Overview

overview

8

Static

static

3

2026-06-08...at.exe

windows10-2004-x64

8

2026-06-08...at.exe

windows11-21h2-x64

8

Analysis

  • max time kernel
    149s
  • max time network
    100s
  • platform
    windows11-21h2_x64
  • resource
    win11-20260513-en
  • resource tags

    arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
  • submitted
    08/06/2026, 15:58

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-06-08_aefcdc16fb02dd8edbfe6c26145335d0_akira_amadey_blankgrabber_elex_glassworm_luca-stealer_njrat.exe
  • Size 1.7MB
  • Sample260608-tevxbsgt7j
  • SHA256 c696784cc0e7a9915b83f4df662e33de890e574288ad4e15c41168ba48db3b6e
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
discoveryexecutionpersistence

Malware Config

Signatures

  • Command and Scripting Interpreter: PowerShell 1 TTPs 60 IoCs

    Run Powershell and hide display window.

    execution
  • Executes dropped EXE 3 IoCs
  • Adds Run key to start application 2 TTPs 26 IoCs
    persistence
  • System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Scheduled Task/Job: Scheduled Task 1 TTPs 10 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistenceexecution
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 29 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-06-08_aefcdc16fb02dd8edbfe6c26145335d0_akira_amadey_blankgrabber_elex_glassworm_luca-stealer_njrat.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-06-08_aefcdc16fb02dd8edbfe6c26145335d0_akira_amadey_blankgrabber_elex_glassworm_luca-stealer_njrat.exe"
    1⤵
    • Adds Run key to start application
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:4932
    • C:\Windows\SysWOW64\cmd.exe
      cmd.exe /c powershell -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\2026-06-08_aefcdc16fb02dd8edbfe6c26145335d0_akira_amadey_blankgrabber_elex_glassworm_luca-stealer_njrat.exe' -ErrorAction SilentlyContinue"
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:2844
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        powershell -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\2026-06-08_aefcdc16fb02dd8edbfe6c26145335d0_akira_amadey_blankgrabber_elex_glassworm_luca-stealer_njrat.exe' -ErrorAction SilentlyContinue"
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:4396
    • C:\Windows\SysWOW64\cmd.exe
      cmd.exe /c powershell -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp' -ErrorAction SilentlyContinue"
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:5884
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        powershell -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp' -ErrorAction SilentlyContinue"
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:5632
    • C:\Windows\SysWOW64\cmd.exe
      cmd.exe /c powershell -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\WindowsUpdate' -ErrorAction SilentlyContinue"
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:2392
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        powershell -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\WindowsUpdate' -ErrorAction SilentlyContinue"
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:2444
    • C:\Windows\SysWOW64\cmd.exe
      cmd.exe /c powershell -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Defender' -ErrorAction SilentlyContinue"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:2832
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        powershell -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Defender' -ErrorAction SilentlyContinue"
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:2524
    • C:\Windows\SysWOW64\cmd.exe
      cmd.exe /c powershell -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\ProgramData\WindowsUpdateCache' -ErrorAction SilentlyContinue"
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:3452
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        powershell -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\ProgramData\WindowsUpdateCache' -ErrorAction SilentlyContinue"
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:5580
    • C:\Windows\SysWOW64\cmd.exe
      cmd.exe /c powershell -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\.cache\winup' -ErrorAction SilentlyContinue"
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:2456
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        powershell -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\.cache\winup' -ErrorAction SilentlyContinue"
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:3416
    • C:\Windows\SysWOW64\cmd.exe
      cmd.exe /c schtasks /create /tn "WindowsUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\2026-06-08_aefcdc16fb02dd8edbfe6c26145335d0_akira_amadey_blankgrabber_elex_glassworm_luca-stealer_njrat.exe" /sc onlogon /ru "Admin" /f /rl highest /it
