Overview

overview

10

Static

static

10

Built.exe

windows10-ltsc 2021-x64

10

Analysis

  • max time kernel
    150s
  • max time network
    150s
  • platform
    windows10-ltsc 2021_x64
  • resource
    win10ltsc2021-20250207-en
  • resource tags

    arch:x64arch:x86image:win10ltsc2021-20250207-enlocale:en-usos:windows10-ltsc 2021-x64system
  • submitted
    10/02/2025, 18:20

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    Built.exe

  • Size

    7.4MB

  • MD5

    1180a2369c7c67cf88c11d79db3050b9

  • SHA1

    5906f9cf24d5c87b408f4fc17c9b7f2867430ef7

  • SHA256

    2c1599ce9dc98d6ba85eb8f1d90a8d784dcfea8ed165e24560094a3408e1619b

  • SHA512

    2bd1b4cc8bc20c7b90e9c9fdfb01b8684c3ec8307918dc3b46f7585868355ee3e0a467089b0c87865469fd2ebde4b0b3aa4f9dda4e665f08c220e66ea39fefc0

  • SSDEEP

    196608:NWL0cDNP59Ljv+bhqNVoBKUh8mz4Iv9PPv1DVWhM:XiNPvL+9qz8/b4IRv3WhM

Score
10/10
adwaredefense_evasiondiscoveryexecutionpersistenceprivilege_escalationspywarestealerupx

Malware Config

Signatures

  • Deletes Windows Defender Definitions 2 TTPs 1 IoCs

    Uses mpcmdrun utility to delete all AV definitions.

    defense_evasion
  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 7 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence
  • Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs

    Using powershell.exe command.

    execution
  • Downloads MZ/PE file 1 IoCs
  • Event Triggered Execution: Component Object Model Hijacking 1 TTPs

    Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

    persistenceprivilege_escalation
  • Executes dropped EXE 11 IoCs
  • Loads dropped DLL 17 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Installs/modifies Browser Helper Object 2 TTPs 8 IoCs

    BHOs are DLL modules which act as plugins for Internet Explorer.

    stealeradware
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Drops file in System32 directory 1 IoCs
  • Enumerates processes with tasklist 1 TTPs 2 IoCs
    discovery
  • UPX packed file 60 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 35 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

    Adversaries may check for Internet connectivity on compromised systems.

    discovery
  • Detects videocard installed 1 TTPs 1 IoCs

    Uses WMIC.exe to determine videocard installed.

