Overview

overview

10

Static

static

5

EXITLAG_PA....4.zip

windows10-2004-x64

10

EXITLAG_PA....4.zip

windows11-ltsc_2024-x64

8

EXITLAG_PA...on.bat

windows10-2004-x64

1

EXITLAG_PA...on.bat

windows11-ltsc_2024-x64

1

EXITLAG_PA....4.exe

windows10-2004-x64

10

EXITLAG_PA....4.exe

windows11-ltsc_2024-x64

10

EXITLAG_PA...rt.exe

windows10-2004-x64

10

EXITLAG_PA...rt.exe

windows11-ltsc_2024-x64

10

EXITLAG_PA...ow.dll

windows10-2004-x64

1

EXITLAG_PA...ow.dll

windows11-ltsc_2024-x64

1

EXITLAG_PA...pi.dll

windows10-2004-x64

1

EXITLAG_PA...pi.dll

windows11-ltsc_2024-x64

8

EXITLAG_PA...fig.db

windows10-2004-x64

3

EXITLAG_PA...fig.db

windows11-ltsc_2024-x64

3

EXITLAG_PA...s2.bin

windows10-2004-x64

3

EXITLAG_PA...s2.bin

windows11-ltsc_2024-x64

8

EXITLAG_PA...64.dll

windows10-2004-x64

1

EXITLAG_PA...64.dll

windows11-ltsc_2024-x64

1

EXITLAG_PA...rl.dll

windows10-2004-x64

1

EXITLAG_PA...rl.dll

windows11-ltsc_2024-x64

8

EXITLAG_PA...e3.dll

windows10-2004-x64

1

EXITLAG_PA...e3.dll

windows11-ltsc_2024-x64

8

EXITLAG_PA...b1.dll

windows10-2004-x64

1

EXITLAG_PA...b1.dll

windows11-ltsc_2024-x64

1

Analysis

  • max time kernel
    900s
  • max time network
    899s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260710-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    16/07/2026, 02:14

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    EXITLAG_PATCHER_V1.4.4/ExitLagCrackV1.4.4.exe
  • Size 43.1MB
  • Sample260716-cn9y6sbs8j
  • SHA256 b03e9657b6d14754a89b519aa07388ac95e61258c217edad4adf68a5ba2488e1
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
credential_accessdefense_evasiondiscoverysalatstealerpersistencespywarestealertrojanupx

Malware Config

Signatures

  • Family: salatstealer

    SalatStealer is a stealer that takes sceenshot written in Golang.

    stealersalatstealer
  • Detect SalatStealer payload 55 IoCs
  • UAC bypass 3 TTPs 1 IoCs
    defense_evasiontrojan
  • Enumerates VirtualBox registry keys 2 TTPs 64 IoCs
    defense_evasion
  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 42 IoCs
    defense_evasion
  • Looks for VirtualBox Guest Additions in registry 2 TTPs 42 IoCs
    defense_evasion
  • Badlisted process makes network request 10 IoCs

    Network request originating from process or tool commonly abused by malware.

  • Looks for VMWare Tools registry key 2 TTPs 42 IoCs
    defense_evasion
  • Looks for VMWare services registry key. 1 TTPs 64 IoCs
    defense_evasion
  • Executes dropped EXE 64 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Unsecured Credentials: Credentials In Files 1 TTPs

    Steal credentials from unsecured files.

