924b383b04c68017160a9c7e321eff265840987fb23c140a15c74033bd2b2032

Resubmissions

07/10/2024, 00:00

241007-aaf3tsxdma 10

06/10/2024, 23:57

241006-3zlzlaxcma 10

Analysis

max time kernel
46s
max time network
35s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
06/10/2024, 23:57

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

celerysetup.exe
Size

7.6MB
MD5

bcc4c5c4f3e9d8e5c12a4b156766f117
SHA1

f85e013c8bbad32e8f54f99382b80f71adb79130
SHA256

4dbf6c6b281c6841b734e685cfa02d0eca8470e6470193baff6458deff269a99
SHA512

6e7dafce0fa29f65753e8932a24fbe44c1caa498730ffed6dd9649395bf0db33fffecb404a6a92e9f26d65df57d9ed58aa86d533b462f0035b600e12daafddc0
SSDEEP

196608:k3+sxfkRrLvjurErvI9pWjgU1DEzx7sKL/s1tekAW5kCU79aUXgH:yXxfezurEUWjhEhn01tjer0Kc

Score

8^/10

credential_access discovery execution spyware stealer upx

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
1084	powershell.exe
2844	powershell.exe
2784	powershell.exe

Executes dropped EXE 1 IoCs

pid	Process
876	rar.exe

Loads dropped DLL 17 IoCs

pid	Process
3388	celerysetup.exe
3388	celerysetup.exe
3388	celerysetup.exe
3388	celerysetup.exe
3388	celerysetup.exe
3388	celerysetup.exe
3388	celerysetup.exe
3388	celerysetup.exe
3388	celerysetup.exe
3388	celerysetup.exe
3388	celerysetup.exe
3388	celerysetup.exe
3388	celerysetup.exe
3388	celerysetup.exe
3388	celerysetup.exe
3388	celerysetup.exe
3388	celerysetup.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
credential_access stealer

Credentials In Files
T1552.001
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
19	discord.com
20	discord.com

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
17	ip-api.com

Enumerates processes with tasklist 1 TTPs 2 IoCs

discovery

Process Discovery

T1057

pid	Process
3020	tasklist.exe
1184	tasklist.exe

UPX packed file 55 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x0007000000023470-21.dat	upx
behavioral1/memory/3388-25-0x00007FFAC7140000-0x00007FFAC7819000-memory.dmp	upx
behavioral1/files/0x0007000000023463-28.dat	upx
behavioral1/memory/3388-37-0x00007FFADA320000-0x00007FFADA345000-memory.dmp	upx
behavioral1/files/0x000700000002346a-48.dat	upx
behavioral1/files/0x0007000000023469-47.dat	upx
behavioral1/memory/3388-46-0x00007FFADFE30000-0x00007FFADFE3F000-memory.dmp	upx
behavioral1/files/0x0007000000023468-45.dat	upx
behavioral1/files/0x0007000000023467-44.dat	upx
behavioral1/files/0x0007000000023466-43.dat	upx
behavioral1/files/0x0007000000023465-42.dat	upx
behavioral1/files/0x0007000000023464-41.dat	upx
behavioral1/files/0x0007000000023462-40.dat	upx
behavioral1/files/0x0007000000023475-39.dat	upx
behavioral1/files/0x0007000000023474-38.dat	upx
behavioral1/files/0x0007000000023473-36.dat	upx
behavioral1/files/0x000700000002346f-33.dat	upx
behavioral1/files/0x000700000002346d-32.dat	upx
behavioral1/files/0x000700000002346e-30.dat	upx
behavioral1/memory/3388-54-0x00007FFADA2F0000-0x00007FFADA31D000-memory.dmp	upx