  • Modifies Internet Explorer settings 1 TTPs 24 IoCs
    adwarespyware
  • Modifies data under HKEY_USERS 2 IoCs
  • Modifies registry class 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 28 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • System policy modification 1 TTPs 4 IoCs
    defense_evasion
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\Built.exe
    "C:\Users\Admin\AppData\Local\Temp\Built.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1388
    • C:\Users\Admin\AppData\Local\Temp\Built.exe
      "C:\Users\Admin\AppData\Local\Temp\Built.exe"
      2⤵
      • Loads dropped DLL
      • Suspicious use of WriteProcessMemory
      PID:1092
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Built.exe'"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:1496
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Built.exe'
          4⤵
          • Command and Scripting Interpreter: PowerShell
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:3328
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:4308
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend
          4⤵
          • Command and Scripting Interpreter: PowerShell
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:2052
        • C:\Program Files\Windows Defender\MpCmdRun.exe
          "C:\Program Files\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All
          4⤵
          • Deletes Windows Defender Definitions
          PID:2200
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:4912
        • C:\Windows\system32\tasklist.exe
          tasklist /FO LIST
          4⤵
          • Enumerates processes with tasklist
          • Suspicious use of AdjustPrivilegeToken
          PID:2120
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:2264
        • C:\Windows\system32\tasklist.exe
          tasklist /FO LIST
          4⤵
          • Enumerates processes with tasklist
          • Suspicious use of AdjustPrivilegeToken
          PID:2472
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\_MEI13882\rar.exe a -r -hp"123456" "C:\Users\Admin\AppData\Local\Temp\90ryG.zip" *"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:4796
        • C:\Users\Admin\AppData\Local\Temp\_MEI13882\rar.exe
          C:\Users\Admin\AppData\Local\Temp\_MEI13882\rar.exe a -r -hp"123456" "C:\Users\Admin\AppData\Local\Temp\90ryG.zip" *
          4⤵
          • Executes dropped EXE
          PID:4576
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "wmic os get Caption"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:1108
        • C:\Windows\System32\Wbem\WMIC.exe
          wmic os get Caption
          4⤵
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:3668
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "wmic computersystem get totalphysicalmemory"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:4640
        • C:\Windows\System32\Wbem\WMIC.exe
          wmic computersystem get totalphysicalmemory
          4⤵
          • Suspicious behavior: EnumeratesProcesses
          PID:4740
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:4424
        • C:\Windows\System32\Wbem\WMIC.exe
          wmic csproduct get uuid
          4⤵
          • Suspicious behavior: EnumeratesProcesses
          PID:3172
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:412
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          powershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER
          4⤵
          • Command and Scripting Interpreter: PowerShell
          • Suspicious behavior: EnumeratesProcesses
          PID:788
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:3784
        • C:\Windows\System32\Wbem\WMIC.exe
          wmic path win32_VideoController get name
          4⤵
          • Detects videocard installed
          • Suspicious behavior: EnumeratesProcesses
          PID:1068
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:1076
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault
          4⤵
          • Suspicious behavior: EnumeratesProcesses
          PID:1116
  • C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
    "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xOTUuNDMiIHNoZWxsX3ZlcnNpb249IjEuMy4xOTUuNDMiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7MkU5MUVDRDMtQjA3NC00QjIyLUEyRUUtNTkyM0IxMEVENDA5fSIgdXNlcmlkPSJ7MzVFRUE0Q0YtMUZGOS00OEQ0LTg0MDAtMzRFMDQ0NjBFNTc3fSIgaW5zdGFsbHNvdXJjZT0ibGltaXRlZCIgcmVxdWVzdGlkPSJ7OEYxREVFNDgtQTlCMi00MTVBLUEwMjQtQzkxNUJBRTAxNjhEfSIgZGVkdXA9ImNyIiBkb21haW5qb2luZWQ9IjAiPjxodyBsb2dpY2FsX2NwdXM9IjIiIHBoeXNtZW1vcnk9IjQiIGRpc2tfdHlwZT0iMiIgc3NlPSIxIiBzc2UyPSIxIiBzc2UzPSIxIiBzc3NlMz0iMSIgc3NlNDE9IjEiIHNzZTQyPSIxIiBhdng9IjEiLz48b3MgcGxhdGZvcm09IndpbiIgdmVyc2lvbj0iMTAuMC4xOTA0NC40NTI5IiBzcD0iIiBhcmNoPSJ4NjQiIHByb2R1Y3RfdHlwZT0iMTI1IiBpc193aXA9IjAiIGlzX2luX2xvY2tkb3duX21vZGU9IjAiLz48b2VtIHByb2R1Y3RfbWFudWZhY3R1cmVyPSIiIHByb2R1Y3RfbmFtZT0iIi8-PGV4cCBldGFnPSImcXVvdDtyNDUydDErazJUZ3EvSFh6anZGTkJSaG9wQldSOXNialh4cWVVREg5dVgwPSZxdW90OyIvPjxhcHAgYXBwaWQ9Ins4QTY5RDM0NS1ENTY0LTQ2M2MtQUZGMS1BNjlEOUU1MzBGOTZ9IiB2ZXJzaW9uPSIxMjMuMC42MzEyLjEyMyIgbmV4dHZlcnNpb249IiIgbGFuZz0iZW4iIGJyYW5kPSJHR0xTIiBjbGllbnQ9IiIgaW5zdGFsbGFnZT0iMyIgaW5zdGFsbGRhdGV0aW1lPSIxNzM4OTM2MzkxIiBvb2JlX2luc3RhbGxfdGltZT0iMTMzODM0MDg5MTA1NjUwMDAwIj48ZXZlbnQgZXZlbnR0eXBlPSIzMSIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMjE3OTg2MiIgc3lzdGVtX3VwdGltZV90aWNrcz0iNTA1ODY5NDAxNCIvPjwvYXBwPjwvcmVxdWVzdD4
    1⤵
    • System Location Discovery: System Language Discovery
    • System Network Configuration Discovery: Internet Connection Discovery
    PID:3328
  • C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{1F8E97BF-4F61-4899-9D33-4F1CBB78EC5A}\MicrosoftEdge_X64_132.0.2957.140.exe
    "C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{1F8E97BF-4F61-4899-9D33-4F1CBB78EC5A}\MicrosoftEdge_X64_132.0.2957.140.exe" --msedge --verbose-logging --do-not-launch-msedge --system-level --channel=stable
    1⤵
    • Drops file in Program Files directory
    • Suspicious use of WriteProcessMemory
    PID:2704
    • C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{1F8E97BF-4F61-4899-9D33-4F1CBB78EC5A}\EDGEMITMP_E0927.tmp\setup.exe
      "C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{1F8E97BF-4F61-4899-9D33-4F1CBB78EC5A}\EDGEMITMP_E0927.tmp\setup.exe" --install-archive="C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{1F8E97BF-4F61-4899-9D33-4F1CBB78EC5A}\MicrosoftEdge_X64_132.0.2957.140.exe" --msedge --verbose-logging --do-not-launch-msedge --system-level --channel=stable
      2⤵
      • Boot or Logon Autostart Execution: Active Setup
      • Executes dropped EXE
      • Installs/modifies Browser Helper Object
      • Drops file in Program Files directory
      • Drops file in Windows directory
      • Modifies Internet Explorer settings
      • Modifies registry class
      • Suspicious use of WriteProcessMemory
      • System policy modification
      PID:2892
      • C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{1F8E97BF-4F61-4899-9D33-4F1CBB78EC5A}\EDGEMITMP_E0927.tmp\setup.exe
        "C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{1F8E97BF-4F61-4899-9D33-4F1CBB78EC5A}\EDGEMITMP_E0927.tmp\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\SystemTemp\MsEdgeCrashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=132.0.6834.160 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{1F8E97BF-4F61-4899-9D33-4F1CBB78EC5A}\EDGEMITMP_E0927.tmp\setup.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=132.0.2957.140 --initial-client-data=0x248,0x24c,0x250,0x224,0x254,0x7ff6630ca818,0x7ff6630ca824,0x7ff6630ca830
        3⤵
        • Executes dropped EXE
        • Drops file in Windows directory
        PID:220
      • C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{1F8E97BF-4F61-4899-9D33-4F1CBB78EC5A}\EDGEMITMP_E0927.tmp\setup.exe
        "C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{1F8E97BF-4F61-4899-9D33-4F1CBB78EC5A}\EDGEMITMP_E0927.tmp\setup.exe" --msedge --channel=stable --system-level --verbose-logging --create-shortcuts=2 --install-level=1
        3⤵
        • Executes dropped EXE
        • Drops file in System32 directory
        • Drops file in Windows directory
        • Modifies data under HKEY_USERS
        • Suspicious use of WriteProcessMemory
        PID:1720
        • C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{1F8E97BF-4F61-4899-9D33-4F1CBB78EC5A}\EDGEMITMP_E0927.tmp\setup.exe
          "C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{1F8E97BF-4F61-4899-9D33-4F1CBB78EC5A}\EDGEMITMP_E0927.tmp\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\SystemTemp\MsEdgeCrashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=132.0.6834.160 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{1F8E97BF-4F61-4899-9D33-4F1CBB78EC5A}\EDGEMITMP_E0927.tmp\setup.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=132.0.2957.140 --initial-client-data=0x248,0x24c,0x250,0x224,0x254,0x7ff6630ca818,0x7ff6630ca824,0x7ff6630ca830
          4⤵
          • Executes dropped EXE
          • Drops file in Windows directory
          PID:1016
      • C:\Program Files (x86)\Microsoft\Edge\Application\132.0.2957.140\Installer\setup.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\132.0.2957.140\Installer\setup.exe" --msedge --channel=stable --register-package-identity --verbose-logging --system-level
        3⤵
        • Executes dropped EXE
        • Drops file in Windows directory
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of WriteProcessMemory
        PID:1436
        • C:\Program Files (x86)\Microsoft\Edge\Application\132.0.2957.140\Installer\setup.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\132.0.2957.140\Installer\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\SystemTemp\MsEdgeCrashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=132.0.6834.160 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\132.0.2957.140\Installer\setup.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=132.0.2957.140 --initial-client-data=0x248,0x24c,0x250,0x224,0x254,0x7ff76676a818,0x7ff76676a824,0x7ff76676a830
          4⤵
          • Executes dropped EXE
          • Drops file in Windows directory
          PID:4424
      • C:\Program Files (x86)\Microsoft\Edge\Application\132.0.2957.140\Installer\setup.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\132.0.2957.140\Installer\setup.exe" --msedge --channel=stable --remove-deprecated-packages --verbose-logging --system-level
        3⤵
        • Executes dropped EXE
        • Drops file in Windows directory
        PID:3076
        • C:\Program Files (x86)\Microsoft\Edge\Application\132.0.2957.140\Installer\setup.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\132.0.2957.140\Installer\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\SystemTemp\MsEdgeCrashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=132.0.6834.160 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\132.0.2957.140\Installer\setup.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=132.0.2957.140 --initial-client-data=0x248,0x24c,0x250,0x224,0x254,0x7ff76676a818,0x7ff76676a824,0x7ff76676a830
          4⤵
          • Executes dropped EXE
          • Drops file in Windows directory
          PID:4868
      • C:\Program Files (x86)\Microsoft\Edge\Application\132.0.2957.140\Installer\setup.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\132.0.2957.140\Installer\setup.exe" --msedge --channel=stable --update-game-assist-package --verbose-logging --system-level
        3⤵
        • Executes dropped EXE
        • Drops file in Windows directory
        PID:3400
        • C:\Program Files (x86)\Microsoft\Edge\Application\132.0.2957.140\Installer\setup.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\132.0.2957.140\Installer\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\SystemTemp\MsEdgeCrashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=132.0.6834.160 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\132.0.2957.140\Installer\setup.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=132.0.2957.140 --initial-client-data=0x248,0x24c,0x250,0x224,0x254,0x7ff76676a818,0x7ff76676a824,0x7ff76676a830
          4⤵
          • Executes dropped EXE
          • Drops file in Windows directory
          PID:4800

