Overview

overview

8

Static

static

3

P2UCP0TI2N...35.exe

windows10-2004-x64

8

Resubmissions

19/06/2025, 15:31

250619-sydlqaxls68

22/05/2025, 15:16

250522-snsmwsaj5s8

12/04/2025, 07:32

250412-jc2lzszns58

Analysis

  • max time kernel
    150s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20250314-en
  • submitted
    12/04/2025, 07:32

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    P2UCP0TI2NAT0D97KZDHJX1YG835.exe
  • Size 9.3MB
  • Sample250412-jc2lzszns5
  • SHA256 854d5ac4352c653dbb566a39de26f260181a666c01dc8f26347585bcd129a99d
  • MD5 SHA1 SHA512 SSDEEP
Score
8/10
discoveryexecutionpersistence

Malware Config

Signatures

  • Command and Scripting Interpreter: PowerShell 1 TTPs 23 IoCs

    Run Powershell and hide display window.

    execution
  • Adds Run key to start application 2 TTPs 23 IoCs
    persistence
  • System Location Discovery: System Language Discovery 1 TTPs 46 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 23 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\P2UCP0TI2NAT0D97KZDHJX1YG835.exe
    "C:\Users\Admin\AppData\Local\Temp\P2UCP0TI2NAT0D97KZDHJX1YG835.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:6060
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell -WindowStyle hidden -Command "if (-Not (Test-Path \"HKCU:\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\App\")) { Set-ItemProperty -Path \"HKCU:\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\" -Name \"App\" -Value \"C:\Users\Admin\AppData\Local\Temp\P2UCP0TI2NAT0D97KZDHJX1YG835.exe\" }"
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Adds Run key to start application
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:404
  • C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\P2UCP0TI2NAT0D97KZDHJX1YG835.exe
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:4768
    • C:\Users\Admin\AppData\Local\Temp\P2UCP0TI2NAT0D97KZDHJX1YG835.exe
      C:\Users\Admin\AppData\Local\Temp\P2UCP0TI2NAT0D97KZDHJX1YG835.exe
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:3224
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        powershell -WindowStyle hidden -Command "if (-Not (Test-Path \"HKCU:\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\App\")) { Set-ItemProperty -Path \"HKCU:\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\" -Name \"App\" -Value \"C:\Users\Admin\AppData\Local\Temp\P2UCP0TI2NAT0D97KZDHJX1YG835.exe\" }"
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • Adds Run key to start application
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:5756
  • C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\P2UCP0TI2NAT0D97KZDHJX1YG835.exe
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:6036
    • C:\Users\Admin\AppData\Local\Temp\P2UCP0TI2NAT0D97KZDHJX1YG835.exe
      C:\Users\Admin\AppData\Local\Temp\P2UCP0TI2NAT0D97KZDHJX1YG835.exe
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:3316
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        powershell -WindowStyle hidden -Command "if (-Not (Test-Path \"HKCU:\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\App\")) { Set-ItemProperty -Path \"HKCU:\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\" -Name \"App\" -Value \"C:\Users\Admin\AppData\Local\Temp\P2UCP0TI2NAT0D97KZDHJX1YG835.exe\" }"
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • Adds Run key to start application
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:1412
  • C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\P2UCP0TI2NAT0D97KZDHJX1YG835.exe
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:5680
    • C:\Users\Admin\AppData\Local\Temp\P2UCP0TI2NAT0D97KZDHJX1YG835.exe
      C:\Users\Admin\AppData\Local\Temp\P2UCP0TI2NAT0D97KZDHJX1YG835.exe
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:4220
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        powershell -WindowStyle hidden -Command "if (-Not (Test-Path \"HKCU:\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\App\")) { Set-ItemProperty -Path \"HKCU:\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\" -Name \"App\" -Value \"C:\Users\Admin\AppData\Local\Temp\P2UCP0TI2NAT0D97KZDHJX1YG835.exe\" }"
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • Adds Run key to start application
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:4288
  • C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\P2UCP0TI2NAT0D97KZDHJX1YG835.exe
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:6088
    • C:\Users\Admin\AppData\Local\Temp\P2UCP0TI2NAT0D97KZDHJX1YG835.exe
      C:\Users\Admin\AppData\Local\Temp\P2UCP0TI2NAT0D97KZDHJX1YG835.exe
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:5048
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        powershell -WindowStyle hidden -Command "if (-Not (Test-Path \"HKCU:\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\App\")) { Set-ItemProperty -Path \"HKCU:\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\" -Name \"App\" -Value \"C:\Users\Admin\AppData\Local\Temp\P2UCP0TI2NAT0D97KZDHJX1YG835.exe\" }"