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:1520
      • C:\Windows\SysWOW64\schtasks.exe
        schtasks /create /tn "WindowsUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\2026-06-08_aefcdc16fb02dd8edbfe6c26145335d0_akira_amadey_blankgrabber_elex_glassworm_luca-stealer_njrat.exe" /sc onlogon /ru "Admin" /f /rl highest /it
        3⤵
        • System Location Discovery: System Language Discovery
        • Scheduled Task/Job: Scheduled Task
        PID:5664
    • C:\Windows\SysWOW64\cmd.exe
      cmd.exe /c schtasks /create /tn "WindowsUpdateBackup" /tr "C:\Users\Admin\AppData\Local\Temp\2026-06-08_aefcdc16fb02dd8edbfe6c26145335d0_akira_amadey_blankgrabber_elex_glassworm_luca-stealer_njrat.exe" /sc minute /mo 15 /f /rl highest
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:1360
      • C:\Windows\SysWOW64\schtasks.exe
        schtasks /create /tn "WindowsUpdateBackup" /tr "C:\Users\Admin\AppData\Local\Temp\2026-06-08_aefcdc16fb02dd8edbfe6c26145335d0_akira_amadey_blankgrabber_elex_glassworm_luca-stealer_njrat.exe" /sc minute /mo 15 /f /rl highest
        3⤵
        • System Location Discovery: System Language Discovery
        • Scheduled Task/Job: Scheduled Task
        PID:1788
  • C:\Users\Admin\AppData\Local\Temp\2026-06-08_aefcdc16fb02dd8edbfe6c26145335d0_akira_amadey_blankgrabber_elex_glassworm_luca-stealer_njrat.exe
    C:\Users\Admin\AppData\Local\Temp\2026-06-08_aefcdc16fb02dd8edbfe6c26145335d0_akira_amadey_blankgrabber_elex_glassworm_luca-stealer_njrat.exe
    1⤵
    • Adds Run key to start application
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:4764
    • C:\Windows\SysWOW64\cmd.exe
      cmd.exe /c powershell -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\2026-06-08_aefcdc16fb02dd8edbfe6c26145335d0_akira_amadey_blankgrabber_elex_glassworm_luca-stealer_njrat.exe' -ErrorAction SilentlyContinue"
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:4816
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        powershell -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\2026-06-08_aefcdc16fb02dd8edbfe6c26145335d0_akira_amadey_blankgrabber_elex_glassworm_luca-stealer_njrat.exe' -ErrorAction SilentlyContinue"
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:3716
    • C:\Windows\SysWOW64\cmd.exe
      cmd.exe /c powershell -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp' -ErrorAction SilentlyContinue"
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:5568
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        powershell -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp' -ErrorAction SilentlyContinue"
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:868
    • C:\Windows\SysWOW64\cmd.exe
      cmd.exe /c powershell -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\WindowsUpdate' -ErrorAction SilentlyContinue"
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:3056
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        powershell -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\WindowsUpdate' -ErrorAction SilentlyContinue"
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:1064
    • C:\Windows\SysWOW64\cmd.exe
      cmd.exe /c powershell -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Defender' -ErrorAction SilentlyContinue"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:996
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        powershell -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Defender' -ErrorAction SilentlyContinue"
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:3392
    • C:\Windows\SysWOW64\cmd.exe
      cmd.exe /c powershell -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\ProgramData\WindowsUpdateCache' -ErrorAction SilentlyContinue"
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:4848
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        powershell -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\ProgramData\WindowsUpdateCache' -ErrorAction SilentlyContinue"
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:2864
    • C:\Windows\SysWOW64\cmd.exe
      cmd.exe /c powershell -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\.cache\winup' -ErrorAction SilentlyContinue"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:856
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        powershell -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\.cache\winup' -ErrorAction SilentlyContinue"
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:1508
    • C:\Windows\SysWOW64\cmd.exe
      cmd.exe /c schtasks /create /tn "WindowsUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\2026-06-08_aefcdc16fb02dd8edbfe6c26145335d0_akira_amadey_blankgrabber_elex_glassworm_luca-stealer_njrat.exe" /sc onlogon /ru "Admin" /f /rl highest /it