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

2
T1059

PowerShell

1
T1059.001

Persistence

Boot or Logon Autostart Execution

1
T1547

Active Setup

1
T1547.014

Browser Extensions

1
T1176

Event Triggered Execution

1
T1546

Component Object Model Hijacking

1
T1546.015

Privilege Escalation

Boot or Logon Autostart Execution

1
T1547

Active Setup

1
T1547.014

Event Triggered Execution

1
T1546

Component Object Model Hijacking

1
T1546.015

Defense Evasion

Impair Defenses

1
T1562

Modify Registry

4
T1112

Credential Access

Credentials from Password Stores

1
T1555

Credentials from Web Browsers

1
T1555.003

Unsecured Credentials

1
T1552

Credentials In Files

1
T1552.001

Discovery

Browser Information Discovery

1
T1217

Process Discovery

1
T1057

Query Registry

2
T1012

System Information Discovery

2
T1082

System Location Discovery

1
T1614

System Language Discovery

1
T1614.001

System Network Configuration Discovery

1
T1016

Internet Connection Discovery

1
T1016.001

Lateral Movement

Collection

Data from Local System

1
T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{1F8E97BF-4F61-4899-9D33-4F1CBB78EC5A}\EDGEMITMP_E0927.tmp\setup.exe
    Filesize

