2874cff787c58fe6dc93c54173005f3ba7a3a4883b0c9b7e8f6429a661bd31d5

Analysis

max time kernel
149s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
27/09/2024, 06:49

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Office 2019 KMS Activator Ultimate 1.4 Setup.exe
Size

2.5MB
MD5

4f2c137841704345eac8bba1e0f6d10c
SHA1

982dea8270400212c334c8161be0e2229df3e2e7
SHA256

2874cff787c58fe6dc93c54173005f3ba7a3a4883b0c9b7e8f6429a661bd31d5
SHA512

87363ef8a7ad5ce2d95a14fb0b5eb777d15d7090dbdbd2ce88478ecaf858e7a2924bc3eb2a37a13fbedd2a2546c4945bfb5390585da4673c553b0938c3082051
SSDEEP

49152:z75g4oxdEqym999kEASSsoqMSNGe+p8FKnHZyKU8lPpt5i:X5JIGqym94EUsoqzGgKHZNPq

Score

7^/10

discovery

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\Control Panel\International\Geo\Nation	Office 2019 KMS Activator Ultimate 1.4.exe

Executes dropped EXE 2 IoCs

pid	Process
3260	Office 2019 KMS Activator Ultimate 1.4 Setup.tmp
1492	Office 2019 KMS Activator Ultimate 1.4.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Program Files directory 5 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Office 2019 KMS Activator Ultimate 1.4\Office 2019 KMS Activator Ultimate 1.4.exe	Office 2019 KMS Activator Ultimate 1.4 Setup.tmp
File created	C:\Program Files\Office 2019 KMS Activator Ultimate 1.4\unins000.dat	Office 2019 KMS Activator Ultimate 1.4 Setup.tmp
File created	C:\Program Files\Office 2019 KMS Activator Ultimate 1.4\is-UTIOE.tmp	Office 2019 KMS Activator Ultimate 1.4 Setup.tmp
File created	C:\Program Files\Office 2019 KMS Activator Ultimate 1.4\is-AHIPK.tmp	Office 2019 KMS Activator Ultimate 1.4 Setup.tmp
File opened for modification	C:\Program Files\Office 2019 KMS Activator Ultimate 1.4\unins000.dat	Office 2019 KMS Activator Ultimate 1.4 Setup.tmp

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cscript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cscript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cscript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	find.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	find.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cscript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cscript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cscript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cscript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	find.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	find.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cscript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cscript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cscript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cscript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cscript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cscript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cscript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cscript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	find.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cscript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cscript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	find.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cscript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cscript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cscript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cscript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cscript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cscript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cscript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cscript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	find.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	find.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cscript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	find.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Office 2019 KMS Activator Ultimate 1.4.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cscript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cscript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Office 2019 KMS Activator Ultimate 1.4 Setup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	find.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cscript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	find.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cscript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cscript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cscript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cscript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cscript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cscript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	find.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cscript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cscript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cscript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cscript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cscript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	find.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cscript.exe

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WINWORD.EXE

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WINWORD.EXE

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000_Classes\Local Settings	Office 2019 KMS Activator Ultimate 1.4.exe

Suspicious behavior: AddClipboardFormatListener 2 IoCs

pid	Process
4468	WINWORD.EXE
4468	WINWORD.EXE

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3260	Office 2019 KMS Activator Ultimate 1.4 Setup.tmp
3260	Office 2019 KMS Activator Ultimate 1.4 Setup.tmp

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
3260	Office 2019 KMS Activator Ultimate 1.4 Setup.tmp
1492	Office 2019 KMS Activator Ultimate 1.4.exe
1492	Office 2019 KMS Activator Ultimate 1.4.exe

Suspicious use of SetWindowsHookEx 9 IoCs

pid	Process
4468	WINWORD.EXE
4468	WINWORD.EXE
4468	WINWORD.EXE
4468	WINWORD.EXE
4468	WINWORD.EXE
4468	WINWORD.EXE
4468	WINWORD.EXE
4468	WINWORD.EXE
4468	WINWORD.EXE

