umbral | 852a0e2b6016d2b2e0953c50e0985fe60320a70e73515cfea7706f86130a06ca

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20250410-en
resource tags

arch:x64arch:x86image:win10v2004-20250410-enlocale:en-usos:windows10-2004-x64system
submitted
12/04/2025, 15:43

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

N1NC5_solara.exe
Size

2.8MB
MD5

d4ef72e55ee8d916a060dae174398888
SHA1

92dc6ce33833a32e70d377bd6d66a17c0fd2369a
SHA256

852a0e2b6016d2b2e0953c50e0985fe60320a70e73515cfea7706f86130a06ca
SHA512

a814c8a43b4602888c9f12969f96c83c193528a7679ee8432da8f8e4b11a1379e35c4b07ad6cedec5e434d0b5ec7ad8124bbd6f3092fbcd0acc1b98fbb144f16
SSDEEP

49152:G5wRNpPAI7CYItONjnwsp61qLJa2uQzdqYoqDLdS96A4zDziq2EJLFp2C/Xv:GaRvROYEQEqFajKoqDLgMAI2KLmC/X

Score

10^/10

umbral defense_evasion discovery execution persistence privilege_escalation spyware stealer

Malware Config

Signatures

Detect Umbral payload 2 IoCs

resource	yara_rule
behavioral1/files/0x00100000000227f5-6.dat	family_umbral
behavioral1/memory/5256-22-0x0000021F9E740000-0x0000021F9E780000-memory.dmp	family_umbral

Umbral
Umbral stealer is an opensource moduler stealer written in C#.
stealer umbral
Umbral family
umbral

Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
4756	powershell.exe
4624	powershell.exe
2336	powershell.exe
3980	powershell.exe

Modifies Windows Firewall 2 TTPs 1 IoCs

defense_evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
3884	netsh.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2645532622-3298555945-705856666-1000\Control Panel\International\Geo\Nation	N1NC5_solara.exe

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\58ef1cb24ef99d0cdb9aa4d818c79b63.exe	Server.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\58ef1cb24ef99d0cdb9aa4d818c79b63.exe	Server.exe

Executes dropped EXE 39 IoCs

pid	Process
5256	Umbral.exe
5204	Server.exe
4472	BootstrapperNew.exe
5628	Server.exe
2340	Server.exe
3408	Server.exe
6028	Server.exe
2008	Server.exe
3156	Server.exe
3244	Server.exe
5904	Server.exe
4468	Server.exe
2492	Server.exe
1516	Server.exe
5328	Server.exe
556	Server.exe
4448	Server.exe
860	Server.exe
4192	Server.exe
448	Server.exe
880	Server.exe
4920	Server.exe
3164	Server.exe
5164	Server.exe
2504	Server.exe
2432	Server.exe
2720	Server.exe
5400	Server.exe
6008	Server.exe
3088	Server.exe
5548	Server.exe
5232	Server.exe
3824	Server.exe
5928	Server.exe
5680	Server.exe
336	Server.exe
3452	Server.exe
4420	Server.exe
3172	Server.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2645532622-3298555945-705856666-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\58ef1cb24ef99d0cdb9aa4d818c79b63 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\Server.exe\" .."	Server.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\58ef1cb24ef99d0cdb9aa4d818c79b63 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\Server.exe\" .."	Server.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
17	discord.com
18	discord.com

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
15	ip-api.com

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe

System Location Discovery: System Language Discovery 1 TTPs 38 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Server.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Server.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Server.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Server.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Server.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Server.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Server.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Server.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Server.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Server.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Server.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Server.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Server.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Server.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Server.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Server.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Server.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Server.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Server.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Server.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Server.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Server.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Server.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Server.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Server.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Server.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Server.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Server.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Server.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Server.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Server.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Server.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Server.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Server.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Server.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Server.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Server.exe

Detects videocard installed 1 TTPs 1 IoCs

Uses WMIC.exe to determine videocard installed.

