webrat | d5f59b35f4b02bbbd274627334674d0eb8b7f08ced64a6512c6a6979d4fb24e3

Analysis

max time kernel
899s
max time network
902s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
12/09/2026, 12:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
juscned.exe
Size 5.6MB
Sample260912-pg778abe52
SHA256 d5f59b35f4b02bbbd274627334674d0eb8b7f08ced64a6512c6a6979d4fb24e3
MD5 6aa7f319cab6a664a578b7f48203c4f2
SHA1 f7d67ecdc5c129b4a9265c860e73b7500ee0045a
SHA512 005ffd5144965c1549eb94c1d536ab85f96e7b1c1103441f5d65e3fd0e14a60bbd037b5b8e4e84d9e1dbca1216f1fe0ce41b94376aa18cf1f20d36cf3a184cde
SSDEEP 98304:J0CJEAHoCZokX6U83NdnHC40zQ2sdV4PKRkrMsuL/KIkP4BEgcSvQup1VQFqCiq:JTEa9XIdR0zQfVsfZg93yuPVQgKA
TLSH
T161563369A0B42E63EC55FA7BA307CCE416C553DA8CB57F9750C0C6D1893B7F42E8881A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

collection credential_access defense_evasion discovery execution webrat persistence rat spyware stealer trojan upx

Malware Config

Signatures

Family: WebRAT
WebRAT is a Windows RAT written in Golang.
rat webrat

Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
4376	powershell.exe
4052	powershell.exe
4204	powershell.exe
4500	powershell.exe

Executes dropped EXE 3 IoCs

pid	Process
2636	juscned.exe
4924	juscned.exe
4728	juscned.exe

Reads WinSCP keys stored on the system 2 TTPs
Tries to access WinSCP stored sessions.
spyware stealer

Data from Local System
T1005

Credentials in Registry
T1552.002
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads local data of messenger clients 2 TTPs
Infostealers often target stored data of messaging applications, which can include saved credentials and account information.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
credential_access stealer

Credentials In Files
T1552.001

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	juscned.exe
Key opened	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	juscned.exe
Key opened	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	juscned.exe

Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Checks whether UAC is enabled 1 TTPs 3 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	juscned.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	juscned.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	juscned.exe

Discovers running processes 1 TTPs 64 IoCs

Running process information can be used to identify security tools or plan follow-on actions.

discovery

Process Discovery

T1057

pid	Process
1372	tasklist.exe
2464	tasklist.exe
708	tasklist.exe
3104	tasklist.exe
3288	tasklist.exe
4144	tasklist.exe
2236	tasklist.exe
1472	tasklist.exe
1056	tasklist.exe
3372	tasklist.exe
4608	tasklist.exe
4972	tasklist.exe
2544	tasklist.exe
5032	tasklist.exe
3228	tasklist.exe
2620	tasklist.exe
1552	tasklist.exe
2644	tasklist.exe
4068	tasklist.exe
1124	tasklist.exe
3728	tasklist.exe
1696	tasklist.exe
3080	tasklist.exe
3220	tasklist.exe
3400	tasklist.exe
3832	tasklist.exe
1788	tasklist.exe
4380	tasklist.exe
2096	tasklist.exe
3688	tasklist.exe
208	tasklist.exe
2728	tasklist.exe
4496	tasklist.exe
3256	tasklist.exe
4764	tasklist.exe
2568	tasklist.exe
212	tasklist.exe
3788	tasklist.exe
824	tasklist.exe
4156	tasklist.exe
4812	tasklist.exe
2464	tasklist.exe
4576	tasklist.exe
4568	tasklist.exe
60	tasklist.exe
4912	tasklist.exe
3656	tasklist.exe
1264	tasklist.exe
1140	tasklist.exe
2984	tasklist.exe
1696	tasklist.exe
2460	tasklist.exe
4060	tasklist.exe
3888	tasklist.exe
4968	tasklist.exe
4268	tasklist.exe
4308	tasklist.exe
404	tasklist.exe
4640	tasklist.exe
4916	tasklist.exe
3536	tasklist.exe
2708	tasklist.exe
3484	tasklist.exe
4408	tasklist.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/3432-0-0x00000000008F0000-0x00000000016F3000-memory.dmp	upx
behavioral1/memory/3432-2-0x00000000008F0000-0x00000000016F3000-memory.dmp	upx
behavioral1/memory/3432-1-0x00000000008F0000-0x00000000016F3000-memory.dmp	upx
behavioral1/files/0x00070000000243c3-8.dat	upx
behavioral1/memory/3432-11-0x00000000008F0000-0x00000000016F3000-memory.dmp	upx
behavioral1/memory/2636-10-0x0000000000400000-0x0000000001203000-memory.dmp	upx
behavioral1/memory/4924-13-0x0000000000400000-0x0000000001203000-memory.dmp	upx
behavioral1/memory/4924-15-0x0000000000400000-0x0000000001203000-memory.dmp	upx
behavioral1/memory/2636-16-0x0000000000400000-0x0000000001203000-memory.dmp	upx
behavioral1/memory/2636-17-0x0000000000400000-0x0000000001203000-memory.dmp	upx
behavioral1/memory/4728-22-0x0000000000400000-0x0000000001203000-memory.dmp	upx
behavioral1/memory/4924-63-0x0000000000400000-0x0000000001203000-memory.dmp	upx
behavioral1/memory/2636-64-0x0000000000400000-0x0000000001203000-memory.dmp	upx
behavioral1/memory/4728-68-0x0000000000400000-0x0000000001203000-memory.dmp	upx
behavioral1/memory/2636-70-0x0000000000400000-0x0000000001203000-memory.dmp	upx
behavioral1/memory/4924-69-0x0000000000400000-0x0000000001203000-memory.dmp	upx
behavioral1/memory/4924-101-0x0000000000400000-0x0000000001203000-memory.dmp	upx
behavioral1/memory/4728-110-0x0000000000400000-0x0000000001203000-memory.dmp	upx
behavioral1/memory/2636-111-0x0000000000400000-0x0000000001203000-memory.dmp	upx
behavioral1/memory/4728-112-0x0000000000400000-0x0000000001203000-memory.dmp	upx
behavioral1/memory/2636-113-0x0000000000400000-0x0000000001203000-memory.dmp	upx
behavioral1/memory/4728-114-0x0000000000400000-0x0000000001203000-memory.dmp	upx
behavioral1/memory/2636-115-0x0000000000400000-0x0000000001203000-memory.dmp	upx
behavioral1/memory/4728-116-0x0000000000400000-0x0000000001203000-memory.dmp	upx
behavioral1/memory/2636-117-0x0000000000400000-0x0000000001203000-memory.dmp	upx
behavioral1/memory/4728-119-0x0000000000400000-0x0000000001203000-memory.dmp	upx
behavioral1/memory/2636-120-0x0000000000400000-0x0000000001203000-memory.dmp	upx
behavioral1/memory/4728-121-0x0000000000400000-0x0000000001203000-memory.dmp	upx
behavioral1/memory/2636-122-0x0000000000400000-0x0000000001203000-memory.dmp	upx
behavioral1/memory/4728-123-0x0000000000400000-0x0000000001203000-memory.dmp	upx
behavioral1/memory/2636-124-0x0000000000400000-0x0000000001203000-memory.dmp	upx
behavioral1/memory/4728-125-0x0000000000400000-0x0000000001203000-memory.dmp	upx
behavioral1/memory/2636-126-0x0000000000400000-0x0000000001203000-memory.dmp	upx
behavioral1/memory/4728-127-0x0000000000400000-0x0000000001203000-memory.dmp	upx
behavioral1/memory/2636-128-0x0000000000400000-0x0000000001203000-memory.dmp	upx
behavioral1/memory/4728-129-0x0000000000400000-0x0000000001203000-memory.dmp	upx
behavioral1/memory/2636-130-0x0000000000400000-0x0000000001203000-memory.dmp	upx
behavioral1/memory/4728-131-0x0000000000400000-0x0000000001203000-memory.dmp	upx
behavioral1/memory/2636-132-0x0000000000400000-0x0000000001203000-memory.dmp	upx
behavioral1/memory/4728-133-0x0000000000400000-0x0000000001203000-memory.dmp	upx
behavioral1/memory/2636-134-0x0000000000400000-0x0000000001203000-memory.dmp	upx
behavioral1/memory/4728-135-0x0000000000400000-0x0000000001203000-memory.dmp	upx
behavioral1/memory/2636-136-0x0000000000400000-0x0000000001203000-memory.dmp	upx
behavioral1/memory/4728-137-0x0000000000400000-0x0000000001203000-memory.dmp	upx
behavioral1/memory/2636-138-0x0000000000400000-0x0000000001203000-memory.dmp	upx
behavioral1/memory/4728-139-0x0000000000400000-0x0000000001203000-memory.dmp	upx
behavioral1/memory/2636-140-0x0000000000400000-0x0000000001203000-memory.dmp	upx
behavioral1/memory/4728-141-0x0000000000400000-0x0000000001203000-memory.dmp	upx
behavioral1/memory/2636-142-0x0000000000400000-0x0000000001203000-memory.dmp	upx
behavioral1/memory/4728-143-0x0000000000400000-0x0000000001203000-memory.dmp	upx
behavioral1/memory/2636-144-0x0000000000400000-0x0000000001203000-memory.dmp	upx
behavioral1/memory/4728-145-0x0000000000400000-0x0000000001203000-memory.dmp	upx
behavioral1/memory/2636-146-0x0000000000400000-0x0000000001203000-memory.dmp	upx
behavioral1/memory/4728-147-0x0000000000400000-0x0000000001203000-memory.dmp	upx
behavioral1/memory/2636-148-0x0000000000400000-0x0000000001203000-memory.dmp	upx
behavioral1/memory/4728-149-0x0000000000400000-0x0000000001203000-memory.dmp	upx
behavioral1/memory/2636-150-0x0000000000400000-0x0000000001203000-memory.dmp	upx
behavioral1/memory/4728-151-0x0000000000400000-0x0000000001203000-memory.dmp	upx
behavioral1/memory/2636-152-0x0000000000400000-0x0000000001203000-memory.dmp	upx
behavioral1/memory/4728-153-0x0000000000400000-0x0000000001203000-memory.dmp	upx
behavioral1/memory/2636-154-0x0000000000400000-0x0000000001203000-memory.dmp	upx
behavioral1/memory/4728-155-0x0000000000400000-0x0000000001203000-memory.dmp	upx
behavioral1/memory/2636-156-0x0000000000400000-0x0000000001203000-memory.dmp	upx
behavioral1/memory/4728-157-0x0000000000400000-0x0000000001203000-memory.dmp	upx