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2284 wrote to memory of 3260	2284	Office 2019 KMS Activator Ultimate 1.4 Setup.exe	81
PID 2284 wrote to memory of 3260	2284	Office 2019 KMS Activator Ultimate 1.4 Setup.exe	81
PID 2284 wrote to memory of 3260	2284	Office 2019 KMS Activator Ultimate 1.4 Setup.exe	81
PID 1492 wrote to memory of 4816	1492	Office 2019 KMS Activator Ultimate 1.4.exe	96
PID 1492 wrote to memory of 4816	1492	Office 2019 KMS Activator Ultimate 1.4.exe	96
PID 1492 wrote to memory of 4816	1492	Office 2019 KMS Activator Ultimate 1.4.exe	96
PID 4816 wrote to memory of 4296	4816	cmd.exe	98
PID 4816 wrote to memory of 4296	4816	cmd.exe	98
PID 4816 wrote to memory of 4296	4816	cmd.exe	98
PID 4816 wrote to memory of 432	4816	cmd.exe	99
PID 4816 wrote to memory of 432	4816	cmd.exe	99
PID 4816 wrote to memory of 432	4816	cmd.exe	99
PID 4816 wrote to memory of 4364	4816	cmd.exe	100
PID 4816 wrote to memory of 4364	4816	cmd.exe	100
PID 4816 wrote to memory of 4364	4816	cmd.exe	100
PID 4816 wrote to memory of 3164	4816	cmd.exe	101
PID 4816 wrote to memory of 3164	4816	cmd.exe	101
PID 4816 wrote to memory of 3164	4816	cmd.exe	101
PID 4816 wrote to memory of 4728	4816	cmd.exe	102
PID 4816 wrote to memory of 4728	4816	cmd.exe	102
PID 4816 wrote to memory of 4728	4816	cmd.exe	102
PID 4816 wrote to memory of 2228	4816	cmd.exe	103
PID 4816 wrote to memory of 2228	4816	cmd.exe	103
PID 4816 wrote to memory of 2228	4816	cmd.exe	103
PID 4816 wrote to memory of 4344	4816	cmd.exe	104
PID 4816 wrote to memory of 4344	4816	cmd.exe	104
PID 4816 wrote to memory of 4344	4816	cmd.exe	104
PID 4816 wrote to memory of 4404	4816	cmd.exe	105
PID 4816 wrote to memory of 4404	4816	cmd.exe	105
PID 4816 wrote to memory of 4404	4816	cmd.exe	105
PID 4816 wrote to memory of 1228	4816	cmd.exe	106
PID 4816 wrote to memory of 1228	4816	cmd.exe	106
PID 4816 wrote to memory of 1228	4816	cmd.exe	106
PID 4816 wrote to memory of 1512	4816	cmd.exe	107
PID 4816 wrote to memory of 1512	4816	cmd.exe	107
PID 4816 wrote to memory of 1512	4816	cmd.exe	107
PID 4816 wrote to memory of 3640	4816	cmd.exe	108
PID 4816 wrote to memory of 3640	4816	cmd.exe	108
PID 4816 wrote to memory of 3640	4816	cmd.exe	108
PID 4816 wrote to memory of 2900	4816	cmd.exe	109
PID 4816 wrote to memory of 2900	4816	cmd.exe	109
PID 4816 wrote to memory of 2900	4816	cmd.exe	109
PID 4816 wrote to memory of 1752	4816	cmd.exe	110
PID 4816 wrote to memory of 1752	4816	cmd.exe	110
PID 4816 wrote to memory of 1752	4816	cmd.exe	110
PID 1492 wrote to memory of 316	1492	Office 2019 KMS Activator Ultimate 1.4.exe	111
PID 1492 wrote to memory of 316	1492	Office 2019 KMS Activator Ultimate 1.4.exe	111
PID 1492 wrote to memory of 316	1492	Office 2019 KMS Activator Ultimate 1.4.exe	111
PID 316 wrote to memory of 948	316	cmd.exe	113
PID 316 wrote to memory of 948	316	cmd.exe	113
PID 316 wrote to memory of 948	316	cmd.exe	113
PID 316 wrote to memory of 4188	316	cmd.exe	114
PID 316 wrote to memory of 4188	316	cmd.exe	114
PID 316 wrote to memory of 4188	316	cmd.exe	114
PID 316 wrote to memory of 2296	316	cmd.exe	115
PID 316 wrote to memory of 2296	316	cmd.exe	115
PID 316 wrote to memory of 2296	316	cmd.exe	115
PID 316 wrote to memory of 3468	316	cmd.exe	116
PID 316 wrote to memory of 3468	316	cmd.exe	116
PID 316 wrote to memory of 3468	316	cmd.exe	116
PID 316 wrote to memory of 4500	316	cmd.exe	117
PID 316 wrote to memory of 4500	316	cmd.exe	117
PID 316 wrote to memory of 4500	316	cmd.exe	117
PID 316 wrote to memory of 4520	316	cmd.exe	118