    6.6MB

    MD5

    b4c8ad75087b8634d4f04dc6f92da9aa

    SHA1

    7efaa2472521c79d58c4ef18a258cc573704fb5d

    SHA256

    522a25568bb503cf8b44807661f31f0921dee91d37691bf399868733205690bf

    SHA512

    5094505b33a848badcffd6b3b93aad9ad73f391e201dee052376c4f8573ba351f0b8c102131216088ffb38d0ed7b5fe70ba95c3ac2c33a50c993584fe7c435e3

    Download Submit

  • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
    Filesize

    3KB

    MD5

    3eb3833f769dd890afc295b977eab4b4

    SHA1

    e857649b037939602c72ad003e5d3698695f436f

    SHA256

    c485a6e2fd17c342fca60060f47d6a5655a65a412e35e001bb5bf88d96e6e485

    SHA512

    c24bbc8f278478d43756807b8c584d4e3fb2289db468bc92986a489f74a8da386a667a758360a397e77e018e363be8912ac260072fa3e31117ad0599ac749e72

    Download Submit

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
    Filesize

    1KB

    MD5

    d6d1b8bb34838ccf42d5f69e919b1612

    SHA1

    20e9df1f5dd5908ce1b537d158961e0b1674949e

    SHA256

    8a4e7eae00df2e789c958a38e78ac0b53f439afe2d5bfe8a81fb8c6e232b6491

    SHA512

    ff3ba5dc3cb548018747a315f098e01c5a6f8aee029223ef4080b3db76b0ecaa6a01a1c79e1434bdf2aa5b2ae66ec85d33e760064282411c7712fba890a0309d

    Download Submit

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
    Filesize

    64B

    MD5

    ea0f4836eb1b9ccf112db0fc738142f3

    SHA1

    7ec8cd07b48e44d1a38953729aeacae5a9df3e6f

    SHA256

    9ba225d9a7f5fcef5de9ae1d3d99df7d838e75c5e9456015e822d14854d1d141

    SHA512

    0d6dac432e920967bac23ada01f0cd9be66e29624211e30f0a8d94b0fa82821dac6100e3706523b5a13081f52392ba4e76535cf078136926ad7e0655bed536cb

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\_MEI13882\VCRUNTIME140.dll
    Filesize

    106KB

    MD5

    4585a96cc4eef6aafd5e27ea09147dc6

    SHA1

    489cfff1b19abbec98fda26ac8958005e88dd0cb

    SHA256

    a8f950b4357ec12cfccddc9094cca56a3d5244b95e09ea6e9a746489f2d58736

    SHA512

    d78260c66331fe3029d2cc1b41a5d002ec651f2e3bbf55076d65839b5e3c6297955afd4d9ab8951fbdc9f929dbc65eb18b14b59bce1f2994318564eb4920f286

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\_MEI13882\_bz2.pyd
    Filesize

    48KB

    MD5

    20a7ecfe1e59721e53aebeb441a05932

    SHA1

    a91c81b0394d32470e9beff43b4faa4aacd42573

    SHA256

    7ebbe24da78b652a1b6fe77b955507b1daff6af7ff7e5c3fa5ac71190bde3da8

    SHA512

    99e5d877d34ebaaaeb281c86af3fff9d54333bd0617f1366e3b4822d33e23586ef9b11f4f7dd7e1e4a314c7a881f33123735294fe8af3a136cd10f80a9b8d902

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\_MEI13882\_ctypes.pyd
    Filesize

    58KB

    MD5

    5006b7ea33fce9f7800fecc4eb837a41

    SHA1

    f6366ba281b2f46e9e84506029a6bdf7948e60eb

    SHA256

    8f7a5b0abc319ba9bfd11581f002e533fcbe4ca96cedd37656b579cd3942ef81

    SHA512

    e3e5e8f471a8ca0d5f0091e00056bd53c27105a946ca936da3f5897b9d802167149710404386c2ed3399b237b8da24b1a24e2561c436ed2e031a8f0564fbbc7c

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\_MEI13882\_decimal.pyd
    Filesize

    106KB

    MD5

    d0231f126902db68d7f6ca1652b222c0

    SHA1

    70e79674d0084c106e246474c4fb112e9c5578eb

    SHA256

    69876f825678b717c51b7e7e480de19499d972cb1e98bbfd307e53ee5bace351

    SHA512

    b6b6bfd5fde200a9f45aeb7f6f845eac916feeef2e3fca54e4652e1f19d66ae9817f1625ce0ed79d62e504377011ce23fd95a407fbdbaa6911a09e48b5ef4179

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\_MEI13882\_hashlib.pyd
    Filesize