      2⤵
      • System Location Discovery: System Language Discovery
      PID:4900
      • C:\Windows\SysWOW64\schtasks.exe
        schtasks /create /tn "WindowsUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\2026-06-08_aefcdc16fb02dd8edbfe6c26145335d0_akira_amadey_blankgrabber_elex_glassworm_luca-stealer_njrat.exe" /sc onlogon /ru "Admin" /f /rl highest /it
        3⤵
        • Scheduled Task/Job: Scheduled Task
        PID:864
    • C:\Windows\SysWOW64\cmd.exe
      cmd.exe /c schtasks /create /tn "WindowsUpdateBackup" /tr "C:\Users\Admin\AppData\Local\Temp\2026-06-08_aefcdc16fb02dd8edbfe6c26145335d0_akira_amadey_blankgrabber_elex_glassworm_luca-stealer_njrat.exe" /sc minute /mo 15 /f /rl highest
      2⤵
      • System Location Discovery: System Language Discovery
      PID:2332
      • C:\Windows\SysWOW64\schtasks.exe
        schtasks /create /tn "WindowsUpdateBackup" /tr "C:\Users\Admin\AppData\Local\Temp\2026-06-08_aefcdc16fb02dd8edbfe6c26145335d0_akira_amadey_blankgrabber_elex_glassworm_luca-stealer_njrat.exe" /sc minute /mo 15 /f /rl highest
        3⤵
        • System Location Discovery: System Language Discovery
        • Scheduled Task/Job: Scheduled Task
        PID:5676
  • C:\ProgramData\WindowsUpdateCache\WindowsUpdate.exe
    C:\ProgramData\WindowsUpdateCache\WindowsUpdate.exe
    1⤵
    • Executes dropped EXE
    • Adds Run key to start application
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:3296
    • C:\Windows\SysWOW64\cmd.exe
      cmd.exe /c powershell -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\ProgramData\WindowsUpdateCache\WindowsUpdate.exe' -ErrorAction SilentlyContinue"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:4464
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        powershell -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\ProgramData\WindowsUpdateCache\WindowsUpdate.exe' -ErrorAction SilentlyContinue"
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:1568
    • C:\Windows\SysWOW64\cmd.exe
      cmd.exe /c powershell -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\ProgramData\WindowsUpdateCache' -ErrorAction SilentlyContinue"
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:1748
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        powershell -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\ProgramData\WindowsUpdateCache' -ErrorAction SilentlyContinue"
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:1364
    • C:\Windows\SysWOW64\cmd.exe
      cmd.exe /c powershell -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\WindowsUpdate' -ErrorAction SilentlyContinue"
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:2968
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        powershell -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\WindowsUpdate' -ErrorAction SilentlyContinue"
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:1740
    • C:\Windows\SysWOW64\cmd.exe
      cmd.exe /c powershell -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Defender' -ErrorAction SilentlyContinue"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:5888
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        powershell -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Defender' -ErrorAction SilentlyContinue"
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:2124
    • C:\Windows\SysWOW64\cmd.exe
      cmd.exe /c powershell -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\ProgramData\WindowsUpdateCache' -ErrorAction SilentlyContinue"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:4176
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        powershell -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\ProgramData\WindowsUpdateCache' -ErrorAction SilentlyContinue"
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:1172
    • C:\Windows\SysWOW64\cmd.exe
      cmd.exe /c powershell -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\.cache\winup' -ErrorAction SilentlyContinue"
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:2420
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        powershell -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\.cache\winup' -ErrorAction SilentlyContinue"
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious use of AdjustPrivilegeToken
        PID:2512
    • C:\Windows\SysWOW64\cmd.exe
      cmd.exe /c schtasks /create /tn "WindowsUpdate" /tr "C:\ProgramData\WindowsUpdateCache\WindowsUpdate.exe" /sc onlogon /ru "Admin" /f /rl highest /it
      2⤵
      • System Location Discovery: System Language Discovery
      PID:3196
      • C:\Windows\SysWOW64\schtasks.exe