C:\Users\Admin\AppData\Local\Temp\Office 2019 KMS Activator Ultimate 1.4 Setup.exe
"C:\Users\Admin\AppData\Local\Temp\Office 2019 KMS Activator Ultimate 1.4 Setup.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2284
- C:\Users\Admin\AppData\Local\Temp\is-4T5JR.tmp\Office 2019 KMS Activator Ultimate 1.4 Setup.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-4T5JR.tmp\Office 2019 KMS Activator Ultimate 1.4 Setup.tmp" /SL5="$A02CA,2362428,57856,C:\Users\Admin\AppData\Local\Temp\Office 2019 KMS Activator Ultimate 1.4 Setup.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of FindShellTrayWindow
  PID:3260

C:\Program Files\Office 2019 KMS Activator Ultimate 1.4\Office 2019 KMS Activator Ultimate 1.4.exe
"C:\Program Files\Office 2019 KMS Activator Ultimate 1.4\Office 2019 KMS Activator Ultimate 1.4.exe"
1⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:1492
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\Office2019kms.cmd"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4816
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c dir /b ..\root\Licenses19\proplusvl_kms*.xrm-ms
    3⤵
    PID:4296
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c dir /b ..\root\Licenses19\proplusvl_mak*.xrm-ms
    3⤵
    - System Location Discovery: System Language Discovery
    PID:432
- - C:\Windows\SysWOW64\cscript.exe
    cscript //nologo ospp.vbs /unpkey:KTQRG
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4364
- - C:\Windows\SysWOW64\cscript.exe
    cscript //nologo ospp.vbs /inpkey:VQ9DP-NVHPH-T9HJC-J9PDT-KTQRG
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3164
- - C:\Windows\SysWOW64\cscript.exe
    cscript //nologo ospp.vbs /sethst:kms.chinancce.com
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4728
- - C:\Windows\SysWOW64\cscript.exe
    cscript //nologo ospp.vbs /act
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2228
- - C:\Windows\SysWOW64\find.exe
    find /i "successful"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4344
- - C:\Windows\SysWOW64\cscript.exe
    cscript //nologo ospp.vbs /sethst:kms.srv.crsoo.com
    3⤵
    PID:4404
- - C:\Windows\SysWOW64\cscript.exe
    cscript //nologo ospp.vbs /act
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1228
- - C:\Windows\SysWOW64\find.exe
    find /i "successful"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1512
- - C:\Windows\SysWOW64\cscript.exe
    cscript //nologo ospp.vbs /sethst:kms.loli.beer
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3640
- - C:\Windows\SysWOW64\cscript.exe
    cscript //nologo ospp.vbs /act
    3⤵
    PID:2900
- - C:\Windows\SysWOW64\find.exe
    find /i "successful"
    3⤵
    PID:1752
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\office2010kms.cmd"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:316
- - C:\Windows\SysWOW64\cscript.exe
    cscript //nologo ospp.vbs /unpkey:8R6BM
    3⤵
    - System Location Discovery: System Language Discovery
    PID:948
- - C:\Windows\SysWOW64\cscript.exe
    cscript //nologo ospp.vbs /unpkey:H3GVB
    3⤵
    PID:4188
- - C:\Windows\SysWOW64\cscript.exe
    cscript //nologo ospp.vbs /inpkey:V7QKV-4XVVR-XYV4D-F7DFM-8R6BM
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2296
- - C:\Windows\SysWOW64\cscript.exe
    cscript //nologo ospp.vbs /inpkey:VYBBJ-TRJPB-QFQRF-QFT4D-H3GVB
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3468
- - C:\Windows\SysWOW64\cscript.exe
    cscript //nologo ospp.vbs /sethst:kms.chinancce.com
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4500
- - C:\Windows\SysWOW64\cscript.exe
    cscript //nologo ospp.vbs /act
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4520
- - C:\Windows\SysWOW64\find.exe
    find /i "successful"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3984
- - C:\Windows\SysWOW64\cscript.exe
    cscript //nologo ospp.vbs /sethst:kms.srv.crsoo.com
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2888