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
1988	schtasks.exe
3900	schtasks.exe

Suspicious behavior: EnumeratesProcesses 20 IoCs

pid	Process
4376	powershell.exe
4376	powershell.exe
4052	powershell.exe
4052	powershell.exe
4204	powershell.exe
4204	powershell.exe
4500	powershell.exe
4500	powershell.exe
2636	juscned.exe
2636	juscned.exe
2636	juscned.exe
2636	juscned.exe
2636	juscned.exe
2636	juscned.exe
2636	juscned.exe
2636	juscned.exe
2636	juscned.exe
2636	juscned.exe
2636	juscned.exe
2636	juscned.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	1668	tasklist.exe
Token: SeDebugPrivilege	1372	tasklist.exe
Token: SeDebugPrivilege	764	tasklist.exe
Token: SeDebugPrivilege	2292	tasklist.exe
Token: SeDebugPrivilege	2644	tasklist.exe
Token: SeDebugPrivilege	4724	tasklist.exe
Token: SeDebugPrivilege	4608	tasklist.exe
Token: SeDebugPrivilege	4568	tasklist.exe
Token: SeDebugPrivilege	4092	tasklist.exe
Token: SeDebugPrivilege	4672	tasklist.exe
Token: SeDebugPrivilege	4380	tasklist.exe
Token: SeDebugPrivilege	3080	tasklist.exe
Token: SeDebugPrivilege	3892	tasklist.exe
Token: SeDebugPrivilege	1584	tasklist.exe
Token: SeDebugPrivilege	4968	tasklist.exe
Token: SeDebugPrivilege	2888	tasklist.exe
Token: SeDebugPrivilege	5084	tasklist.exe
Token: SeDebugPrivilege	3256	tasklist.exe
Token: SeDebugPrivilege	1152	tasklist.exe
Token: SeDebugPrivilege	5024	tasklist.exe
Token: SeDebugPrivilege	1696	tasklist.exe
Token: SeDebugPrivilege	2236	tasklist.exe
Token: SeDebugPrivilege	2636	tasklist.exe
Token: SeDebugPrivilege	5044	tasklist.exe
Token: SeDebugPrivilege	4916	tasklist.exe
Token: SeDebugPrivilege	4972	tasklist.exe
Token: SeDebugPrivilege	60	tasklist.exe
Token: SeDebugPrivilege	2464	tasklist.exe
Token: SeDebugPrivilege	3840	tasklist.exe
Token: SeDebugPrivilege	4912	tasklist.exe
Token: SeDebugPrivilege	3284	tasklist.exe
Token: SeDebugPrivilege	4180	tasklist.exe
Token: SeDebugPrivilege	2644	tasklist.exe
Token: SeDebugPrivilege	3788	tasklist.exe
Token: SeDebugPrivilege	4608	tasklist.exe
Token: SeDebugPrivilege	4268	tasklist.exe
Token: SeDebugPrivilege	3704	tasklist.exe
Token: SeDebugPrivilege	4308	tasklist.exe
Token: SeDebugPrivilege	1636	tasklist.exe
Token: SeDebugPrivilege	4292	tasklist.exe
Token: SeDebugPrivilege	404	tasklist.exe
Token: SeDebugPrivilege	4068	tasklist.exe
Token: SeDebugPrivilege	4496	tasklist.exe
Token: SeDebugPrivilege	1004	tasklist.exe
Token: SeDebugPrivilege	3552	tasklist.exe
Token: SeDebugPrivilege	824	tasklist.exe
Token: SeDebugPrivilege	5020	tasklist.exe
Token: SeDebugPrivilege	3300	tasklist.exe
Token: SeDebugPrivilege	1472	tasklist.exe
Token: SeDebugPrivilege	2460	tasklist.exe
Token: SeDebugPrivilege	2096	tasklist.exe
Token: SeDebugPrivilege	3452	tasklist.exe
Token: SeDebugPrivilege	3220	tasklist.exe
Token: SeDebugPrivilege	4384	tasklist.exe
Token: SeDebugPrivilege	2708	tasklist.exe
Token: SeDebugPrivilege	1924	tasklist.exe
Token: SeDebugPrivilege	5032	tasklist.exe
Token: SeDebugPrivilege	4640	tasklist.exe
Token: SeDebugPrivilege	1056	tasklist.exe
Token: SeDebugPrivilege	1528	tasklist.exe
Token: SeDebugPrivilege	3236	tasklist.exe
Token: SeDebugPrivilege	3688	tasklist.exe
Token: SeDebugPrivilege	5112	tasklist.exe
Token: SeDebugPrivilege	1124	tasklist.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3432 wrote to memory of 1668	3432	juscned.exe	84
PID 3432 wrote to memory of 1372	3432	juscned.exe	87
PID 3432 wrote to memory of 764	3432	juscned.exe	89
PID 3432 wrote to memory of 2292	3432	juscned.exe	91
PID 3432 wrote to memory of 2644	3432	juscned.exe	93
PID 3432 wrote to memory of 4724	3432	juscned.exe	95
PID 3432 wrote to memory of 4608	3432	juscned.exe	97
PID 3432 wrote to memory of 4568	3432	juscned.exe	99
PID 3432 wrote to memory of 4092	3432	juscned.exe	101
PID 3432 wrote to memory of 4672	3432	juscned.exe	103
PID 3432 wrote to memory of 4380	3432	juscned.exe	105
PID 3432 wrote to memory of 3080	3432	juscned.exe	107
PID 3432 wrote to memory of 3892	3432	juscned.exe	109
PID 3432 wrote to memory of 1584	3432	juscned.exe	111
PID 3432 wrote to memory of 4968	3432	juscned.exe	113
PID 3432 wrote to memory of 2888	3432	juscned.exe	115
PID 3432 wrote to memory of 5084	3432	juscned.exe	117
PID 3432 wrote to memory of 3256	3432	juscned.exe	119
PID 3432 wrote to memory of 1152	3432	juscned.exe	121
PID 3432 wrote to memory of 5024	3432	juscned.exe	123
PID 3432 wrote to memory of 1696	3432	juscned.exe	125
PID 3432 wrote to memory of 2236	3432	juscned.exe	127
PID 3432 wrote to memory of 2636	3432	juscned.exe	129
PID 3432 wrote to memory of 5044	3432	juscned.exe	131
PID 3432 wrote to memory of 4916	3432	juscned.exe	133
PID 3432 wrote to memory of 4972	3432	juscned.exe	135
PID 3432 wrote to memory of 60	3432	juscned.exe	137
PID 3432 wrote to memory of 2464	3432	juscned.exe	139
PID 3432 wrote to memory of 3840	3432	juscned.exe	141
PID 3432 wrote to memory of 4912	3432	juscned.exe	143
PID 3432 wrote to memory of 3284	3432	juscned.exe	145
PID 3432 wrote to memory of 4180	3432	juscned.exe	147
PID 3432 wrote to memory of 2644	3432	juscned.exe	149
PID 3432 wrote to memory of 3788	3432	juscned.exe	151
PID 3432 wrote to memory of 4608	3432	juscned.exe	153
PID 3432 wrote to memory of 4268	3432	juscned.exe	155
PID 3432 wrote to memory of 3704	3432	juscned.exe	157
PID 3432 wrote to memory of 4308	3432	juscned.exe	159
PID 3432 wrote to memory of 1636	3432	juscned.exe	161
PID 3432 wrote to memory of 4292	3432	juscned.exe	163
PID 3432 wrote to memory of 404	3432	juscned.exe	165
PID 3432 wrote to memory of 4068	3432	juscned.exe	167
PID 3432 wrote to memory of 4496	3432	juscned.exe	169
PID 3432 wrote to memory of 1004	3432	juscned.exe	171
PID 3432 wrote to memory of 3552	3432	juscned.exe	173
PID 3432 wrote to memory of 824	3432	juscned.exe	175
PID 3432 wrote to memory of 5020	3432	juscned.exe	177
PID 3432 wrote to memory of 3300	3432	juscned.exe	179
PID 3432 wrote to memory of 1472	3432	juscned.exe	181
PID 3432 wrote to memory of 1988	3432	juscned.exe	183
PID 3432 wrote to memory of 2636	3432	juscned.exe	186
PID 2636 wrote to memory of 2460	2636	juscned.exe	187
PID 2636 wrote to memory of 1924	2636	juscned.exe	189
PID 4924 wrote to memory of 2096	4924	juscned.exe	191
PID 4924 wrote to memory of 3452	4924	juscned.exe	193
PID 4924 wrote to memory of 3220	4924	juscned.exe	195
PID 4924 wrote to memory of 4384	4924	juscned.exe	197
PID 4924 wrote to memory of 2708	4924	juscned.exe	199
PID 4924 wrote to memory of 5032	4924	juscned.exe	201
PID 2636 wrote to memory of 4640	2636	juscned.exe	203
PID 4924 wrote to memory of 1056	4924	juscned.exe	205
PID 2636 wrote to memory of 1528	2636	juscned.exe	207
PID 4924 wrote to memory of 3688	4924	juscned.exe	209
PID 2636 wrote to memory of 3236	2636	juscned.exe	211