        schtasks /create /tn "WindowsUpdate" /tr "C:\ProgramData\WindowsUpdateCache\WindowsUpdate.exe" /sc onlogon /ru "Admin" /f /rl highest /it
        3⤵
        • System Location Discovery: System Language Discovery
        • Scheduled Task/Job: Scheduled Task
        PID:3860
    • C:\Windows\SysWOW64\cmd.exe
      cmd.exe /c schtasks /create /tn "WindowsUpdateBackup" /tr "C:\ProgramData\WindowsUpdateCache\WindowsUpdate.exe" /sc minute /mo 15 /f /rl highest
      2⤵
      • System Location Discovery: System Language Discovery
      PID:2184
      • C:\Windows\SysWOW64\schtasks.exe
        schtasks /create /tn "WindowsUpdateBackup" /tr "C:\ProgramData\WindowsUpdateCache\WindowsUpdate.exe" /sc minute /mo 15 /f /rl highest
        3⤵
        • Scheduled Task/Job: Scheduled Task
        PID:1700
  • C:\Users\Admin\AppData\Roaming\WindowsUpdate\WindowsUpdate.exe
    C:\Users\Admin\AppData\Roaming\WindowsUpdate\WindowsUpdate.exe
    1⤵
    • Executes dropped EXE
    • Adds Run key to start application
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:3900
    • C:\Windows\SysWOW64\cmd.exe
      cmd.exe /c powershell -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\WindowsUpdate\WindowsUpdate.exe' -ErrorAction SilentlyContinue"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:2868
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        powershell -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\WindowsUpdate\WindowsUpdate.exe' -ErrorAction SilentlyContinue"
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:1032
    • C:\Windows\SysWOW64\cmd.exe
      cmd.exe /c powershell -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\WindowsUpdate' -ErrorAction SilentlyContinue"
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:4824
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        powershell -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\WindowsUpdate' -ErrorAction SilentlyContinue"
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:4844
    • C:\Windows\SysWOW64\cmd.exe
      cmd.exe /c powershell -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\WindowsUpdate' -ErrorAction SilentlyContinue"
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:5448
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        powershell -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\WindowsUpdate' -ErrorAction SilentlyContinue"
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:2128
    • C:\Windows\SysWOW64\cmd.exe
      cmd.exe /c powershell -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Defender' -ErrorAction SilentlyContinue"
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:1824
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        powershell -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Defender' -ErrorAction SilentlyContinue"
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:4288
    • C:\Windows\SysWOW64\cmd.exe
      cmd.exe /c powershell -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\ProgramData\WindowsUpdateCache' -ErrorAction SilentlyContinue"
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:1100
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        powershell -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\ProgramData\WindowsUpdateCache' -ErrorAction SilentlyContinue"
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:4812
    • C:\Windows\SysWOW64\cmd.exe
      cmd.exe /c powershell -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\.cache\winup' -ErrorAction SilentlyContinue"
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:3104
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        powershell -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\.cache\winup' -ErrorAction SilentlyContinue"
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • System Location Discovery: System Language Discovery
        • Suspicious use of AdjustPrivilegeToken
        PID:4560
    • C:\Windows\SysWOW64\cmd.exe
      cmd.exe /c schtasks /create /tn "WindowsUpdate" /tr "C:\Users\Admin\AppData\Roaming\WindowsUpdate\WindowsUpdate.exe" /sc onlogon /ru "Admin" /f /rl highest /it
      2⤵
      • System Location Discovery: System Language Discovery
      PID:3068
      • C:\Windows\SysWOW64\schtasks.exe
        schtasks /create /tn "WindowsUpdate" /tr "C:\Users\Admin\AppData\Roaming\WindowsUpdate\WindowsUpdate.exe" /sc onlogon /ru "Admin" /f /rl highest /it
        3⤵
        • System Location Discovery: System Language Discovery
        • Scheduled Task/Job: Scheduled Task
        PID:5256
    • C:\Windows\SysWOW64\cmd.exe
      cmd.exe /c schtasks /create /tn "WindowsUpdateBackup" /tr "C:\Users\Admin\AppData\Roaming\WindowsUpdate\WindowsUpdate.exe" /sc minute /mo 15 /f /rl highest
      2⤵
      • System Location Discovery: System Language Discovery
