i "python_installer.exe"
2⤵
PID:532

C:\Windows\system32\timeout.exe
timeout /t 2 /nobreak
2⤵
- Delays execution with timeout.exe
PID:1272

C:\Windows\system32\tasklist.exe
tasklist
2⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
PID:1308

C:\Windows\system32\find.exe
find /i "python_installer.exe"
2⤵
PID:4048

C:\Windows\system32\timeout.exe
timeout /t 2 /nobreak
2⤵
- Delays execution with timeout.exe
PID:3572

C:\Windows\system32\tasklist.exe
tasklist
2⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
PID:1044

C:\Windows\system32\find.exe
find /i "python_installer.exe"
2⤵
PID:972

C:\Windows\system32\timeout.exe
timeout /t 2 /nobreak
2⤵
- Delays execution with timeout.exe
PID:232

C:\Windows\system32\tasklist.exe
tasklist
2⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
PID:4652

C:\Windows\system32\find.exe
find /i "python_installer.exe"
2⤵
PID:2260

C:\Windows\system32\timeout.exe
timeout /t 2 /nobreak
2⤵
- Delays execution with timeout.exe
PID:1720

C:\Windows\system32\tasklist.exe
tasklist
2⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
PID:1476

C:\Windows\system32\find.exe
find /i "python_installer.exe"
2⤵
PID:4324

C:\Windows\system32\timeout.exe
timeout /t 2 /nobreak
2⤵
- Delays execution with timeout.exe
PID:2552

C:\Windows\system32\tasklist.exe
tasklist
2⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
PID:4768

C:\Windows\system32\find.exe
find /i "python_installer.exe"
2⤵
PID:2344

C:\Windows\system32\timeout.exe
timeout /t 2 /nobreak
2⤵
- Delays execution with timeout.exe
PID:696

C:\Windows\system32\tasklist.exe
tasklist
2⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
PID:1948

C:\Windows\system32\find.exe
find /i "python_installer.exe"
2⤵
PID:628

C:\Windows\system32\timeout.exe
timeout /t 2 /nobreak
2⤵
- Delays execution with timeout.exe
PID:4016

C:\Windows\system32\tasklist.exe
tasklist
2⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
PID:4728

C:\Windows\system32\find.exe
find /i "python_installer.exe"
2⤵
PID:2476

C:\Windows\system32\timeout.exe
timeout /t 2 /nobreak
2⤵
- Delays execution with timeout.exe
PID:4596

C:\Windows\system32\tasklist.exe
tasklist
2⤵
- Suspicious use of AdjustPrivilegeToken
PID:5104

C:\Windows\system32\find.exe
find /i "python_installer.exe"
2⤵
PID:412

C:\Windows\system32\timeout.exe
timeout /t 2 /nobreak
2⤵
PID:1132

C:\Windows\system32\tasklist.exe
tasklist
2⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
PID:2008

C:\Windows\system32\find.exe
find /i "python_installer.exe"
2⤵
PID:3944

C:\Windows\system32\timeout.exe
timeout /t 2 /nobreak
2⤵
- Delays execution with timeout.exe
PID:5084

C:\Windows\system32\tasklist.exe
tasklist
2⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
PID:1624

C:\Windows\system32\find.exe
find /i "python_installer.exe"
2⤵
PID:764

C:\Windows\system32\timeout.exe
timeout /t 2 /nobreak
2⤵
- Delays execution with timeout.exe
PID:1984

C:\Windows\system32\tasklist.exe
tasklist
2⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
PID:2064

C:\Windows\system32\find.exe
find /i "python_installer.exe"
2⤵
PID:612

C:\Windows\system32\timeout.exe
timeout /t 2 /nobreak
2⤵
- Delays execution with timeout.exe
PID:4900

C:\Windows\system32\tasklist.exe
tasklist
2⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
PID:2640

C:\Windows\system32\find.exe
find /i "python_installer.exe"
2⤵
PID:3080

C:\Windows\system32\timeout.exe
timeout /t 2 /nobreak
2⤵
- Delays execution with timeout.exe
PID:4568

C:\Windows\system32\tasklist.exe
tasklist
2⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
PID:3700

C:\Windows\system32\find.exe
find /i "python_installer.exe"
2⤵
PID:3176

C:\Windows\system32\timeout.exe
timeout /t 2 /nobreak
2⤵
- Delays execution with timeout.exe
PID:1888