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

outlook_office_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	juscned.exe

outlook_win_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	juscned.exe

C:\Users\Admin\AppData\Local\Temp\juscned.exe
"C:\Users\Admin\AppData\Local\Temp\juscned.exe"
1⤵
- Checks whether UAC is enabled
- Suspicious use of WriteProcessMemory
PID:3432
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq wireshark.exe" /NH
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:1668
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq dumpcap.exe" /NH
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:1372
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq procmon.exe" /NH
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:764
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq procmon64.exe" /NH
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:2292
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq procexp.exe" /NH
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:2644
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq procexp64.exe" /NH
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:4724
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq processhacker.exe" /NH
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:4608
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq x64dbg.exe" /NH
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:4568
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq x32dbg.exe" /NH
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:4092
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq ollydbg.exe" /NH
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:4672
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq ida.exe" /NH
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:4380
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq ida64.exe" /NH
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:3080
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq idag.exe" /NH
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:3892
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq idag64.exe" /NH
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:1584
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq idaw.exe" /NH
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:4968
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq idaw64.exe" /NH
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:2888
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq fiddler.exe" /NH
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:5084
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq httpdebugger.exe" /NH
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:3256
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq httpdebuggerui.exe" /NH
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:1152
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq dnspy.exe" /NH
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:5024
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq pestudio.exe" /NH
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:1696
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq cheatengine.exe" /NH
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:2236
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq hxd.exe" /NH
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:2636
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq devenv.exe" /NH
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:5044
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq windbg.exe" /NH
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:4916
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq immunitydebugger.exe" /NH
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:4972
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq apimonitor.exe" /NH
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:60
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq autoruns.exe" /NH
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:2464
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq autorunsc.exe" /NH
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:3840
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq filemon.exe" /NH
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:4912
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq regmon.exe" /NH
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:3284
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq resourcehacker.exe" /NH
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:4180
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq vmtoolsd.exe" /NH
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:2644
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq vmwaretray.exe" /NH
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:3788
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq vmwareuser.exe" /NH
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:4608
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq vmusrvc.exe" /NH
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:4268
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq vmsrvc.exe" /NH
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:3704
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq vboxservice.exe" /NH
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:4308
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq vboxtray.exe" /NH
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:1636
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq xenservice.exe" /NH
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:4292
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq qemu-ga.exe" /NH
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:404
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq sandboxie.exe" /NH
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:4068
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq sandboxiedcomlaunch.exe" /NH
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:4496
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq sandboxierpcss.exe" /NH
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:1004
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq joeboxcontrol.exe" /NH
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:3552
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq joeboxserver.exe" /NH
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:824
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq prl_tools.exe" /NH
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:5020
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq prl_cc.exe" /NH
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:3300
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq vmacthlp.exe" /NH
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:1472
- C:\Windows\system32\schtasks.exe
  schtasks /Create /XML C:\Users\Admin\AppData\Local\Temp\juscned_task.xml /TN juscned /F
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:1988
- C:\Users\Admin\AppData\Local\Common Files\Java\Java Update\juscned.exe
  "C:\Users\Admin\AppData\Local\Common Files\Java\Java Update\juscned.exe" --installed
  2⤵
  - Executes dropped EXE
  - Accesses Microsoft Outlook profiles
  - Checks whether UAC is enabled
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  - outlook_office_path
  - outlook_win_path
  PID:2636
- - C:\Windows\system32\tasklist.exe
    tasklist /FI "IMAGENAME eq wireshark.exe" /NH