- - C:\Windows\SysWOW64\cscript.exe
    cscript //nologo ospp.vbs /act
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3768
- - C:\Windows\SysWOW64\find.exe
    find /i "successful"
    3⤵
    PID:5008
- - C:\Windows\SysWOW64\cscript.exe
    cscript //nologo ospp.vbs /sethst:kms.loli.beer
    3⤵
    - System Location Discovery: System Language Discovery
    PID:512
- - C:\Windows\SysWOW64\cscript.exe
    cscript //nologo ospp.vbs /act
    3⤵
    - System Location Discovery: System Language Discovery
    PID:904
- - C:\Windows\SysWOW64\find.exe
    find /i "successful"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5092
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\Office2019kms.cmd"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:408
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c dir /b ..\root\Licenses19\proplusvl_kms*.xrm-ms
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4352
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c dir /b ..\root\Licenses19\proplusvl_mak*.xrm-ms
    3⤵
    PID:4728
- - C:\Windows\SysWOW64\cscript.exe
    cscript //nologo ospp.vbs /unpkey:KTQRG
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2772
- - C:\Windows\SysWOW64\cscript.exe
    cscript //nologo ospp.vbs /inpkey:VQ9DP-NVHPH-T9HJC-J9PDT-KTQRG
    3⤵
    PID:2596
- - C:\Windows\SysWOW64\cscript.exe
    cscript //nologo ospp.vbs /sethst:kms.chinancce.com
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1488
- - C:\Windows\SysWOW64\cscript.exe
    cscript //nologo ospp.vbs /act
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1996
- - C:\Windows\SysWOW64\find.exe
    find /i "successful"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2900
- - C:\Windows\SysWOW64\cscript.exe
    cscript //nologo ospp.vbs /sethst:kms.srv.crsoo.com
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5000
- - C:\Windows\SysWOW64\cscript.exe
    cscript //nologo ospp.vbs /act
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1716
- - C:\Windows\SysWOW64\find.exe
    find /i "successful"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4836
- - C:\Windows\SysWOW64\cscript.exe
    cscript //nologo ospp.vbs /sethst:kms.loli.beer
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4596
- - C:\Windows\SysWOW64\cscript.exe
    cscript //nologo ospp.vbs /act
    3⤵
    PID:2296
- - C:\Windows\SysWOW64\find.exe
    find /i "successful"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4560
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\office2016kms.cmd"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3696
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c dir /b ..\root\Licenses16\proplusvl_kms*.xrm-ms
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2924
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c dir /b ..\root\Licenses16\proplusvl_mak*.xrm-ms
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3744
- - C:\Windows\SysWOW64\cscript.exe
    cscript //nologo ospp.vbs /unpkey:WFG99
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3604
- - C:\Windows\SysWOW64\cscript.exe
    cscript //nologo ospp.vbs /unpkey:DRTFM
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4592
- - C:\Windows\SysWOW64\cscript.exe
    cscript //nologo ospp.vbs /unpkey:BTDRB
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4588
- - C:\Windows\SysWOW64\cscript.exe
    cscript //nologo ospp.vbs /unpkey:CPQVG
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3776
- - C:\Windows\SysWOW64\cscript.exe
    cscript //nologo ospp.vbs /inpkey:XQNVK-8JYDB-WJ9W3-YJ8YR-WFG99
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1868
- - C:\Windows\SysWOW64\cscript.exe
    cscript //nologo ospp.vbs /sethst:kms.chinancce.com
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1948
- - C:\Windows\SysWOW64\cscript.exe
    cscript //nologo ospp.vbs /act
    3⤵
    - System Location Discovery: System Language Discovery
    PID:800