System Information Discovery

T1082

pid	Process
1016	wmic.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4756	powershell.exe
4756	powershell.exe
4624	powershell.exe
4624	powershell.exe
2336	powershell.exe
2336	powershell.exe
624	powershell.exe
624	powershell.exe
3980	powershell.exe
3980	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	5256	Umbral.exe
Token: SeDebugPrivilege	4756	powershell.exe
Token: SeDebugPrivilege	4624	powershell.exe
Token: SeDebugPrivilege	2336	powershell.exe
Token: SeDebugPrivilege	624	powershell.exe
Token: SeIncreaseQuotaPrivilege	1996	wmic.exe
Token: SeSecurityPrivilege	1996	wmic.exe
Token: SeTakeOwnershipPrivilege	1996	wmic.exe
Token: SeLoadDriverPrivilege	1996	wmic.exe
Token: SeSystemProfilePrivilege	1996	wmic.exe
Token: SeSystemtimePrivilege	1996	wmic.exe
Token: SeProfSingleProcessPrivilege	1996	wmic.exe
Token: SeIncBasePriorityPrivilege	1996	wmic.exe
Token: SeCreatePagefilePrivilege	1996	wmic.exe
Token: SeBackupPrivilege	1996	wmic.exe
Token: SeRestorePrivilege	1996	wmic.exe
Token: SeShutdownPrivilege	1996	wmic.exe
Token: SeDebugPrivilege	1996	wmic.exe
Token: SeSystemEnvironmentPrivilege	1996	wmic.exe
Token: SeRemoteShutdownPrivilege	1996	wmic.exe
Token: SeUndockPrivilege	1996	wmic.exe
Token: SeManageVolumePrivilege	1996	wmic.exe
Token: 33	1996	wmic.exe
Token: 34	1996	wmic.exe
Token: 35	1996	wmic.exe
Token: 36	1996	wmic.exe
Token: SeIncreaseQuotaPrivilege	1996	wmic.exe
Token: SeSecurityPrivilege	1996	wmic.exe
Token: SeTakeOwnershipPrivilege	1996	wmic.exe
Token: SeLoadDriverPrivilege	1996	wmic.exe
Token: SeSystemProfilePrivilege	1996	wmic.exe
Token: SeSystemtimePrivilege	1996	wmic.exe
Token: SeProfSingleProcessPrivilege	1996	wmic.exe
Token: SeIncBasePriorityPrivilege	1996	wmic.exe
Token: SeCreatePagefilePrivilege	1996	wmic.exe
Token: SeBackupPrivilege	1996	wmic.exe
Token: SeRestorePrivilege	1996	wmic.exe
Token: SeShutdownPrivilege	1996	wmic.exe
Token: SeDebugPrivilege	1996	wmic.exe
Token: SeSystemEnvironmentPrivilege	1996	wmic.exe
Token: SeRemoteShutdownPrivilege	1996	wmic.exe
Token: SeUndockPrivilege	1996	wmic.exe
Token: SeManageVolumePrivilege	1996	wmic.exe
Token: 33	1996	wmic.exe
Token: 34	1996	wmic.exe
Token: 35	1996	wmic.exe
Token: 36	1996	wmic.exe
Token: SeIncreaseQuotaPrivilege	2604	wmic.exe
Token: SeSecurityPrivilege	2604	wmic.exe
Token: SeTakeOwnershipPrivilege	2604	wmic.exe
Token: SeLoadDriverPrivilege	2604	wmic.exe
Token: SeSystemProfilePrivilege	2604	wmic.exe
Token: SeSystemtimePrivilege	2604	wmic.exe
Token: SeProfSingleProcessPrivilege	2604	wmic.exe
Token: SeIncBasePriorityPrivilege	2604	wmic.exe
Token: SeCreatePagefilePrivilege	2604	wmic.exe
Token: SeBackupPrivilege	2604	wmic.exe
Token: SeRestorePrivilege	2604	wmic.exe
Token: SeShutdownPrivilege	2604	wmic.exe
Token: SeDebugPrivilege	2604	wmic.exe
Token: SeSystemEnvironmentPrivilege	2604	wmic.exe
Token: SeRemoteShutdownPrivilege	2604	wmic.exe
Token: SeUndockPrivilege	2604	wmic.exe
Token: SeManageVolumePrivilege	2604	wmic.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5488 wrote to memory of 5256	5488	N1NC5_solara.exe	91
PID 5488 wrote to memory of 5256	5488	N1NC5_solara.exe	91