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:2460
- - C:\Windows\system32\tasklist.exe
    tasklist /FI "IMAGENAME eq dumpcap.exe" /NH
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:1924
- - C:\Windows\system32\tasklist.exe
    tasklist /FI "IMAGENAME eq procmon.exe" /NH
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:4640
- - C:\Windows\system32\tasklist.exe
    tasklist /FI "IMAGENAME eq procmon64.exe" /NH
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:1528
- - C:\Windows\system32\tasklist.exe
    tasklist /FI "IMAGENAME eq procexp.exe" /NH
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:3236
- - C:\Windows\system32\tasklist.exe
    tasklist /FI "IMAGENAME eq procexp64.exe" /NH
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:5112
- - C:\Windows\system32\tasklist.exe
    tasklist /FI "IMAGENAME eq processhacker.exe" /NH
    3⤵
    PID:4580
- - C:\Windows\system32\tasklist.exe
    tasklist /FI "IMAGENAME eq x64dbg.exe" /NH
    3⤵
    - Discovers running processes
    PID:208
- - C:\Windows\system32\tasklist.exe
    tasklist /FI "IMAGENAME eq x32dbg.exe" /NH
    3⤵
    PID:5068
- - C:\Windows\system32\tasklist.exe
    tasklist /FI "IMAGENAME eq ollydbg.exe" /NH
    3⤵
    - Discovers running processes
    PID:3372
- - C:\Windows\system32\tasklist.exe
    tasklist /FI "IMAGENAME eq ida.exe" /NH
    3⤵
    PID:2984
- - C:\Windows\system32\tasklist.exe
    tasklist /FI "IMAGENAME eq ida64.exe" /NH
    3⤵
    - Discovers running processes
    PID:3256
- - C:\Windows\system32\tasklist.exe
    tasklist /FI "IMAGENAME eq idag.exe" /NH
    3⤵
    - Discovers running processes
    PID:3656
- - C:\Windows\system32\tasklist.exe
    tasklist /FI "IMAGENAME eq idag64.exe" /NH
    3⤵
    PID:3320
- - C:\Windows\system32\tasklist.exe
    tasklist /FI "IMAGENAME eq idaw.exe" /NH
    3⤵
    PID:3172
- - C:\Windows\system32\tasklist.exe
    tasklist /FI "IMAGENAME eq idaw64.exe" /NH
    3⤵
    PID:4972
- - C:\Windows\system32\tasklist.exe
    tasklist /FI "IMAGENAME eq fiddler.exe" /NH
    3⤵
    PID:452
- - C:\Windows\system32\tasklist.exe
    tasklist /FI "IMAGENAME eq httpdebugger.exe" /NH
    3⤵
    - Discovers running processes
    PID:1264
- - C:\Windows\system32\tasklist.exe
    tasklist /FI "IMAGENAME eq httpdebuggerui.exe" /NH
    3⤵
    - Discovers running processes
    PID:4408
- - C:\Windows\system32\tasklist.exe
    tasklist /FI "IMAGENAME eq dnspy.exe" /NH
    3⤵
    - Discovers running processes
    PID:4156
- - C:\Windows\system32\tasklist.exe
    tasklist /FI "IMAGENAME eq pestudio.exe" /NH
    3⤵
    - Discovers running processes
    PID:3228
- - C:\Windows\system32\tasklist.exe
    tasklist /FI "IMAGENAME eq cheatengine.exe" /NH
    3⤵
    PID:2844
- - C:\Windows\system32\tasklist.exe
    tasklist /FI "IMAGENAME eq hxd.exe" /NH
    3⤵
    PID:3792
- - C:\Windows\system32\tasklist.exe
    tasklist /FI "IMAGENAME eq devenv.exe" /NH
    3⤵
    - Discovers running processes
    PID:3728
- - C:\Windows\system32\tasklist.exe
    tasklist /FI "IMAGENAME eq windbg.exe" /NH
    3⤵
    - Discovers running processes
    PID:4060
- - C:\Windows\system32\tasklist.exe
    tasklist /FI "IMAGENAME eq immunitydebugger.exe" /NH
    3⤵
    - Discovers running processes
    PID:3400
- - C:\Windows\system32\tasklist.exe
    tasklist /FI "IMAGENAME eq apimonitor.exe" /NH
    3⤵
    PID:4496
- - C:\Windows\system32\tasklist.exe
    tasklist /FI "IMAGENAME eq autoruns.exe" /NH
    3⤵
    PID:4920
- - C:\Windows\system32\tasklist.exe
    tasklist /FI "IMAGENAME eq autorunsc.exe" /NH
    3⤵
    - Discovers running processes
    PID:4812
- - C:\Windows\system32\tasklist.exe
    tasklist /FI "IMAGENAME eq filemon.exe" /NH
    3⤵
    - Discovers running processes
    PID:1696
- - C:\Windows\system32\tasklist.exe
    tasklist /FI "IMAGENAME eq regmon.exe" /NH
    3⤵
    PID:3272
- - C:\Windows\system32\tasklist.exe
    tasklist /FI "IMAGENAME eq resourcehacker.exe" /NH
    3⤵
    - Discovers running processes
    PID:3104
- - C:\Windows\system32\tasklist.exe
    tasklist /FI "IMAGENAME eq vmtoolsd.exe" /NH
    3⤵
    - Discovers running processes
    PID:3288
- - C:\Windows\system32\tasklist.exe
    tasklist /FI "IMAGENAME eq vmwaretray.exe" /NH
    3⤵
    PID:2424
- - C:\Windows\system32\tasklist.exe
    tasklist /FI "IMAGENAME eq vmwareuser.exe" /NH
    3⤵
    - Discovers running processes
    PID:2728
- - C:\Windows\system32\tasklist.exe
    tasklist /FI "IMAGENAME eq vmusrvc.exe" /NH
    3⤵
    - Discovers running processes
    PID:2568
- - C:\Windows\system32\tasklist.exe
    tasklist /FI "IMAGENAME eq vmsrvc.exe" /NH
    3⤵
    PID:1960
- - C:\Windows\system32\tasklist.exe
    tasklist /FI "IMAGENAME eq vboxservice.exe" /NH
    3⤵
    PID:2052
- - C:\Windows\system32\tasklist.exe
    tasklist /FI "IMAGENAME eq vboxtray.exe" /NH
    3⤵
    - Discovers running processes
    PID:1552
- - C:\Windows\system32\tasklist.exe
    tasklist /FI "IMAGENAME eq xenservice.exe" /NH
    3⤵
    PID:1828
- - C:\Windows\system32\tasklist.exe
    tasklist /FI "IMAGENAME eq qemu-ga.exe" /NH
    3⤵
    PID:4960
- - C:\Windows\system32\tasklist.exe
    tasklist /FI "IMAGENAME eq sandboxie.exe" /NH
    3⤵
    PID:2108
- - C:\Windows\system32\tasklist.exe
    tasklist /FI "IMAGENAME eq sandboxiedcomlaunch.exe" /NH
    3⤵
    PID:4068
- - C:\Windows\system32\tasklist.exe
    tasklist /FI "IMAGENAME eq sandboxierpcss.exe" /NH
    3⤵
    - Discovers running processes
    PID:2984
- - C:\Windows\system32\tasklist.exe
    tasklist /FI "IMAGENAME eq joeboxcontrol.exe" /NH
    3⤵
    PID:5024
- - C:\Windows\system32\tasklist.exe
    tasklist /FI "IMAGENAME eq joeboxserver.exe" /NH
    3⤵
    - Discovers running processes
    PID:1696
- - C:\Windows\system32\tasklist.exe
    tasklist /FI "IMAGENAME eq prl_tools.exe" /NH
    3⤵
    PID:1800
- - C:\Windows\system32\tasklist.exe
    tasklist /FI "IMAGENAME eq prl_cc.exe" /NH
    3⤵
    PID:2720
- - C:\Windows\system32\tasklist.exe
    tasklist /FI "IMAGENAME eq vmacthlp.exe" /NH
    3⤵
    - Discovers running processes
    PID:2464
- - C:\Windows\system32\schtasks.exe
    schtasks /Create /XML C:\Users\Admin\AppData\Local\Temp\juscned_task.xml /TN juscned /F
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3900
- - C:\Users\Admin\AppData\Local\Common Files\Java\Java Update\juscned.exe
    "C:\Users\Admin\AppData\Local\Common Files\Java\Java Update\juscned.exe" --watchdog 2636 --wd-target "C:\Users\Admin\AppData\Local\Common Files\Java\Java Update\juscned.exe"
    3⤵
    - Executes dropped EXE
    PID:4728
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -NonInteractive -WindowStyle Hidden -Command "(Get-WmiObject -Query \"select Name from Win32_Processor\").Name"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:4376
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -NonInteractive -WindowStyle Hidden -Command "(Get-WmiObject -Query \"Select Name from Win32_VideoController\").Name"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:4052
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -NonInteractive -WindowStyle Hidden -Command "(Get-WmiObject -Query \"select Caption from Win32_OperatingSystem\").Caption"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:4204
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -NonInteractive -WindowStyle Hidden -Command "(Get-WmiObject -Query \"select TotalPhysicalMemory from Win32_ComputerSystem\").TotalPhysicalMemory"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:4500