- - C:\Windows\SysWOW64\find.exe
    find /i "successful"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1644
- - C:\Windows\SysWOW64\cscript.exe
    cscript //nologo ospp.vbs /sethst:kms.srv.crsoo.com
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5136
- - C:\Windows\SysWOW64\cscript.exe
    cscript //nologo ospp.vbs /act
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5156
- - C:\Windows\SysWOW64\find.exe
    find /i "successful"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5164
- - C:\Windows\SysWOW64\cscript.exe
    cscript //nologo ospp.vbs /sethst:kms.loli.beer
    3⤵
    PID:5192
- - C:\Windows\SysWOW64\cscript.exe
    cscript //nologo ospp.vbs /act
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5212
- - C:\Windows\SysWOW64\find.exe
    find /i "successful"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5220
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\office2013kms.cmd"
  2⤵
  PID:5256
- - C:\Windows\SysWOW64\cscript.exe
    cscript //nologo ospp.vbs /unpkey:92CD4
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5312
- - C:\Windows\SysWOW64\cscript.exe
    cscript //nologo ospp.vbs /unpkey:GVGXT
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5332
- - C:\Windows\SysWOW64\cscript.exe
    cscript //nologo ospp.vbs /inpkey:KBKQT-2NMXY-JJWGP-M62JB-92CD4
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5352
- - C:\Windows\SysWOW64\cscript.exe
    cscript //nologo ospp.vbs /inpkey:YC7DK-G2NP3-2QQC3-J6H88-GVGXT
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5372
- - C:\Windows\SysWOW64\cscript.exe
    cscript //nologo ospp.vbs /sethst:kms.chinancce.com
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5400
- - C:\Windows\SysWOW64\cscript.exe
    cscript //nologo ospp.vbs /act
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5476
- - C:\Windows\SysWOW64\find.exe
    find /i "successful"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5484
- - C:\Windows\SysWOW64\cscript.exe
    cscript //nologo ospp.vbs /sethst:kms.srv.crsoo.com
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5444
- - C:\Windows\SysWOW64\cscript.exe
    cscript //nologo ospp.vbs /act
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5520
- - C:\Windows\SysWOW64\find.exe
    find /i "successful"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5528
- - C:\Windows\SysWOW64\cscript.exe
    cscript //nologo ospp.vbs /sethst:kms.loli.beer
    3⤵
    - System Location Discovery: System Language Discovery
    PID:184
- - C:\Windows\SysWOW64\cscript.exe
    cscript //nologo ospp.vbs /act
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5572
- - C:\Windows\SysWOW64\find.exe
    find /i "successful"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5580
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://bestfreewareapps.com/office-2019-download-free.html
  2⤵
  PID:5640
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ffe09e146f8,0x7ffe09e14708,0x7ffe09e14718
    3⤵
    PID:5684
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2204,6594299824998134014,7464515736562261325,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2216 /prefetch:2
    3⤵
    PID:5900
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2204,6594299824998134014,7464515736562261325,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2268 /prefetch:3
    3⤵
    PID:5908
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2204,6594299824998134014,7464515736562261325,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2836 /prefetch:8
    3⤵
    PID:5952
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2204,6594299824998134014,7464515736562261325,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3356 /prefetch:1
    3⤵
    PID:6080
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2204,6594299824998134014,7464515736562261325,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3376 /prefetch:1
    3⤵
    PID:6096