behavioral1/memory/3388-56-0x00007FFADE040000-0x00007FFADE059000-memory.dmp	upx
behavioral1/memory/3388-58-0x00007FFADA1C0000-0x00007FFADA1E4000-memory.dmp	upx
behavioral1/memory/3388-60-0x00007FFAD6260000-0x00007FFAD63D6000-memory.dmp	upx
behavioral1/memory/3388-62-0x00007FFADBD60000-0x00007FFADBD79000-memory.dmp	upx
behavioral1/memory/3388-64-0x00007FFADA2E0000-0x00007FFADA2ED000-memory.dmp	upx
behavioral1/memory/3388-66-0x00007FFAD6B20000-0x00007FFAD6B53000-memory.dmp	upx
behavioral1/memory/3388-71-0x00007FFAD66A0000-0x00007FFAD676D000-memory.dmp	upx
behavioral1/memory/3388-70-0x00007FFAC7140000-0x00007FFAC7819000-memory.dmp	upx
behavioral1/memory/3388-74-0x00007FFADA320000-0x00007FFADA345000-memory.dmp	upx
behavioral1/memory/3388-73-0x00007FFAC68C0000-0x00007FFAC6DE9000-memory.dmp	upx
behavioral1/memory/3388-79-0x00007FFAD6990000-0x00007FFAD699D000-memory.dmp	upx
behavioral1/memory/3388-78-0x00007FFADA2F0000-0x00007FFADA31D000-memory.dmp	upx
behavioral1/memory/3388-76-0x00007FFAD69A0000-0x00007FFAD69B4000-memory.dmp	upx
behavioral1/memory/3388-82-0x00007FFAD0A90000-0x00007FFAD0BAB000-memory.dmp	upx
behavioral1/memory/3388-81-0x00007FFADE040000-0x00007FFADE059000-memory.dmp	upx
behavioral1/memory/3388-83-0x00007FFADA1C0000-0x00007FFADA1E4000-memory.dmp	upx
behavioral1/memory/3388-97-0x00007FFAD6260000-0x00007FFAD63D6000-memory.dmp	upx
behavioral1/memory/3388-113-0x00007FFADBD60000-0x00007FFADBD79000-memory.dmp	upx
behavioral1/memory/3388-150-0x00007FFAD6B20000-0x00007FFAD6B53000-memory.dmp	upx
behavioral1/memory/3388-164-0x00007FFAD66A0000-0x00007FFAD676D000-memory.dmp	upx
behavioral1/memory/3388-167-0x00007FFAC7140000-0x00007FFAC7819000-memory.dmp	upx
behavioral1/memory/3388-181-0x00007FFAD0A90000-0x00007FFAD0BAB000-memory.dmp	upx
behavioral1/memory/3388-187-0x00007FFADA1C0000-0x00007FFADA1E4000-memory.dmp	upx
behavioral1/memory/3388-186-0x00007FFADE040000-0x00007FFADE059000-memory.dmp	upx
behavioral1/memory/3388-185-0x00007FFADA2F0000-0x00007FFADA31D000-memory.dmp	upx
behavioral1/memory/3388-184-0x00007FFADFE30000-0x00007FFADFE3F000-memory.dmp	upx
behavioral1/memory/3388-183-0x00007FFADA320000-0x00007FFADA345000-memory.dmp	upx
behavioral1/memory/3388-182-0x00007FFAC68C0000-0x00007FFAC6DE9000-memory.dmp	upx
behavioral1/memory/3388-180-0x00007FFAD6990000-0x00007FFAD699D000-memory.dmp	upx
behavioral1/memory/3388-179-0x00007FFAD69A0000-0x00007FFAD69B4000-memory.dmp	upx
behavioral1/memory/3388-177-0x00007FFAD66A0000-0x00007FFAD676D000-memory.dmp	upx
behavioral1/memory/3388-176-0x00007FFAD6B20000-0x00007FFAD6B53000-memory.dmp	upx
behavioral1/memory/3388-175-0x00007FFADA2E0000-0x00007FFADA2ED000-memory.dmp	upx
behavioral1/memory/3388-174-0x00007FFADBD60000-0x00007FFADBD79000-memory.dmp	upx
behavioral1/memory/3388-173-0x00007FFAD6260000-0x00007FFAD63D6000-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	taskmgr.exe