C:\Users\Admin\AppData\Local\Common Files\Java\Java Update\juscned.exe
"C:\Users\Admin\AppData\Local\Common Files\Java\Java Update\juscned.exe"
1⤵
- Executes dropped EXE
- Checks whether UAC is enabled
- Suspicious use of WriteProcessMemory
PID:4924
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq wireshark.exe" /NH
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:2096
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq dumpcap.exe" /NH
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:3452
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq procmon.exe" /NH
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:3220
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq procmon64.exe" /NH
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:4384
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq procexp.exe" /NH
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:2708
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq procexp64.exe" /NH
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:5032
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq processhacker.exe" /NH
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:1056
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq x64dbg.exe" /NH
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:3688
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq x32dbg.exe" /NH
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:1124
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq ollydbg.exe" /NH
  2⤵
  - Discovers running processes
  PID:2544
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq ida.exe" /NH
  2⤵
  PID:2856
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq ida64.exe" /NH
  2⤵
  PID:4328
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq idag.exe" /NH
  2⤵
  PID:4572
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq idag64.exe" /NH
  2⤵
  PID:4628
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq idaw.exe" /NH
  2⤵
  PID:1136
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq idaw64.exe" /NH
  2⤵
  - Discovers running processes
  PID:3484
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq fiddler.exe" /NH
  2⤵
  PID:3900
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq httpdebugger.exe" /NH
  2⤵
  - Discovers running processes
  PID:4916
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq httpdebuggerui.exe" /NH
  2⤵
  PID:2924
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq dnspy.exe" /NH
  2⤵
  - Discovers running processes
  PID:4764
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq pestudio.exe" /NH
  2⤵
  PID:4268
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq cheatengine.exe" /NH
  2⤵
  PID:3364
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq hxd.exe" /NH
  2⤵
  - Discovers running processes
  PID:2620
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq devenv.exe" /NH
  2⤵
  - Discovers running processes
  PID:3832
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq windbg.exe" /NH
  2⤵
  - Discovers running processes
  PID:708
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq immunitydebugger.exe" /NH
  2⤵
  PID:2532
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq apimonitor.exe" /NH
  2⤵
  PID:3776
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq autoruns.exe" /NH
  2⤵
  PID:4664
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq autorunsc.exe" /NH
  2⤵
  PID:2180
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq filemon.exe" /NH
  2⤵
  PID:2440
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq regmon.exe" /NH
  2⤵
  PID:456
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq resourcehacker.exe" /NH
  2⤵
  - Discovers running processes
  PID:4144
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq vmtoolsd.exe" /NH
  2⤵
  - Discovers running processes
  PID:212
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq vmwaretray.exe" /NH
  2⤵
  PID:4988
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq vmwareuser.exe" /NH
  2⤵
  - Discovers running processes
  PID:1140
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq vmusrvc.exe" /NH
  2⤵
  - Discovers running processes
  PID:4496
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq vmsrvc.exe" /NH
  2⤵
  PID:2304
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq vboxservice.exe" /NH
  2⤵
  PID:3656
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq vboxtray.exe" /NH
  2⤵
  PID:4148
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq xenservice.exe" /NH
  2⤵
  PID:3796
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq qemu-ga.exe" /NH
  2⤵
  PID:4904
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq sandboxie.exe" /NH
  2⤵
  - Discovers running processes
  PID:3888
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq sandboxiedcomlaunch.exe" /NH
  2⤵
  PID:3488
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq sandboxierpcss.exe" /NH
  2⤵
  PID:2160
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq joeboxcontrol.exe" /NH
  2⤵
  - Discovers running processes
  PID:3536
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq joeboxserver.exe" /NH
  2⤵
  - Discovers running processes
  PID:4576
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq prl_tools.exe" /NH
  2⤵
  - Discovers running processes
  PID:1788
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:4496
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq prl_cc.exe" /NH
  2⤵
  PID:2580
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq vmacthlp.exe" /NH
  2⤵
  PID:2416