      PID:3040
      • C:\Windows\SysWOW64\schtasks.exe
        schtasks /create /tn "WindowsUpdateBackup" /tr "C:\Users\Admin\AppData\Roaming\WindowsUpdate\WindowsUpdate.exe" /sc minute /mo 15 /f /rl highest
        3⤵
        • Scheduled Task/Job: Scheduled Task
        PID:5708
  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Defender\WindowsUpdate.exe
    C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Defender\WindowsUpdate.exe
    1⤵
    • Executes dropped EXE
    • Adds Run key to start application
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:3768
    • C:\Windows\SysWOW64\cmd.exe
      cmd.exe /c powershell -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Defender\WindowsUpdate.exe' -ErrorAction SilentlyContinue"
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:6016
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        powershell -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Defender\WindowsUpdate.exe' -ErrorAction SilentlyContinue"
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:1408
    • C:\Windows\SysWOW64\cmd.exe
      cmd.exe /c powershell -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Defender' -ErrorAction SilentlyContinue"
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:5760
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        powershell -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Defender' -ErrorAction SilentlyContinue"
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:2580
    • C:\Windows\SysWOW64\cmd.exe
      cmd.exe /c powershell -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\WindowsUpdate' -ErrorAction SilentlyContinue"
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:5580
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        powershell -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\WindowsUpdate' -ErrorAction SilentlyContinue"
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:4916
    • C:\Windows\SysWOW64\cmd.exe
      cmd.exe /c powershell -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Defender' -ErrorAction SilentlyContinue"
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:1916
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        powershell -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Defender' -ErrorAction SilentlyContinue"
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:3228
    • C:\Windows\SysWOW64\cmd.exe
      cmd.exe /c powershell -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\ProgramData\WindowsUpdateCache' -ErrorAction SilentlyContinue"
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:4636
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        powershell -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\ProgramData\WindowsUpdateCache' -ErrorAction SilentlyContinue"
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • System Location Discovery: System Language Discovery
        PID:4664
    • C:\Windows\SysWOW64\cmd.exe
      cmd.exe /c powershell -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\.cache\winup' -ErrorAction SilentlyContinue"
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:2704
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        powershell -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\.cache\winup' -ErrorAction SilentlyContinue"
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • System Location Discovery: System Language Discovery
        • Suspicious use of AdjustPrivilegeToken
        PID:3220
    • C:\Windows\SysWOW64\cmd.exe
      cmd.exe /c schtasks /create /tn "WindowsUpdate" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Defender\WindowsUpdate.exe" /sc onlogon /ru "Admin" /f /rl highest /it
      2⤵
      • System Location Discovery: System Language Discovery
      PID:1028
      • C:\Windows\SysWOW64\schtasks.exe
        schtasks /create /tn "WindowsUpdate" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Defender\WindowsUpdate.exe" /sc onlogon /ru "Admin" /f /rl highest /it
        3⤵
        • System Location Discovery: System Language Discovery
        • Scheduled Task/Job: Scheduled Task
        PID:4612
    • C:\Windows\SysWOW64\cmd.exe
      cmd.exe /c schtasks /create /tn "WindowsUpdateBackup" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Defender\WindowsUpdate.exe" /sc minute /mo 15 /f /rl highest
      2⤵
      • System Location Discovery: System Language Discovery
      PID:412
      • C:\Windows\SysWOW64\schtasks.exe
        schtasks /create /tn "WindowsUpdateBackup" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Defender\WindowsUpdate.exe" /sc minute /mo 15 /f /rl highest
        3⤵
        • System Location Discovery: System Language Discovery
        • Scheduled Task/Job: Scheduled Task
        PID:2900