    credential_accessstealer
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
    spyware
  • Adds Run key to start application 2 TTPs 8 IoCs
    persistence
  • Drops file in System32 directory 2 IoCs
  • UPX packed file 64 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Drops file in Program Files directory 16 IoCs
  • Drops file in Windows directory 4 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 30 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\EXITLAG_PATCHER_V1.4.4\ExitLagCrackV1.4.4.exe
    "C:\Users\Admin\AppData\Local\Temp\EXITLAG_PATCHER_V1.4.4\ExitLagCrackV1.4.4.exe"
    1⤵
    • Enumerates VirtualBox registry keys
    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
    • Looks for VirtualBox Guest Additions in registry
    • Looks for VMWare Tools registry key
    • Looks for VMWare services registry key.
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:3380
    • C:\Users\Admin\AppData\Local\Temp\GpuService_9e1e7c.exe
      "C:\Users\Admin\AppData\Local\Temp\GpuService_9e1e7c.exe"
      2⤵
      • Executes dropped EXE
      • Drops file in Program Files directory
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:5308
      • C:\Users\Admin\AppData\Local\Adobe\WmiPrvSE.exe
        C:\Users\Admin\AppData\Local\Adobe\WmiPrvSE.exe
        3⤵
        • Executes dropped EXE
        • Drops file in Program Files directory
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious behavior: GetForegroundWindowSpam
        • Suspicious use of WriteProcessMemory
        PID:2184
        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
          powershell.exe
          4⤵
          • Badlisted process makes network request
          • System Location Discovery: System Language Discovery
          PID:5132
        • C:\Program Files (x86)\Microsoft\Edge\Application\WmiPrvSE.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\WmiPrvSE.exe" -
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:4708
    • C:\Users\Admin\AppData\Local\Packages\smartscreen.exe
      C:\Users\Admin\AppData\Local\Packages\smartscreen.exe
      2⤵
      • Enumerates VirtualBox registry keys
      • Identifies VirtualBox via ACPI registry values (likely anti-VM)
      • Looks for VirtualBox Guest Additions in registry
      • Looks for VMWare Tools registry key
      • Looks for VMWare services registry key.
      • Executes dropped EXE
      • Drops file in Program Files directory
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:5776
      • C:\Users\Admin\AppData\Local\Temp\GpuService_9e1e7c.exe
        "C:\Users\Admin\AppData\Local\Temp\GpuService_9e1e7c.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        PID:5284
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        powershell.exe
        3⤵
        • UAC bypass
        • Badlisted process makes network request
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:1464
        • C:\Windows\SysWOW64\ReAgentc.exe
          "C:\Windows\system32\ReAgentc.exe" /disable
          4⤵
          • Drops file in System32 directory
          • Drops file in Windows directory
          • System Location Discovery: System Language Discovery
          PID:1296
      • C:\Program Files (x86)\Microsoft\Edge\Application\smartscreen.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\smartscreen.exe" -
        3⤵
        • Enumerates VirtualBox registry keys
        • Identifies VirtualBox via ACPI registry values (likely anti-VM)
        • Looks for VirtualBox Guest Additions in registry
        • Looks for VMWare Tools registry key
        • Looks for VMWare services registry key.
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of WriteProcessMemory
        PID:3680
        • C:\Users\Admin\AppData\Local\Temp\GpuService_9e1e7c.exe
          "C:\Users\Admin\AppData\Local\Temp\GpuService_9e1e7c.exe"
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:2708
  • C:\Program Files (x86)\Windows Defender\winlogon.exe
    "C:\Program Files (x86)\Windows Defender\winlogon.exe"
    1⤵
    • Enumerates VirtualBox registry keys
    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
    • Looks for VirtualBox Guest Additions in registry
    • Looks for VMWare Tools registry key
    • Looks for VMWare services registry key.
    • Executes dropped EXE
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:4272
    • C:\Users\Admin\AppData\Local\Temp\GpuService_9e1e7c.exe
      "C:\Users\Admin\AppData\Local\Temp\GpuService_9e1e7c.exe"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      PID:4268
  • C:\Program Files (x86)\Adobe\dllhost.exe
    "C:\Program Files (x86)\Adobe\dllhost.exe"
    1⤵
    • Enumerates VirtualBox registry keys
    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
    • Looks for VirtualBox Guest Additions in registry
    • Looks for VMWare Tools registry key
    • Executes dropped EXE
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:1140
    • C:\Users\Admin\AppData\Local\Temp\GpuService_9e1e7c.exe
      "C:\Users\Admin\AppData\Local\Temp\GpuService_9e1e7c.exe"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      PID:6136
  • C:\Program Files (x86)\Microsoft\spoolsv.exe
    "C:\Program Files (x86)\Microsoft\spoolsv.exe"
    1⤵
    • Enumerates VirtualBox registry keys
    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
    • Looks for VirtualBox Guest Additions in registry
    • Looks for VMWare Tools registry key
    • Looks for VMWare services registry key.
    • Executes dropped EXE
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    PID:4816
  • C:\Program Files (x86)\Reference Assemblies\sppsvc.exe
    "C:\Program Files (x86)\Reference Assemblies\sppsvc.exe"
    1⤵
    • Enumerates VirtualBox registry keys
    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
    • Looks for VirtualBox Guest Additions in registry
    • Looks for VMWare Tools registry key
    • Looks for VMWare services registry key.
    • Executes dropped EXE
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    PID:3512
  • C:\Program Files (x86)\Mozilla Maintenance Service\WmiPrvSE.exe
    "C:\Program Files (x86)\Mozilla Maintenance Service\WmiPrvSE.exe"
    1⤵
    • Enumerates VirtualBox registry keys
    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
    • Looks for VirtualBox Guest Additions in registry
    • Looks for VMWare Tools registry key
    • Looks for VMWare services registry key.
    • Executes dropped EXE
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:2352
    • C:\Users\Admin\AppData\Local\Temp\GpuService_9e1e7c.exe
      "C:\Users\Admin\AppData\Local\Temp\GpuService_9e1e7c.exe"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      PID:3252
  • C:\Program Files (x86)\Windows Sidebar\StartMenuExperienceHost.exe
    "C:\Program Files (x86)\Windows Sidebar\StartMenuExperienceHost.exe"
    1⤵
    • Enumerates VirtualBox registry keys
    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
    • Looks for VirtualBox Guest Additions in registry
    • Looks for VMWare Tools registry key
    • Looks for VMWare services registry key.
    • Executes dropped EXE
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    PID:1112
  • C:\Users\Admin\AppData\Local\D3DSCache\lsass.exe
    C:\Users\Admin\AppData\Local\D3DSCache\lsass.exe
    1⤵
    • Enumerates VirtualBox registry keys