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:1572

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:2084

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4592

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4392

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4128

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4752

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4656

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:1608

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Credentials in Registry

T1552.002

Discovery

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Email Collection

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

juscned.exe

Path C:\Users\Admin\AppData\Local\Common Files\Java\Java Update\juscned.exe
Size 5.6MB
SHA256 d5f59b35f4b02bbbd274627334674d0eb8b7f08ced64a6512c6a6979d4fb24e3
MD5 6aa7f319cab6a664a578b7f48203c4f2
SHA1 f7d67ecdc5c129b4a9265c860e73b7500ee0045a
SHA512 005ffd5144965c1549eb94c1d536ab85f96e7b1c1103441f5d65e3fd0e14a60bbd037b5b8e4e84d9e1dbca1216f1fe0ce41b94376aa18cf1f20d36cf3a184cde
SSDEEP 98304:J0CJEAHoCZokX6U83NdnHC40zQ2sdV4PKRkrMsuL/KIkP4BEgcSvQup1VQFqCiq:JTEa9XIdR0zQfVsfZg93yuPVQgKA
TLSH
T161563369A0B42E63EC55FA7BA307CCE416C553DA8CB57F9750C0C6D1893B7F42E8881A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Login Data.tmp_wr
Size 40KB
SHA256 06aeb2f9c1ee642348c091fb27541c143545354c273055ce30832e0f61aedf81
MD5 ba979c77c714b67908bc582ec373c723
SHA1 ff6b59b47b8d3ad488eaa7a4b0040a9a93eb19fe
SHA512 fc6b860dcb9e00c6ab7aa72555fb17921bbb8b1276acf0ab5fcb20b5f2dbd4bf71946c5c4fcfc46310f8de29491a63e46d43805070d19f290070f60077f80b01
SSDEEP 96:wDaCn8MouB6w9fUP8iZqmvJKLPeymwil:wDaG7Iw9f/iSi
TLSH
T16103440F2E682801C8B94632BCF124E62E7DA03E4F13EED12CB504659D75C52B52E5EF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Cookies.tmp_wr

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies.tmp_wr
Size 20KB
SHA256 0fc5a595133877b49c23e21a28f7fd4223866f57f595fa8593a9e6de28066259
MD5 0a3f1250f93a65e20525375f5dc1a4bd
SHA1 76114740020afc6b295df4232809c78fd578e40c
SHA512 a650fe9125215e15a4cf2e9b678f6371bf6a4e26699b0f355d9132656258ab32c840c8d27dcfa81e10b6bb8f7416ccfee3f7261955d1fa5ee44a814891100e97
SSDEEP 24:TLyW91kweka6cLbXYFpFNYba5+6UwcQ8PAl5fBTd5t/WmssVq9Hj:TeW9aw/aHLopFMavU1iBTHZDaD
TLSH
T17592F08F1F303614C0F88736E9D6099B2E7C152C93536A89AE5454B39CD649BF1091B6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Web Data.tmp_wr