Detects videocard installed 1 TTPs 1 IoCs

Uses WMIC.exe to determine videocard installed.

System Information Discovery

T1082

pid	Process
2156	WMIC.exe

Suspicious behavior: EnumeratesProcesses 49 IoCs

pid	Process
1084	powershell.exe
2784	powershell.exe
1084	powershell.exe
2784	powershell.exe
2844	powershell.exe
2844	powershell.exe
3120	powershell.exe
3120	powershell.exe
2364	taskmgr.exe
2364	taskmgr.exe
2364	taskmgr.exe
2364	taskmgr.exe
2364	taskmgr.exe
2364	taskmgr.exe
2364	taskmgr.exe
2364	taskmgr.exe
2364	taskmgr.exe
2364	taskmgr.exe
2364	taskmgr.exe
2364	taskmgr.exe
2364	taskmgr.exe
2364	taskmgr.exe
2364	taskmgr.exe
2364	taskmgr.exe
2364	taskmgr.exe
2364	taskmgr.exe
2364	taskmgr.exe
2364	taskmgr.exe
2364	taskmgr.exe
2364	taskmgr.exe
2364	taskmgr.exe
2364	taskmgr.exe
2364	taskmgr.exe
2364	taskmgr.exe
2364	taskmgr.exe
2364	taskmgr.exe
2364	taskmgr.exe
2364	taskmgr.exe
2364	taskmgr.exe
2364	taskmgr.exe
2364	taskmgr.exe
2364	taskmgr.exe
2364	taskmgr.exe
2364	taskmgr.exe
2364	taskmgr.exe
2364	taskmgr.exe
2364	taskmgr.exe
2364	taskmgr.exe
2364	taskmgr.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	1084	powershell.exe
Token: SeDebugPrivilege	2784	powershell.exe
Token: SeDebugPrivilege	3020	tasklist.exe
Token: SeDebugPrivilege	1184	tasklist.exe
Token: SeIncreaseQuotaPrivilege	4184	WMIC.exe
Token: SeSecurityPrivilege	4184	WMIC.exe
Token: SeTakeOwnershipPrivilege	4184	WMIC.exe
Token: SeLoadDriverPrivilege	4184	WMIC.exe
Token: SeSystemProfilePrivilege	4184	WMIC.exe
Token: SeSystemtimePrivilege	4184	WMIC.exe
Token: SeProfSingleProcessPrivilege	4184	WMIC.exe
Token: SeIncBasePriorityPrivilege	4184	WMIC.exe
Token: SeCreatePagefilePrivilege	4184	WMIC.exe
Token: SeBackupPrivilege	4184	WMIC.exe
Token: SeRestorePrivilege	4184	WMIC.exe
Token: SeShutdownPrivilege	4184	WMIC.exe
Token: SeDebugPrivilege	4184	WMIC.exe
Token: SeSystemEnvironmentPrivilege	4184	WMIC.exe
Token: SeRemoteShutdownPrivilege	4184	WMIC.exe
Token: SeUndockPrivilege	4184	WMIC.exe
Token: SeManageVolumePrivilege	4184	WMIC.exe
Token: 33	4184	WMIC.exe
Token: 34	4184	WMIC.exe
Token: 35	4184	WMIC.exe
Token: 36	4184	WMIC.exe
Token: SeIncreaseQuotaPrivilege	4184	WMIC.exe
Token: SeSecurityPrivilege	4184	WMIC.exe
Token: SeTakeOwnershipPrivilege	4184	WMIC.exe
Token: SeLoadDriverPrivilege	4184	WMIC.exe
Token: SeSystemProfilePrivilege	4184	WMIC.exe
Token: SeSystemtimePrivilege	4184	WMIC.exe
Token: SeProfSingleProcessPrivilege	4184	WMIC.exe
Token: SeIncBasePriorityPrivilege	4184	WMIC.exe
Token: SeCreatePagefilePrivilege	4184	WMIC.exe
Token: SeBackupPrivilege	4184	WMIC.exe
Token: SeRestorePrivilege	4184	WMIC.exe
Token: SeShutdownPrivilege	4184	WMIC.exe
Token: SeDebugPrivilege	4184	WMIC.exe
Token: SeSystemEnvironmentPrivilege	4184	WMIC.exe
Token: SeRemoteShutdownPrivilege	4184	WMIC.exe
Token: SeUndockPrivilege	4184	WMIC.exe
Token: SeManageVolumePrivilege	4184	WMIC.exe
Token: 33	4184	WMIC.exe
Token: 34	4184	WMIC.exe
Token: 35	4184	WMIC.exe
Token: 36	4184	WMIC.exe
Token: SeIncreaseQuotaPrivilege	2472	WMIC.exe
Token: SeSecurityPrivilege	2472	WMIC.exe
Token: SeTakeOwnershipPrivilege	2472	WMIC.exe
Token: SeLoadDriverPrivilege	2472	WMIC.exe
Token: SeSystemProfilePrivilege	2472	WMIC.exe
Token: SeSystemtimePrivilege	2472	WMIC.exe
Token: SeProfSingleProcessPrivilege	2472	WMIC.exe
Token: SeIncBasePriorityPrivilege	2472	WMIC.exe
Token: SeCreatePagefilePrivilege	2472	WMIC.exe
Token: SeBackupPrivilege	2472	WMIC.exe
Token: SeRestorePrivilege	2472	WMIC.exe
Token: SeShutdownPrivilege	2472	WMIC.exe
Token: SeDebugPrivilege	2472	WMIC.exe
Token: SeSystemEnvironmentPrivilege	2472	WMIC.exe
Token: SeRemoteShutdownPrivilege	2472	WMIC.exe
Token: SeUndockPrivilege	2472	WMIC.exe
Token: SeManageVolumePrivilege	2472	WMIC.exe
Token: 33	2472	WMIC.exe

Suspicious use of FindShellTrayWindow 51 IoCs

pid	Process
2364	taskmgr.exe
2364	taskmgr.exe
2364	taskmgr.exe
2364	taskmgr.exe
2364	taskmgr.exe
2364	taskmgr.exe
2364	taskmgr.exe
2364	taskmgr.exe
2364	taskmgr.exe
2364	taskmgr.exe
2364	taskmgr.exe
2364	taskmgr.exe
2364	taskmgr.exe
2364	taskmgr.exe
2364	taskmgr.exe
2364	taskmgr.exe
2364	taskmgr.exe
2364	taskmgr.exe
2364	taskmgr.exe
2364	taskmgr.exe
2364	taskmgr.exe
2364	taskmgr.exe
2364	taskmgr.exe
2364	taskmgr.exe
2364	taskmgr.exe
2364	taskmgr.exe
2364	taskmgr.exe
2364	taskmgr.exe
2364	taskmgr.exe
2364	taskmgr.exe
2364	taskmgr.exe
2364	taskmgr.exe
2364	taskmgr.exe
2364	taskmgr.exe
2364	taskmgr.exe
2364	taskmgr.exe
2364	taskmgr.exe
2364	taskmgr.exe
2364	taskmgr.exe
2364	taskmgr.exe
2364	taskmgr.exe
2364	taskmgr.exe
2364	taskmgr.exe
2364	taskmgr.exe
2364	taskmgr.exe
2364	taskmgr.exe
2364	taskmgr.exe
2364	taskmgr.exe
2364	taskmgr.exe
2364	taskmgr.exe
2364	taskmgr.exe