    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
    • Looks for VirtualBox Guest Additions in registry
    • Looks for VMWare Tools registry key
    • Looks for VMWare services registry key.
    • Executes dropped EXE
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:4772
    • C:\Users\Admin\AppData\Local\Temp\GpuService_9e1e7c.exe
      "C:\Users\Admin\AppData\Local\Temp\GpuService_9e1e7c.exe"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      PID:5700
  • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
    1⤵
      PID:1740
    • C:\Windows\System32\svchost.exe
      C:\Windows\System32\svchost.exe -k netsvcs -p -s BDESVC
      1⤵
        PID:3264
      • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
        1⤵
          PID:2064
        • C:\Program Files (x86)\Microsoft\spoolsv.exe
          "C:\Program Files (x86)\Microsoft\spoolsv.exe"
          1⤵
          • Enumerates VirtualBox registry keys
          • Identifies VirtualBox via ACPI registry values (likely anti-VM)
          • Looks for VirtualBox Guest Additions in registry
          • Looks for VMWare Tools registry key
          • Looks for VMWare services registry key.
          • Executes dropped EXE
          • Suspicious use of WriteProcessMemory
          PID:2988
          • C:\Users\Admin\AppData\Local\Temp\GpuService_9e1e7c.exe
            "C:\Users\Admin\AppData\Local\Temp\GpuService_9e1e7c.exe"
            2⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:5588
        • C:\Program Files (x86)\Adobe\dllhost.exe
          "C:\Program Files (x86)\Adobe\dllhost.exe"
          1⤵
          • Enumerates VirtualBox registry keys
          • Identifies VirtualBox via ACPI registry values (likely anti-VM)
          • Looks for VirtualBox Guest Additions in registry
          • Looks for VMWare Tools registry key
          • Looks for VMWare services registry key.
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:2764
          • C:\Users\Admin\AppData\Local\Temp\GpuService_9e1e7c.exe
            "C:\Users\Admin\AppData\Local\Temp\GpuService_9e1e7c.exe"
            2⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:4284
        • C:\Program Files (x86)\Windows Defender\winlogon.exe
          "C:\Program Files (x86)\Windows Defender\winlogon.exe"
          1⤵
          • Enumerates VirtualBox registry keys
          • Identifies VirtualBox via ACPI registry values (likely anti-VM)
          • Looks for VirtualBox Guest Additions in registry
          • Looks for VMWare Tools registry key
          • Looks for VMWare services registry key.
          • Executes dropped EXE
          • Suspicious use of WriteProcessMemory
          PID:5104
          • C:\Users\Admin\AppData\Local\Temp\GpuService_9e1e7c.exe
            "C:\Users\Admin\AppData\Local\Temp\GpuService_9e1e7c.exe"
            2⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:5536
        • C:\Program Files (x86)\Reference Assemblies\sppsvc.exe
          "C:\Program Files (x86)\Reference Assemblies\sppsvc.exe"
          1⤵
          • Enumerates VirtualBox registry keys
          • Identifies VirtualBox via ACPI registry values (likely anti-VM)
          • Looks for VirtualBox Guest Additions in registry
          • Looks for VMWare Tools registry key
          • Looks for VMWare services registry key.
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:1216
        • C:\Program Files (x86)\Mozilla Maintenance Service\WmiPrvSE.exe
          "C:\Program Files (x86)\Mozilla Maintenance Service\WmiPrvSE.exe"
          1⤵
          • Enumerates VirtualBox registry keys
          • Identifies VirtualBox via ACPI registry values (likely anti-VM)
          • Looks for VirtualBox Guest Additions in registry
          • Looks for VMWare Tools registry key
          • Looks for VMWare services registry key.
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:4520
        • C:\Program Files (x86)\Windows Sidebar\StartMenuExperienceHost.exe
          "C:\Program Files (x86)\Windows Sidebar\StartMenuExperienceHost.exe"
          1⤵
          • Enumerates VirtualBox registry keys
          • Identifies VirtualBox via ACPI registry values (likely anti-VM)
          • Looks for VirtualBox Guest Additions in registry
          • Looks for VMWare Tools registry key
          • Looks for VMWare services registry key.
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:2304
        • C:\Users\Admin\AppData\Local\D3DSCache\lsass.exe
          "C:\Users\Admin\AppData\Local\D3DSCache\lsass.exe"
          1⤵
          • Enumerates VirtualBox registry keys
          • Identifies VirtualBox via ACPI registry values (likely anti-VM)
          • Looks for VirtualBox Guest Additions in registry
          • Looks for VMWare Tools registry key
          • Looks for VMWare services registry key.
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:2068
          • C:\Users\Admin\AppData\Local\Temp\GpuService_9e1e7c.exe
            "C:\Users\Admin\AppData\Local\Temp\GpuService_9e1e7c.exe"
            2⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:4052
        • C:\Users\Admin\AppData\Local\Packages\smartscreen.exe
          "C:\Users\Admin\AppData\Local\Packages\smartscreen.exe"
          1⤵
          • Enumerates VirtualBox registry keys
          • Identifies VirtualBox via ACPI registry values (likely anti-VM)
          • Looks for VirtualBox Guest Additions in registry
          • Looks for VMWare Tools registry key
          • Looks for VMWare services registry key.
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:3328
        • C:\Windows\system32\svchost.exe
          C:\Windows\system32\svchost.exe -k GPSvcGroup
          1⤵
            PID:2644
          • C:\Program Files (x86)\Mozilla Maintenance Service\WmiPrvSE.exe
            "C:\Program Files (x86)\Mozilla Maintenance Service\WmiPrvSE.exe"
            1⤵
            • Enumerates VirtualBox registry keys
            • Identifies VirtualBox via ACPI registry values (likely anti-VM)
            • Looks for VirtualBox Guest Additions in registry
            • Looks for VMWare Tools registry key
            • Looks for VMWare services registry key.
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:2964
            • C:\Users\Admin\AppData\Local\Temp\GpuService_9e1e7c.exe
              "C:\Users\Admin\AppData\Local\Temp\GpuService_9e1e7c.exe"
              2⤵
              • Executes dropped EXE
              • System Location Discovery: System Language Discovery
              PID:2728
          • C:\Program Files (x86)\Microsoft\spoolsv.exe
            "C:\Program Files (x86)\Microsoft\spoolsv.exe"
            1⤵
            • Enumerates VirtualBox registry keys
            • Identifies VirtualBox via ACPI registry values (likely anti-VM)
            • Looks for VirtualBox Guest Additions in registry
            • Looks for VMWare Tools registry key
            • Looks for VMWare services registry key.
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:616
          • C:\Program Files (x86)\Windows Defender\winlogon.exe
            "C:\Program Files (x86)\Windows Defender\winlogon.exe"
            1⤵
            • Enumerates VirtualBox registry keys
            • Identifies VirtualBox via ACPI registry values (likely anti-VM)
            • Looks for VirtualBox Guest Additions in registry
