f59139de75ba74749f8ee7895f5d64639d87d2d0d1a39f4d08bf67e2e28a4850

Analysis

max time kernel
144s
max time network
159s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
04/06/2026, 18:44

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
sellnet-cheat.exe
Size 309.1MB
Sample260604-xdzexacz4m
SHA256 f59139de75ba74749f8ee7895f5d64639d87d2d0d1a39f4d08bf67e2e28a4850
MD5 038b57dee1f72a2bab4268371c33a1a8
SHA1 8022c302bf96b8ad161ab45d3163c633212cd931
SHA512 87e7396432d1e9465e99dd604c5fe36127522fceddb9252977bf80bd73d6030553dbeefd0a87eee63349237abeab5dffc08bc9bb7428355e61904817e341ff06
SSDEEP 6291456:n3p93nAJEkL5lT9hskapdG+yfCyPSX75PwHms9oxRHL5ldSlXD6DS3UN2i2N1:grphsjpklKyPSqGsKr5fS1l34l2z
TLSH
T16EF83367E1A710DCC96BC170C26BA772BA30B81801347E7F5A54DBB12F61E605F6EB24
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

defense_evasion discovery execution persistence

Malware Config

Signatures

Enumerates VirtualBox registry keys 2 TTPs 15 IoCs

defense_evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxGuest	sellnet-cheat.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxMouse	sellnet-cheat.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxSF	sellnet-cheat.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxService	sellnet-cheat.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxGuest	SecurityHealthService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxVideo	SecurityHealthService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxService	SecurityHealthService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxSF	SecurityHealthService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxVideo	SecurityHealthService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxService	SecurityHealthService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxVideo	sellnet-cheat.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxSF	SecurityHealthService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxGuest	SecurityHealthService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxMouse	SecurityHealthService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxMouse	SecurityHealthService.exe

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 9 IoCs

defense_evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	SecurityHealthService.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\RSDT\VBOX__	SecurityHealthService.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	sellnet-cheat.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\FADT\VBOX__	sellnet-cheat.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	SecurityHealthService.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\FADT\VBOX__	SecurityHealthService.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\RSDT\VBOX__	sellnet-cheat.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\FADT\VBOX__	SecurityHealthService.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\RSDT\VBOX__	SecurityHealthService.exe

Looks for VirtualBox Guest Additions in registry 2 TTPs 3 IoCs

defense_evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Oracle\VirtualBox Guest Additions	sellnet-cheat.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Oracle\VirtualBox Guest Additions	SecurityHealthService.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Oracle\VirtualBox Guest Additions	SecurityHealthService.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 6 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
5400	powershell.exe
2376	powershell.exe
6128	powershell.exe
5380	powershell.exe
4308	powershell.exe
912	powershell.exe

Looks for VMWare Tools registry key 2 TTPs 3 IoCs

defense_evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\VMware, Inc.\VMware Tools	sellnet-cheat.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\VMware, Inc.\VMware Tools	SecurityHealthService.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\VMware, Inc.\VMware Tools	SecurityHealthService.exe

Looks for VMWare services registry key. 1 TTPs 15 IoCs

defense_evasion

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\vmtools	sellnet-cheat.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\vmci	SecurityHealthService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\vmx86	SecurityHealthService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\vmmouse	sellnet-cheat.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\vmtools	SecurityHealthService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\vmx86	SecurityHealthService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\vmx86	sellnet-cheat.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\vmmouse	SecurityHealthService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\vmtools	SecurityHealthService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VMMEMCTL	SecurityHealthService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\vmmouse	SecurityHealthService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VMMEMCTL	SecurityHealthService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\vmci	sellnet-cheat.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VMMEMCTL	sellnet-cheat.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\vmci	SecurityHealthService.exe

Executes dropped EXE 2 IoCs

pid	Process
4840	SecurityHealthService.exe
3112	SecurityHealthService.exe

Adds Run key to start application 2 TTPs 6 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000\Software\Microsoft\Windows\CurrentVersion\Run\AppReadinessService = "wscript.exe \"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\AppReadiness\\AppReadinessService.vbs\""	SecurityHealthService.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000\Software\Microsoft\Windows\CurrentVersion\Run\AppReadinessService = "wscript.exe \"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\AppReadiness\\AppReadinessService.vbs\""	SecurityHealthService.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000\Software\Microsoft\Windows\CurrentVersion\Run\SecurityHealthService = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Themes\\SecurityHealthService.exe"	sellnet-cheat.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000\Software\Microsoft\Windows\CurrentVersion\Run\AppReadinessService = "wscript.exe \"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\AppReadiness\\AppReadinessService.vbs\""	sellnet-cheat.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000\Software\Microsoft\Windows\CurrentVersion\Run\SecurityHealthService = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Themes\\SecurityHealthService.exe"	SecurityHealthService.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000\Software\Microsoft\Windows\CurrentVersion\Run\SecurityHealthService = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Themes\\SecurityHealthService.exe"	SecurityHealthService.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
2	api.ipify.org