PID 5488 wrote to memory of 5204	5488	N1NC5_solara.exe	92
PID 5488 wrote to memory of 5204	5488	N1NC5_solara.exe	92
PID 5488 wrote to memory of 5204	5488	N1NC5_solara.exe	92
PID 5488 wrote to memory of 4472	5488	N1NC5_solara.exe	93
PID 5488 wrote to memory of 4472	5488	N1NC5_solara.exe	93
PID 5256 wrote to memory of 4756	5256	Umbral.exe	94
PID 5256 wrote to memory of 4756	5256	Umbral.exe	94
PID 5256 wrote to memory of 4624	5256	Umbral.exe	96
PID 5256 wrote to memory of 4624	5256	Umbral.exe	96
PID 5256 wrote to memory of 2336	5256	Umbral.exe	98
PID 5256 wrote to memory of 2336	5256	Umbral.exe	98
PID 5256 wrote to memory of 624	5256	Umbral.exe	100
PID 5256 wrote to memory of 624	5256	Umbral.exe	100
PID 5256 wrote to memory of 1996	5256	Umbral.exe	102
PID 5256 wrote to memory of 1996	5256	Umbral.exe	102
PID 5256 wrote to memory of 2604	5256	Umbral.exe	105
PID 5256 wrote to memory of 2604	5256	Umbral.exe	105
PID 5256 wrote to memory of 5792	5256	Umbral.exe	107
PID 5256 wrote to memory of 5792	5256	Umbral.exe	107
PID 5256 wrote to memory of 3980	5256	Umbral.exe	109
PID 5256 wrote to memory of 3980	5256	Umbral.exe	109
PID 5256 wrote to memory of 1016	5256	Umbral.exe	111
PID 5256 wrote to memory of 1016	5256	Umbral.exe	111
PID 5204 wrote to memory of 3884	5204	Server.exe	113
PID 5204 wrote to memory of 3884	5204	Server.exe	113
PID 5204 wrote to memory of 3884	5204	Server.exe	113
PID 6124 wrote to memory of 5628	6124	cmd.exe	119
PID 6124 wrote to memory of 5628	6124	cmd.exe	119
PID 6124 wrote to memory of 5628	6124	cmd.exe	119
PID 5356 wrote to memory of 2340	5356	cmd.exe	120
PID 5356 wrote to memory of 2340	5356	cmd.exe	120
PID 5356 wrote to memory of 2340	5356	cmd.exe	120
PID 1512 wrote to memory of 3408	1512	cmd.exe	125
PID 1512 wrote to memory of 3408	1512	cmd.exe	125
PID 1512 wrote to memory of 3408	1512	cmd.exe	125
PID 1328 wrote to memory of 6028	1328	cmd.exe	126
PID 1328 wrote to memory of 6028	1328	cmd.exe	126
PID 1328 wrote to memory of 6028	1328	cmd.exe	126
PID 6056 wrote to memory of 3156	6056	cmd.exe	131
PID 6056 wrote to memory of 3156	6056	cmd.exe	131
PID 6056 wrote to memory of 3156	6056	cmd.exe	131
PID 3152 wrote to memory of 2008	3152	cmd.exe	132
PID 3152 wrote to memory of 2008	3152	cmd.exe	132
PID 3152 wrote to memory of 2008	3152	cmd.exe	132
PID 5872 wrote to memory of 3244	5872	cmd.exe	138
PID 5872 wrote to memory of 3244	5872	cmd.exe	138
PID 5872 wrote to memory of 3244	5872	cmd.exe	138
PID 5444 wrote to memory of 5904	5444	cmd.exe	139
PID 5444 wrote to memory of 5904	5444	cmd.exe	139
PID 5444 wrote to memory of 5904	5444	cmd.exe	139
PID 4060 wrote to memory of 4468	4060	cmd.exe	144
PID 4060 wrote to memory of 4468	4060	cmd.exe	144
PID 4060 wrote to memory of 4468	4060	cmd.exe	144
PID 5808 wrote to memory of 2492	5808	cmd.exe	145
PID 5808 wrote to memory of 2492	5808	cmd.exe	145
PID 5808 wrote to memory of 2492	5808	cmd.exe	145
PID 5772 wrote to memory of 1516	5772	cmd.exe	151
PID 5772 wrote to memory of 1516	5772	cmd.exe	151
PID 5772 wrote to memory of 1516	5772	cmd.exe	151
PID 4420 wrote to memory of 5328	4420	cmd.exe	152
PID 4420 wrote to memory of 5328	4420	cmd.exe	152
PID 4420 wrote to memory of 5328	4420	cmd.exe	152