            • Looks for VMWare Tools registry key
            • Looks for VMWare services registry key.
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:2400
          • C:\Program Files (x86)\Adobe\dllhost.exe
            "C:\Program Files (x86)\Adobe\dllhost.exe"
            1⤵
            • Enumerates VirtualBox registry keys
            • Identifies VirtualBox via ACPI registry values (likely anti-VM)
            • Looks for VirtualBox Guest Additions in registry
            • Looks for VMWare Tools registry key
            • Looks for VMWare services registry key.
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:5948
            • C:\Users\Admin\AppData\Local\Temp\GpuService_9e1e7c.exe
              "C:\Users\Admin\AppData\Local\Temp\GpuService_9e1e7c.exe"
              2⤵
              • Executes dropped EXE
              • System Location Discovery: System Language Discovery
              PID:4036
          • C:\Program Files (x86)\Reference Assemblies\sppsvc.exe
            "C:\Program Files (x86)\Reference Assemblies\sppsvc.exe"
            1⤵
            • Enumerates VirtualBox registry keys
            • Identifies VirtualBox via ACPI registry values (likely anti-VM)
            • Looks for VirtualBox Guest Additions in registry
            • Looks for VMWare Tools registry key
            • Looks for VMWare services registry key.
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:4800
          • C:\Program Files (x86)\Windows Sidebar\StartMenuExperienceHost.exe
            "C:\Program Files (x86)\Windows Sidebar\StartMenuExperienceHost.exe"
            1⤵
            • Enumerates VirtualBox registry keys
            • Identifies VirtualBox via ACPI registry values (likely anti-VM)
            • Looks for VirtualBox Guest Additions in registry
            • Looks for VMWare Tools registry key
            • Looks for VMWare services registry key.
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:5672
          • C:\Users\Admin\AppData\Local\D3DSCache\lsass.exe
            "C:\Users\Admin\AppData\Local\D3DSCache\lsass.exe"
            1⤵
            • Enumerates VirtualBox registry keys
            • Identifies VirtualBox via ACPI registry values (likely anti-VM)
            • Looks for VirtualBox Guest Additions in registry
            • Looks for VMWare Tools registry key
            • Looks for VMWare services registry key.
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:4664
            • C:\Users\Admin\AppData\Local\Temp\GpuService_9e1e7c.exe
              "C:\Users\Admin\AppData\Local\Temp\GpuService_9e1e7c.exe"
              2⤵
              • Executes dropped EXE
              • System Location Discovery: System Language Discovery
              PID:5212
          • C:\Users\Admin\AppData\Local\Packages\smartscreen.exe
            "C:\Users\Admin\AppData\Local\Packages\smartscreen.exe"
            1⤵
            • Enumerates VirtualBox registry keys
            • Identifies VirtualBox via ACPI registry values (likely anti-VM)
            • Looks for VirtualBox Guest Additions in registry
            • Looks for VMWare Tools registry key
            • Looks for VMWare services registry key.
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:4128
            • C:\Users\Admin\AppData\Local\Temp\GpuService_9e1e7c.exe
              "C:\Users\Admin\AppData\Local\Temp\GpuService_9e1e7c.exe"
              2⤵
              • Executes dropped EXE
              • System Location Discovery: System Language Discovery
              PID:5572
          • C:\Program Files (x86)\Mozilla Maintenance Service\WmiPrvSE.exe
            "C:\Program Files (x86)\Mozilla Maintenance Service\WmiPrvSE.exe"
            1⤵
            • Enumerates VirtualBox registry keys
            • Identifies VirtualBox via ACPI registry values (likely anti-VM)
            • Looks for VirtualBox Guest Additions in registry
            • Looks for VMWare Tools registry key
            • Looks for VMWare services registry key.
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:4288
            • C:\Users\Admin\AppData\Local\Temp\GpuService_9e1e7c.exe
              "C:\Users\Admin\AppData\Local\Temp\GpuService_9e1e7c.exe"
              2⤵
              • Executes dropped EXE
              • System Location Discovery: System Language Discovery
              PID:2212
          • C:\Program Files (x86)\Microsoft\spoolsv.exe
            "C:\Program Files (x86)\Microsoft\spoolsv.exe"
            1⤵
            • Enumerates VirtualBox registry keys
            • Identifies VirtualBox via ACPI registry values (likely anti-VM)
            • Looks for VirtualBox Guest Additions in registry
            • Looks for VMWare Tools registry key
            • Looks for VMWare services registry key.
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:5956
          • C:\Program Files (x86)\Reference Assemblies\sppsvc.exe
            "C:\Program Files (x86)\Reference Assemblies\sppsvc.exe"
            1⤵
            • Enumerates VirtualBox registry keys
            • Identifies VirtualBox via ACPI registry values (likely anti-VM)
            • Looks for VirtualBox Guest Additions in registry
            • Looks for VMWare Tools registry key
            • Looks for VMWare services registry key.
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:5184
          • C:\Program Files (x86)\Windows Defender\winlogon.exe
            "C:\Program Files (x86)\Windows Defender\winlogon.exe"
            1⤵
            • Enumerates VirtualBox registry keys
            • Identifies VirtualBox via ACPI registry values (likely anti-VM)
            • Looks for VirtualBox Guest Additions in registry
            • Looks for VMWare Tools registry key
            • Looks for VMWare services registry key.
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:5428
            • C:\Users\Admin\AppData\Local\Temp\GpuService_9e1e7c.exe
              "C:\Users\Admin\AppData\Local\Temp\GpuService_9e1e7c.exe"
              2⤵
              • Executes dropped EXE
              • System Location Discovery: System Language Discovery
              PID:4924
          • C:\Program Files (x86)\Adobe\dllhost.exe
            "C:\Program Files (x86)\Adobe\dllhost.exe"
            1⤵
            • Enumerates VirtualBox registry keys
            • Identifies VirtualBox via ACPI registry values (likely anti-VM)
            • Looks for VirtualBox Guest Additions in registry
            • Looks for VMWare Tools registry key
            • Looks for VMWare services registry key.
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:1296
          • C:\Program Files (x86)\Windows Sidebar\StartMenuExperienceHost.exe
            "C:\Program Files (x86)\Windows Sidebar\StartMenuExperienceHost.exe"
            1⤵
            • Enumerates VirtualBox registry keys
            • Identifies VirtualBox via ACPI registry values (likely anti-VM)
            • Looks for VirtualBox Guest Additions in registry
            • Looks for VMWare Tools registry key
            • Looks for VMWare services registry key.
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:5828
          • C:\Users\Admin\AppData\Local\D3DSCache\lsass.exe
            "C:\Users\Admin\AppData\Local\D3DSCache\lsass.exe"
            1⤵
            • Enumerates VirtualBox registry keys