Suspicious use of SendNotifyMessage 50 IoCs

pid	Process
2364	taskmgr.exe
2364	taskmgr.exe
2364	taskmgr.exe
2364	taskmgr.exe
2364	taskmgr.exe
2364	taskmgr.exe
2364	taskmgr.exe
2364	taskmgr.exe
2364	taskmgr.exe
2364	taskmgr.exe
2364	taskmgr.exe
2364	taskmgr.exe
2364	taskmgr.exe
2364	taskmgr.exe
2364	taskmgr.exe
2364	taskmgr.exe
2364	taskmgr.exe
2364	taskmgr.exe
2364	taskmgr.exe
2364	taskmgr.exe
2364	taskmgr.exe
2364	taskmgr.exe
2364	taskmgr.exe
2364	taskmgr.exe
2364	taskmgr.exe
2364	taskmgr.exe
2364	taskmgr.exe
2364	taskmgr.exe
2364	taskmgr.exe
2364	taskmgr.exe
2364	taskmgr.exe
2364	taskmgr.exe
2364	taskmgr.exe
2364	taskmgr.exe
2364	taskmgr.exe
2364	taskmgr.exe
2364	taskmgr.exe
2364	taskmgr.exe
2364	taskmgr.exe
2364	taskmgr.exe
2364	taskmgr.exe
2364	taskmgr.exe
2364	taskmgr.exe
2364	taskmgr.exe
2364	taskmgr.exe
2364	taskmgr.exe
2364	taskmgr.exe
2364	taskmgr.exe
2364	taskmgr.exe
2364	taskmgr.exe

Suspicious use of WriteProcessMemory 46 IoCs

description	pid	Process	procid_target
PID 2652 wrote to memory of 3388	2652	celerysetup.exe	84
PID 2652 wrote to memory of 3388	2652	celerysetup.exe	84
PID 3388 wrote to memory of 4720	3388	celerysetup.exe	85
PID 3388 wrote to memory of 4720	3388	celerysetup.exe	85
PID 3388 wrote to memory of 4236	3388	celerysetup.exe	86
PID 3388 wrote to memory of 4236	3388	celerysetup.exe	86
PID 4720 wrote to memory of 2784	4720	cmd.exe	89
PID 4720 wrote to memory of 2784	4720	cmd.exe	89
PID 4236 wrote to memory of 1084	4236	cmd.exe	90
PID 4236 wrote to memory of 1084	4236	cmd.exe	90
PID 3388 wrote to memory of 628	3388	celerysetup.exe	91
PID 3388 wrote to memory of 628	3388	celerysetup.exe	91
PID 3388 wrote to memory of 1116	3388	celerysetup.exe	92
PID 3388 wrote to memory of 1116	3388	celerysetup.exe	92
PID 628 wrote to memory of 3020	628	cmd.exe	95
PID 628 wrote to memory of 3020	628	cmd.exe	95
PID 1116 wrote to memory of 1184	1116	cmd.exe	96
PID 1116 wrote to memory of 1184	1116	cmd.exe	96
PID 3388 wrote to memory of 3692	3388	celerysetup.exe	98
PID 3388 wrote to memory of 3692	3388	celerysetup.exe	98
PID 3692 wrote to memory of 876	3692	cmd.exe	100
PID 3692 wrote to memory of 876	3692	cmd.exe	100
PID 3388 wrote to memory of 4588	3388	celerysetup.exe	101
PID 3388 wrote to memory of 4588	3388	celerysetup.exe	101
PID 4588 wrote to memory of 4184	4588	cmd.exe	103
PID 4588 wrote to memory of 4184	4588	cmd.exe	103
PID 3388 wrote to memory of 3840	3388	celerysetup.exe	104
PID 3388 wrote to memory of 3840	3388	celerysetup.exe	104
PID 3840 wrote to memory of 2472	3840	cmd.exe	106
PID 3840 wrote to memory of 2472	3840	cmd.exe	106
PID 3388 wrote to memory of 3644	3388	celerysetup.exe	107
PID 3388 wrote to memory of 3644	3388	celerysetup.exe	107
PID 3644 wrote to memory of 684	3644	cmd.exe	109
PID 3644 wrote to memory of 684	3644	cmd.exe	109
PID 3388 wrote to memory of 4620	3388	celerysetup.exe	110
PID 3388 wrote to memory of 4620	3388	celerysetup.exe	110
PID 4620 wrote to memory of 2844	4620	cmd.exe	112
PID 4620 wrote to memory of 2844	4620	cmd.exe	112
PID 3388 wrote to memory of 1880	3388	celerysetup.exe	113
PID 3388 wrote to memory of 1880	3388	celerysetup.exe	113
PID 1880 wrote to memory of 2156	1880	cmd.exe	115
PID 1880 wrote to memory of 2156	1880	cmd.exe	115
PID 3388 wrote to memory of 4368	3388	celerysetup.exe	116
PID 3388 wrote to memory of 4368	3388	celerysetup.exe	116
PID 4368 wrote to memory of 3120	4368	cmd.exe	118
PID 4368 wrote to memory of 3120	4368	cmd.exe	118

C:\Users\Admin\AppData\Local\Temp\celerysetup.exe
"C:\Users\Admin\AppData\Local\Temp\celerysetup.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2652
- C:\Users\Admin\AppData\Local\Temp\celerysetup.exe
  "C:\Users\Admin\AppData\Local\Temp\celerysetup.exe"
  2⤵
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:3388
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\celerysetup.exe'"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4720
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\celerysetup.exe'
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2784
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4236
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1084
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:628
  - - C:\Windows\system32\tasklist.exe
      tasklist /FO LIST
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:3020
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1116
  - - C:\Windows\system32\tasklist.exe
      tasklist /FO LIST
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:1184
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\_MEI26522\rar.exe a -r -hp"n" "C:\Users\Admin\AppData\Local\Temp\mw1KD.zip" *"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3692
  - - C:\Users\Admin\AppData\Local\Temp\_MEI26522\rar.exe
      C:\Users\Admin\AppData\Local\Temp\_MEI26522\rar.exe a -r -hp"n" "C:\Users\Admin\AppData\Local\Temp\mw1KD.zip" *
      4⤵
      Executes dropped EXE
      PID:876
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic os get Caption"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4588
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic os get Caption
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:4184
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic computersystem get totalphysicalmemory"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3840
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic computersystem get totalphysicalmemory
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:2472
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3644
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic csproduct get uuid
      4⤵
      PID:684
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4620
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:2844
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1880
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic path win32_VideoController get name
      4⤵
      Detects videocard installed
      PID:2156
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4368
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:3120