C:\Windows\system32\tasklist.exe
tasklist
2⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
PID:4044

C:\Windows\system32\find.exe
find /i "python_installer.exe"
2⤵
PID:3040

C:\Windows\system32\timeout.exe
timeout /t 2 /nobreak
2⤵
- Delays execution with timeout.exe
PID:2628

C:\Windows\system32\tasklist.exe
tasklist
2⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
PID:3852

C:\Windows\system32\find.exe
find /i "python_installer.exe"
2⤵
PID:4732

C:\Windows\system32\timeout.exe
timeout /t 2 /nobreak
2⤵
- Delays execution with timeout.exe
PID:4852

C:\Windows\system32\tasklist.exe
tasklist
2⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
PID:2528

C:\Windows\system32\find.exe
find /i "python_installer.exe"
2⤵
PID:3476

C:\Windows\system32\timeout.exe
timeout /t 2 /nobreak
2⤵
- Delays execution with timeout.exe
PID:4448

C:\Windows\system32\tasklist.exe
tasklist
2⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
PID:1272

C:\Windows\system32\find.exe
find /i "python_installer.exe"
2⤵
PID:4744

C:\Windows\system32\timeout.exe
timeout /t 2 /nobreak
2⤵
- Delays execution with timeout.exe
PID:1308

C:\Windows\system32\tasklist.exe
tasklist
2⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
PID:4888

C:\Windows\system32\find.exe
find /i "python_installer.exe"
2⤵
PID:3572

C:\Windows\system32\timeout.exe
timeout /t 2 /nobreak
2⤵
- Delays execution with timeout.exe
PID:4080

C:\Windows\system32\tasklist.exe
tasklist
2⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
PID:1336

C:\Windows\system32\find.exe
find /i "python_installer.exe"
2⤵
PID:1844

C:\Windows\system32\timeout.exe
timeout /t 2 /nobreak
2⤵
- Delays execution with timeout.exe
PID:2012

C:\Windows\system32\tasklist.exe
tasklist
2⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
PID:4340

C:\Windows\system32\find.exe
find /i "python_installer.exe"
2⤵
PID:4524

C:\Windows\system32\timeout.exe
timeout /t 2 /nobreak
2⤵
- Delays execution with timeout.exe
PID:4656

C:\Windows\system32\tasklist.exe
tasklist
2⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
PID:2016

C:\Windows\system32\find.exe
find /i "python_installer.exe"
2⤵
PID:2608

C:\Windows\system32\timeout.exe
timeout /t 2 /nobreak
2⤵
- Delays execution with timeout.exe
PID:2592

C:\Windows\system32\tasklist.exe
tasklist
2⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
PID:5116

C:\Windows\system32\find.exe
find /i "python_installer.exe"
2⤵
PID:4188

C:\Windows\system32\timeout.exe
timeout /t 2 /nobreak
2⤵
- Delays execution with timeout.exe
PID:4676

C:\Windows\system32\tasklist.exe
tasklist
2⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
PID:2656

C:\Windows\system32\find.exe
find /i "python_installer.exe"
2⤵
PID:2232

C:\Windows\system32\timeout.exe
timeout /t 2 /nobreak
2⤵
- Delays execution with timeout.exe
PID:4036

C:\Windows\system32\tasklist.exe
tasklist
2⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
PID:3036

C:\Windows\system32\find.exe
find /i "python_installer.exe"
2⤵
PID:3396

C:\Windows\system32\timeout.exe
timeout /t 2 /nobreak
2⤵
- Delays execution with timeout.exe
PID:4076

C:\Windows\system32\tasklist.exe
tasklist
2⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
PID:4416

C:\Windows\system32\find.exe
find /i "python_installer.exe"
2⤵
PID:4120

C:\Windows\system32\timeout.exe
timeout /t 2 /nobreak
2⤵
- Delays execution with timeout.exe
PID:3320

C:\Windows\system32\tasklist.exe
tasklist
2⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
PID:5060

C:\Windows\system32\find.exe
find /i "python_installer.exe"
2⤵
PID:4832

C:\Windows\system32\timeout.exe
timeout /t 2 /nobreak
2⤵
- Delays execution with timeout.exe
PID:2136