C:\Users\Admin\AppData\Local\Temp\N1NC5_solara.exe
"C:\Users\Admin\AppData\Local\Temp\N1NC5_solara.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:5488
- C:\Users\Admin\AppData\Local\Temp\Umbral.exe
  "C:\Users\Admin\AppData\Local\Temp\Umbral.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:5256
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell.exe" Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Umbral.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4756
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell.exe" Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4624
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell.exe" Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2336
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell.exe" Get-ItemPropertyValue -Path HKLN:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:624
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic.exe" os get Caption
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:1996
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic.exe" computersystem get totalphysicalmemory
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2604
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic.exe" csproduct get uuid
    3⤵
    PID:5792
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell.exe" Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:3980
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic" path win32_VideoController get name
    3⤵
    - Detects videocard installed
    PID:1016
- C:\Users\Admin\AppData\Local\Temp\Server.exe
  "C:\Users\Admin\AppData\Local\Temp\Server.exe"
  2⤵
  - Drops startup file
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5204
- - C:\Windows\SysWOW64\netsh.exe
    netsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\Server.exe" "Server.exe" ENABLE
    3⤵
    - Modifies Windows Firewall
    - Event Triggered Execution: Netsh Helper DLL
    - System Location Discovery: System Language Discovery
    PID:3884
- C:\Users\Admin\AppData\Local\Temp\BootstrapperNew.exe
  "C:\Users\Admin\AppData\Local\Temp\BootstrapperNew.exe"
  2⤵
  - Executes dropped EXE
  PID:4472

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Server.exe" ..
1⤵
- Suspicious use of WriteProcessMemory
PID:6124
- C:\Users\Admin\AppData\Local\Temp\Server.exe
  C:\Users\Admin\AppData\Local\Temp\Server.exe ..
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:5628

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Server.exe" ..
1⤵
- Suspicious use of WriteProcessMemory
PID:5356
- C:\Users\Admin\AppData\Local\Temp\Server.exe
  C:\Users\Admin\AppData\Local\Temp\Server.exe ..
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2340

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Server.exe" ..
1⤵
- Suspicious use of WriteProcessMemory
PID:1328
- C:\Users\Admin\AppData\Local\Temp\Server.exe
  C:\Users\Admin\AppData\Local\Temp\Server.exe ..
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:6028

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Server.exe" ..
1⤵
- Suspicious use of WriteProcessMemory
PID:1512
- C:\Users\Admin\AppData\Local\Temp\Server.exe
  C:\Users\Admin\AppData\Local\Temp\Server.exe ..
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3408