C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE
"C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:4468

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:768

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1512

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\Office 2019 KMS Activator Ultimate 1.4\Office 2019 KMS Activator Ultimate 1.4.exe

Filesize
2.3MB

MD5
fd0e25d8ee64da9df1b2fa7bdc52585c

SHA1
2047cec593bcd14b3749aac7def1c3d20e29e167

SHA256
ea894f2df80e384e1756cff59793ae1f66897c2d668bc5c7d4684d488a7a66a8

SHA512
68d405d63a0a15da332054be70dca8b7a4490c14c2589eb4da3c70dfaec6fa9e29ee2bc06ccad04ccfa55f0b1e70fc2c79cb4aa3ea6b40e36e4a6c5fddfb5e11

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
719923124ee00fb57378e0ebcbe894f7

SHA1
cc356a7d27b8b27dc33f21bd4990f286ee13a9f9

SHA256
aa22ab845fa08c786bd3366ec39f733d5be80e9ac933ed115ff048ff30090808

SHA512
a207b6646500d0d504cf70ee10f57948e58dab7f214ad2e7c4af0e7ca23ce1d37c8c745873137e6c55bdcf0f527031a66d9cc54805a0eac3678be6dd497a5bbc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
d7114a6cd851f9bf56cf771c37d664a2

SHA1
769c5d04fd83e583f15ab1ef659de8f883ecab8a

SHA256
d2c75c7d68c474d4b8847b4ba6cfd09fe90717f46dd398c86483d825a66e977e

SHA512
33bdae2305ae98e7c0de576de5a6600bd70a425e7b891d745cba9de992036df1b3d1df9572edb0f89f320e50962d06532dae9491985b6b57fd37d5f46f7a2ff8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
ba9af805afedab90e9e1f9bdaf4344d3

SHA1
2a187ba563bb2008be33f6076ede83aad7ce1795

SHA256
3a009f63fcafefb10e2f3caea305cd571c1b75cff0105b7a8d8acb372ac23f35

SHA512
e754cb97206d6c0ce7b92f820ed3534de9c0699040ca586d493eaf7b6f122a7ec05afd057ee57d95c95dd2987749872a6d9e61ab9ed0dc86e44f1eac337e3ff5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Office\16.0\WebServiceCache\AllUsers\odc.officeapps.live.com\053C480C-058A-4B02-8652-B461F5B63057

Filesize
1KB

MD5
85ad173999ed440af6120f3b4fd436fa

SHA1
eebe3bae40b0c82db581b905e2a4c4a90055c9b3

SHA256
2fb3e7ca57b5ec8657ff2b909c74dee246e7ed2b30abd60dec96fc4fb88bd165

SHA512
3c506252a27bc4a3d718fc2ad89036850ee3c9d5fd79966fc5e28debe1844d96e8d2777e160e8537034129fd8109dff027bf5eb4a082c99d0db93730ec31427e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Office\16.0\WebServiceCache\AllUsers\odc.officeapps.live.com\B0C172C9-D86F-4298-AE7B-2BC744DB914D

Filesize
397B

MD5
2f82426450332b558a61ae9ca551abd9

SHA1
abdbf8f8bdd7572bcdefbd1e0b7da8d3cf17144d

SHA256
57d6315a8f1f11aaa111a9956ddd0d560f791f757c379ed77bbb5a1b5b577f52

SHA512
dbc43dab6cbde98647c5a88cd508a1528ef79c030286cf82cb4cb03c4af81930ad1c3b2644ead9eceea27cd5772324f42a51f04f1693102254567205a6abf0b5