C:\Windows\system32\tasklist.exe
tasklist
2⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
PID:3044

C:\Windows\system32\find.exe
find /i "python_installer.exe"
2⤵
PID:4620

C:\Windows\system32\timeout.exe
timeout /t 2 /nobreak
2⤵
- Delays execution with timeout.exe
PID:1168

C:\Windows\system32\tasklist.exe
tasklist
2⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
PID:2724

C:\Windows\system32\find.exe
find /i "python_installer.exe"
2⤵
PID:2020

C:\Windows\system32\timeout.exe
timeout /t 2 /nobreak
2⤵
- Delays execution with timeout.exe
PID:4900

C:\Windows\system32\tasklist.exe
tasklist
2⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
PID:3164

C:\Windows\system32\find.exe
find /i "python_installer.exe"
2⤵
PID:1552

C:\Windows\system32\timeout.exe
timeout /t 2 /nobreak
2⤵
PID:4672

C:\Windows\system32\tasklist.exe
tasklist
2⤵
- Suspicious use of AdjustPrivilegeToken
PID:944

C:\Windows\system32\find.exe
find /i "python_installer.exe"
2⤵
PID:3392

C:\Windows\system32\timeout.exe
timeout /t 2 /nobreak
2⤵
- Delays execution with timeout.exe
PID:3176

C:\Windows\system32\tasklist.exe
tasklist
2⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
PID:4044

C:\Windows\system32\find.exe
find /i "python_installer.exe"
2⤵
PID:3248

C:\Windows\system32\timeout.exe
timeout /t 2 /nobreak
2⤵
- Delays execution with timeout.exe
PID:4488

C:\Windows\system32\tasklist.exe
tasklist
2⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
PID:5004

C:\Windows\system32\find.exe
find /i "python_installer.exe"
2⤵
PID:3312

C:\Windows\system32\timeout.exe
timeout /t 2 /nobreak
2⤵
- Delays execution with timeout.exe
PID:4888

C:\Windows\system32\tasklist.exe
tasklist
2⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
PID:636

C:\Windows\system32\find.exe
find /i "python_installer.exe"
2⤵
PID:4312

C:\Windows\system32\timeout.exe
timeout /t 2 /nobreak
2⤵
- Delays execution with timeout.exe
PID:1476

C:\Windows\system32\tasklist.exe
tasklist
2⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
PID:2992

C:\Windows\system32\find.exe
find /i "python_installer.exe"
2⤵
PID:376

C:\Windows\system32\timeout.exe
timeout /t 2 /nobreak
2⤵
- Delays execution with timeout.exe
PID:2068

C:\Windows\system32\tasklist.exe
tasklist
2⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
PID:4012

C:\Windows\system32\find.exe
find /i "python_installer.exe"
2⤵
PID:220

C:\Windows\system32\timeout.exe
timeout /t 2 /nobreak
2⤵
- Delays execution with timeout.exe
PID:3340

C:\Windows\system32\tasklist.exe
tasklist
2⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
PID:4016

C:\Windows\system32\find.exe
find /i "python_installer.exe"
2⤵
PID:2132

C:\Windows\system32\timeout.exe
timeout /t 2 /nobreak
2⤵
- Delays execution with timeout.exe
PID:4040

C:\Windows\system32\tasklist.exe
tasklist
2⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
PID:1704

C:\Windows\system32\find.exe
find /i "python_installer.exe"
2⤵
PID:4848

C:\Windows\system32\timeout.exe
timeout /t 2 /nobreak
2⤵
- Delays execution with timeout.exe
PID:1364

C:\Windows\system32\tasklist.exe
tasklist
2⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
PID:4936

C:\Windows\system32\find.exe
find /i "python_installer.exe"
2⤵
PID:4588

C:\Windows\system32\timeout.exe
timeout /t 2 /nobreak
2⤵
- Delays execution with timeout.exe
PID:4972

C:\Windows\system32\tasklist.exe
tasklist
2⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
PID:396

C:\Windows\system32\find.exe
find /i "python_installer.exe"
2⤵
PID:2620

C:\Windows\system32\timeout.exe
timeout /t 2 /nobreak
2⤵
- Delays execution with timeout.exe
PID:5104

C:\Windows\system32\tasklist.exe
tasklist
2⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
PID:920