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Data.tmp_wr
Size 138KB
SHA256 bee75e82b8ae4f196e3c872fd32c5704a4e9a7275be62bdab79e0f4d97b0a427
MD5 404ee90d779f7ff5c9b442365f6e9a38
SHA1 f1cae5cf692a4c0db2104c3b86d1e2600fa8d89c
SHA512 f4fb5f55df8db6b76ea9c8dd97e8d8ae23ad984329c883ca93d4dda783acf5ee2146ae06a88745bb74d82217c81857ac1a5cd7e4aaabda2ca069e4d8d8d4b432
SSDEEP 384:zeuvBnhJsueMEGvIW1DcP2OQjhtVumDQnby/:FnbZeMrv/hGtQjhCn+/
TLSH
T168D3874B3A743002EDE59A722CE050BB5E3CB17D4F55A5D4387620698EF2963A23D4BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 2KB
SHA256 b1f292b6199aa29c7fafbca007e5f9e3f68edcbbca1965bc828cc92dc0f18bb8
MD5 6cf293cb4d80be23433eecf74ddb5503
SHA1 24fe4752df102c2ef492954d6b046cb5512ad408
SHA512 0f91e2da0da8794b9797c7b50eb5dfd27bde4546ceb6902a776664ce887dd6f12a0dd8773d612ccc76dfd029cd280778a0f0ae17ce679b3d2ffd968dd7e94a00
TLSH
T148510F323375F1E4C8567F071E68198053BF4395EA94AF5CB298621ED92741B8F222F3
MD5 SHA1 SHA512 TLSH

Submit Download

Cookies.tmp_wr

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies.tmp_wr
Size 20KB
SHA256 de48f5c4308a2477450952a8fd6462c411cc966f9e0fb0065a252b3be831a482
MD5 7696a61462ad640aba1171c8c42f837d
SHA1 4b1efd332c87a107f7b72f71e4b88af6c7994e05
SHA512 4b9849565bdb051e85ce777cc950516fa73b8beb75d54cb794a536176e9c239c5ec46de257c01b028924579d94ef7ddba31872ab244d4c2f999000814437e8a0
SSDEEP 24:TLZLbXYFpFNYbatqn1kweka6za6UwpQ9YH8PATZ6HfB:T9LopFMatSaw/auUOt8B
TLSH
T1F4928A4E5F346220C0F44B36EDD189672F7C212CD3A72699DE1420F3DE925ABF1095AA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Web Data.tmp_wr

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Web Data.tmp_wr
Size 224KB
SHA256 d781b56555e65272ef4019de8706cba5042fb7afcf0f6e2ca56183ca9567ba8e
MD5 710df06c7732247ac90a924171429a31
SHA1 74ca20f5987e39ea08d3765803fa25a9638eddea
SHA512 446dcaa944760f53b09f2112d434f8436ccaffcd7e6e270f699068161a7113f9c0b71de8f4e634bdccebb2364c6976c818fae12adb83c006fe1cce421a690c02
SSDEEP 192:f+xj3fT8w0QQnG2IMW1hPJubRd6vPtcdCewdbsc7V1VJ:2B3fQ9QQn7IMW1hPJuVd6vPkxW
TLSH
T1DD24640A7B787001EDE3D9725CB080771E3CA16D8F22A6915DB654694EB2853A23D8EF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 64B
SHA256 120aeb6d51d942abd453d508b7bfd606aff0c798e588ca2e18b23d5a993820ad
MD5 34b159616f80c1d5893cf406775bad4e
SHA1 dff5f71c17b07b8549b36e1c768db925205e1b4f
SHA512 3694b353483d4297944cf8d0ecfba7ed832d94dc25dd7012c7d6b4415b5bfcc90d72b468f3cf3a038f3936d5b56ee14622677eb069a3a29933cb18ee447bb82b
MD5 SHA1 SHA512

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 64B
SHA256 a7de5177c68a64bd48b36d49e2853799f4ebcfa8e4761f7cc472f333dc5f65cf
MD5 446dd1cf97eaba21cf14d03aebc79f27
SHA1 36e4cc7367e0c7b40f4a8ace272941ea46373799
SHA512 a6d754709f30b122112ae30e5ab22486393c5021d33da4d1304c061863d2e1e79e8aeb029cae61261bb77d0e7becd53a7b0106d6ea4368b4c302464e3d941cf7
MD5 SHA1 SHA512

Submit Download

__PSScriptPolicyTest_zh5e1w2a.pec.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_zh5e1w2a.pec.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

juscned_task.xml

Path C:\Users\Admin\AppData\Local\Temp\juscned_task.xml
Size 1KB
SHA256 f400ac3c7ef2b410a693a9d6ef28877a42376de678c57907a97782b60d0ce695
MD5 0bf9615f5313d3a19dc2d987d19ba46b
SHA1 fa2d7c9d95feef754d27fc28b2b0fc8c3b5f137f
SHA512 cff34ab4ce0a3a8abd64fdc684fee6228254b715e63b8a384ab23c007a981dd72b4381ef02c06426227bbb0d6df1b5af76e983e4450baa1e581621ae7ffa3a84
TLSH
T1802132909C15F12F755A973ECB915383367E6BA90BB54038D9CC4DBC748A1CAB10397B
MD5 SHA1 SHA512 TLSH

Submit Download

wruntime.log

Path C:\Users\Admin\AppData\Local\Temp\wruntime.log
Size 978B
SHA256 38dc5faaf9e1767547c4796287ba5119f48caa5e5f4cea88aa8555d3207cbc86
MD5 ced6b9796e30fb0a5fd29a753298d72e
SHA1 0156f7aa0c1e869638953656ab74fcaa5f5c3ae1
SHA512 49e6e004a7acb5d00626dd77b6e853a18195c92aef5cf687c4ecf3b3172773442410419f04de76cc0661a1e56e81eb2f1ab8c4ce0eae5d2e21db3ce66b23c1e5
TLSH
T1561178CC2C8B1A28B542507682E256498564900C0F59F0B0C6B5D08D22FD59ABBBBF74
MD5 SHA1 SHA512 TLSH

Submit Download

wruntime.log

Path C:\Users\Admin\AppData\Local\Temp\wruntime.log
Size 1KB
SHA256 99ebe1c2229cf529e299326d7f5e652ef3b4078cdec85eb3be8013fc468d7bbe
MD5 e0c9efd696a2a3350e04dac76fc35351
SHA1 ff4af0a6319303703fb00fa5bb72705249c02e4e
SHA512 644f8b7166548f2461a4dc4ea70e700749de16d8f06011d439badadb8752e710ebdc2ddde177ba032d24440625ae48f5ccb950c03c9c18ae0b8fdd6e1c1e5a63
TLSH
T13E31A9C86C8B1935F641117792E252498AA5D01C0E58F1B0CEB5C08E23BD59FBBA7B75
MD5 SHA1 SHA512 TLSH

Submit Download

wruntime.log

Path C:\Users\Admin\AppData\Local\Temp\wruntime.log
Size 2KB
SHA256 d6ff69c276cf797918a2e3a00f2a8f3732f6a632b29eeb9f583bac0fa21d0bbf
MD5 6dc189d52ba1cff59711148f891f95ee
SHA1 1f2d3fef6daa43336f4664253c0768bc3af11b1c
SHA512 06fd61a0a41885960ca48d90f8573c098c08421649cb02892b309be8b4aa5a2e7ba8c74d1dec6ab440a07fb859398b3a11a32852653349d421ee40a76972b087
TLSH
T11551AF8479836C24B35600B662E10614456BE4784A9DE1F189BDDACD22E803F7BFBF78
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2636-122-0x0000000000400000-0x0000000001203000-memory.dmp