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Server.exe" ..
1⤵
- Suspicious use of WriteProcessMemory
PID:3152
- C:\Users\Admin\AppData\Local\Temp\Server.exe
  C:\Users\Admin\AppData\Local\Temp\Server.exe ..
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2008

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Server.exe" ..
1⤵
- Suspicious use of WriteProcessMemory
PID:6056
- C:\Users\Admin\AppData\Local\Temp\Server.exe
  C:\Users\Admin\AppData\Local\Temp\Server.exe ..
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3156

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Server.exe" ..
1⤵
- Suspicious use of WriteProcessMemory
PID:5444
- C:\Users\Admin\AppData\Local\Temp\Server.exe
  C:\Users\Admin\AppData\Local\Temp\Server.exe ..
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:5904

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Server.exe" ..
1⤵
- Suspicious use of WriteProcessMemory
PID:5872
- C:\Users\Admin\AppData\Local\Temp\Server.exe
  C:\Users\Admin\AppData\Local\Temp\Server.exe ..
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3244

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Server.exe" ..
1⤵
- Suspicious use of WriteProcessMemory
PID:4060
- C:\Users\Admin\AppData\Local\Temp\Server.exe
  C:\Users\Admin\AppData\Local\Temp\Server.exe ..
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4468

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Server.exe" ..
1⤵
- Suspicious use of WriteProcessMemory
PID:5808
- C:\Users\Admin\AppData\Local\Temp\Server.exe
  C:\Users\Admin\AppData\Local\Temp\Server.exe ..
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2492

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Server.exe" ..
1⤵
- Suspicious use of WriteProcessMemory
PID:5772
- C:\Users\Admin\AppData\Local\Temp\Server.exe
  C:\Users\Admin\AppData\Local\Temp\Server.exe ..
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:1516

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Server.exe" ..
1⤵
- Suspicious use of WriteProcessMemory
PID:4420
- C:\Users\Admin\AppData\Local\Temp\Server.exe
  C:\Users\Admin\AppData\Local\Temp\Server.exe ..
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:5328

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Server.exe" ..
1⤵
PID:1020
- C:\Users\Admin\AppData\Local\Temp\Server.exe
  C:\Users\Admin\AppData\Local\Temp\Server.exe ..
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4448

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Server.exe" ..
1⤵
PID:1232
- C:\Users\Admin\AppData\Local\Temp\Server.exe
  C:\Users\Admin\AppData\Local\Temp\Server.exe ..
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:556

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Server.exe" ..
1⤵
PID:3360
- C:\Users\Admin\AppData\Local\Temp\Server.exe
  C:\Users\Admin\AppData\Local\Temp\Server.exe ..
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:860

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Server.exe" ..
1⤵
PID:5276
- C:\Users\Admin\AppData\Local\Temp\Server.exe
  C:\Users\Admin\AppData\Local\Temp\Server.exe ..
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4192

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Server.exe" ..
1⤵
PID:6128
- C:\Users\Admin\AppData\Local\Temp\Server.exe
  C:\Users\Admin\AppData\Local\Temp\Server.exe ..
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:880

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Server.exe" ..
1⤵
PID:872
- C:\Users\Admin\AppData\Local\Temp\Server.exe
  C:\Users\Admin\AppData\Local\Temp\Server.exe ..
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:448

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Server.exe" ..
1⤵
PID:3940
- C:\Users\Admin\AppData\Local\Temp\Server.exe
  C:\Users\Admin\AppData\Local\Temp\Server.exe ..
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3164

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Server.exe" ..
1⤵
PID:5432
- C:\Users\Admin\AppData\Local\Temp\Server.exe
  C:\Users\Admin\AppData\Local\Temp\Server.exe ..
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4920

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Server.exe" ..
1⤵
PID:5916
- C:\Users\Admin\AppData\Local\Temp\Server.exe
  C:\Users\Admin\AppData\Local\Temp\Server.exe ..
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2504