    35KB

    MD5

    a81e0df35ded42e8909597f64865e2b3

    SHA1

    6b1d3a3cd48e94f752dd354791848707676ca84d

    SHA256

    5582f82f7656d4d92ed22f8e460bebd722e04c8f993c3a6adcc8437264981185

    SHA512

    2cda7348faffabc826fb7c4eddc120675730077540f042d6dc8f5e6921cf2b9cb88afcd114f53290aa20df832e3b7a767432ea292f6e5b5b5b7d0e05cf8905a6

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\_MEI13882\_lzma.pyd
    Filesize

    85KB

    MD5

    f8b61629e42adfe417cb39cdbdf832bb

    SHA1

    e7f59134b2bf387a5fd5faa6d36393cbcbd24f61

    SHA256

    7a3973fedd5d4f60887cf0665bcb7bd3c648ad40d3ae7a8e249d875395e5e320

    SHA512

    58d2882a05289b9d17949884bf50c8f4480a6e6d2b8bd48dfdbcb03d5009af64abf7e9967357aeebf95575d7ef434a40e8ad07a2c1fe275d1a87aa59dcc702d6

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\_MEI13882\_queue.pyd
    Filesize

    25KB

    MD5

    0da22ccb73cd146fcdf3c61ef279b921

    SHA1

    333547f05e351a1378dafa46f4b7c10cbebe3554

    SHA256

    e8ae2c5d37a68bd34054678ae092e2878f73a0f41e6787210f1e9b9bb97f37a0

    SHA512

    9eece79511163eb7c36a937f3f2f83703195fc752b63400552ca03d0d78078875ff41116ebaeb05c48e58e82b01254a328572096a17aaad818d32f3d2d07f436

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\_MEI13882\_socket.pyd
    Filesize

    43KB

    MD5

    c12bded48873b3098c7a36eb06b34870

    SHA1

    c32a57bc2fc8031417632500aa9b1c01c3866ade

    SHA256

    6c4860cb071bb6d0b899f7ca2a1da796b06ea391bac99a01f192e856725e88aa

    SHA512

    335510d6f2f13fb2476a5a17445ca6820c86f7a8a8650f4fd855dd098d022a16c80a8131e04212fd724957d8785ad51ccaff532f2532224ccfd6ce44f4e740f9

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\_MEI13882\_sqlite3.pyd
    Filesize

    56KB

    MD5

    63618d0bc7b07aecc487a76eb3a94af8

    SHA1

    53d528ef2ecbe8817d10c7df53ae798d0981943a

    SHA256

    e74c9ca9007b6b43ff46783ecb393e6ec9ebbdf03f7c12a90c996d9331700a8b

    SHA512

    8280f0f6afc69a82bc34e16637003afb61fee5d8f2cab80be7d66525623ec33f1449b0cc8c96df363c661bd9dbc7918a787ecafaaa5d2b85e6cafdcf0432d394

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\_MEI13882\_ssl.pyd
    Filesize

    65KB

    MD5

    e52dbaeba8cd6cadf00fea19df63f0c1

    SHA1

    c03f112ee2035d0eaab184ae5f9db89aca04273a

    SHA256

    eaf60a9e979c95669d8f209f751725df385944f347142e0ecdcf2f794d005ead

    SHA512

    10eef8fd49e2997542e809c4436ad35dcc6b8a4b9b4313ad54481daef5f01296c9c5f6dedad93fb620f267aef46b0208deffbad1903593fd26fd717a030e89e8

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\_MEI13882\base_library.zip
    Filesize

    1.4MB

    MD5

    ab7f4a669c5c2e599c3269fdfb084ab0

    SHA1

    8be6caf55cc96e8e6dcf636bae7e6f4c79adc92f

    SHA256

    4b09a5a9c58e6c0804b5ddc3ff34bfaee4fd736d0506d8cba69fbc192a2c395b

    SHA512

    34b26e54e4a062e01bf95f1468502632b185ccaa369f7fe1dc6f5b469cda1657131a1521ebb0bf57cec74c324df1daba523e61fba4e5405558c88ca30f67a12a

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\_MEI13882\blank.aes
    Filesize

    124KB

    MD5

    6694bf1167b1916c712bc59c8e637c79

    SHA1

    b8683668816992e694a20580c24e0fcd9ed63047

    SHA256

    a690695a2dc49b94402fef0b12e783a307a4e99f78514069b4b1df4a3706e846

    SHA512

    0d9b609703a8c1fda1220f3d2ea8f72eecff52a8e540d0b9349ad8350ce5a42aef8811ad356cfa9b3e867ed0b64e61ca17152c4fda6c4d4103990c86fcef15e6

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\_MEI13882\blank.aes
    Filesize

    124KB

    MD5

    4f5fba87ffbccfdc1f857c8074a48d4c

    SHA1

    33738c7652c0069ccdc2029aba31f28990b44b46

    SHA256

    bbfbec984fe73cc48138d1bf117ee7d809406d910874267f1af047abf2265363

    SHA512

    ae239880c3dea2ab1b91eddf07f64e8dff7327bf6ada9d6ea9d27b61fd6dacc2a00615ccc86e407d978b2740c47068023b300a769c60f97277bc2c07a049d7ff