Download

memory/2636-126-0x0000000000400000-0x0000000001203000-memory.dmp

Download

memory/2636-164-0x0000000000400000-0x0000000001203000-memory.dmp

Download

memory/2636-162-0x0000000000400000-0x0000000001203000-memory.dmp

Download

memory/2636-17-0x0000000000400000-0x0000000001203000-memory.dmp

Download

memory/2636-16-0x0000000000400000-0x0000000001203000-memory.dmp

Download

memory/2636-160-0x0000000000400000-0x0000000001203000-memory.dmp

Download

memory/2636-64-0x0000000000400000-0x0000000001203000-memory.dmp

Download

memory/2636-158-0x0000000000400000-0x0000000001203000-memory.dmp

Download

memory/2636-156-0x0000000000400000-0x0000000001203000-memory.dmp

Download

memory/2636-70-0x0000000000400000-0x0000000001203000-memory.dmp

Download

memory/2636-154-0x0000000000400000-0x0000000001203000-memory.dmp

Download

memory/2636-152-0x0000000000400000-0x0000000001203000-memory.dmp

Download

memory/2636-10-0x0000000000400000-0x0000000001203000-memory.dmp

Download

memory/2636-150-0x0000000000400000-0x0000000001203000-memory.dmp

Download

memory/2636-148-0x0000000000400000-0x0000000001203000-memory.dmp

Download

memory/2636-146-0x0000000000400000-0x0000000001203000-memory.dmp

Download

memory/2636-144-0x0000000000400000-0x0000000001203000-memory.dmp

Download

memory/2636-142-0x0000000000400000-0x0000000001203000-memory.dmp

Download

memory/2636-111-0x0000000000400000-0x0000000001203000-memory.dmp

Download

memory/2636-140-0x0000000000400000-0x0000000001203000-memory.dmp

Download

memory/2636-113-0x0000000000400000-0x0000000001203000-memory.dmp

Download

memory/2636-138-0x0000000000400000-0x0000000001203000-memory.dmp

Download

memory/2636-115-0x0000000000400000-0x0000000001203000-memory.dmp

Download

memory/2636-136-0x0000000000400000-0x0000000001203000-memory.dmp

Download

memory/2636-117-0x0000000000400000-0x0000000001203000-memory.dmp

Download

memory/2636-134-0x0000000000400000-0x0000000001203000-memory.dmp

Download

memory/2636-120-0x0000000000400000-0x0000000001203000-memory.dmp

Download

memory/2636-132-0x0000000000400000-0x0000000001203000-memory.dmp

Download

memory/2636-130-0x0000000000400000-0x0000000001203000-memory.dmp

Download

memory/2636-128-0x0000000000400000-0x0000000001203000-memory.dmp

Download

memory/2636-124-0x0000000000400000-0x0000000001203000-memory.dmp

Download

memory/3432-2-0x00000000008F0000-0x00000000016F3000-memory.dmp

Download

memory/3432-11-0x00000000008F0000-0x00000000016F3000-memory.dmp

Download

memory/3432-1-0x00000000008F0000-0x00000000016F3000-memory.dmp

Download

memory/3432-0-0x00000000008F0000-0x00000000016F3000-memory.dmp

Download

memory/4376-31-0x0000012455FE0000-0x0000012456002000-memory.dmp

Download

memory/4376-34-0x0000012456650000-0x000001245679E000-memory.dmp

Download

memory/4728-135-0x0000000000400000-0x0000000001203000-memory.dmp

Download

memory/4728-129-0x0000000000400000-0x0000000001203000-memory.dmp

Download

memory/4728-133-0x0000000000400000-0x0000000001203000-memory.dmp

Download

memory/4728-119-0x0000000000400000-0x0000000001203000-memory.dmp

Download

memory/4728-125-0x0000000000400000-0x0000000001203000-memory.dmp

Download

memory/4728-116-0x0000000000400000-0x0000000001203000-memory.dmp

Download

memory/4728-137-0x0000000000400000-0x0000000001203000-memory.dmp

Download

memory/4728-114-0x0000000000400000-0x0000000001203000-memory.dmp

Download

memory/4728-139-0x0000000000400000-0x0000000001203000-memory.dmp

Download

memory/4728-112-0x0000000000400000-0x0000000001203000-memory.dmp

Download

memory/4728-141-0x0000000000400000-0x0000000001203000-memory.dmp

Download

memory/4728-110-0x0000000000400000-0x0000000001203000-memory.dmp

Download

memory/4728-143-0x0000000000400000-0x0000000001203000-memory.dmp

Download

memory/4728-131-0x0000000000400000-0x0000000001203000-memory.dmp

Download

memory/4728-145-0x0000000000400000-0x0000000001203000-memory.dmp

Download

memory/4728-127-0x0000000000400000-0x0000000001203000-memory.dmp

Download

memory/4728-147-0x0000000000400000-0x0000000001203000-memory.dmp

Download

memory/4728-121-0x0000000000400000-0x0000000001203000-memory.dmp

Download

memory/4728-149-0x0000000000400000-0x0000000001203000-memory.dmp

Download

memory/4728-123-0x0000000000400000-0x0000000001203000-memory.dmp

Download

memory/4728-151-0x0000000000400000-0x0000000001203000-memory.dmp

Download

memory/4728-163-0x0000000000400000-0x0000000001203000-memory.dmp

Download

memory/4728-153-0x0000000000400000-0x0000000001203000-memory.dmp

Download

memory/4728-22-0x0000000000400000-0x0000000001203000-memory.dmp

Download

memory/4728-155-0x0000000000400000-0x0000000001203000-memory.dmp

Download

memory/4728-68-0x0000000000400000-0x0000000001203000-memory.dmp

Download

memory/4728-157-0x0000000000400000-0x0000000001203000-memory.dmp

Download

memory/4728-161-0x0000000000400000-0x0000000001203000-memory.dmp

Download

memory/4728-159-0x0000000000400000-0x0000000001203000-memory.dmp

Download

memory/4924-63-0x0000000000400000-0x0000000001203000-memory.dmp

Download

memory/4924-15-0x0000000000400000-0x0000000001203000-memory.dmp

Download

memory/4924-69-0x0000000000400000-0x0000000001203000-memory.dmp

Download

memory/4924-13-0x0000000000400000-0x0000000001203000-memory.dmp

Download

memory/4924-101-0x0000000000400000-0x0000000001203000-memory.dmp

Download