C:\Windows\system32\find.exe
find /i "python_installer.exe"
2⤵
PID:4516

C:\Windows\system32\timeout.exe
timeout /t 2 /nobreak
2⤵
- Delays execution with timeout.exe
PID:4904

C:\Windows\system32\tasklist.exe
tasklist
2⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
PID:1120

C:\Windows\system32\find.exe
find /i "python_installer.exe"
2⤵
PID:3896

C:\Windows\system32\timeout.exe
timeout /t 2 /nobreak
2⤵
- Delays execution with timeout.exe
PID:3632

C:\Windows\system32\tasklist.exe
tasklist
2⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
PID:1280

C:\Windows\system32\find.exe
find /i "python_installer.exe"
2⤵
PID:428

C:\Windows\system32\timeout.exe
timeout /t 2 /nobreak
2⤵
- Delays execution with timeout.exe
PID:2796

C:\Windows\system32\tasklist.exe
tasklist
2⤵
- Suspicious use of AdjustPrivilegeToken
PID:4172

C:\Windows\system32\find.exe
find /i "python_installer.exe"
2⤵
PID:3688

C:\Windows\system32\timeout.exe
timeout /t 2 /nobreak
2⤵
PID:3424

C:\Windows\system32\tasklist.exe
tasklist
2⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
PID:468

C:\Windows\system32\find.exe
find /i "python_installer.exe"
2⤵
PID:1600

C:\Windows\system32\timeout.exe
timeout /t 2 /nobreak
2⤵
- Delays execution with timeout.exe
PID:3160

C:\Windows\system32\tasklist.exe
tasklist
2⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
PID:1532

C:\Windows\system32\find.exe
find /i "python_installer.exe"
2⤵
PID:3080

C:\Windows\system32\timeout.exe
timeout /t 2 /nobreak
2⤵
- Delays execution with timeout.exe
PID:3920

C:\Windows\system32\tasklist.exe
tasklist
2⤵
- Suspicious use of AdjustPrivilegeToken
PID:2700

C:\Windows\system32\find.exe
find /i "python_installer.exe"
2⤵
PID:4236

C:\Windows\system32\timeout.exe
timeout /t 2 /nobreak
2⤵
- Delays execution with timeout.exe
PID:2088

C:\Windows\system32\tasklist.exe
tasklist
2⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
PID:3064

C:\Windows\system32\find.exe
find /i "python_installer.exe"
2⤵
PID:4408

C:\Windows\system32\timeout.exe
timeout /t 2 /nobreak
2⤵
- Delays execution with timeout.exe
PID:3040

C:\Windows\system32\tasklist.exe
tasklist
2⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
PID:2032

C:\Windows\system32\find.exe
find /i "python_installer.exe"
2⤵
PID:4220

C:\Windows\system32\timeout.exe
timeout /t 2 /nobreak
2⤵
- Delays execution with timeout.exe
PID:5100

C:\Windows\system32\tasklist.exe
tasklist
2⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
PID:1272

C:\Windows\system32\find.exe
find /i "python_installer.exe"
2⤵
PID:4744

C:\Windows\system32\timeout.exe
timeout /t 2 /nobreak
2⤵
- Delays execution with timeout.exe
PID:3324

C:\Windows\system32\tasklist.exe
tasklist
2⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
PID:3048

C:\Windows\system32\find.exe
find /i "python_installer.exe"
2⤵
PID:3296

C:\Windows\system32\timeout.exe
timeout /t 2 /nobreak
2⤵
- Delays execution with timeout.exe
PID:4264

C:\Windows\system32\tasklist.exe
tasklist
2⤵
- Enumerates processes with tasklist
PID:4124

C:\Windows\system32\find.exe
find /i "python_installer.exe"
2⤵
PID:2924

C:\Windows\system32\timeout.exe
timeout /t 2 /nobreak
2⤵
- Delays execution with timeout.exe
PID:232

C:\Windows\system32\tasklist.exe
tasklist
2⤵
- Enumerates processes with tasklist
PID:3872

C:\Windows\system32\find.exe
find /i "python_installer.exe"
2⤵
PID:4760

C:\Windows\system32\timeout.exe
timeout /t 2 /nobreak
2⤵
- Delays execution with timeout.exe
PID:4480