            • Identifies VirtualBox via ACPI registry values (likely anti-VM)
            • Looks for VirtualBox Guest Additions in registry
            • Looks for VMWare Tools registry key
            • Looks for VMWare services registry key.
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:1520
            • C:\Users\Admin\AppData\Local\Temp\GpuService_9e1e7c.exe
              "C:\Users\Admin\AppData\Local\Temp\GpuService_9e1e7c.exe"
              2⤵
              • Executes dropped EXE
              PID:4220
          • C:\Users\Admin\AppData\Local\Packages\smartscreen.exe
            "C:\Users\Admin\AppData\Local\Packages\smartscreen.exe"
            1⤵
            • Enumerates VirtualBox registry keys
            • Identifies VirtualBox via ACPI registry values (likely anti-VM)
            • Looks for VirtualBox Guest Additions in registry
            • Looks for VMWare Tools registry key
            • Looks for VMWare services registry key.
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:5040
            • C:\Users\Admin\AppData\Local\Temp\GpuService_9e1e7c.exe
              "C:\Users\Admin\AppData\Local\Temp\GpuService_9e1e7c.exe"
              2⤵
              • Executes dropped EXE
              PID:3280
          • C:\Windows\System32\SecurityHealthHost.exe
            \\?\C:\Windows\System32\SecurityHealthHost.exe {08728914-3F57-4D52-9E31-49DAECA5A80A} -Embedding
            1⤵
              PID:4808
            • C:\Program Files (x86)\Mozilla Maintenance Service\WmiPrvSE.exe
              "C:\Program Files (x86)\Mozilla Maintenance Service\WmiPrvSE.exe"
              1⤵
              • Enumerates VirtualBox registry keys
              • Identifies VirtualBox via ACPI registry values (likely anti-VM)
              • Looks for VirtualBox Guest Additions in registry
              • Looks for VMWare Tools registry key
              • Looks for VMWare services registry key.
              • Executes dropped EXE
              • System Location Discovery: System Language Discovery
              • Suspicious use of WriteProcessMemory
              PID:4484
              • C:\Users\Admin\AppData\Local\Temp\GpuService_9e1e7c.exe
                "C:\Users\Admin\AppData\Local\Temp\GpuService_9e1e7c.exe"
                2⤵
                • Executes dropped EXE
                • System Location Discovery: System Language Discovery
                PID:4712
            • C:\Program Files (x86)\Microsoft\spoolsv.exe
              "C:\Program Files (x86)\Microsoft\spoolsv.exe"
              1⤵
              • Enumerates VirtualBox registry keys
              • Identifies VirtualBox via ACPI registry values (likely anti-VM)
              • Looks for VirtualBox Guest Additions in registry
              • Looks for VMWare Tools registry key
              • Looks for VMWare services registry key.
              • Executes dropped EXE
              • System Location Discovery: System Language Discovery
              PID:3260
            • C:\Program Files (x86)\Reference Assemblies\sppsvc.exe
              "C:\Program Files (x86)\Reference Assemblies\sppsvc.exe"
              1⤵
              • Enumerates VirtualBox registry keys
              • Identifies VirtualBox via ACPI registry values (likely anti-VM)
              • Looks for VirtualBox Guest Additions in registry
              • Looks for VMWare Tools registry key
              • Looks for VMWare services registry key.
              • Executes dropped EXE
              • Suspicious use of WriteProcessMemory
              PID:3444
              • C:\Users\Admin\AppData\Local\Temp\GpuService_9e1e7c.exe
                "C:\Users\Admin\AppData\Local\Temp\GpuService_9e1e7c.exe"
                2⤵
                • Executes dropped EXE
                • System Location Discovery: System Language Discovery
                PID:2624
            • C:\Program Files (x86)\Adobe\dllhost.exe
              "C:\Program Files (x86)\Adobe\dllhost.exe"
              1⤵
              • Enumerates VirtualBox registry keys
              • Identifies VirtualBox via ACPI registry values (likely anti-VM)
              • Looks for VirtualBox Guest Additions in registry
              • Looks for VMWare Tools registry key
              • Looks for VMWare services registry key.
              • Executes dropped EXE
              • System Location Discovery: System Language Discovery
              PID:1668
            • C:\Program Files (x86)\Windows Defender\winlogon.exe
              "C:\Program Files (x86)\Windows Defender\winlogon.exe"
              1⤵
              • Enumerates VirtualBox registry keys
              • Identifies VirtualBox via ACPI registry values (likely anti-VM)
              • Looks for VirtualBox Guest Additions in registry
              • Looks for VMWare Tools registry key
              • Looks for VMWare services registry key.
              • Executes dropped EXE
              • System Location Discovery: System Language Discovery
              PID:3792
            • C:\Program Files (x86)\Windows Sidebar\StartMenuExperienceHost.exe
              "C:\Program Files (x86)\Windows Sidebar\StartMenuExperienceHost.exe"
              1⤵
              • Enumerates VirtualBox registry keys
              • Identifies VirtualBox via ACPI registry values (likely anti-VM)
              • Looks for VirtualBox Guest Additions in registry
              • Looks for VMWare Tools registry key
              • Looks for VMWare services registry key.
              • Executes dropped EXE
              • System Location Discovery: System Language Discovery
              PID:5320
            • C:\Users\Admin\AppData\Local\D3DSCache\lsass.exe
              "C:\Users\Admin\AppData\Local\D3DSCache\lsass.exe"
              1⤵
              • Identifies VirtualBox via ACPI registry values (likely anti-VM)
              • Looks for VirtualBox Guest Additions in registry
              • Looks for VMWare Tools registry key
              • Looks for VMWare services registry key.
              • Executes dropped EXE
              • System Location Discovery: System Language Discovery
              • Suspicious use of WriteProcessMemory
              PID:4652
              • C:\Users\Admin\AppData\Local\Temp\GpuService_9e1e7c.exe
                "C:\Users\Admin\AppData\Local\Temp\GpuService_9e1e7c.exe"
                2⤵
                • Executes dropped EXE
                • System Location Discovery: System Language Discovery
                PID:4852
            • C:\Users\Admin\AppData\Local\Packages\smartscreen.exe
              "C:\Users\Admin\AppData\Local\Packages\smartscreen.exe"
              1⤵
              • Enumerates VirtualBox registry keys
              • Identifies VirtualBox via ACPI registry values (likely anti-VM)
              • Looks for VirtualBox Guest Additions in registry
              • Looks for VMWare Tools registry key
              • Looks for VMWare services registry key.
              • System Location Discovery: System Language Discovery
              • Suspicious use of WriteProcessMemory
              PID:3752
              • C:\Users\Admin\AppData\Local\Temp\GpuService_9e1e7c.exe
                "C:\Users\Admin\AppData\Local\Temp\GpuService_9e1e7c.exe"
                2⤵
                • System Location Discovery: System Language Discovery
                PID:3532