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        WindowsUpdate.exe
        • Path C:\ProgramData\WindowsUpdateCache\WindowsUpdate.exe
        • Size 1.7MB
        • SHA256 c696784cc0e7a9915b83f4df662e33de890e574288ad4e15c41168ba48db3b6e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        powershell.exe.log
        • Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log
        • Size 2KB
        • SHA256 9600b3fdf0565ccb49e21656aa4b24d7c18f776bfd04d9ee984b134707550f02
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        StartupProfileData-NonInteractive
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
        • Size 18KB
        • SHA256 6b1f8c1cf24e92fa81fd65b9e2a1a1df9fa9fdfb19b82356a2a6b38b71829f11
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        StartupProfileData-NonInteractive
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
        • Size 18KB
        • SHA256 d2aac8921d7b0cd7fe33b07272025555718b6c21f8ef25673e5e3dbc001eb43f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        StartupProfileData-NonInteractive
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
        • Size 18KB
        • SHA256 ec049d6010c1618497c4ec98c410637fc7581973bd540cb36bca1508cdb47128
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        StartupProfileData-NonInteractive
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
        • Size 18KB
        • SHA256 90dc0edf4efab46a45c82f610d6d943e675d1efe8d0e808783f28d7ed69086a8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        StartupProfileData-NonInteractive
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
        • Size 18KB
        • SHA256 e797b35480451032765ccc830f29f18dd269f48d7e6c15a5b5c6dae0a1d2e2d4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        StartupProfileData-NonInteractive
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
        • Size 18KB
        • SHA256 ff60c37c9811b453a3d9ebe703af6d9aeadcfc5a312c8cc55cd28d8a6fb95c12
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        StartupProfileData-NonInteractive
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
        • Size 18KB
        • SHA256 14dc72dd2621070445721768f0223e7043734aad8fdd85ae8bde965bdc1fa3f6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        StartupProfileData-NonInteractive
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
        • Size 18KB
        • SHA256 ea452e1ac424d257ecf1978a6fa0f5f18c7654c86f5f19ea9d89a9cd57cdf25d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        StartupProfileData-NonInteractive
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
        • Size 18KB
        • SHA256 a2a72272e0776b97288acb190626537206525e6b0c62571ea6566226b89d8f41
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        StartupProfileData-NonInteractive
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
        • Size 18KB
        • SHA256 ecda8db68e4e258d3c7ebabacef38e59f36b73827a0129e9838584698fcd59c8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        StartupProfileData-NonInteractive
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
        • Size 18KB
        • SHA256 e19cdf0ec94161292580aa2cd46da150c5af571d29980dad56545b0d91ba9bc4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        StartupProfileData-NonInteractive
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
        • Size 18KB
        • SHA256 d04585f6400d62e0331f2d7735ec3492cdc9383a05b0819b9c6d0dbe35fb8566
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        StartupProfileData-NonInteractive
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
        • Size 18KB
        • SHA256 de09ea3d8477145c09d714347e29e89529945c88a66538bd11beb9c48fa1b755
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        StartupProfileData-NonInteractive
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
        • Size 18KB
        • SHA256 54b0abb830b2097b33bfc85cab3c724246c36e917f08f829105ec39cb1a6d29f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        StartupProfileData-NonInteractive
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
        • Size 18KB
        • SHA256 8fa256da2cd7e00b898fa2ea09368393abd784112ac16f881bc1cfa7f6862b66
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        StartupProfileData-NonInteractive
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
        • Size 18KB
        • SHA256 9b82b294a9f8421121ea3457f5ab7cadc37b4b72b7e2aee31b53f227789d18ef
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        StartupProfileData-NonInteractive
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
        • Size 18KB
        • SHA256 899ec22fd6882e87f17c2a732654dd0c23e2d949fe123f1f52725f4e4f2ca5a5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        StartupProfileData-NonInteractive
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
        • Size 18KB
        • SHA256 89e7abe8d60c3e8b4961d8c385e9ea91587796bfab57cb1d3470b0b76151fe50
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        StartupProfileData-NonInteractive
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
        • Size 18KB
        • SHA256 53defc33ea46c1e7e2f5882899e74ed10eac489b5522da688dc650ce5bf218f8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        StartupProfileData-NonInteractive
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
        • Size 18KB
        • SHA256 48f7bea148914b3b52b71b5e7cfbae2c32b0efcd00abd081c62c7634eafb3859
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        StartupProfileData-NonInteractive
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
        • Size 18KB
        • SHA256 fb19aa33bf8b60fb1c098b4dd5e8e3ebad650e795ed2fd1b71f7dc5838b6c414
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        __PSScriptPolicyTest_am1la2zt.bih.ps1
        • Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_am1la2zt.bih.ps1
        • Size 60B
        • SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        memory/868-226-0x000000006F920000-0x000000006F96C000-memory.dmp
        Download