Suspicious use of NtSetInformationThreadHideFromDebugger 46 IoCs

pid	Process
5012	sellnet-cheat.exe
4840	SecurityHealthService.exe
3112	SecurityHealthService.exe
4840	SecurityHealthService.exe
5012	sellnet-cheat.exe
4840	SecurityHealthService.exe
3112	SecurityHealthService.exe
5012	sellnet-cheat.exe
3112	SecurityHealthService.exe
5012	sellnet-cheat.exe
4840	SecurityHealthService.exe
3112	SecurityHealthService.exe
4840	SecurityHealthService.exe
5012	sellnet-cheat.exe
3112	SecurityHealthService.exe
4840	SecurityHealthService.exe
5012	sellnet-cheat.exe
4840	SecurityHealthService.exe
3112	SecurityHealthService.exe
4840	SecurityHealthService.exe
5012	sellnet-cheat.exe
3112	SecurityHealthService.exe
3112	SecurityHealthService.exe
4840	SecurityHealthService.exe
5012	sellnet-cheat.exe
4840	SecurityHealthService.exe
4840	SecurityHealthService.exe
5012	sellnet-cheat.exe
3112	SecurityHealthService.exe
4840	SecurityHealthService.exe
5012	sellnet-cheat.exe
3112	SecurityHealthService.exe
5012	sellnet-cheat.exe
3112	SecurityHealthService.exe
4840	SecurityHealthService.exe
5012	sellnet-cheat.exe
3112	SecurityHealthService.exe
4840	SecurityHealthService.exe
3112	SecurityHealthService.exe
5012	sellnet-cheat.exe
4840	SecurityHealthService.exe
3112	SecurityHealthService.exe
4840	SecurityHealthService.exe
5012	sellnet-cheat.exe
4840	SecurityHealthService.exe
3112	SecurityHealthService.exe

Enumerates system info in registry 2 TTPs 9 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	SecurityHealthService.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\Description\System\BIOS	SecurityHealthService.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\Description\System\BIOS	SecurityHealthService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	SecurityHealthService.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	SecurityHealthService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	SecurityHealthService.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	sellnet-cheat.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	sellnet-cheat.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\Description\System\BIOS	sellnet-cheat.exe

Gathers network information 2 TTPs 5 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
1204	ipconfig.exe
5256	ipconfig.exe
3052	ipconfig.exe
1672	ipconfig.exe
3816	ipconfig.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 3 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
1796	schtasks.exe
5908	schtasks.exe
4416	schtasks.exe

Suspicious behavior: EnumeratesProcesses 52 IoCs

pid	Process
5012	sellnet-cheat.exe
5012	sellnet-cheat.exe
5012	sellnet-cheat.exe
5012	sellnet-cheat.exe
5012	sellnet-cheat.exe
5012	sellnet-cheat.exe
4840	SecurityHealthService.exe
4840	SecurityHealthService.exe
3112	SecurityHealthService.exe
3112	SecurityHealthService.exe
5400	powershell.exe
5400	powershell.exe
4840	SecurityHealthService.exe
4840	SecurityHealthService.exe
4840	SecurityHealthService.exe
4840	SecurityHealthService.exe
3112	SecurityHealthService.exe
3112	SecurityHealthService.exe
3112	SecurityHealthService.exe
3112	SecurityHealthService.exe
6128	powershell.exe
2376	powershell.exe
6128	powershell.exe
2376	powershell.exe
5012	sellnet-cheat.exe
5012	sellnet-cheat.exe
3112	SecurityHealthService.exe
3112	SecurityHealthService.exe
4840	SecurityHealthService.exe
4840	SecurityHealthService.exe
5012	sellnet-cheat.exe
5012	sellnet-cheat.exe
5012	sellnet-cheat.exe
5012	sellnet-cheat.exe
4840	SecurityHealthService.exe
4840	SecurityHealthService.exe
5012	sellnet-cheat.exe
5012	sellnet-cheat.exe
5012	sellnet-cheat.exe
5012	sellnet-cheat.exe
4840	SecurityHealthService.exe
4840	SecurityHealthService.exe
5012	sellnet-cheat.exe
5012	sellnet-cheat.exe
912	powershell.exe
912	powershell.exe
4840	SecurityHealthService.exe
4840	SecurityHealthService.exe
5380	powershell.exe
4308	powershell.exe
4308	powershell.exe
5380	powershell.exe