            Network

                  MITRE ATT&CK Enterprise v16

                  Reconnaissance

                  Resource Development

                  Initial Access

                  Execution

                  Persistence

                  Boot or Logon Autostart Execution

                  1
                  T1547

                  Registry Run Keys / Startup Folder

                  1
                  T1547.001

                  Privilege Escalation

                  Abuse Elevation Control Mechanism

                  1
                  T1548

                  Bypass User Account Control

                  1
                  T1548.002

                  Boot or Logon Autostart Execution

                  1
                  T1547

                  Registry Run Keys / Startup Folder

                  1
                  T1547.001

                  Defense Evasion

                  Abuse Elevation Control Mechanism

                  1
                  T1548

                  Bypass User Account Control

                  1
                  T1548.002

                  Impair Defenses

                  1
                  T1562

                  Disable or Modify Tools

                  1
                  T1562.001

                  Modify Registry

                  2
                  T1112

                  Virtualization/Sandbox Evasion

                  5
                  T1497

                  Credential Access

                  Credentials from Password Stores

                  1
                  T1555

                  Credentials from Web Browsers

                  1
                  T1555.003

                  Unsecured Credentials

                  3
                  T1552

                  Credentials In Files

                  3
                  T1552.001

                  Discovery

                  Query Registry

                  4
                  T1012

                  System Information Discovery

                  1
                  T1082

                  System Location Discovery

                  1
                  T1614

                  System Language Discovery

                  1
                  T1614.001

                  Virtualization/Sandbox Evasion

                  5
                  T1497

                  Lateral Movement

                  Collection

                  Data from Local System

                  2
                  T1005

                  Command and Control

                  Exfiltration

                  Impact

                  Replay Monitor

                  Loading Replay Monitor...

                  Downloads

                  winlogon.exe
                  • Path C:\Program Files (x86)\Windows Defender\winlogon.exe
                  • Size 43.1MB
                  • SHA256 b03e9657b6d14754a89b519aa07388ac95e61258c217edad4adf68a5ba2488e1
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  svc_470bf943.log
                  • Path C:\ProgramData\svc_470bf943.log
                  • Size 2KB
                  • SHA256 f3d5373a67f74aec3e893a0be51c45d41f2f5e4338c5475fc56e88f52eb6199a
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  svc_470bf943.log
                  • Path C:\ProgramData\svc_470bf943.log
                  • Size 2KB
                  • SHA256 4edaa4f3403b90b9845339b53e6bda3dd2a4a17a353396e0806615d6b180b726
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  svc_470bf943.log
                  • Path C:\ProgramData\svc_470bf943.log
                  • Size 3KB
                  • SHA256 5f0e17088f2db20525d068569b641b5615c1675cbc19bb5f53ff42f2e31b00d2
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  svc_470bf943.log
                  • Path C:\ProgramData\svc_470bf943.log
                  • Size 3KB
                  • SHA256 ed4e019348b9ef6cde79da61b6a2a5baf75b8bbf06ce8d1c483cc568b545bb16
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  svc_470bf943.log
                  • Path C:\ProgramData\svc_470bf943.log
                  • Size 3KB
                  • SHA256 6781c6dd68ee70802022aeb6130c055d7da0c26773606b23c49b76dfb104d59c
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  svc_470bf943.log
                  • Path C:\ProgramData\svc_470bf943.log
                  • Size 4KB
                  • SHA256 5e0b8f226b97660ffff2462df65a3144abaf0e460edf6cea1992a0095dc0c3c8
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  svc_470bf943.log
                  • Path C:\ProgramData\svc_470bf943.log
                  • Size 5KB
                  • SHA256 c8a888741d84337368a518c03a2db7d693bd5d9d5400418b6f68cceff71ed6a0
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  svc_470bf943.log
                  • Path C:\ProgramData\svc_470bf943.log
                  • Size 5KB
                  • SHA256 a260efcb51b2f09882d26ea2ca71f9764a781c3a7bc80c058ad6071359e32ee5
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  svc_470bf943.log
                  • Path C:\ProgramData\svc_470bf943.log
                  • Size 6KB
                  • SHA256 b3332159ccf609971ddbcdfd64d948a1c3cc9463558a3f67ecadf4083a4cc303
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  svc_470bf943.log
                  • Path C:\ProgramData\svc_470bf943.log
                  • Size 7KB
                  • SHA256 ffa85343a79506ccd47a2fea90e214e1844fc50fdc4aba308b7e84a0d021042d
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  svc_470bf943.log
                  • Path C:\ProgramData\svc_470bf943.log
                  • Size 7KB
                  • SHA256 7cf6e1a29b8959c40566dfd43e1d4d57f096d002888919c8a5ea571ecf94bc68
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  svc_470bf943.log
                  • Path C:\ProgramData\svc_470bf943.log
                  • Size 9KB
                  • SHA256 b77675a9c8a93ce1a430c5fa1d566f0758195af92d35366fe1be58f6fa588f0d
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  svc_470bf943.log
                  • Path C:\ProgramData\svc_470bf943.log
                  • Size 9KB
                  • SHA256 da0e7eb2d425e495d49bc9d4f951cdb33fb7a0dbb687878ca4443ecb20e3f959
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  svc_470bf943.log
                  • Path C:\ProgramData\svc_470bf943.log
                  • Size 9KB
                  • SHA256 3c9d158a37bb819306894107fb06ccd28755c4a34eaf3d65927af3e8e3c01541
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  svc_470bf943.log
                  • Path C:\ProgramData\svc_470bf943.log
                  • Size 10KB
                  • SHA256 bfc9ae3818054c5c1aeb2b8acf00413a83fea8edcd892fc7205c358eaf781087
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  svc_470bf943.log
                  • Path C:\ProgramData\svc_470bf943.log
                  • Size 1KB
                  • SHA256 189581da7e172f1714038b57558eb7df1355ee58a21cd8249be10f9f13db7b47
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  ModuleAnalysisCache
                  • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache
                  • Size 63KB
                  • SHA256 45d791a99f9c74c74ebe382ad752ccc539c8e8b05bffc443e8ac6dbc0a4e3075
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  StartupProfileData-Interactive
                  • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
                  • Size 23KB
                  • SHA256 58b899605203af868815f81a6f75c85f4555eee79713b29cbab4d5c34da1ec82
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  311730734
                  • Path C:\Users\Admin\AppData\Local\Temp\311730734
                  • Size 138KB
                  • SHA256 a0a5c8d75dfc450030aedc84b34d5f33f1faa7e8560e78cf667698bab5b4094e
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  GpuService_9e1e7c.exe
                  • Path C:\Users\Admin\AppData\Local\Temp\GpuService_9e1e7c.exe
                  • Size 3.4MB
                  • SHA256 145e75c7e55b58a5167488fa514544a66a7f864474fa8f8b016de0aa29457ca3
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  __PSScriptPolicyTest_uuxsxwoi.u3i.ps1
                  • Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_uuxsxwoi.u3i.ps1
                  • Size 60B
                  • SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  memory/1112-259-0x0000000003AD0000-0x000000000472F000-memory.dmp
                  Download