        memory/1032-194-0x00000000073B0000-0x00000000073C5000-memory.dmp
        Download

        memory/1032-179-0x000000006F920000-0x000000006F96C000-memory.dmp
        Download

        memory/1064-284-0x000000006F920000-0x000000006F96C000-memory.dmp
        Download

        memory/1172-408-0x000000006F920000-0x000000006F96C000-memory.dmp
        Download

        memory/1364-219-0x000000006F920000-0x000000006F96C000-memory.dmp
        Download

        memory/1408-186-0x000000006F920000-0x000000006F96C000-memory.dmp
        Download

        memory/1508-440-0x000000006F920000-0x000000006F96C000-memory.dmp
        Download

        memory/1568-193-0x0000000007E80000-0x0000000007E91000-memory.dmp
        Download

        memory/1568-171-0x0000000007B50000-0x0000000007BF4000-memory.dmp
        Download

        memory/1568-164-0x000000006F920000-0x000000006F96C000-memory.dmp
        Download

        memory/1568-162-0x0000000006940000-0x000000000698C000-memory.dmp
        Download

        memory/1568-142-0x00000000064D0000-0x0000000006827000-memory.dmp
        Download

        memory/1740-291-0x000000006F920000-0x000000006F96C000-memory.dmp
        Download

        memory/2124-343-0x000000006F920000-0x000000006F96C000-memory.dmp
        Download

        memory/2128-298-0x000000006F920000-0x000000006F96C000-memory.dmp
        Download

        memory/2444-65-0x000000006F950000-0x000000006F99C000-memory.dmp
        Download

        memory/2512-469-0x000000006F920000-0x000000006F96C000-memory.dmp
        Download

        memory/2524-81-0x000000006F950000-0x000000006F99C000-memory.dmp
        Download

        memory/2580-251-0x000000006F920000-0x000000006F96C000-memory.dmp
        Download

        memory/2864-399-0x000000006F920000-0x000000006F96C000-memory.dmp
        Download

        memory/3220-476-0x000000006F920000-0x000000006F96C000-memory.dmp
        Download

        memory/3228-393-0x000000006F920000-0x000000006F96C000-memory.dmp
        Download

        memory/3296-261-0x0000000074060000-0x0000000075377000-memory.dmp
        Download

        memory/3296-506-0x0000000074060000-0x0000000075377000-memory.dmp
        Download

        memory/3392-336-0x000000006F920000-0x000000006F96C000-memory.dmp
        Download

        memory/3416-111-0x000000006F950000-0x000000006F99C000-memory.dmp
        Download

        memory/3716-172-0x000000006F920000-0x000000006F96C000-memory.dmp
        Download

        memory/3768-508-0x0000000074060000-0x0000000075377000-memory.dmp
        Download

        memory/3768-263-0x0000000074060000-0x0000000075377000-memory.dmp
        Download