Suspicious use of AdjustPrivilegeToken 49 IoCs

description	pid	Process
Token: SeDebugPrivilege	5400	powershell.exe
Token: SeDebugPrivilege	6128	powershell.exe
Token: SeDebugPrivilege	2376	powershell.exe
Token: SeDebugPrivilege	912	powershell.exe
Token: SeIncreaseQuotaPrivilege	912	powershell.exe
Token: SeSecurityPrivilege	912	powershell.exe
Token: SeTakeOwnershipPrivilege	912	powershell.exe
Token: SeLoadDriverPrivilege	912	powershell.exe
Token: SeSystemProfilePrivilege	912	powershell.exe
Token: SeSystemtimePrivilege	912	powershell.exe
Token: SeProfSingleProcessPrivilege	912	powershell.exe
Token: SeIncBasePriorityPrivilege	912	powershell.exe
Token: SeCreatePagefilePrivilege	912	powershell.exe
Token: SeBackupPrivilege	912	powershell.exe
Token: SeRestorePrivilege	912	powershell.exe
Token: SeShutdownPrivilege	912	powershell.exe
Token: SeDebugPrivilege	912	powershell.exe
Token: SeSystemEnvironmentPrivilege	912	powershell.exe
Token: SeRemoteShutdownPrivilege	912	powershell.exe
Token: SeUndockPrivilege	912	powershell.exe
Token: SeManageVolumePrivilege	912	powershell.exe
Token: 33	912	powershell.exe
Token: 34	912	powershell.exe
Token: 35	912	powershell.exe
Token: 36	912	powershell.exe
Token: SeIncreaseQuotaPrivilege	912	powershell.exe
Token: SeSecurityPrivilege	912	powershell.exe
Token: SeTakeOwnershipPrivilege	912	powershell.exe
Token: SeLoadDriverPrivilege	912	powershell.exe
Token: SeSystemProfilePrivilege	912	powershell.exe
Token: SeSystemtimePrivilege	912	powershell.exe
Token: SeProfSingleProcessPrivilege	912	powershell.exe
Token: SeIncBasePriorityPrivilege	912	powershell.exe
Token: SeCreatePagefilePrivilege	912	powershell.exe
Token: SeBackupPrivilege	912	powershell.exe
Token: SeRestorePrivilege	912	powershell.exe
Token: SeShutdownPrivilege	912	powershell.exe
Token: SeDebugPrivilege	912	powershell.exe
Token: SeSystemEnvironmentPrivilege	912	powershell.exe
Token: SeRemoteShutdownPrivilege	912	powershell.exe
Token: SeUndockPrivilege	912	powershell.exe
Token: SeManageVolumePrivilege	912	powershell.exe
Token: 33	912	powershell.exe
Token: 34	912	powershell.exe
Token: 35	912	powershell.exe
Token: 36	912	powershell.exe
Token: SeSystemEnvironmentPrivilege	912	powershell.exe
Token: SeDebugPrivilege	4308	powershell.exe
Token: SeDebugPrivilege	5380	powershell.exe

Suspicious use of WriteProcessMemory 28 IoCs

description	pid	Process	procid_target
PID 5012 wrote to memory of 4416	5012	sellnet-cheat.exe	80
PID 5012 wrote to memory of 4532	5012	sellnet-cheat.exe	86
PID 5012 wrote to memory of 2932	5012	sellnet-cheat.exe	88
PID 2932 wrote to memory of 1204	2932	cmd.exe	90
PID 5012 wrote to memory of 2720	5012	sellnet-cheat.exe	91
PID 2720 wrote to memory of 5400	2720	cmd.exe	93
PID 4840 wrote to memory of 1796	4840	SecurityHealthService.exe	94
PID 3112 wrote to memory of 5908	3112	SecurityHealthService.exe	96
PID 3112 wrote to memory of 5900	3112	SecurityHealthService.exe	97
PID 4840 wrote to memory of 5024	4840	SecurityHealthService.exe	99
PID 3112 wrote to memory of 6092	3112	SecurityHealthService.exe	100
PID 4840 wrote to memory of 5352	4840	SecurityHealthService.exe	102
PID 6092 wrote to memory of 5256	6092	cmd.exe	104
PID 5352 wrote to memory of 3052	5352	cmd.exe	105
PID 3112 wrote to memory of 2916	3112	SecurityHealthService.exe	106
PID 4840 wrote to memory of 3220	4840	SecurityHealthService.exe	108
PID 2916 wrote to memory of 2376	2916	cmd.exe	110
PID 3220 wrote to memory of 6128	3220	cmd.exe	111
PID 5012 wrote to memory of 2248	5012	sellnet-cheat.exe	112
PID 2248 wrote to memory of 912	2248	cmd.exe	114
PID 4840 wrote to memory of 2664	4840	SecurityHealthService.exe	115
PID 3112 wrote to memory of 2616	3112	SecurityHealthService.exe	117
PID 2664 wrote to memory of 1672	2664	cmd.exe	119
PID 2616 wrote to memory of 3816	2616	cmd.exe	120
PID 4840 wrote to memory of 4932	4840	SecurityHealthService.exe	121
PID 3112 wrote to memory of 4616	3112	SecurityHealthService.exe	122
PID 4616 wrote to memory of 4308	4616	cmd.exe	125
PID 4932 wrote to memory of 5380	4932	cmd.exe	126