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\_MEI13882\libcrypto-3.dll
    Filesize

    1.6MB

    MD5

    27515b5bb912701abb4dfad186b1da1f

    SHA1

    3fcc7e9c909b8d46a2566fb3b1405a1c1e54d411

    SHA256

    fe80bd2568f8628032921fe7107bd611257ff64c679c6386ef24ba25271b348a

    SHA512

    087dfdede2a2e6edb3131f4fde2c4df25161bee9578247ce5ec2bce03e17834898eb8d18d1c694e4a8c5554ad41392d957e750239d3684a51a19993d3f32613c

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\_MEI13882\libffi-8.dll
    Filesize

    29KB

    MD5

    08b000c3d990bc018fcb91a1e175e06e

    SHA1

    bd0ce09bb3414d11c91316113c2becfff0862d0d

    SHA256

    135c772b42ba6353757a4d076ce03dbf792456143b42d25a62066da46144fece

    SHA512

    8820d297aeda5a5ebe1306e7664f7a95421751db60d71dc20da251bcdfdc73f3fd0b22546bd62e62d7aa44dfe702e4032fe78802fb16ee6c2583d65abc891cbf

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\_MEI13882\libssl-3.dll
    Filesize

    223KB

    MD5

    6eda5a055b164e5e798429dcd94f5b88

    SHA1

    2c5494379d1efe6b0a101801e09f10a7cb82dbe9

    SHA256

    377da6175c8a3815d164561350ae1df22e024bc84c55ae5d2583b51dfd0a19a8

    SHA512

    74283b4051751f9e4fd0f4b92ca4b953226c155fe4730d737d7ce41a563d6f212da770e96506d1713d8327d6fef94bae4528336ebcfb07e779de0e0f0cb31f2e

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\_MEI13882\python311.dll
    Filesize

    1.6MB

    MD5

    0b66c50e563d74188a1e96d6617261e8

    SHA1

    cfd778b3794b4938e584078cbfac0747a8916d9e

    SHA256

    02c665f77db6b255fc62f978aedbe2092b7ef1926836290da68fd838dbf2a9f2

    SHA512

    37d710cb5c0ceb5957d11b61684cfbc65951c1d40ab560f3f3cb8feca42f9d43bd981a0ff44c3cb7562779264f18116723457e79e0e23852d7638b1a954a258f

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\_MEI13882\rar.exe
    Filesize

    615KB

    MD5

    9c223575ae5b9544bc3d69ac6364f75e

    SHA1

    8a1cb5ee02c742e937febc57609ac312247ba386

    SHA256

    90341ac8dcc9ec5f9efe89945a381eb701fe15c3196f594d9d9f0f67b4fc2213

    SHA512

    57663e2c07b56024aaae07515ee3a56b2f5068ebb2f2dc42be95d1224376c2458da21c965aab6ae54de780cb874c2fc9de83d9089abf4536de0f50faca582d09

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\_MEI13882\rarreg.key
    Filesize

    456B

    MD5

    4531984cad7dacf24c086830068c4abe

    SHA1

    fa7c8c46677af01a83cf652ef30ba39b2aae14c3

    SHA256

    58209c8ab4191e834ffe2ecd003fd7a830d3650f0fd1355a74eb8a47c61d4211

    SHA512

    00056f471945d838ef2ce56d51c32967879fe54fcbf93a237ed85a98e27c5c8d2a39bc815b41c15caace2071edd0239d775a31d1794dc4dba49e7ecff1555122

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\_MEI13882\select.pyd
    Filesize

    25KB

    MD5

    1e9e36e61651c3ad3e91aba117edc8d1

    SHA1

    61ab19f15e692704139db2d7fb3ac00c461f9f8b

    SHA256

    5a91ba7ea3cf48033a85247fc3b1083f497bc060778dcf537ca382a337190093

    SHA512

    b367e00e1a8a3e7af42d997b59e180dfca7e31622558398c398f594d619b91cedc4879bfdda303d37f31dfcc3447faa88f65fd13bac109889cee8c1e3c1d62d0

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\_MEI13882\sqlite3.dll
    Filesize

    622KB

    MD5

    c78fab9114164ac981902c44d3cd9b37

    SHA1

    cb34dff3cf82160731c7da5527c9f3e7e7f113b7

    SHA256

    4569acfa25dda192becda0d79f4254ce548a718b566792d73c43931306cc5242

    SHA512

    bf82ccc02248be669fe4e28d8342b726cf52c4ec2bfe2ec1f71661528e2d8df03781ae5ccf005a6022d59a90e36cea7d3c7a495bd11bf149319c891c00ac669b

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\_MEI13882\unicodedata.pyd
    Filesize

    295KB

    MD5

    af87b4aa3862a59d74ff91be300ee9e3

    SHA1

    e5bfd29f92c28afa79a02dc97a26ed47e4f199b4

    SHA256

    fac71c7622957fe0773214c7432364d7fc39c5e12250ff9eaaeea4d897564dc7

    SHA512

    1fb0b8100dffd18c433c4aa97a4f2da76ff6e62e2ef2139edc4f98603ba0bb1c27b310b187b5070cf4e892ffc2d09661a6914defa4509c99b60bcbb50f70f4a0