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Server.exe" ..
1⤵
PID:1164
- C:\Users\Admin\AppData\Local\Temp\Server.exe
  C:\Users\Admin\AppData\Local\Temp\Server.exe ..
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:5164

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Server.exe" ..
1⤵
PID:1632
- C:\Users\Admin\AppData\Local\Temp\Server.exe
  C:\Users\Admin\AppData\Local\Temp\Server.exe ..
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2720

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Server.exe" ..
1⤵
PID:1436
- C:\Users\Admin\AppData\Local\Temp\Server.exe
  C:\Users\Admin\AppData\Local\Temp\Server.exe ..
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2432

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Server.exe" ..
1⤵
PID:1652
- C:\Users\Admin\AppData\Local\Temp\Server.exe
  C:\Users\Admin\AppData\Local\Temp\Server.exe ..
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:5400

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Server.exe" ..
1⤵
PID:1220
- C:\Users\Admin\AppData\Local\Temp\Server.exe
  C:\Users\Admin\AppData\Local\Temp\Server.exe ..
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:6008

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Server.exe" ..
1⤵
PID:6140
- C:\Users\Admin\AppData\Local\Temp\Server.exe
  C:\Users\Admin\AppData\Local\Temp\Server.exe ..
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3088

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Server.exe" ..
1⤵
PID:1488
- C:\Users\Admin\AppData\Local\Temp\Server.exe
  C:\Users\Admin\AppData\Local\Temp\Server.exe ..
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:5548

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Server.exe" ..
1⤵
PID:2628
- C:\Users\Admin\AppData\Local\Temp\Server.exe
  C:\Users\Admin\AppData\Local\Temp\Server.exe ..
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3824

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Server.exe" ..
1⤵
PID:6056
- C:\Users\Admin\AppData\Local\Temp\Server.exe
  C:\Users\Admin\AppData\Local\Temp\Server.exe ..
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:5232

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Server.exe" ..
1⤵
PID:5896
- C:\Users\Admin\AppData\Local\Temp\Server.exe
  C:\Users\Admin\AppData\Local\Temp\Server.exe ..
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:5928

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Server.exe" ..
1⤵
PID:5992
- C:\Users\Admin\AppData\Local\Temp\Server.exe
  C:\Users\Admin\AppData\Local\Temp\Server.exe ..
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:5680

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Server.exe" ..
1⤵
PID:2092
- C:\Users\Admin\AppData\Local\Temp\Server.exe
  C:\Users\Admin\AppData\Local\Temp\Server.exe ..
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:336

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Server.exe" ..
1⤵
PID:5488
- C:\Users\Admin\AppData\Local\Temp\Server.exe
  C:\Users\Admin\AppData\Local\Temp\Server.exe ..
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3452

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Server.exe" ..
1⤵
PID:4528
- C:\Users\Admin\AppData\Local\Temp\Server.exe
  C:\Users\Admin\AppData\Local\Temp\Server.exe ..
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3172

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Server.exe" ..
1⤵
PID:380
- C:\Users\Admin\AppData\Local\Temp\Server.exe
  C:\Users\Admin\AppData\Local\Temp\Server.exe ..
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4420

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Defense Evasion

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v2.0_32\UsageLogs\Server.exe.log

Filesize
319B

MD5
824ba7b7eed8b900a98dd25129c4cd83

SHA1
54478770b2158000ef365591d42977cb854453a1

SHA256
d182dd648c92e41cd62dccc65f130c07f0a96c03b32f907c3d1218e9aa5bda03

SHA512
ae4f3a9673711ecb6cc5d06874c587341d5094803923b53b6e982278fa64549d7acf866de165e23750facd55da556b6794c0d32f129f4087529c73acd4ffb11e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
a43e653ffb5ab07940f4bdd9cc8fade4