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\sellnet-cheat.exe
"C:\Users\Admin\AppData\Local\Temp\sellnet-cheat.exe"
1⤵
- Enumerates VirtualBox registry keys
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Looks for VirtualBox Guest Additions in registry
- Looks for VMWare Tools registry key
- Looks for VMWare services registry key.
- Adds Run key to start application
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:5012
- C:\Windows\SYSTEM32\schtasks.exe
  schtasks /Create /F /SC ONLOGON /TN "\Microsoft\Windows\Security\SecurityHealthService" /TR "\"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\SecurityHealthService.exe\"" /RL HIGHEST
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:4416
- C:\Windows\SYSTEM32\wscript.exe
  wscript.exe "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\AppReadiness\AppReadinessService.vbs"
  2⤵
  PID:4532
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c ipconfig /all
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2932
- - C:\Windows\system32\ipconfig.exe
    ipconfig /all
    3⤵
    - Gathers network information
    PID:1204
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c powershell -NoProfile -Command "try { if ((Get-MpPreference).DisableRealtimeMonitoring -eq $false) { write-host 'ON' } else { write-host 'OFF' } } catch { write-host 'UNKNOWN' }"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2720
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -Command "try { if ((Get-MpPreference).DisableRealtimeMonitoring -eq $false) { write-host 'ON' } else { write-host 'OFF' } } catch { write-host 'UNKNOWN' }"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:5400
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c powershell -NoProfile -Command "$r = @(); try { $wmi = Get-CimInstance -Namespace root/SecurityCenter2 -ClassName AntiVirusProduct -EA Stop; foreach($av in $wmi) { $s = $av.productState; $on = (($s -band 0x1000) -ne 0); $up = (($s -band 0x10) -eq 0); $r += ('AV|{0}|{1}|{2}|{3}' -f $av.displayName, $(if($on){'ACTIVE'}else{'DISABLED'}), $(if($up){'UP-TO-DATE'}else{'OUTDATED'}), ('0x{0:X8}' -f $s)) } } catch { $r += 'AV|WMI_SecurityCenter2|ERROR|N/A|N/A' }; try { $d = Get-MpComputerStatus -EA Stop; $sigAge = ((Get-Date) - $d.AntivirusSignatureLastUpdated).Days; $r += ('DEF|Antivirus|{0}|SigAge:{1}d|Engine:{2}' -f $(if($d.AntivirusEnabled){'ACTIVE'}else{'DISABLED'}), $sigAge, $d.AMEngineVersion); $r += ('DEF|RealTimeProtection|{0}|N/A|N/A' -f $(if($d.RealTimeProtectionEnabled){'ACTIVE'}else{'DISABLED'})); $r += ('DEF|BehaviorMonitor|{0}|N/A|N/A' -f $(if($d.BehaviorMonitorEnabled){'ACTIVE'}else{'DISABLED'})); $r += ('DEF|IoavProtection|{0}|N/A|N/A' -f $(if($d.IoavProtectionEnabled){'ACTIVE'}else{'DISABLED'})); $r += ('DEF|NISEnabled|{0}|N/A|N/A' -f $(if($d.NISEnabled){'ACTIVE'}else{'DISABLED'})); $r += ('DEF|TamperProtection|{0}|N/A|N/A' -f $(if($d.IsTamperProtected){'ACTIVE'}else{'DISABLED'})); $r += ('DEF|OnAccessProtection|{0}|N/A|N/A' -f $(if($d.OnAccessProtectionEnabled){'ACTIVE'}else{'DISABLED'})) } catch { $r += 'DEF|Defender_Query|ERROR|N/A|N/A' }; try { $fw = Get-NetFirewallProfile -EA Stop; foreach($p in $fw) { $r += ('FW|{0}|{1}|N/A|N/A' -f $p.Name, $(if($p.Enabled){'ACTIVE'}else{'DISABLED'})) } } catch { $r += 'FW|Firewall_Query|ERROR|N/A|N/A' }; try { $uac = (Get-ItemProperty 'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System' -EA Stop); $lvl = $uac.ConsentPromptBehaviorAdmin; $luaOn = $uac.EnableLUA; $r += ('UAC|UserAccountControl|{0}|Level:{1}|N/A' -f $(if($luaOn -eq 1){'ACTIVE'}else{'DISABLED'}), $lvl) } catch { $r += 'UAC|UAC_Query|ERROR|N/A|N/A' }; try { $amsi = Get-ChildItem 'HKLM:\SOFTWARE\Microsoft\AMSI\Providers' -EA Stop; $r += ('AMSI|Providers|ACTIVE|Count:{0}|N/A' -f $amsi.Count) } catch { $r += 'AMSI|Providers|UNKNOWN|N/A|N/A' }; try { $drv = Get-WmiObject Win32_SystemDriver -EA Stop | Where-Object { $_.DisplayName -match 'CrowdStrike|Carbon Black|Sentinel|Cylance|Sophos|ESET|Kaspersky|Bitdefender|McAfee|Symantec|Norton|Malwarebytes|Panda|Trend Micro|Webroot|F-Secure|Avast|AVG|Comodo|Windows Defender' } | Select-Object -First 10; foreach($dr in $drv) { $r += ('EDR|{0}|{1}|N/A|{2}' -f $dr.DisplayName, $(if($dr.State -eq 'Running'){'ACTIVE'}else{'STOPPED'}), $dr.PathName) } if(-not $drv) { $r += 'EDR|No_EDR_Drivers|NONE|N/A|N/A' } } catch { $r += 'EDR|Driver_Query|ERROR|N/A|N/A' }; try { $sb = Confirm-SecureBootUEFI -EA Stop; $r += ('SYS|SecureBoot|{0}|N/A|N/A' -f $(if($sb){'ACTIVE'}else{'DISABLED'})) } catch { $r += 'SYS|SecureBoot|UNKNOWN|N/A|N/A' }; 'AV_SCAN_RESULT:' + ($r -join ';')"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2248
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -Command "$r = @(); try { $wmi = Get-CimInstance -Namespace root/SecurityCenter2 -ClassName AntiVirusProduct -EA Stop; foreach($av in $wmi) { $s = $av.productState; $on = (($s -band 0x1000) -ne 0); $up = (($s -band 0x10) -eq 0); $r += ('AV|{0}|{1}|{2}|{3}' -f $av.displayName, $(if($on){'ACTIVE'}else{'DISABLED'}), $(if($up){'UP-TO-DATE'}else{'OUTDATED'}), ('0x{0:X8}' -f $s)) } } catch { $r += 'AV|WMI_SecurityCenter2|ERROR|N/A|N/A' }; try { $d = Get-MpComputerStatus -EA Stop; $sigAge = ((Get-Date) - $d.AntivirusSignatureLastUpdated).Days; $r += ('DEF|Antivirus|{0}|SigAge:{1}d|Engine:{2}' -f $(if($d.AntivirusEnabled){'ACTIVE'}else{'DISABLED'}), $sigAge, $d.AMEngineVersion); $r += ('DEF|RealTimeProtection|{0}|N/A|N/A' -f $(if($d.RealTimeProtectionEnabled){'ACTIVE'}else{'DISABLED'})); $r += ('DEF|BehaviorMonitor|{0}|N/A|N/A' -f $(if($d.BehaviorMonitorEnabled){'ACTIVE'}else{'DISABLED'})); $r += ('DEF|IoavProtection|{0}|N/A|N/A' -f $(if($d.IoavProtectionEnabled){'ACTIVE'}else{'DISABLED'})); $r += ('DEF|NISEnabled|{0}|N/A|N/A' -f $(if($d.NISEnabled){'ACTIVE'}else{'DISABLED'})); $r += ('DEF|TamperProtection|{0}|N/A|N/A' -f $(if($d.IsTamperProtected){'ACTIVE'}else{'DISABLED'})); $r += ('DEF|OnAccessProtection|{0}|N/A|N/A' -f $(if($d.OnAccessProtectionEnabled){'ACTIVE'}else{'DISABLED'})) } catch { $r += 'DEF|Defender_Query|ERROR|N/A|N/A' }; try { $fw = Get-NetFirewallProfile -EA Stop; foreach($p in $fw) { $r += ('FW|{0}|{1}|N/A|N/A' -f $p.Name, $(if($p.Enabled){'ACTIVE'}else{'DISABLED'})) } } catch { $r += 'FW|Firewall_Query|ERROR|N/A|N/A' }; try { $uac = (Get-ItemProperty 'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System' -EA Stop); $lvl = $uac.ConsentPromptBehaviorAdmin; $luaOn = $uac.EnableLUA; $r += ('UAC|UserAccountControl|{0}|Level:{1}|N/A' -f $(if($luaOn -eq 1){'ACTIVE'}else{'DISABLED'}), $lvl) } catch { $r += 'UAC|UAC_Query|ERROR|N/A|N/A' }; try { $amsi = Get-ChildItem 'HKLM:\SOFTWARE\Microsoft\AMSI\Providers' -EA Stop; $r += ('AMSI|Providers|ACTIVE|Count:{0}|N/A' -f $amsi.Count) } catch { $r += 'AMSI|Providers|UNKNOWN|N/A|N/A' }; try { $drv = Get-WmiObject Win32_SystemDriver -EA Stop | Where-Object { $_.DisplayName -match 'CrowdStrike|Carbon Black|Sentinel|Cylance|Sophos|ESET|Kaspersky|Bitdefender|McAfee|Symantec|Norton|Malwarebytes|Panda|Trend Micro|Webroot|F-Secure|Avast|AVG|Comodo|Windows Defender' } | Select-Object -First 10; foreach($dr in $drv) { $r += ('EDR|{0}|{1}|N/A|{2}' -f $dr.DisplayName, $(if($dr.State -eq 'Running'){'ACTIVE'}else{'STOPPED'}), $dr.PathName) } if(-not $drv) { $r += 'EDR|No_EDR_Drivers|NONE|N/A|N/A' } } catch { $r += 'EDR|Driver_Query|ERROR|N/A|N/A' }; try { $sb = Confirm-SecureBootUEFI -EA Stop; $r += ('SYS|SecureBoot|{0}|N/A|N/A' -f $(if($sb){'ACTIVE'}else{'DISABLED'})) } catch { $r += 'SYS|SecureBoot|UNKNOWN|N/A|N/A' }; 'AV_SCAN_RESULT:' + ($r -join ';')"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:912