                  memory/1112-290-0x0000000003AD0000-0x000000000472F000-memory.dmp
                  Download

                  memory/1112-300-0x0000000003AD0000-0x000000000472F000-memory.dmp
                  Download

                  memory/1112-303-0x0000000000560000-0x0000000000D82000-memory.dmp
                  Download

                  memory/1112-292-0x0000000003AD0000-0x000000000472F000-memory.dmp
                  Download

                  memory/1112-291-0x0000000003AD0000-0x000000000472F000-memory.dmp
                  Download

                  memory/1112-294-0x0000000003AD0000-0x000000000472F000-memory.dmp
                  Download

                  memory/1112-293-0x0000000003AD0000-0x000000000472F000-memory.dmp
                  Download

                  memory/1140-201-0x0000000003C00000-0x000000000485F000-memory.dmp
                  Download

                  memory/1140-225-0x0000000003C00000-0x000000000485F000-memory.dmp
                  Download

                  memory/1140-223-0x0000000003C00000-0x000000000485F000-memory.dmp
                  Download

                  memory/1140-226-0x0000000003C00000-0x000000000485F000-memory.dmp
                  Download

                  memory/1140-224-0x0000000003C00000-0x000000000485F000-memory.dmp
                  Download

                  memory/1140-227-0x0000000003C00000-0x000000000485F000-memory.dmp
                  Download

                  memory/1140-228-0x0000000003C00000-0x000000000485F000-memory.dmp
                  Download

                  memory/1140-231-0x00000000006C0000-0x0000000000EE2000-memory.dmp
                  Download

                  memory/1464-482-0x0000000006E30000-0x0000000006E78000-memory.dmp
                  Download

                  memory/1464-505-0x0000000007C90000-0x0000000007CC6000-memory.dmp
                  Download

                  memory/1464-475-0x0000000006540000-0x000000000689B000-memory.dmp
                  Download

                  memory/1464-477-0x00000000068A0000-0x00000000068BE000-memory.dmp
                  Download

                  memory/1464-478-0x00000000068C0000-0x000000000690C000-memory.dmp
                  Download

                  memory/1464-472-0x0000000006310000-0x0000000006376000-memory.dmp
                  Download

                  memory/1464-470-0x00000000062A0000-0x0000000006306000-memory.dmp
                  Download

                  memory/1464-469-0x00000000061D0000-0x00000000061F2000-memory.dmp
                  Download

                  memory/1464-506-0x0000000070D70000-0x0000000070DBC000-memory.dmp
                  Download

                  memory/1464-468-0x0000000005B80000-0x00000000061CA000-memory.dmp
                  Download

                  memory/1464-467-0x0000000003020000-0x0000000003056000-memory.dmp
                  Download

                  memory/1464-517-0x00000000090C0000-0x000000000967A000-memory.dmp
                  Download

                  memory/1464-507-0x0000000070FF0000-0x000000007134B000-memory.dmp
                  Download

                  memory/1464-516-0x0000000008350000-0x0000000008372000-memory.dmp
                  Download

                  memory/1464-510-0x0000000007CD0000-0x0000000007CF0000-memory.dmp
                  Download

                  memory/1464-511-0x0000000007CF0000-0x0000000007D93000-memory.dmp
                  Download

                  memory/1464-513-0x0000000007E40000-0x0000000007E5A000-memory.dmp
                  Download

                  memory/1464-512-0x0000000008480000-0x0000000008AFC000-memory.dmp
                  Download

                  memory/1464-515-0x0000000007F50000-0x0000000007FE6000-memory.dmp
                  Download

                  memory/1464-514-0x0000000007EA0000-0x0000000007EAA000-memory.dmp
                  Download

                  memory/2184-59-0x0000000000AC0000-0x0000000001716000-memory.dmp
                  Download

                  memory/2184-370-0x0000000000AC0000-0x0000000001716000-memory.dmp
                  Download

                  memory/2184-232-0x0000000000AC0000-0x0000000001716000-memory.dmp
                  Download

                  memory/2352-335-0x0000000003960000-0x00000000045BF000-memory.dmp
                  Download

                  memory/2352-340-0x0000000000BE0000-0x0000000001402000-memory.dmp
                  Download

                  memory/2352-334-0x0000000003960000-0x00000000045BF000-memory.dmp
                  Download

                  memory/2352-332-0x0000000003960000-0x00000000045BF000-memory.dmp
                  Download

                  memory/2352-337-0x0000000003960000-0x00000000045BF000-memory.dmp
                  Download