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /0
1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2364

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
d85ba6ff808d9e5444a4b369f5bc2730

SHA1
31aa9d96590fff6981b315e0b391b575e4c0804a

SHA256
84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

SHA512
8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
6d3e9c29fe44e90aae6ed30ccf799ca8

SHA1
c7974ef72264bbdf13a2793ccf1aed11bc565dce

SHA256
2360634e63e8f0b5748e2c56ebb8f4aa78e71008ea7b5c9ca1c49be03b49557d

SHA512
60c38c4367352537545d859f64b9c5cbada94240478d1d039fd27b5ecba4dc1c90051557c16d802269703b873546ead416279c0a80c6fd5e49ad361cef22596a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
64B

MD5
a9ce891ee24f7735c5fd4d3259faac12

SHA1
ba77a8a6ff4bc0316cc224d776f4c4b900b833af

SHA256
0452059c03156daeb99522f31f43ae2f4008b26f4a67298a6d8f3e13f431d5a3

SHA512
01d5cd5e1e94edcd37056c8b3cd48706ba93acffa3312135ed76e4ed83402ef7fe78572f002aadbde924e69d0e3e522e70820ec3f78d157e9f0a9db419387ba0

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI26522\VCRUNTIME140.dll

Filesize
116KB

MD5
be8dbe2dc77ebe7f88f910c61aec691a

SHA1
a19f08bb2b1c1de5bb61daf9f2304531321e0e40

SHA256
4d292623516f65c80482081e62d5dadb759dc16e851de5db24c3cbb57b87db83

SHA512
0da644472b374f1da449a06623983d0477405b5229e386accadb154b43b8b083ee89f07c3f04d2c0c7501ead99ad95aecaa5873ff34c5eeb833285b598d5a655

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI26522\_bz2.pyd

Filesize
48KB

MD5
ba8871f10f67817358fe84f44b986801

SHA1
d57a3a841415969051826e8dcd077754fd7caea0

SHA256
9d30387ee07585516f8ce479fcd4e052597835d4149568c1d8382a4a3a0ae7e1

SHA512
8e23b032b785f37b920206fa3064c5fa0e28949f23b2e985fae26c9a355a6bc33dcd380925091f627d4d7936f0958e90fa7c022d89c73db8a1ea6ad267a1a341

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI26522\_ctypes.pyd

Filesize
59KB

MD5
e7629e12d646da3be8d60464ad457cef

SHA1
17cf7dacb460183c19198d9bb165af620291bf08

SHA256
eb8affa4e7a4da15c9cda37c68ac8232d885a9d367b28973473949b205384789

SHA512
974ae1607093161a5f33eda9e0a0ade214700d05eb728c8157e7b7589c587cc1cdefe0132d16d31c2941ed4eec4668428564609a0a2ced983c8b13f98a84801b

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI26522\_decimal.pyd

Filesize
105KB

MD5
94fbb133e2b93ea55205ecbd83fcae39

SHA1
788a71fa29e10fc9ea771c319f62f9f0429d8550

SHA256
f8e8fbeee7c8454fa42fe47f1da9c63f6b6e631b0dff22c80631f426efcba78b

SHA512
b488f06be28fc8ffd3d8be6b986c7a35ab868198b10943bfa59b9130ebd50354adb9e1818b73ed1f2c92d33d869091e9167346b4430668ca31dd46a845276dea

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI26522\_hashlib.pyd

Filesize
35KB

MD5
3c1056edef1c509136160d69d94c4b28

SHA1
e944653161631647a301b3bddc08f8a13a4bf23e

SHA256
41e4bb3c6064cb9e8a62e17056aea19e3d7e6ff1efc17c18d76118ac4e3b7243

SHA512
a03fcf2af6df72923714f66d26774a39e709fa8ad879d72b838d531692231f68480b5ff65b83358ad6b7b411f4ece7028a8613c3b1177acf1d3c933a843ca19a

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI26522\_lzma.pyd

Filesize
86KB

MD5
ed348285c1ad1db0effd915c0cb087c3

SHA1
b5b8446d2e079d451c2de793c0f437d23f584f7b

SHA256
fa84770ccf4394d046ed69edaea71957306a25def4986ee6650daf0a2c2d3e43

SHA512
28a4c21bdb0bd697e93b276c184bfc5e317d930c4462e655d9d9ef7487168809ee952e32a856304cdd67a76d6b2286bf94fe9b9de6706c8d36a810aa916ce8e1