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\SecurityHealthService.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\SecurityHealthService.exe
1⤵
- Enumerates VirtualBox registry keys
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Looks for VirtualBox Guest Additions in registry
- Looks for VMWare Tools registry key
- Looks for VMWare services registry key.
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4840
- C:\Windows\system32\schtasks.exe
  schtasks /Create /F /SC ONLOGON /TN "\Microsoft\Windows\Security\SecurityHealthService" /TR "\"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\SecurityHealthService.exe\"" /RL HIGHEST
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:1796
- C:\Windows\system32\wscript.exe
  wscript.exe "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\AppReadiness\AppReadinessService.vbs"
  2⤵
  PID:5024
- C:\Windows\system32\cmd.exe
  cmd.exe /c ipconfig /all
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5352
- - C:\Windows\system32\ipconfig.exe
    ipconfig /all
    3⤵
    - Gathers network information
    PID:3052
- C:\Windows\system32\cmd.exe
  cmd.exe /c powershell -NoProfile -Command "try { if ((Get-MpPreference).DisableRealtimeMonitoring -eq $false) { write-host 'ON' } else { write-host 'OFF' } } catch { write-host 'UNKNOWN' }"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3220
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -Command "try { if ((Get-MpPreference).DisableRealtimeMonitoring -eq $false) { write-host 'ON' } else { write-host 'OFF' } } catch { write-host 'UNKNOWN' }"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:6128
- C:\Windows\system32\cmd.exe
  cmd.exe /c ipconfig /all
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2664
- - C:\Windows\system32\ipconfig.exe
    ipconfig /all
    3⤵
    - Gathers network information
    PID:1672
- C:\Windows\system32\cmd.exe
  cmd.exe /c powershell -NoProfile -Command "try { if ((Get-MpPreference).DisableRealtimeMonitoring -eq $false) { write-host 'ON' } else { write-host 'OFF' } } catch { write-host 'UNKNOWN' }"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4932
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -Command "try { if ((Get-MpPreference).DisableRealtimeMonitoring -eq $false) { write-host 'ON' } else { write-host 'OFF' } } catch { write-host 'UNKNOWN' }"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:5380