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_3ybukbs4.jzn.ps1
    Filesize

    60B

    MD5

    d17fe0a3f47be24a6453e9ef58c94641

    SHA1

    6ab83620379fc69f80c0242105ddffd7d98d5d9d

    SHA256

    96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

    SHA512

    5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

    Download Submit

  • C:\Windows\SystemTemp\msedge_installer.log
    Filesize

    70KB

    MD5

    06dc07505d6052fa841541134d63467a

    SHA1

    29a4a5cdaf9f4bd2657b10151ad4fbbc610bdadc

    SHA256

    29537691d82b9a714ce685385e7867951389c97ce125892805878cfc7ae93165

    SHA512

    7ff2e3d5b36a43d0924539b73b58f7ee568f00e63bf9d736d3e297966292c2f394d2d27dbf1f3767cdee42264bbf626b2d7cd365fa32f7472de5379ac315fbcb

    Download Submit

  • C:\Windows\SystemTemp\msedge_installer.log
    Filesize

    95KB

    MD5

    c8c5cb62a2f33f714152b87020ba8ab8

    SHA1

    b2d9bb0f5883d6459dace3d694cff79091ecfff9

    SHA256

    7223a63ba4eb865e6b4c8acb6494471f4da343249c07e22593bb129d54d4c591

    SHA512

    27c90bf1d55626c897d4072beb33a183889fa925783f043edcabe0debbc87306bb8454949f436b46bb2eb7c1b9d6492bc8676734bcce23a6714a4cd25f0ac50e

    Download Submit

  • C:\Windows\SystemTemp\msedge_installer.log
    Filesize

    100KB

    MD5

    78207de76692356df1e1ebb1d886448a

    SHA1

    bbcdacbc06b8ce3e33c4f5bb552c58e62a50cb37

    SHA256

    0a7c9b7ce56255c37e9d69f4342ecf2f682974700a42e8a969a543ae3dd9db51

    SHA512

    bd22ee00034f6d644d266909a9dd1a01910a7420a2c88b44fa9d55706dc984c373201d43f5b70aec513081f9cf714db9751d413cbc3e0baa6da3d064f1a54646

    Download Submit

  • C:\Windows\SystemTemp\msedge_installer.log
    Filesize

    101KB

    MD5

    80b62cc73a8ebc05b7f2283ce1808a41

    SHA1

    9dc90024328e3be7fd81260932a80123d960e4ad

    SHA256

    50c202bf28e58f9559cd4f797fa5b8878c38855cc06d86132fafaa32db518697

    SHA512

    de93911d42ba6fd7a5ec04599fa8c9c233fa94b6ee5da5d8752e1e8e58bbbd40d46ba074a9626618ebecb6ccf39a08dfbef9ecc79c8f1896239e42a98667592a