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI26522\_queue.pyd

Filesize
26KB

MD5
048e8e18d1ae823e666c501c8a8ad1dd

SHA1
63b1513a9f4dfd5b23ec8466d85ef44bfb4a7157

SHA256
7285eef53fd485d6093a9aecbe8fc87c6d70ae4e91d41f382a2a3edff7ebc6c8

SHA512
e57e162d1099b696d11bad172d36824a41fde3dd1d3be0dbd239746f8c87f17e78f889c8ad75ffdac89032b258e6f55f0dab82aae21b9d7ad166ceedfe131b61

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI26522\_socket.pyd

Filesize
44KB

MD5
4ee9483c490fa48ee9a09debe0dd7649

SHA1
f9ba6501c7b635f998949cf3568faf4591f21edd

SHA256
9c644a6db56052cf2680476648391b47b603957ffb353ad44a68dac761805ef1

SHA512
c55ddd782cc52d1aba6fd4466ed72387aad4debd3c48315db16aa35d3a5265478d8b197a3a0e0bcf9277004c10b4ccfe8706ab9d0e886d19c0cc4cb406fab4a4

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI26522\_sqlite3.pyd

Filesize
57KB

MD5
b8aa2de7df9ba5eab6609dcf07829aa6

SHA1
4b8420c44784745b1e2d2a25bd4174fc3da4c881

SHA256
644669d0875b33aa7e9d3f1856bc8b696f796ad61c7edb9219f8f0ff1a69531a

SHA512
5587efef4c349a137d785594bb7cbffef19fd418bf7d6fb2a4a3e2107354f5f874eeb7e18799031bde335bc65e4ca53f73793a60c67a5482c7e6d1564894ba17

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI26522\_ssl.pyd

Filesize
65KB

MD5
a9f1bda7447ab9d69df7391d10290240

SHA1
62a3beb8afc6426f84e737162b3ec3814648fe9f

SHA256
2bb05f7dbd21e67d2a6671411f8ae503dd7538a6767b2169b3033b695557ac13

SHA512
539e94b59093dcf62d6f1a312d9b6aac27873f6416cde050e756e367b9907a8c0e7a31109a433b206bf023436d823d3d945f695cc7291604c0a24bcd27dc1451

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI26522\base_library.zip

Filesize
1.3MB

MD5
06be1ee89ad16b854cb697655b3e8cb2

SHA1
24847e5b01ff8469084361e7dcfeedeba236e656

SHA256
04dca6c4bd5e1de1f4f0650e8939c8689733593d4c88a820370cf7ff5618b76d

SHA512
3b0a5d7865056fcdc91838f4e0ccd452f1378400862efda1f8b1883ad64611f0e6485bdb7d779647880631b805885ec5f5f2eb8ddc7092d057557816cfb7583a

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI26522\blank.aes

Filesize
116KB

MD5
0ac1a1efe5cdb9da2fdd14bf89371804

SHA1
a0bdb17d93d8dcce0ace68d036a196dbe6ebc685

SHA256
c09e1755cd7e560516628d832f05eaf61fe1a1c4927098d6a4e2cd0a5bceeba2

SHA512
45b49bf5123ecbe75642b42f77b901e3be68413730f601aa0c07e169dcfa6d303edff4f1d692fa01ede9ed0389e23f6068b0b105a880831d86dda7319253d816

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI26522\blank.aes

Filesize
116KB

MD5
40b82d3ea363fb84f945764d9f56403b

SHA1
0d70ad9e0dfb78ae63ce54d9fb16efab28c08490

SHA256
3aeea5f79e331f6d269656f2e45ecd5087da35a0d96b7faf0bbf5be0092c1d5b

SHA512
9573df3df545b918f40f62077faae0e9d318520778b1bfe6ebffc927eb4745ff7c291da94d18322d17797e5f6984cc5867cd4e268812f572ac78ba170fcc7067

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI26522\libcrypto-3.dll

Filesize
1.6MB

MD5
7f1b899d2015164ab951d04ebb91e9ac

SHA1
1223986c8a1cbb57ef1725175986e15018cc9eab

SHA256
41201d2f29cf3bc16bf32c8cecf3b89e82fec3e5572eb38a578ae0fb0c5a2986

SHA512
ca227b6f998cacca3eb6a8f18d63f8f18633ab4b8464fb8b47caa010687a64516181ad0701c794d6bfe3f153662ea94779b4f70a5a5a94bb3066d8a011b4310d

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI26522\libffi-8.dll

Filesize
29KB

MD5
08b000c3d990bc018fcb91a1e175e06e

SHA1
bd0ce09bb3414d11c91316113c2becfff0862d0d

SHA256
135c772b42ba6353757a4d076ce03dbf792456143b42d25a62066da46144fece

SHA512
8820d297aeda5a5ebe1306e7664f7a95421751db60d71dc20da251bcdfdc73f3fd0b22546bd62e62d7aa44dfe702e4032fe78802fb16ee6c2583d65abc891cbf

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI26522\libssl-3.dll

Filesize
222KB

MD5
264be59ff04e5dcd1d020f16aab3c8cb

SHA1
2d7e186c688b34fdb4c85a3fce0beff39b15d50e

SHA256
358b59da9580e7102adfc1be9400acea18bc49474db26f2f8bacb4b8839ce49d

SHA512
9abb96549724affb2e69e5cb2c834ecea3f882f2f7392f2f8811b8b0db57c5340ab21be60f1798c7ab05f93692eb0aeab077caf7e9b7bb278ad374ff3c52d248