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\SecurityHealthService.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\SecurityHealthService.exe"
1⤵
- Enumerates VirtualBox registry keys
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Looks for VirtualBox Guest Additions in registry
- Looks for VMWare Tools registry key
- Looks for VMWare services registry key.
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3112
- C:\Windows\system32\schtasks.exe
  schtasks /Create /F /SC ONLOGON /TN "\Microsoft\Windows\Security\SecurityHealthService" /TR "\"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\SecurityHealthService.exe\"" /RL HIGHEST
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:5908
- C:\Windows\system32\wscript.exe
  wscript.exe "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\AppReadiness\AppReadinessService.vbs"
  2⤵
  PID:5900
- C:\Windows\system32\cmd.exe
  cmd.exe /c ipconfig /all
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:6092
- - C:\Windows\system32\ipconfig.exe
    ipconfig /all
    3⤵
    - Gathers network information
    PID:5256
- C:\Windows\system32\cmd.exe
  cmd.exe /c powershell -NoProfile -Command "try { if ((Get-MpPreference).DisableRealtimeMonitoring -eq $false) { write-host 'ON' } else { write-host 'OFF' } } catch { write-host 'UNKNOWN' }"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2916
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -Command "try { if ((Get-MpPreference).DisableRealtimeMonitoring -eq $false) { write-host 'ON' } else { write-host 'OFF' } } catch { write-host 'UNKNOWN' }"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2376
- C:\Windows\system32\cmd.exe
  cmd.exe /c ipconfig /all
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2616
- - C:\Windows\system32\ipconfig.exe
    ipconfig /all
    3⤵
    - Gathers network information
    PID:3816
- C:\Windows\system32\cmd.exe
  cmd.exe /c powershell -NoProfile -Command "try { if ((Get-MpPreference).DisableRealtimeMonitoring -eq $false) { write-host 'ON' } else { write-host 'OFF' } } catch { write-host 'UNKNOWN' }"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4616
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -Command "try { if ((Get-MpPreference).DisableRealtimeMonitoring -eq $false) { write-host 'ON' } else { write-host 'OFF' } } catch { write-host 'UNKNOWN' }"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4308