SHA1
af43d04e3427f111b22dc891c5c7ee8a10ac4123

SHA256
c4c53abb13e99475aebfbe9fec7a8fead81c14c80d9dcc2b81375304f3a683fe

SHA512
62a97e95e1f19a8d4302847110dae44f469877eed6aa8ea22345c6eb25ee220e7d310fa0b7ec5df42356815421c0af7c46a0f1fee8933cc446641800eda6cd1b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
276798eeb29a49dc6e199768bc9c2e71

SHA1
5fdc8ccb897ac2df7476fbb07517aca5b7a6205b

SHA256
cd0a1056e8f1b6cb5cb328532239d802f4e2aa8f8fcdc0fcb487684bd68e0dcc

SHA512
0d34fce64bbefc57d64fa6e03ca886952263d5f24df9c1c4cce6a1e8f5a47a9a21e9820f8d38caa7f7b43a52336ce00b738ea18419aaa7c788b72e04ce19e4f2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
45ad40f012b09e141955482368549640

SHA1
3f9cd15875c1e397c3b2b5592805577ae88a96cb

SHA256
ea3b59172f1a33677f9cb3843fb4d6093b806d3a7cf2f3c6d4692f5421f656ce

SHA512
3de08f8affca1c1450088f560776cf3d65146cadac43c06eb922c7b3cea436e519966cf38458303ffeb1a58c53f8952cffda6c34216fda7594e014b516e83b33

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
60047280e6ab00d77cc7a3d66f4d5f28

SHA1
9227682e6847f83fdca60f3d8dfcfe21b63ac12d

SHA256
296c41997099049cb28a122dcb29166fd4c98a991b2b2558a9f95aa7673fe16f

SHA512
da37e8221c1a05bb8d5d6eccba15206846f5b5a80713d303a5c863a6f8e1b2d070755d1b02a740bbc2472f1b77d1aba8739f840da4ddb74134b43f5682b61040

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
948B

MD5
c9b6705519e1eef08f86c4ba5f4286f3

SHA1
6c6b179e452ecee2673a1d4fe128f1c06f70577f

SHA256
0f9cad44a79126871580e19b01dc3f880c5173b1faaf8b9018d5d1f829714705

SHA512
6d8f85a7a8b0b124530f36a157cd0441b5c1eacdc35e274af9fbf0569d03d1d5e468651a5b2425f0215c282ecfa7b1ffeaeeaf18612822f00bd14306d30640c7

Download Submit
C:\Users\Admin\AppData\Local\Temp\BootstrapperNew.exe

Filesize
3.4MB

MD5
07b2ed9af56f55a999156738b17848df

SHA1
960e507c0ef860080b573c4e11a76328c8831d08

SHA256
73427b83bd00a8745e5182d2cdb3727e654ae9af5e42befc45903027f6606597

SHA512
3a982d1130b41e6c01943eee7fa546c3da95360afdad03bff434b9211201c80f22bd8bf79d065180010bc0659ee1e71febbfd750320d95811ee26a54ee1b34c6

Download Submit
C:\Users\Admin\AppData\Local\Temp\Server.exe

Filesize
32KB

MD5
c30d7d561c7cd145687cfec82a8dc436

SHA1
6cd3cc34b5074a8b25a1d1b605d56ed9b0bc4203

SHA256
d467702296dbb5c5f84db6ffa8373684b429997c0ea3f1e2c88365250239bf01

SHA512
f8f1c5aaca62a20dd9342491a9d82571c8c280807dd61c9bd91d035436651115fce371bed4cab19af325b4b956b36fcd4ec93cccb433229438047947078260c8

Download Submit
C:\Users\Admin\AppData\Local\Temp\Umbral.exe

Filesize
231KB

MD5
edfc834a78aa9ffddb793cf2bd1e7aa1

SHA1
e5e559c15bffa95a233a6bcef428f5b51df71d90

SHA256
b8ccc05c96538a0c62b3a108f26c56c851027300eba900764d9ac1e0519f786c

SHA512
60456bedfd091fd7cd8a0f285d8e8634bde097a2b887f24e59173aab8d7335832dd9185608b693f9a4369eb4b750435cb6cd95f4b43dcf039580a23a51589b06