C:\Windows\system32\tasklist.exe
tasklist
2⤵
- Enumerates processes with tasklist
PID:1720

C:\Windows\system32\find.exe
find /i "python_installer.exe"
2⤵
PID:636

C:\Windows\system32\timeout.exe
timeout /t 2 /nobreak
2⤵
PID:4064

C:\Windows\system32\tasklist.exe
tasklist
2⤵
- Enumerates processes with tasklist
PID:2608

C:\Windows\system32\find.exe
find /i "python_installer.exe"
2⤵
PID:840

C:\Windows\system32\timeout.exe
timeout /t 2 /nobreak
2⤵
- Delays execution with timeout.exe
PID:2068

C:\Windows\system32\tasklist.exe
tasklist
2⤵
- Enumerates processes with tasklist
PID:3480

C:\Windows\system32\find.exe
find /i "python_installer.exe"
2⤵
PID:1904

C:\Windows\system32\timeout.exe
timeout /t 2 /nobreak
2⤵
- Delays execution with timeout.exe
PID:3340

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Process Discovery

T1057

Query Registry

T1012

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_quzaerql.3qk.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\python_installer.exe

Filesize
27.3MB

MD5
9a99ae597902b70b1273e88cc8d41abd

SHA1
058c5319e77a698b185975084c7be7d25ae021b2

SHA256
69165821dad57c6d8d29ec8598933db7c4498f8ef9d477fa13c677fd82567b58

SHA512
ad8e63ab10ad324ffc897346d18ee8a91459bbcb4f433103c94177eefe5aa512a996efac4284e8f9fd5c91c1e86bd7594b58eb9ecc235512bd55e9d5355fdc84

Download Submit
C:\Windows\Temp\{059BECB4-C4F3-4571-9530-FE5701B40E9B}\.ba\PythonBA.dll

Filesize
650KB

MD5
8a0ff08cb1a531501f1ebe6ac7c0bd2b

SHA1
16a8b02eb8dde520a20a139d9dcb784edf75f2c0

SHA256
4b52b37b1c2e5f5d1ab5d6d22c4c4095b63ddf26fb9dec24254deef102daa1fe

SHA512
da95551e1e6c9528f503668cc57cb0dd8d220c441d3d3d0ca7d4a59e665dbc00e0f0fc434b880aeea984f3f5b1bc3b5091786231454875e0833965a3a25df8f1

Download Submit
C:\Windows\Temp\{059BECB4-C4F3-4571-9530-FE5701B40E9B}\.ba\SideBar.png

Filesize
50KB

MD5
888eb713a0095756252058c9727e088a

SHA1
c14f69f2bef6bc3e2162b4dd78e9df702d94cdb4

SHA256
79434bd1368f47f08acf6db66638531d386bf15166d78d9bfea4da164c079067

SHA512
7c59f4ada242b19c2299b6789a65a1f34565fed78730c22c904db16a9872fe6a07035c6d46a64ee94501fbcd96de586a8a5303ca22f33da357d455c014820ca0

Download Submit
C:\Windows\Temp\{212DF1B3-4710-48F1-99C6-2E1367E33771}\.cr\python_installer.exe

Filesize
847KB

MD5
23c2a4873a11487432a5a9f8fae22daf

SHA1
b54c2efc8e82da30bb572f1c8b38caaa83fe9f4c

SHA256
06534685e5d6290f714396cd31eaea9c5db2db897c81ccebb83c18e2a8f7f500

SHA512
8c4f8677be71b6d2d6ac73c94c3d6e2b401b1b849b1298b58f6ef922739477a58fc2ab5b15520ccfb8014a7b877768b04830ef590b4859304246f5e3cca97ce7

Download Submit
memory/756-0-0x00007FFC66ED3000-0x00007FFC66ED5000-memory.dmp

Filesize
8KB

Download
memory/756-1-0x000001F670EC0000-0x000001F670EE2000-memory.dmp

Filesize
136KB

Download
memory/756-11-0x00007FFC66ED0000-0x00007FFC67991000-memory.dmp

Filesize
10.8MB

Download
memory/756-12-0x00007FFC66ED0000-0x00007FFC67991000-memory.dmp

Filesize
10.8MB

Download
memory/756-16-0x00007FFC66ED0000-0x00007FFC67991000-memory.dmp

Filesize
10.8MB

Download