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • Adds Run key to start application
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:4672
  • C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\P2UCP0TI2NAT0D97KZDHJX1YG835.exe
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:4516
    • C:\Users\Admin\AppData\Local\Temp\P2UCP0TI2NAT0D97KZDHJX1YG835.exe
      C:\Users\Admin\AppData\Local\Temp\P2UCP0TI2NAT0D97KZDHJX1YG835.exe
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:2164
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        powershell -WindowStyle hidden -Command "if (-Not (Test-Path \"HKCU:\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\App\")) { Set-ItemProperty -Path \"HKCU:\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\" -Name \"App\" -Value \"C:\Users\Admin\AppData\Local\Temp\P2UCP0TI2NAT0D97KZDHJX1YG835.exe\" }"
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • Adds Run key to start application
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:2084
  • C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\P2UCP0TI2NAT0D97KZDHJX1YG835.exe
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:5148
    • C:\Users\Admin\AppData\Local\Temp\P2UCP0TI2NAT0D97KZDHJX1YG835.exe
      C:\Users\Admin\AppData\Local\Temp\P2UCP0TI2NAT0D97KZDHJX1YG835.exe
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:4488
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        powershell -WindowStyle hidden -Command "if (-Not (Test-Path \"HKCU:\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\App\")) { Set-ItemProperty -Path \"HKCU:\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\" -Name \"App\" -Value \"C:\Users\Admin\AppData\Local\Temp\P2UCP0TI2NAT0D97KZDHJX1YG835.exe\" }"
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • Adds Run key to start application
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:4184
  • C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\P2UCP0TI2NAT0D97KZDHJX1YG835.exe
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:4548
    • C:\Users\Admin\AppData\Local\Temp\P2UCP0TI2NAT0D97KZDHJX1YG835.exe
      C:\Users\Admin\AppData\Local\Temp\P2UCP0TI2NAT0D97KZDHJX1YG835.exe
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:5360
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        powershell -WindowStyle hidden -Command "if (-Not (Test-Path \"HKCU:\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\App\")) { Set-ItemProperty -Path \"HKCU:\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\" -Name \"App\" -Value \"C:\Users\Admin\AppData\Local\Temp\P2UCP0TI2NAT0D97KZDHJX1YG835.exe\" }"
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • Adds Run key to start application
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:5224
  • C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\P2UCP0TI2NAT0D97KZDHJX1YG835.exe
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1228
    • C:\Users\Admin\AppData\Local\Temp\P2UCP0TI2NAT0D97KZDHJX1YG835.exe
      C:\Users\Admin\AppData\Local\Temp\P2UCP0TI2NAT0D97KZDHJX1YG835.exe
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:6064
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        powershell -WindowStyle hidden -Command "if (-Not (Test-Path \"HKCU:\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\App\")) { Set-ItemProperty -Path \"HKCU:\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\" -Name \"App\" -Value \"C:\Users\Admin\AppData\Local\Temp\P2UCP0TI2NAT0D97KZDHJX1YG835.exe\" }"
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • Adds Run key to start application
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:4144
  • C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\P2UCP0TI2NAT0D97KZDHJX1YG835.exe
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2276
    • C:\Users\Admin\AppData\Local\Temp\P2UCP0TI2NAT0D97KZDHJX1YG835.exe
      C:\Users\Admin\AppData\Local\Temp\P2UCP0TI2NAT0D97KZDHJX1YG835.exe
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:4372
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        powershell -WindowStyle hidden -Command "if (-Not (Test-Path \"HKCU:\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\App\")) { Set-ItemProperty -Path \"HKCU:\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\" -Name \"App\" -Value \"C:\Users\Admin\AppData\Local\Temp\P2UCP0TI2NAT0D97KZDHJX1YG835.exe\" }"
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • Adds Run key to start application
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:960
  • C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\P2UCP0TI2NAT0D97KZDHJX1YG835.exe
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:4708
    • C:\Users\Admin\AppData\Local\Temp\P2UCP0TI2NAT0D97KZDHJX1YG835.exe
      C:\Users\Admin\AppData\Local\Temp\P2UCP0TI2NAT0D97KZDHJX1YG835.exe