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 4KB
SHA256 e27390d57580e3dfba07bec3d8e430203bbc91e90f6937079b3fd52abc721bd4
MD5 dbbd2d4458d7e8094846420da595dfc3
SHA1 267cb47b904f14a519d2bd73abfdb30e1a06e1a6
SHA512 480e7ca865b811f79f35fcfe7a9ac0280b48d1f9459873d18f000db55c72d53345cf3a10075c1ac407439545f699ce2a7bef38b00b4e19439edf384b00045531
SSDEEP 96:iq4uYqGEo9xx+incqKXq3qotzYNYr7aqCiNLm7RIz+cBPzQh0nRAy6FcxZcosQSm:iq4uYqGEUdncqKXq3qotzYuWq2Iz+wx
TLSH
T11D91EE323375E0D5C8263F07192C19C463AF439AEA54AF48B258620EED2714BDF122F7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 5a89041e2f8489557426321d0b9dde59bf484ca5687e0155894ed537511d2933
MD5 8dca0f4e76340d75d74e8b034790a6cc
SHA1 f454ef867111702ef1240103107bd4893ac827c2
SHA512 e2865418177141678f645711413fa366f8f1569ab8df55e46a75587b69caf308affc78cd646880bde2dab8615267ae978b03ff980bf21f80f934f5eef5662251
TLSH
T1AF319E77B3ECC065C8D9217A108C5D1072B6C3C7449EDFCB7A84C628967F6D9DB541A4
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 d07ec59dac41076078f1f94c5d79720590d1dc5940f8a1ff5347f013ab1a12e6
MD5 f3d1342c855de99a305dffb922590a59
SHA1 26335b5988341fec8a2fc3d0ea7daf63d634b454
SHA512 dc2f9cee7c9e83d7886c4cf49a21fd1cd1f5bee319b5b3104a37abfbfaa2aebf3b10fb1d641bb1faf8ff74bb3c1b832edd25b0f97aa597fa5d0d4c8c966c9f75
TLSH
T1FD218633B7ACC234C8D911BA2089AD01B2B5C3C7449E8E8B7B84C518A57F99ADB641E4
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 f66dcfa4d243b9575b66da1fe2c62d2c8e2c4f154a127577be26a96b157180aa
MD5 285a864881f5152cce226844752093ca
SHA1 7cead409a5e24fe197e4bd2747902fef82c6337b
SHA512 5eb032566acd010c52d5fbbf738ad77b022f82291c4c3bf92452ca648965c6b4fd5c792a73199b51d0ddb4e2da96a64561fd158b03af516209878b681c554998
TLSH
T17F21A833B7ACC235C8D911BA2088AD01B2B5C3C7449ECECB7B84C508A57F99ADF641E4
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 15dfd7de7e0597f407d4fae5d978302cc6ec49773757ebe9b69ae747564b3413
MD5 0579a9b56e39b9acde06db24983d6102
SHA1 b6d7ea6b2750641ac1aa6d405f8927030c0ce767
SHA512 6a453590163a29ac049681b41cda1e2ecbe90ae87f3da19c3ef786f7662d57925b588fe432c1960a6738f9402654bc608f2376a9a50752af232089b46a48538d
TLSH
T14C218933B79CC234C8C9117A1089AD01B2B5C3C7449E8E8B7B84C518A5BF49ADF641A4
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_t3mk4ink.ytw.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_t3mk4ink.ytw.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

AppReadinessService.vbs

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\AppReadiness\AppReadinessService.vbs
Size 720B
SHA256 ada860fca5b2ecf7b0911e74e0ecee92ca8d1f62763435f88235d4f8131ed1d9
MD5 d5606cb7549c80888485fff1f46a895f
SHA1 2af6d1f16c83ecf0f26a197fef3b99c7bd9a9574
SHA512 6b26d63a2136bbcc920b77e94ebda6fdd6236e19e798208cfc12fc17727811f54965a77568dcbe8e666d3b7a15cc0a4e521357b47fc84de1d0a57029b4a532a6
TLSH
T1D0012308E916CD34E431D8593138F00BF5A621267662967BFE44C0CEAFB03BCC5484C7
MD5 SHA1 SHA512 TLSH