                  memory/2352-326-0x0000000003960000-0x00000000045BF000-memory.dmp
                  Download

                  memory/2352-333-0x0000000003960000-0x00000000045BF000-memory.dmp
                  Download

                  memory/2352-336-0x0000000003960000-0x00000000045BF000-memory.dmp
                  Download

                  memory/3252-289-0x00000000006E0000-0x0000000001336000-memory.dmp
                  Download

                  memory/3252-236-0x00000000006E0000-0x0000000001336000-memory.dmp
                  Download

                  memory/3380-40-0x00000000039D0000-0x000000000462F000-memory.dmp
                  Download

                  memory/3380-61-0x00000000039D0000-0x000000000462F000-memory.dmp
                  Download

                  memory/3380-362-0x0000000000A40000-0x0000000001262000-memory.dmp
                  Download

                  memory/3380-43-0x00000000039D0000-0x000000000462F000-memory.dmp
                  Download

                  memory/3380-31-0x00000000039D0000-0x000000000462F000-memory.dmp
                  Download

                  memory/3380-39-0x00000000039D0000-0x000000000462F000-memory.dmp
                  Download

                  memory/3380-42-0x00000000039D0000-0x000000000462F000-memory.dmp
                  Download

                  memory/3380-344-0x00000000039D0000-0x000000000462F000-memory.dmp
                  Download

                  memory/3380-44-0x00000000039D0000-0x000000000462F000-memory.dmp
                  Download

                  memory/3380-38-0x00000000039D0000-0x000000000462F000-memory.dmp
                  Download

                  memory/3380-48-0x00000000039D0000-0x000000000462F000-memory.dmp
                  Download

                  memory/3380-47-0x00000000039D0000-0x000000000462F000-memory.dmp
                  Download

                  memory/3380-45-0x0000000000A40000-0x0000000001262000-memory.dmp
                  Download

                  memory/3512-175-0x00000000040F0000-0x0000000004D4F000-memory.dmp
                  Download

                  memory/3512-176-0x00000000040F0000-0x0000000004D4F000-memory.dmp
                  Download

                  memory/3512-179-0x00000000040F0000-0x0000000004D4F000-memory.dmp
                  Download

                  memory/3512-178-0x00000000040F0000-0x0000000004D4F000-memory.dmp
                  Download

                  memory/3512-161-0x00000000040F0000-0x0000000004D4F000-memory.dmp
                  Download

                  memory/3512-188-0x00000000040F0000-0x0000000004D4F000-memory.dmp
                  Download

                  memory/3512-191-0x0000000000F10000-0x0000000001732000-memory.dmp
                  Download

                  memory/3512-177-0x00000000040F0000-0x0000000004D4F000-memory.dmp
                  Download

                  memory/4268-308-0x00000000006E0000-0x0000000001336000-memory.dmp
                  Download

                  memory/4268-288-0x00000000006E0000-0x0000000001336000-memory.dmp
                  Download

                  memory/4272-295-0x0000000008760000-0x00000000093BF000-memory.dmp
                  Download

                  memory/4272-280-0x0000000008760000-0x00000000093BF000-memory.dmp
                  Download

                  memory/4272-298-0x0000000008760000-0x00000000093BF000-memory.dmp
                  Download

                  memory/4272-310-0x00000000002A0000-0x0000000000AC2000-memory.dmp
                  Download

                  memory/4272-299-0x0000000008760000-0x00000000093BF000-memory.dmp
                  Download

                  memory/4272-305-0x0000000008760000-0x00000000093BF000-memory.dmp
                  Download

                  memory/4272-297-0x0000000008760000-0x00000000093BF000-memory.dmp
                  Download

                  memory/4272-296-0x0000000008760000-0x00000000093BF000-memory.dmp
                  Download

                  memory/4816-190-0x0000000000A50000-0x0000000001272000-memory.dmp
                  Download

                  memory/4816-173-0x0000000004060000-0x0000000004CBF000-memory.dmp
                  Download

                  memory/4816-181-0x0000000004060000-0x0000000004CBF000-memory.dmp
                  Download

                  memory/4816-132-0x0000000004060000-0x0000000004CBF000-memory.dmp
                  Download

                  memory/4816-172-0x0000000004060000-0x0000000004CBF000-memory.dmp
                  Download

                  memory/4816-170-0x0000000004060000-0x0000000004CBF000-memory.dmp
                  Download

                  memory/4816-169-0x0000000004060000-0x0000000004CBF000-memory.dmp
                  Download

                  memory/4816-171-0x0000000004060000-0x0000000004CBF000-memory.dmp
                  Download

                  memory/5132-555-0x0000000070FF0000-0x000000007134B000-memory.dmp
                  Download

                  memory/5132-554-0x0000000070D70000-0x0000000070DBC000-memory.dmp
                  Download

                  memory/5284-369-0x00000000001B0000-0x0000000000E06000-memory.dmp
                  Download

                  memory/5284-367-0x00000000001B0000-0x0000000000E06000-memory.dmp
                  Download

                  memory/5308-46-0x0000000000670000-0x00000000012C6000-memory.dmp
                  Download

                  memory/5308-50-0x0000000000670000-0x00000000012C6000-memory.dmp
                  Download

                  memory/5308-60-0x0000000000670000-0x00000000012C6000-memory.dmp
                  Download

                  memory/5308-18-0x0000000000670000-0x00000000012C6000-memory.dmp
                  Download

                  memory/5700-423-0x0000000000190000-0x0000000000DE6000-memory.dmp
                  Download

                  memory/5700-427-0x0000000000190000-0x0000000000DE6000-memory.dmp
                  Download

                  memory/5776-371-0x0000000000680000-0x0000000000EA2000-memory.dmp
                  Download

                  memory/5776-385-0x00000000047E0000-0x000000000543F000-memory.dmp
                  Download

                  memory/6136-174-0x0000000000BD0000-0x0000000001826000-memory.dmp
                  Download

                  memory/6136-139-0x0000000000BD0000-0x0000000001826000-memory.dmp
                  Download