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:5992
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        powershell -WindowStyle hidden -Command "if (-Not (Test-Path \"HKCU:\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\App\")) { Set-ItemProperty -Path \"HKCU:\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\" -Name \"App\" -Value \"C:\Users\Admin\AppData\Local\Temp\P2UCP0TI2NAT0D97KZDHJX1YG835.exe\" }"
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • Adds Run key to start application
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:8
  • C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\P2UCP0TI2NAT0D97KZDHJX1YG835.exe
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:5392
    • C:\Users\Admin\AppData\Local\Temp\P2UCP0TI2NAT0D97KZDHJX1YG835.exe
      C:\Users\Admin\AppData\Local\Temp\P2UCP0TI2NAT0D97KZDHJX1YG835.exe
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      PID:2108
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        powershell -WindowStyle hidden -Command "if (-Not (Test-Path \"HKCU:\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\App\")) { Set-ItemProperty -Path \"HKCU:\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\" -Name \"App\" -Value \"C:\Users\Admin\AppData\Local\Temp\P2UCP0TI2NAT0D97KZDHJX1YG835.exe\" }"
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • Adds Run key to start application
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:1656
  • C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\P2UCP0TI2NAT0D97KZDHJX1YG835.exe
    1⤵
      PID:1576
      • C:\Users\Admin\AppData\Local\Temp\P2UCP0TI2NAT0D97KZDHJX1YG835.exe
        C:\Users\Admin\AppData\Local\Temp\P2UCP0TI2NAT0D97KZDHJX1YG835.exe
        2⤵
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        PID:3884
        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
          powershell -WindowStyle hidden -Command "if (-Not (Test-Path \"HKCU:\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\App\")) { Set-ItemProperty -Path \"HKCU:\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\" -Name \"App\" -Value \"C:\Users\Admin\AppData\Local\Temp\P2UCP0TI2NAT0D97KZDHJX1YG835.exe\" }"
          3⤵
          • Command and Scripting Interpreter: PowerShell
          • Adds Run key to start application
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:1528
    • C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\P2UCP0TI2NAT0D97KZDHJX1YG835.exe
      1⤵
        PID:3108
        • C:\Users\Admin\AppData\Local\Temp\P2UCP0TI2NAT0D97KZDHJX1YG835.exe
          C:\Users\Admin\AppData\Local\Temp\P2UCP0TI2NAT0D97KZDHJX1YG835.exe
          2⤵
          • System Location Discovery: System Language Discovery
          PID:5224
          • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
            powershell -WindowStyle hidden -Command "if (-Not (Test-Path \"HKCU:\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\App\")) { Set-ItemProperty -Path \"HKCU:\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\" -Name \"App\" -Value \"C:\Users\Admin\AppData\Local\Temp\P2UCP0TI2NAT0D97KZDHJX1YG835.exe\" }"
            3⤵
            • Command and Scripting Interpreter: PowerShell
            • Adds Run key to start application
            • System Location Discovery: System Language Discovery
            • Suspicious use of AdjustPrivilegeToken
            PID:3412
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\P2UCP0TI2NAT0D97KZDHJX1YG835.exe
        1⤵
          PID:3652
          • C:\Users\Admin\AppData\Local\Temp\P2UCP0TI2NAT0D97KZDHJX1YG835.exe
            C:\Users\Admin\AppData\Local\Temp\P2UCP0TI2NAT0D97KZDHJX1YG835.exe
            2⤵
            • System Location Discovery: System Language Discovery
            PID:228
            • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              powershell -WindowStyle hidden -Command "if (-Not (Test-Path \"HKCU:\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\App\")) { Set-ItemProperty -Path \"HKCU:\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\" -Name \"App\" -Value \"C:\Users\Admin\AppData\Local\Temp\P2UCP0TI2NAT0D97KZDHJX1YG835.exe\" }"
              3⤵
              • Command and Scripting Interpreter: PowerShell
              • Adds Run key to start application
              • System Location Discovery: System Language Discovery
              • Suspicious use of AdjustPrivilegeToken
              PID:3504
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\P2UCP0TI2NAT0D97KZDHJX1YG835.exe
          1⤵
            PID:5632
            • C:\Users\Admin\AppData\Local\Temp\P2UCP0TI2NAT0D97KZDHJX1YG835.exe
              C:\Users\Admin\AppData\Local\Temp\P2UCP0TI2NAT0D97KZDHJX1YG835.exe
              2⤵
              • System Location Discovery: System Language Discovery
              PID:4536
              • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                powershell -WindowStyle hidden -Command "if (-Not (Test-Path \"HKCU:\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\App\")) { Set-ItemProperty -Path \"HKCU:\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\" -Name \"App\" -Value \"C:\Users\Admin\AppData\Local\Temp\P2UCP0TI2NAT0D97KZDHJX1YG835.exe\" }"
                3⤵
                • Command and Scripting Interpreter: PowerShell
                • Adds Run key to start application
                • System Location Discovery: System Language Discovery
                • Suspicious use of AdjustPrivilegeToken
                PID:1916
          • C:\Windows\system32\cmd.exe
            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\P2UCP0TI2NAT0D97KZDHJX1YG835.exe
            1⤵
              PID:1624
              • C:\Users\Admin\AppData\Local\Temp\P2UCP0TI2NAT0D97KZDHJX1YG835.exe
                C:\Users\Admin\AppData\Local\Temp\P2UCP0TI2NAT0D97KZDHJX1YG835.exe
                2⤵
                • System Location Discovery: System Language Discovery
                PID:4664
                • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                  powershell -WindowStyle hidden -Command "if (-Not (Test-Path \"HKCU:\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\App\")) { Set-ItemProperty -Path \"HKCU:\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\" -Name \"App\" -Value \"C:\Users\Admin\AppData\Local\Temp\P2UCP0TI2NAT0D97KZDHJX1YG835.exe\" }"
                  3⤵
                  • Command and Scripting Interpreter: PowerShell
                  • Adds Run key to start application
                  • System Location Discovery: System Language Discovery
                  • Suspicious use of AdjustPrivilegeToken
                  PID:1608
            • C:\Windows\system32\cmd.exe
              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\P2UCP0TI2NAT0D97KZDHJX1YG835.exe
              1⤵
                PID:2972
                • C:\Users\Admin\AppData\Local\Temp\P2UCP0TI2NAT0D97KZDHJX1YG835.exe
                  C:\Users\Admin\AppData\Local\Temp\P2UCP0TI2NAT0D97KZDHJX1YG835.exe
                  2⤵
                  • System Location Discovery: System Language Discovery
                  PID:5956
                  • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                    powershell -WindowStyle hidden -Command "if (-Not (Test-Path \"HKCU:\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\App\")) { Set-ItemProperty -Path \"HKCU:\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\" -Name \"App\" -Value \"C:\Users\Admin\AppData\Local\Temp\P2UCP0TI2NAT0D97KZDHJX1YG835.exe\" }"
                    3⤵
                    • Command and Scripting Interpreter: PowerShell
                    • Adds Run key to start application
                    • System Location Discovery: System Language Discovery
                    • Suspicious use of AdjustPrivilegeToken
                    PID:1936
              • C:\Windows\system32\cmd.exe
                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\P2UCP0TI2NAT0D97KZDHJX1YG835.exe
                1⤵
                  PID:4836
                  • C:\Users\Admin\AppData\Local\Temp\P2UCP0TI2NAT0D97KZDHJX1YG835.exe
                    C:\Users\Admin\AppData\Local\Temp\P2UCP0TI2NAT0D97KZDHJX1YG835.exe
                    2⤵
                    • System Location Discovery: System Language Discovery
                    PID:5300
                    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                      powershell -WindowStyle hidden -Command "if (-Not (Test-Path \"HKCU:\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\App\")) { Set-ItemProperty -Path \"HKCU:\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\" -Name \"App\" -Value \"C:\Users\Admin\AppData\Local\Temp\P2UCP0TI2NAT0D97KZDHJX1YG835.exe\" }"
                      3⤵
                      • Command and Scripting Interpreter: PowerShell
                      • Adds Run key to start application
                      • System Location Discovery: System Language Discovery
                      • Suspicious use of AdjustPrivilegeToken
                      PID:2788
                • C:\Windows\system32\cmd.exe
                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\P2UCP0TI2NAT0D97KZDHJX1YG835.exe
                  1⤵
                    PID:5260
                    • C:\Users\Admin\AppData\Local\Temp\P2UCP0TI2NAT0D97KZDHJX1YG835.exe
                      C:\Users\Admin\AppData\Local\Temp\P2UCP0TI2NAT0D97KZDHJX1YG835.exe
                      2⤵
                      • System Location Discovery: System Language Discovery
                      PID:1032
                      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                        powershell -WindowStyle hidden -Command "if (-Not (Test-Path \"HKCU:\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\App\")) { Set-ItemProperty -Path \"HKCU:\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\" -Name \"App\" -Value \"C:\Users\Admin\AppData\Local\Temp\P2UCP0TI2NAT0D97KZDHJX1YG835.exe\" }"