Download Submit
C:\Users\Admin\AppData\Local\Temp\Office2019kms.cmd

Filesize
1KB

MD5
972f965adfab50d1cac978938540376f

SHA1
14b2358142e0e43646375f7f53f29cd58f30f1d9

SHA256
2cdd8a1e3d5e143ce52833fee51c7931c8eea694dc1e41083e11228d357ab1ac

SHA512
a1aeb48f51553a340298bf638679fde8e3e523e1e97777c60c7c6cff98e7508c30451052fdac03f9e617eba0a3c1d19f8b914bf26fc29ea4923b44a7131a3a50

Download Submit
C:\Users\Admin\AppData\Local\Temp\TCD7C3F.tmp\gb.xsl

Filesize
262KB

MD5
51d32ee5bc7ab811041f799652d26e04

SHA1
412193006aa3ef19e0a57e16acf86b830993024a

SHA256
6230814bf5b2d554397580613e20681752240ab87fd354ececf188c1eabe0e97

SHA512
5fc5d889b0c8e5ef464b76f0c4c9e61bda59b2d1205ac9417cc74d6e9f989fb73d78b4eb3044a1a1e1f2c00ce1ca1bd6d4d07eeadc4108c7b124867711c31810

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-4T5JR.tmp\Office 2019 KMS Activator Ultimate 1.4 Setup.tmp

Filesize
697KB

MD5
832dab307e54aa08f4b6cdd9b9720361

SHA1
ebd007fb7482040ecf34339e4bf917209c1018df

SHA256
cc783a04ccbca4edd06564f8ec88fe5a15f1e3bb26cec7de5e090313520d98f3

SHA512
358d43522fd460eb1511708e4df22ea454a95e5bc3c4841931027b5fa3fb1dda05d496d8ad0a8b9279b99e6be74220fe243db8f08ef49845e9fb35c350ef4b49

Download Submit
C:\Users\Admin\AppData\Local\Temp\office2010kms.cmd

Filesize
1KB

MD5
294daac6c70d28c3a57ca53c31621a4d

SHA1
60fc9303830dd86d708626dd203d4fd525862a16

SHA256
07d0245fb238346060d126ca97bc1726f8e7d42fb92a37345f083a68dd7f76f9

SHA512
c9ad43a0234f3261443efd1d61b9171828dc3d105f03054104473e1d26bf211e851cb0188b34545fe24ef54b1a4735ef7d30812d3cae9997594ed1e324d3af70

Download Submit
C:\Users\Admin\AppData\Local\Temp\office2013kms.cmd

Filesize
1KB

MD5
1ab2084afafc840e6770009cef22ad6f

SHA1
c113e1e15acc36a03f5b6da143c492e6ff60ab3f

SHA256
e476b4ae6c634d3b27b308f0b8c85c9bf4fe1be26b4ed571637dbd6a8a21728a

SHA512
382758feb4557bf0449cd257b37f7f96ebf57ee25f6fe44391c5f146a006087c6986e3ba1e72137dc1bd5c5d0fcb45bf0d19a5fd5b1a1b4531d8d2e6a1073d62

Download Submit
C:\Users\Admin\AppData\Local\Temp\office2016kms.cmd

Filesize
2KB

MD5
f8083e698fffb8cdd6b1ea263ce3eeaa

SHA1
d212c9be01ddc5761ce558ecd971c46c8c8b3598

SHA256
cc70cddbe3faf35f245a5777e6600e3d0c58f0c6839bc97fb9ab43c361144a06

SHA512
cebae6c6d1499419f68547932e6f29ab81e4aef0028faad34932690cac47b81dcdd7c8206cdabd2936ebfa6156109ddb11e77bd84d87e8357ca9eeb9e7823e2c