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI26522\python312.dll

Filesize
1.8MB

MD5
cbd02b4c0cf69e5609c77dfd13fba7c4

SHA1
a3c8f6bfd7ffe0783157e41538b3955519f1e695

SHA256
ecef0ed97c7b249af3c56cde0bfcae70f66530d716b48b5d94621c3dba8236b5

SHA512
a3760ecaa9736eb24370a0a20dd22a1ee53b3f8002195947bc7d21b239278ec8e26bcc131d0132c530767d1de59954be7946dcf54fcbf2584052c9d9a5615567

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI26522\rar.exe

Filesize
615KB

MD5
9c223575ae5b9544bc3d69ac6364f75e

SHA1
8a1cb5ee02c742e937febc57609ac312247ba386

SHA256
90341ac8dcc9ec5f9efe89945a381eb701fe15c3196f594d9d9f0f67b4fc2213

SHA512
57663e2c07b56024aaae07515ee3a56b2f5068ebb2f2dc42be95d1224376c2458da21c965aab6ae54de780cb874c2fc9de83d9089abf4536de0f50faca582d09

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI26522\rarreg.key

Filesize
456B

MD5
4531984cad7dacf24c086830068c4abe

SHA1
fa7c8c46677af01a83cf652ef30ba39b2aae14c3

SHA256
58209c8ab4191e834ffe2ecd003fd7a830d3650f0fd1355a74eb8a47c61d4211

SHA512
00056f471945d838ef2ce56d51c32967879fe54fcbf93a237ed85a98e27c5c8d2a39bc815b41c15caace2071edd0239d775a31d1794dc4dba49e7ecff1555122

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI26522\select.pyd

Filesize
25KB

MD5
a71d12c3294b13688f4c2b4d0556abb8

SHA1
13a6b7f99495a4c8477aea5aecc183d18b78e2d4

SHA256
0f3ae1b65102d38f6b33fcbbdadd347aa1b0c09ed8028d4412982b3bd97caf0f

SHA512
ff16cb399b661c170bf79108c62010d32804ead3f6c565b0755a26b62b4f51290bcb71face6cebaa82c0f9b3863aaaa7fa57ddc1e2bbae8598b047d01d15cbe5

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI26522\sqlite3.dll

Filesize
630KB

MD5
ce4f27e09044ec688edeaf5cb9a3e745

SHA1
b184178e8a8af7ac1cd735b8e4b8f45e74791ac9

SHA256
f940ff66960441c76a258846d66d4a357e72ad8fbb6bde62b5e5fbe90103b92d

SHA512
bab572324dcf12e71fb6a9648e9224528bd29c75e7d3b978b7068eca0d6f2cb795165756249f47e1db401267b0a1e5fd06c35b6cf5595a013240f9e3444ea083

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI26522\unicodedata.pyd

Filesize
295KB

MD5
9a03b477b937d8258ef335c9d0b3d4fa

SHA1
5f12a8a9902ea1dc9bbb36c88db27162aa4901a5

SHA256
4d6e035a366c6f74660f74b8b816add345fa7f1c6cf0793dcf1ed9f91b6ce6a4

SHA512
d3d8bb51474f93d02837580f53aacf5ca9eaf8587e83cddb742c707a251fe86f14e8e665aa4423ac99d74c6c94d95c7df3bfd513b3d5c69661e604f22dcabebe

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_kt3rakix.254.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
memory/1084-84-0x00007FFAC5853000-0x00007FFAC5855000-memory.dmp