                        3⤵
                        • Command and Scripting Interpreter: PowerShell
                        • Adds Run key to start application
                        • System Location Discovery: System Language Discovery
                        • Suspicious use of AdjustPrivilegeToken
                        PID:5116
                  • C:\Windows\system32\cmd.exe
                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\P2UCP0TI2NAT0D97KZDHJX1YG835.exe
                    1⤵
                      PID:5668
                      • C:\Users\Admin\AppData\Local\Temp\P2UCP0TI2NAT0D97KZDHJX1YG835.exe
                        C:\Users\Admin\AppData\Local\Temp\P2UCP0TI2NAT0D97KZDHJX1YG835.exe
                        2⤵
                        • System Location Discovery: System Language Discovery
                        PID:1640
                        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                          powershell -WindowStyle hidden -Command "if (-Not (Test-Path \"HKCU:\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\App\")) { Set-ItemProperty -Path \"HKCU:\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\" -Name \"App\" -Value \"C:\Users\Admin\AppData\Local\Temp\P2UCP0TI2NAT0D97KZDHJX1YG835.exe\" }"
                          3⤵
                          • Command and Scripting Interpreter: PowerShell
                          • Adds Run key to start application
                          • System Location Discovery: System Language Discovery
                          • Suspicious use of AdjustPrivilegeToken
                          PID:5556
                    • C:\Windows\system32\cmd.exe
                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\P2UCP0TI2NAT0D97KZDHJX1YG835.exe
                      1⤵
                        PID:3304
                        • C:\Users\Admin\AppData\Local\Temp\P2UCP0TI2NAT0D97KZDHJX1YG835.exe
                          C:\Users\Admin\AppData\Local\Temp\P2UCP0TI2NAT0D97KZDHJX1YG835.exe
                          2⤵
                          • System Location Discovery: System Language Discovery
                          PID:2904
                          • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                            powershell -WindowStyle hidden -Command "if (-Not (Test-Path \"HKCU:\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\App\")) { Set-ItemProperty -Path \"HKCU:\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\" -Name \"App\" -Value \"C:\Users\Admin\AppData\Local\Temp\P2UCP0TI2NAT0D97KZDHJX1YG835.exe\" }"
                            3⤵
                            • Command and Scripting Interpreter: PowerShell
                            • Adds Run key to start application
                            • System Location Discovery: System Language Discovery
                            • Suspicious use of AdjustPrivilegeToken
                            PID:5608
                      • C:\Windows\system32\cmd.exe
                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\P2UCP0TI2NAT0D97KZDHJX1YG835.exe
                        1⤵
                          PID:3648
                          • C:\Users\Admin\AppData\Local\Temp\P2UCP0TI2NAT0D97KZDHJX1YG835.exe
                            C:\Users\Admin\AppData\Local\Temp\P2UCP0TI2NAT0D97KZDHJX1YG835.exe
                            2⤵
                            • System Location Discovery: System Language Discovery
                            PID:1712
                            • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                              powershell -WindowStyle hidden -Command "if (-Not (Test-Path \"HKCU:\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\App\")) { Set-ItemProperty -Path \"HKCU:\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\" -Name \"App\" -Value \"C:\Users\Admin\AppData\Local\Temp\P2UCP0TI2NAT0D97KZDHJX1YG835.exe\" }"
                              3⤵
                              • Command and Scripting Interpreter: PowerShell
                              • Adds Run key to start application
                              • System Location Discovery: System Language Discovery
                              • Suspicious use of AdjustPrivilegeToken
                              PID:2676
                        • C:\Windows\system32\cmd.exe
                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\P2UCP0TI2NAT0D97KZDHJX1YG835.exe
                          1⤵
                            PID:5484
                            • C:\Users\Admin\AppData\Local\Temp\P2UCP0TI2NAT0D97KZDHJX1YG835.exe
                              C:\Users\Admin\AppData\Local\Temp\P2UCP0TI2NAT0D97KZDHJX1YG835.exe
                              2⤵
                                PID:2652