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\UProof\CUSTOM.DIC

Filesize
2B

MD5
f3b25701fe362ec84616a93a45ce9998

SHA1
d62636d8caec13f04e28442a0a6fa1afeb024bbb

SHA256
b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209

SHA512
98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\fb3b0dbfee58fac8.customDestinations-ms

Filesize
1KB

MD5
29322d38cbc8e9e0881c76a22a0e02a3

SHA1
914409ff4899d641b6228965924c1d3b00343f43

SHA256
e0e502a4ed79de7bfa237bee1bae0ccf411b682f9c3c2b7ef88e8f0ca41308e9

SHA512
5834bfa6b37dbc4a8998dcf088bb31b9b305404917a55bd542d9e24be9bba14b5aee7ec99c3b3d336130c2ee95d79ffe004a0ce34b76e86e786aa1a462c3c808

Download Submit
memory/1492-37-0x0000000000060000-0x00000000002BE000-memory.dmp

Filesize
2.4MB

Download
memory/1492-36-0x00000000751DE000-0x00000000751DF000-memory.dmp

Filesize
4KB

Download
memory/1492-44-0x00000000751D0000-0x0000000075980000-memory.dmp

Filesize
7.7MB

Download
memory/1492-42-0x0000000004E90000-0x0000000004EE6000-memory.dmp

Filesize
344KB

Download
memory/1492-48-0x00000000751DE000-0x00000000751DF000-memory.dmp

Filesize
4KB

Download
memory/1492-49-0x00000000751D0000-0x0000000075980000-memory.dmp

Filesize
7.7MB

Download
memory/1492-50-0x00000000751D0000-0x0000000075980000-memory.dmp

Filesize
7.7MB

Download
memory/1492-41-0x0000000004D50000-0x0000000004D5A000-memory.dmp

Filesize
40KB

Download
memory/1492-43-0x00000000751D0000-0x0000000075980000-memory.dmp

Filesize
7.7MB

Download
memory/1492-38-0x0000000004CB0000-0x0000000004D4C000-memory.dmp

Filesize
624KB

Download
memory/1492-39-0x0000000005300000-0x00000000058A4000-memory.dmp

Filesize
5.6MB

Download
memory/1492-40-0x0000000004DF0000-0x0000000004E82000-memory.dmp

Filesize
584KB

Download
memory/2284-0-0x0000000000400000-0x0000000000415000-memory.dmp

Filesize
84KB

Download
memory/2284-2-0x0000000000401000-0x000000000040C000-memory.dmp

Filesize
44KB

Download
memory/2284-8-0x0000000000400000-0x0000000000415000-memory.dmp

Filesize
84KB

Download
memory/2284-33-0x0000000000400000-0x0000000000415000-memory.dmp

Filesize
84KB

Download
memory/3260-32-0x0000000000400000-0x00000000004BE000-memory.dmp

Filesize
760KB

Download
memory/3260-9-0x0000000000400000-0x00000000004BE000-memory.dmp

Filesize
760KB

Download
memory/3260-6-0x0000000000400000-0x00000000004BE000-memory.dmp

Filesize
760KB

Download
memory/4468-56-0x00007FFDD0C30000-0x00007FFDD0C40000-memory.dmp

Filesize
64KB

Download
memory/4468-55-0x00007FFDD0C30000-0x00007FFDD0C40000-memory.dmp

Filesize
64KB

Download
memory/4468-54-0x00007FFDD0C30000-0x00007FFDD0C40000-memory.dmp

Filesize
64KB

Download
memory/4468-58-0x00007FFDD0C30000-0x00007FFDD0C40000-memory.dmp

Filesize
64KB

Download
memory/4468-57-0x00007FFDD0C30000-0x00007FFDD0C40000-memory.dmp

Filesize
64KB

Download
memory/4468-60-0x00007FFDCE650000-0x00007FFDCE660000-memory.dmp

Filesize
64KB

Download
memory/4468-59-0x00007FFDCE650000-0x00007FFDCE660000-memory.dmp

Filesize
64KB

Download