    Download Submit

  • memory/1092-82-0x00007FF9EBA00000-0x00007FF9EBB1C000-memory.dmp

    Filesize

    1.1MB

    Download

  • memory/1092-192-0x00007FF9FEF70000-0x00007FF9FEF93000-memory.dmp

    Filesize

    140KB

    Download

  • memory/1092-71-0x00007FF9FAC80000-0x00007FF9FAD4D000-memory.dmp

    Filesize

    820KB

    Download

  • memory/1092-70-0x00007FF9EC1D0000-0x00007FF9EC7B9000-memory.dmp

    Filesize

    5.9MB

    Download

  • memory/1092-76-0x00007FF9FAF30000-0x00007FF9FAF44000-memory.dmp

    Filesize

    80KB

    Download

  • memory/1092-79-0x00007FF9FEFC0000-0x00007FF9FEFCD000-memory.dmp

    Filesize

    52KB

    Download

  • memory/1092-78-0x00007FFA01670000-0x00007FFA01689000-memory.dmp

    Filesize

    100KB

    Download

  • memory/1092-81-0x00007FF9FF820000-0x00007FF9FF84D000-memory.dmp

    Filesize

    180KB

    Download

  • memory/1092-72-0x00007FF9EBB20000-0x00007FF9EC042000-memory.dmp

    Filesize

    5.1MB

    Download

  • memory/1092-25-0x00007FF9EC1D0000-0x00007FF9EC7B9000-memory.dmp

    Filesize

    5.9MB

    Download

  • memory/1092-83-0x00007FF9FEF70000-0x00007FF9FEF93000-memory.dmp

    Filesize

    140KB

    Download

  • memory/1092-30-0x00007FF9FF850000-0x00007FF9FF873000-memory.dmp

    Filesize

    140KB

    Download

  • memory/1092-74-0x00007FF9FF850000-0x00007FF9FF873000-memory.dmp

    Filesize

    140KB

    Download

  • memory/1092-32-0x00007FFA01750000-0x00007FFA0175F000-memory.dmp

    Filesize

    60KB

    Download

  • memory/1092-50-0x00007FFA01670000-0x00007FFA01689000-memory.dmp

    Filesize

    100KB

    Download

  • memory/1092-106-0x00007FF9EC050000-0x00007FF9EC1C7000-memory.dmp

    Filesize

    1.5MB

    Download

  • memory/1092-113-0x00007FF9FAF50000-0x00007FF9FAF69000-memory.dmp

    Filesize

    100KB

    Download

  • memory/1092-66-0x00007FF9FAE40000-0x00007FF9FAE73000-memory.dmp

    Filesize

    204KB

    Download

  • memory/1092-64-0x00007FFA01740000-0x00007FFA0174D000-memory.dmp

    Filesize

    52KB

    Download

  • memory/1092-52-0x00007FF9FF820000-0x00007FF9FF84D000-memory.dmp

    Filesize

    180KB

    Download

  • memory/1092-128-0x00007FF9FAE40000-0x00007FF9FAE73000-memory.dmp

    Filesize

    204KB

    Download

  • memory/1092-62-0x00007FF9FAF50000-0x00007FF9FAF69000-memory.dmp

    Filesize

    100KB

    Download

  • memory/1092-150-0x00007FF9FAC80000-0x00007FF9FAD4D000-memory.dmp

    Filesize

    820KB

    Download

  • memory/1092-151-0x00007FF9EBB20000-0x00007FF9EC042000-memory.dmp

    Filesize

    5.1MB

    Download

  • memory/1092-153-0x000001FA357F0000-0x000001FA35D12000-memory.dmp

    Filesize

    5.1MB

    Download

  • memory/1092-156-0x00007FF9EBA00000-0x00007FF9EBB1C000-memory.dmp

    Filesize

    1.1MB

    Download

  • memory/1092-157-0x00007FF9EC1D0000-0x00007FF9EC7B9000-memory.dmp

    Filesize

    5.9MB

    Download

  • memory/1092-163-0x00007FF9EC050000-0x00007FF9EC1C7000-memory.dmp

    Filesize

    1.5MB

    Download

  • memory/1092-158-0x00007FF9FF850000-0x00007FF9FF873000-memory.dmp

    Filesize

    140KB

    Download

  • memory/1092-186-0x00007FF9FEFC0000-0x00007FF9FEFCD000-memory.dmp

    Filesize

    52KB

    Download

  • memory/1092-197-0x00007FF9FAC80000-0x00007FF9FAD4D000-memory.dmp

    Filesize

    820KB

    Download

  • memory/1092-199-0x00007FF9EBA00000-0x00007FF9EBB1C000-memory.dmp

    Filesize

    1.1MB

    Download

  • memory/1092-198-0x00007FF9EBB20000-0x00007FF9EC042000-memory.dmp

    Filesize

    5.1MB

    Download

  • memory/1092-196-0x00007FF9FAE40000-0x00007FF9FAE73000-memory.dmp

    Filesize

    204KB

    Download

  • memory/1092-195-0x00007FFA01740000-0x00007FFA0174D000-memory.dmp

    Filesize

    52KB

    Download

  • memory/1092-194-0x00007FF9FAF50000-0x00007FF9FAF69000-memory.dmp

    Filesize

    100KB

    Download

  • memory/1092-193-0x00007FF9EC050000-0x00007FF9EC1C7000-memory.dmp

    Filesize

    1.5MB

    Download

  • memory/1092-73-0x000001FA357F0000-0x000001FA35D12000-memory.dmp

    Filesize

    5.1MB

    Download

  • memory/1092-191-0x00007FF9FF820000-0x00007FF9FF84D000-memory.dmp

    Filesize

    180KB

    Download

  • memory/1092-190-0x00007FFA01670000-0x00007FFA01689000-memory.dmp

    Filesize

    100KB

    Download

  • memory/1092-189-0x00007FFA01750000-0x00007FFA0175F000-memory.dmp

    Filesize

    60KB

    Download

  • memory/1092-188-0x00007FF9FF850000-0x00007FF9FF873000-memory.dmp

    Filesize

    140KB

    Download

  • memory/1092-185-0x00007FF9FAF30000-0x00007FF9FAF44000-memory.dmp

    Filesize

    80KB

    Download

  • memory/1092-173-0x00007FF9EC1D0000-0x00007FF9EC7B9000-memory.dmp

    Filesize

    5.9MB

    Download

  • memory/1092-60-0x00007FF9EC050000-0x00007FF9EC1C7000-memory.dmp

    Filesize

    1.5MB

    Download

  • memory/1092-58-0x00007FF9FEF70000-0x00007FF9FEF93000-memory.dmp

    Filesize

    140KB

    Download

  • memory/2052-121-0x00007FF9EAF30000-0x00007FF9EB9F2000-memory.dmp

    Filesize

    10.8MB

    Download

  • memory/2052-96-0x00007FF9EAF30000-0x00007FF9EB9F2000-memory.dmp

    Filesize

    10.8MB

    Download

  • memory/2052-95-0x00007FF9EAF30000-0x00007FF9EB9F2000-memory.dmp

    Filesize

    10.8MB

    Download

  • memory/2052-90-0x00000206FA5B0000-0x00000206FA5D2000-memory.dmp

    Filesize

    136KB

    Download

  • memory/2052-84-0x00007FF9EAF33000-0x00007FF9EAF35000-memory.dmp

    Filesize

    8KB

    Download