                            Network

                                  MITRE ATT&CK Enterprise v16

                                  Replay Monitor

                                  Loading Replay Monitor...

                                  Downloads

                                  powershell.exe.log
                                  • Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log
                                  • Size 1KB
                                  • SHA256 aa1c97cdbce9a848f1db2ad483f19caa535b55a3a1ef2ad1260e0437002bc82c
                                  • MD5 SHA1 SHA512
                                  Submit Download

                                  StartupProfileData-NonInteractive
                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                  • Size 15KB
                                  • SHA256 04cca9ee1ef00577d74b7eb09b2c34922d0bcdaed4bf2e6530cfca9588ed78b9
                                  • MD5 SHA1 SHA512 SSDEEP
                                  Submit Download

                                  StartupProfileData-NonInteractive
                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                  • Size 15KB
                                  • SHA256 16d27e944b91e579601e4db6719b60ec6520ca21a05b1a1b766f10eab393a9f2
                                  • MD5 SHA1 SHA512 SSDEEP
                                  Submit Download

                                  StartupProfileData-NonInteractive
                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                  • Size 15KB
                                  • SHA256 2febb625fb888dd824c4619f88c7d444ff29210e0636e67c6dbea2daee0c69f9
                                  • MD5 SHA1 SHA512 SSDEEP
                                  Submit Download

                                  StartupProfileData-NonInteractive
                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                  • Size 16KB
                                  • SHA256 4601070e6d0f6096dfa92ac61bac2866b31da90b9d9734954ed6eeb5b2bed336
                                  • MD5 SHA1 SHA512 SSDEEP
                                  Submit Download

                                  StartupProfileData-NonInteractive
                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                  • Size 15KB
                                  • SHA256 17d32fc9ba4cbb5a4227b20aa3a467d5d7b7a4d7a8680a48acd27f9a5b7f27c9
                                  • MD5 SHA1 SHA512 SSDEEP
                                  Submit Download

                                  StartupProfileData-NonInteractive
                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                  • Size 15KB
                                  • SHA256 d9753d0cb96e649686447128fbb403ce0bfac851bd80cd6b8bddb7dfec132d89
                                  • MD5 SHA1 SHA512 SSDEEP
                                  Submit Download

                                  StartupProfileData-NonInteractive
                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                  • Size 15KB
                                  • SHA256 04f2585d5cdaf849c1d90d7f3a8a0f3b1f82b45ca476f05b9ed609acfc455dba
                                  • MD5 SHA1 SHA512 SSDEEP
                                  Submit Download

                                  StartupProfileData-NonInteractive
                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                  • Size 15KB
                                  • SHA256 61f7e5b11620110a8d909577e6d7087da383cc87c222e828e50574db5892af69
                                  • MD5 SHA1 SHA512 SSDEEP
                                  Submit Download

                                  StartupProfileData-NonInteractive
                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                  • Size 15KB
                                  • SHA256 139af815a807a049d870ec0c284ead9e6c2dee14cd2b52c818101a3ba65e6144
                                  • MD5 SHA1 SHA512 SSDEEP
                                  Submit Download

                                  StartupProfileData-NonInteractive
                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                  • Size 15KB
                                  • SHA256 e5200b079ccac1d221ef69c3d92b82cae897e50299c1557084d9b64337c4666b
                                  • MD5 SHA1 SHA512 SSDEEP
                                  Submit Download

                                  StartupProfileData-NonInteractive
                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                  • Size 15KB
                                  • SHA256 1bcf88a51c6355e42bb154440ef2c56a38e25ac464f47f7f4860b15c5801527f
                                  • MD5 SHA1 SHA512 SSDEEP
                                  Submit Download

                                  StartupProfileData-NonInteractive
                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                  • Size 15KB
                                  • SHA256 3e07b44b5ff1b879c63fdc455a797abc8b5a6f89a5bf9dd9c094b106d29b0b61
                                  • MD5 SHA1 SHA512 SSDEEP
                                  Submit Download

                                  StartupProfileData-NonInteractive
                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                  • Size 15KB
                                  • SHA256 800d89515df3418dbdcc89a4c1ba0a62bf49ec399e6ff95507cad1c2d0ad2574
                                  • MD5 SHA1 SHA512 SSDEEP
                                  Submit Download

                                  StartupProfileData-NonInteractive
                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                  • Size 15KB
                                  • SHA256 15cee795465810a82bfa03657a132c06b50a379bc7cee8a6d13a6eae11a1823d
                                  • MD5 SHA1 SHA512 SSDEEP
                                  Submit Download

                                  StartupProfileData-NonInteractive
                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                  • Size 15KB
                                  • SHA256 12840b617a9fb797ba16140d46ebe2455b8bf9d6aba1128c9135f84726ae24a0
                                  • MD5 SHA1 SHA512 SSDEEP
                                  Submit Download

                                  StartupProfileData-NonInteractive
                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                  • Size 15KB
                                  • SHA256 e3984c743669da9237e7692a98751c41bb8fd1de1f5142fcbf3ee9c7da5c700c
                                  • MD5 SHA1 SHA512 SSDEEP
                                  Submit Download

                                  StartupProfileData-NonInteractive
                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                  • Size 15KB
                                  • SHA256 35b3f36ba257fa30e7dc8bd1558dd018063adbcc9a380a3af9468bf54758acfb
                                  • MD5 SHA1 SHA512 SSDEEP
                                  Submit Download