        memory/3900-262-0x0000000074060000-0x0000000075377000-memory.dmp
        Download

        memory/3900-507-0x0000000074060000-0x0000000075377000-memory.dmp
        Download

        memory/4288-358-0x000000006F920000-0x000000006F96C000-memory.dmp
        Download

        memory/4396-29-0x0000000007110000-0x00000000071B4000-memory.dmp
        Download

        memory/4396-20-0x000000006F950000-0x000000006F99C000-memory.dmp
        Download

        memory/4396-37-0x00000000077B0000-0x00000000077CA000-memory.dmp
        Download

        memory/4396-2-0x0000000004CF0000-0x0000000004D00000-memory.dmp
        Download

        memory/4396-3-0x0000000004C40000-0x0000000004C76000-memory.dmp
        Download

        memory/4396-4-0x0000000004CF0000-0x0000000004D00000-memory.dmp
        Download

        memory/4396-36-0x00000000076A0000-0x00000000076B5000-memory.dmp
        Download

        memory/4396-35-0x0000000007690000-0x000000000769E000-memory.dmp
        Download

        memory/4396-34-0x0000000007660000-0x0000000007671000-memory.dmp
        Download

        memory/4396-33-0x00000000076F0000-0x0000000007786000-memory.dmp
        Download

        memory/4396-32-0x00000000074C0000-0x00000000074CA000-memory.dmp
        Download

        memory/4396-31-0x0000000007450000-0x000000000746A000-memory.dmp
        Download

        memory/4396-5-0x0000000005330000-0x000000000595A000-memory.dmp
        Download

        memory/4396-6-0x0000000005140000-0x0000000005162000-memory.dmp
        Download

        memory/4396-30-0x0000000007A90000-0x000000000810A000-memory.dmp
        Download

        memory/4396-7-0x0000000005960000-0x00000000059C6000-memory.dmp
        Download

        memory/4396-8-0x00000000059D0000-0x0000000005A36000-memory.dmp
        Download

        memory/4396-28-0x00000000066E0000-0x00000000066FE000-memory.dmp
        Download

        memory/4396-27-0x0000000004CF0000-0x0000000004D00000-memory.dmp
        Download

        memory/4396-38-0x0000000007790000-0x0000000007798000-memory.dmp
        Download

        memory/4396-19-0x00000000070C0000-0x00000000070F4000-memory.dmp
        Download

        memory/4396-18-0x000000007F7D0000-0x000000007F7E0000-memory.dmp
        Download

        memory/4396-17-0x00000000061A0000-0x00000000061EC000-memory.dmp
        Download

        memory/4396-15-0x0000000005BD0000-0x0000000005F27000-memory.dmp
        Download

        memory/4396-16-0x0000000006110000-0x000000000612E000-memory.dmp
        Download

        memory/4560-483-0x000000006F920000-0x000000006F96C000-memory.dmp
        Download

        memory/4764-505-0x0000000074060000-0x0000000075377000-memory.dmp
        Download

        memory/4764-260-0x0000000074060000-0x0000000075377000-memory.dmp
        Download

        memory/4812-433-0x000000006F920000-0x000000006F96C000-memory.dmp
        Download

        memory/4844-233-0x000000006F920000-0x000000006F96C000-memory.dmp
        Download

        memory/4916-329-0x000000006F920000-0x000000006F96C000-memory.dmp
        Download

        memory/4932-72-0x0000000074060000-0x0000000075377000-memory.dmp
        Download

        memory/4932-0-0x0000000074060000-0x0000000075377000-memory.dmp
        Download

        memory/4932-163-0x0000000074060000-0x0000000075377000-memory.dmp
        Download

        memory/5580-96-0x000000006F950000-0x000000006F99C000-memory.dmp
        Download

        memory/5632-50-0x000000006F950000-0x000000006F99C000-memory.dmp
        Download

        memory/5632-48-0x00000000061A0000-0x00000000064F7000-memory.dmp
        Download