Submit Download

memory/912-130-0x000002137E580000-0x000002137E58E000-memory.dmp

Download

memory/912-123-0x000002137E5A0000-0x000002137E5C4000-memory.dmp

Download

memory/912-121-0x000002137E710000-0x000002137E7C3000-memory.dmp

Download

memory/912-122-0x000002137E5A0000-0x000002137E5CA000-memory.dmp

Download

memory/912-131-0x000002137E5B0000-0x000002137E5CA000-memory.dmp

Download

memory/3112-98-0x00007FF626B20000-0x00007FF62743A000-memory.dmp

Download

memory/3112-92-0x00007FF626B20000-0x00007FF62743A000-memory.dmp

Download

memory/3112-101-0x00007FF626B20000-0x00007FF62743A000-memory.dmp

Download

memory/3112-104-0x00007FF626B20000-0x00007FF62743A000-memory.dmp

Download

memory/3112-107-0x00007FF626B20000-0x00007FF62743A000-memory.dmp

Download

memory/3112-95-0x00007FF626B20000-0x00007FF62743A000-memory.dmp

Download

memory/3112-71-0x00007FF626B20000-0x00007FF62743A000-memory.dmp

Download

memory/3112-80-0x00007FF626B20000-0x00007FF62743A000-memory.dmp

Download

memory/3112-89-0x00007FF626B20000-0x00007FF62743A000-memory.dmp

Download

memory/3112-74-0x00007FF626B20000-0x00007FF62743A000-memory.dmp

Download

memory/3112-86-0x00007FF626B20000-0x00007FF62743A000-memory.dmp

Download

memory/3112-163-0x00007FF626B20000-0x00007FF62743A000-memory.dmp

Download

memory/3112-77-0x00007FF626B20000-0x00007FF62743A000-memory.dmp

Download

memory/3112-83-0x00007FF626B20000-0x00007FF62743A000-memory.dmp

Download

memory/4840-85-0x00007FF626B20000-0x00007FF62743A000-memory.dmp

Download

memory/4840-94-0x00007FF626B20000-0x00007FF62743A000-memory.dmp

Download

memory/4840-162-0x00007FF626B20000-0x00007FF62743A000-memory.dmp

Download

memory/4840-82-0x00007FF626B20000-0x00007FF62743A000-memory.dmp

Download

memory/4840-106-0x00007FF626B20000-0x00007FF62743A000-memory.dmp

Download

memory/4840-103-0x00007FF626B20000-0x00007FF62743A000-memory.dmp

Download

memory/4840-76-0x00007FF626B20000-0x00007FF62743A000-memory.dmp

Download

memory/4840-100-0x00007FF626B20000-0x00007FF62743A000-memory.dmp

Download

memory/4840-79-0x00007FF626B20000-0x00007FF62743A000-memory.dmp

Download

memory/4840-88-0x00007FF626B20000-0x00007FF62743A000-memory.dmp

Download

memory/4840-73-0x00007FF626B20000-0x00007FF62743A000-memory.dmp

Download

memory/4840-97-0x00007FF626B20000-0x00007FF62743A000-memory.dmp

Download

memory/4840-91-0x00007FF626B20000-0x00007FF62743A000-memory.dmp

Download

memory/4840-70-0x00007FF626B20000-0x00007FF62743A000-memory.dmp

Download

memory/5012-69-0x00007FF6C8F40000-0x00007FF6C985A000-memory.dmp

Download

memory/5012-78-0x00007FF6C8F40000-0x00007FF6C985A000-memory.dmp

Download

memory/5012-72-0x00007FF6C8F40000-0x00007FF6C985A000-memory.dmp

Download

memory/5012-96-0x00007FF6C8F40000-0x00007FF6C985A000-memory.dmp

Download

memory/5012-90-0x00007FF6C8F40000-0x00007FF6C985A000-memory.dmp

Download

memory/5012-87-0x00007FF6C8F40000-0x00007FF6C985A000-memory.dmp

Download

memory/5012-99-0x00007FF6C8F40000-0x00007FF6C985A000-memory.dmp

Download

memory/5012-75-0x00007FF6C8F40000-0x00007FF6C985A000-memory.dmp

Download

memory/5012-81-0x00007FF6C8F40000-0x00007FF6C985A000-memory.dmp

Download

memory/5012-102-0x00007FF6C8F40000-0x00007FF6C985A000-memory.dmp

Download

memory/5012-84-0x00007FF6C8F40000-0x00007FF6C985A000-memory.dmp

Download

memory/5012-133-0x00007FF6C8F40000-0x00007FF6C985A000-memory.dmp

Download

memory/5012-105-0x00007FF6C8F40000-0x00007FF6C985A000-memory.dmp

Download

memory/5012-93-0x00007FF6C8F40000-0x00007FF6C985A000-memory.dmp

Download

memory/5400-30-0x000001A7DBFE0000-0x000001A7DBFE6000-memory.dmp

Download

memory/5400-29-0x000001A7DBFB0000-0x000001A7DBFB8000-memory.dmp

Download

memory/5400-28-0x000001A7DC000000-0x000001A7DC01A000-memory.dmp

Download

memory/5400-27-0x000001A7DBFA0000-0x000001A7DBFAA000-memory.dmp

Download

memory/5400-26-0x000001A7DBFC0000-0x000001A7DBFDC000-memory.dmp

Download

memory/5400-25-0x000001A7DBF90000-0x000001A7DBF9A000-memory.dmp

Download

memory/5400-31-0x000001A7DBFF0000-0x000001A7DBFFA000-memory.dmp

Download

memory/5400-24-0x000001A7DBED0000-0x000001A7DBF83000-memory.dmp

Download

memory/5400-23-0x000001A7DBEB0000-0x000001A7DBECC000-memory.dmp

Download

memory/5400-10-0x000001A7DBA90000-0x000001A7DBAB2000-memory.dmp

Download

memory/6128-65-0x0000024D1D050000-0x0000024D1D103000-memory.dmp

Download