                                  StartupProfileData-NonInteractive
                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                  • Size 15KB
                                  • SHA256 53c884bca86aedb4c0cc7630e621581ad70bd141869ff564816eca38b12f494f
                                  • MD5 SHA1 SHA512 SSDEEP
                                  Submit Download

                                  StartupProfileData-NonInteractive
                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                  • Size 15KB
                                  • SHA256 f03762b118f4549167117f666016a1bff8ac6a31dc9a1ea54279fd217cf9d44f
                                  • MD5 SHA1 SHA512 SSDEEP
                                  Submit Download

                                  StartupProfileData-NonInteractive
                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                  • Size 15KB
                                  • SHA256 98fecc3f60b8ca1089e2aad86e2faedbe95fd80e366459f3778201164211e77b
                                  • MD5 SHA1 SHA512 SSDEEP
                                  Submit Download

                                  StartupProfileData-NonInteractive
                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                  • Size 16KB
                                  • SHA256 ea3400a8828685d8de0c31553586592ab377b4b2fce612f1d8d9accafac6fa61
                                  • MD5 SHA1 SHA512 SSDEEP
                                  Submit Download

                                  StartupProfileData-NonInteractive
                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                  • Size 15KB
                                  • SHA256 71baa2b4ba22b0f1549e720fe0fcced96df8ca6712dce04827af6f6827c36b5e
                                  • MD5 SHA1 SHA512 SSDEEP
                                  Submit Download

                                  NrEXDJiACHo.exe
                                  • Path C:\Users\Admin\AppData\Local\Temp\NrEXDJiACHo.exe
                                  • Size 9.3MB
                                  • SHA256 854d5ac4352c653dbb566a39de26f260181a666c01dc8f26347585bcd129a99d
                                  • MD5 SHA1 SHA512 SSDEEP
                                  Submit Download

                                  __PSScriptPolicyTest_3atml1ce.hl5.ps1
                                  • Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_3atml1ce.hl5.ps1
                                  • Size 60B
                                  • SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
                                  • MD5 SHA1 SHA512
                                  Submit Download

                                  config
                                  • Path C:\Users\Admin\AppData\Local\config
                                  • Size 728B
                                  • SHA256 06dbd29cf888a315b8f0f9ca569e2e803927fb8dff4392aba7d6419fbf0322f3
                                  • MD5 SHA1 SHA512
                                  Submit Download

                                  memory/404-19-0x00000000060B0000-0x0000000006116000-memory.dmp
                                  Download

                                  memory/404-20-0x0000000006120000-0x0000000006186000-memory.dmp
                                  Download

                                  memory/404-36-0x0000000007EE0000-0x0000000008484000-memory.dmp
                                  Download

                                  memory/404-35-0x0000000006D80000-0x0000000006DA2000-memory.dmp
                                  Download

                                  memory/404-34-0x0000000006D10000-0x0000000006D2A000-memory.dmp
                                  Download

                                  memory/404-33-0x0000000007890000-0x0000000007926000-memory.dmp
                                  Download

                                  memory/404-32-0x0000000006900000-0x000000000694C000-memory.dmp
                                  Download

                                  memory/404-31-0x0000000006840000-0x000000000685E000-memory.dmp
                                  Download

                                  memory/404-30-0x0000000006210000-0x0000000006564000-memory.dmp
                                  Download

                                  memory/404-39-0x00007FFE740F0000-0x00007FFE742E5000-memory.dmp
                                  Download

                                  memory/404-18-0x0000000005880000-0x00000000058A2000-memory.dmp
                                  Download

                                  memory/404-17-0x0000000005910000-0x0000000005F38000-memory.dmp
                                  Download

                                  memory/404-16-0x00007FFE740F0000-0x00007FFE742E5000-memory.dmp
                                  Download

                                  memory/404-13-0x00007FFE740F0000-0x00007FFE742E5000-memory.dmp
                                  Download

                                  memory/404-15-0x00007FFE740F0000-0x00007FFE742E5000-memory.dmp
                                  Download

                                  memory/404-14-0x00000000052A0000-0x00000000052D6000-memory.dmp
                                  Download

                                  memory/1412-87-0x0000000006100000-0x0000000006454000-memory.dmp
                                  Download

                                  memory/2084-168-0x0000000005840000-0x0000000005B94000-memory.dmp
                                  Download

                                  memory/2164-156-0x0000000003E60000-0x00000000043A2000-memory.dmp
                                  Download