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_lf3lliny.ut0.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
memory/4472-69-0x00000198C9000000-0x00000198C900E000-memory.dmp

Filesize
56KB

Download
memory/4472-75-0x00000198C90A0000-0x00000198C90AA000-memory.dmp

Filesize
40KB

Download
memory/4472-71-0x00000198C9010000-0x00000198C901A000-memory.dmp

Filesize
40KB

Download
memory/4472-73-0x00000198C90B0000-0x00000198C90B8000-memory.dmp

Filesize
32KB

Download
memory/4472-53-0x00000198AABF0000-0x00000198AAC00000-memory.dmp

Filesize
64KB

Download
memory/4472-56-0x00000198C8FB0000-0x00000198C8FB8000-memory.dmp

Filesize
32KB

Download
memory/4472-42-0x00000198AA470000-0x00000198AA7E0000-memory.dmp

Filesize
3.4MB

Download
memory/4472-70-0x00000198C96C0000-0x00000198C97C0000-memory.dmp

Filesize
1024KB

Download
memory/4472-77-0x00000198C97F0000-0x00000198C97F8000-memory.dmp

Filesize
32KB

Download
memory/4472-68-0x00000198C9030000-0x00000198C9068000-memory.dmp

Filesize
224KB

Download
memory/4472-76-0x00000198C9020000-0x00000198C902A000-memory.dmp

Filesize
40KB

Download
memory/4472-74-0x00000198C97C0000-0x00000198C97D6000-memory.dmp

Filesize
88KB

Download
memory/4472-72-0x00000198C9070000-0x00000198C9096000-memory.dmp

Filesize
152KB

Download
memory/4756-52-0x000001661ECC0000-0x000001661ECE2000-memory.dmp

Filesize
136KB

Download
memory/5204-141-0x0000000000C50000-0x0000000000C60000-memory.dmp

Filesize
64KB

Download
memory/5204-41-0x0000000000C50000-0x0000000000C60000-memory.dmp

Filesize
64KB

Download
memory/5256-22-0x0000021F9E740000-0x0000021F9E780000-memory.dmp

Filesize
256KB

Download
memory/5256-80-0x0000021FA05D0000-0x0000021FA0646000-memory.dmp

Filesize
472KB

Download
memory/5256-81-0x0000021FA04F0000-0x0000021FA0540000-memory.dmp

Filesize
320KB

Download
memory/5256-82-0x0000021FA04C0000-0x0000021FA04DE000-memory.dmp

Filesize
120KB

Download
memory/5256-35-0x00007FFF0F8A0000-0x00007FFF10361000-memory.dmp

Filesize
10.8MB

Download
memory/5256-118-0x0000021FA0560000-0x0000021FA056A000-memory.dmp

Filesize
40KB

Download
memory/5256-119-0x0000021FA0590000-0x0000021FA05A2000-memory.dmp

Filesize
72KB

Download
memory/5256-139-0x00007FFF0F8A0000-0x00007FFF10361000-memory.dmp

Filesize
10.8MB

Download
memory/5256-40-0x00007FFF0F8A0000-0x00007FFF10361000-memory.dmp

Filesize
10.8MB

Download
memory/5488-0-0x00007FFF0F8A3000-0x00007FFF0F8A5000-memory.dmp

Filesize
8KB

Download
memory/5488-39-0x00007FFF0F8A0000-0x00007FFF10361000-memory.dmp

Filesize
10.8MB

Download
memory/5488-10-0x00007FFF0F8A0000-0x00007FFF10361000-memory.dmp

Filesize
10.8MB

Download
memory/5488-1-0x0000000000CB0000-0x0000000000F88000-memory.dmp

Filesize
2.8MB

Download