Filesize
8KB

Download
memory/1084-85-0x000001876A820000-0x000001876A842000-memory.dmp

Filesize
136KB

Download
memory/1084-95-0x00007FFAC5850000-0x00007FFAC6311000-memory.dmp

Filesize
10.8MB

Download
memory/1084-96-0x00007FFAC5850000-0x00007FFAC6311000-memory.dmp

Filesize
10.8MB

Download
memory/1084-112-0x00007FFAC5850000-0x00007FFAC6311000-memory.dmp

Filesize
10.8MB

Download
memory/2364-190-0x0000017FFDD60000-0x0000017FFDD61000-memory.dmp

Filesize
4KB

Download
memory/2364-198-0x0000017FFDD60000-0x0000017FFDD61000-memory.dmp

Filesize
4KB

Download
memory/2364-191-0x0000017FFDD60000-0x0000017FFDD61000-memory.dmp

Filesize
4KB

Download
memory/2364-197-0x0000017FFDD60000-0x0000017FFDD61000-memory.dmp

Filesize
4KB

Download
memory/2364-196-0x0000017FFDD60000-0x0000017FFDD61000-memory.dmp

Filesize
4KB

Download
memory/2364-189-0x0000017FFDD60000-0x0000017FFDD61000-memory.dmp

Filesize
4KB

Download
memory/2364-195-0x0000017FFDD60000-0x0000017FFDD61000-memory.dmp

Filesize
4KB

Download
memory/2364-201-0x0000017FFDD60000-0x0000017FFDD61000-memory.dmp

Filesize
4KB

Download
memory/2364-200-0x0000017FFDD60000-0x0000017FFDD61000-memory.dmp

Filesize
4KB

Download
memory/2364-199-0x0000017FFDD60000-0x0000017FFDD61000-memory.dmp

Filesize
4KB

Download
memory/3388-82-0x00007FFAD0A90000-0x00007FFAD0BAB000-memory.dmp

Filesize
1.1MB

Download
memory/3388-83-0x00007FFADA1C0000-0x00007FFADA1E4000-memory.dmp

Filesize
144KB

Download
memory/3388-81-0x00007FFADE040000-0x00007FFADE059000-memory.dmp

Filesize
100KB

Download
memory/3388-76-0x00007FFAD69A0000-0x00007FFAD69B4000-memory.dmp

Filesize
80KB

Download
memory/3388-78-0x00007FFADA2F0000-0x00007FFADA31D000-memory.dmp

Filesize
180KB

Download
memory/3388-97-0x00007FFAD6260000-0x00007FFAD63D6000-memory.dmp

Filesize
1.5MB

Download
memory/3388-79-0x00007FFAD6990000-0x00007FFAD699D000-memory.dmp

Filesize
52KB

Download
memory/3388-73-0x00007FFAC68C0000-0x00007FFAC6DE9000-memory.dmp

Filesize
5.2MB

Download
memory/3388-74-0x00007FFADA320000-0x00007FFADA345000-memory.dmp

Filesize
148KB

Download
memory/3388-72-0x0000019BBE9C0000-0x0000019BBEEE9000-memory.dmp

Filesize
5.2MB

Download
memory/3388-113-0x00007FFADBD60000-0x00007FFADBD79000-memory.dmp

Filesize
100KB

Download
memory/3388-150-0x00007FFAD6B20000-0x00007FFAD6B53000-memory.dmp

Filesize
204KB

Download
memory/3388-70-0x00007FFAC7140000-0x00007FFAC7819000-memory.dmp

Filesize
6.8MB

Download
memory/3388-164-0x00007FFAD66A0000-0x00007FFAD676D000-memory.dmp

Filesize
820KB

Download
memory/3388-165-0x0000019BBE9C0000-0x0000019BBEEE9000-memory.dmp

Filesize
5.2MB

Download
memory/3388-167-0x00007FFAC7140000-0x00007FFAC7819000-memory.dmp

Filesize
6.8MB

Download
memory/3388-181-0x00007FFAD0A90000-0x00007FFAD0BAB000-memory.dmp

Filesize
1.1MB

Download
memory/3388-187-0x00007FFADA1C0000-0x00007FFADA1E4000-memory.dmp

Filesize
144KB

Download
memory/3388-186-0x00007FFADE040000-0x00007FFADE059000-memory.dmp

Filesize
100KB

Download
memory/3388-185-0x00007FFADA2F0000-0x00007FFADA31D000-memory.dmp

Filesize
180KB

Download
memory/3388-184-0x00007FFADFE30000-0x00007FFADFE3F000-memory.dmp

Filesize
60KB

Download
memory/3388-183-0x00007FFADA320000-0x00007FFADA345000-memory.dmp

Filesize
148KB

Download
memory/3388-182-0x00007FFAC68C0000-0x00007FFAC6DE9000-memory.dmp

Filesize
5.2MB

Download
memory/3388-180-0x00007FFAD6990000-0x00007FFAD699D000-memory.dmp

Filesize
52KB

Download
memory/3388-179-0x00007FFAD69A0000-0x00007FFAD69B4000-memory.dmp

Filesize
80KB

Download
memory/3388-177-0x00007FFAD66A0000-0x00007FFAD676D000-memory.dmp

Filesize
820KB

Download
memory/3388-176-0x00007FFAD6B20000-0x00007FFAD6B53000-memory.dmp

Filesize
204KB

Download
memory/3388-175-0x00007FFADA2E0000-0x00007FFADA2ED000-memory.dmp

Filesize
52KB

Download
memory/3388-174-0x00007FFADBD60000-0x00007FFADBD79000-memory.dmp

Filesize
100KB

Download
memory/3388-173-0x00007FFAD6260000-0x00007FFAD63D6000-memory.dmp

Filesize
1.5MB

Download
memory/3388-71-0x00007FFAD66A0000-0x00007FFAD676D000-memory.dmp

Filesize
820KB

Download
memory/3388-66-0x00007FFAD6B20000-0x00007FFAD6B53000-memory.dmp

Filesize
204KB

Download
memory/3388-64-0x00007FFADA2E0000-0x00007FFADA2ED000-memory.dmp

Filesize
52KB

Download
memory/3388-62-0x00007FFADBD60000-0x00007FFADBD79000-memory.dmp

Filesize
100KB

Download
memory/3388-60-0x00007FFAD6260000-0x00007FFAD63D6000-memory.dmp

Filesize
1.5MB

Download
memory/3388-58-0x00007FFADA1C0000-0x00007FFADA1E4000-memory.dmp

Filesize
144KB

Download
memory/3388-56-0x00007FFADE040000-0x00007FFADE059000-memory.dmp

Filesize
100KB

Download
memory/3388-54-0x00007FFADA2F0000-0x00007FFADA31D000-memory.dmp

Filesize
180KB

Download
memory/3388-46-0x00007FFADFE30000-0x00007FFADFE3F000-memory.dmp

Filesize
60KB

Download
memory/3388-37-0x00007FFADA320000-0x00007FFADA345000-memory.dmp

Filesize
148KB

Download
memory/3388-25-0x00007FFAC7140000-0x00007FFAC7819000-memory.dmp

Filesize
6.8MB

Download