                                  memory/2164-157-0x0000000003E60000-0x00000000043A2000-memory.dmp
                                  Download

                                  memory/2164-158-0x0000000003E60000-0x00000000043A2000-memory.dmp
                                  Download

                                  memory/2164-151-0x0000000003E60000-0x00000000043A2000-memory.dmp
                                  Download

                                  memory/2676-562-0x0000000005B70000-0x0000000005EC4000-memory.dmp
                                  Download

                                  memory/2788-470-0x0000000005E80000-0x00000000061D4000-memory.dmp
                                  Download

                                  memory/3224-143-0x0000000003710000-0x0000000003C52000-memory.dmp
                                  Download

                                  memory/3224-46-0x0000000003710000-0x0000000003C52000-memory.dmp
                                  Download

                                  memory/3224-54-0x0000000003710000-0x0000000003C52000-memory.dmp
                                  Download

                                  memory/3224-91-0x00007FFE740F0000-0x00007FFE742E5000-memory.dmp
                                  Download

                                  memory/3224-56-0x0000000003710000-0x0000000003C52000-memory.dmp
                                  Download

                                  memory/3224-55-0x0000000003710000-0x0000000003C52000-memory.dmp
                                  Download

                                  memory/3224-53-0x00007FFE740F0000-0x00007FFE742E5000-memory.dmp
                                  Download

                                  memory/3316-84-0x0000000003540000-0x0000000003A82000-memory.dmp
                                  Download

                                  memory/3316-82-0x0000000003540000-0x0000000003A82000-memory.dmp
                                  Download

                                  memory/3316-123-0x0000000003540000-0x0000000003A82000-memory.dmp
                                  Download

                                  memory/3316-77-0x0000000003540000-0x0000000003A82000-memory.dmp
                                  Download

                                  memory/3316-83-0x0000000003540000-0x0000000003A82000-memory.dmp
                                  Download

                                  memory/4220-106-0x0000000003DF0000-0x0000000004332000-memory.dmp
                                  Download

                                  memory/4220-146-0x0000000003DF0000-0x0000000004332000-memory.dmp
                                  Download

                                  memory/4220-107-0x0000000003DF0000-0x0000000004332000-memory.dmp
                                  Download

                                  memory/4220-108-0x0000000003DF0000-0x0000000004332000-memory.dmp
                                  Download

                                  memory/4220-147-0x0000000003DF0000-0x0000000004332000-memory.dmp
                                  Download

                                  memory/4220-101-0x0000000003DF0000-0x0000000004332000-memory.dmp
                                  Download

                                  memory/4288-118-0x00000000064A0000-0x00000000067F4000-memory.dmp
                                  Download

                                  memory/5048-130-0x0000000003A30000-0x0000000003F72000-memory.dmp
                                  Download

                                  memory/5048-125-0x0000000003A30000-0x0000000003F72000-memory.dmp
                                  Download

                                  memory/5048-145-0x0000000003A30000-0x0000000003F72000-memory.dmp
                                  Download

                                  memory/5048-132-0x0000000003A30000-0x0000000003F72000-memory.dmp
                                  Download

                                  memory/5048-131-0x0000000003A30000-0x0000000003F72000-memory.dmp
                                  Download

                                  memory/5756-72-0x00007FFE740F0000-0x00007FFE742E5000-memory.dmp
                                  Download

                                  memory/5756-59-0x00007FFE740F0000-0x00007FFE742E5000-memory.dmp
                                  Download

                                  memory/5756-58-0x00007FFE740F0000-0x00007FFE742E5000-memory.dmp
                                  Download

                                  memory/5756-70-0x0000000006100000-0x000000000614C000-memory.dmp
                                  Download

                                  memory/6060-42-0x00007FFE740F0000-0x00007FFE742E5000-memory.dmp
                                  Download

                                  memory/6060-40-0x00000000038E0000-0x0000000003E22000-memory.dmp
                                  Download

                                  memory/6060-11-0x00000000038E0000-0x0000000003E22000-memory.dmp
                                  Download

                                  memory/6060-12-0x00000000038E0000-0x0000000003E22000-memory.dmp
                                  Download

                                  memory/6060-10-0x00000000038E0000-0x0000000003E22000-memory.dmp
                                  Download

                                  memory/6060-8-0x00007FFE740F0000-0x00007FFE742E5000-memory.dmp
                                  Download

                                  memory/6060-1-0x0000000002EF0000-0x0000000002EF1000-memory.dmp
                                  Download

                                  memory/6060-2-0x00000000038E0000-0x0000000003E22000-memory.dmp
                                  Download