webrat | aa8f493aa9999c347111187cd8af93e6818da502820431c91400dc0b8b939365

Analysis

user interaction
yes
max time kernel
299s
max time network
301s
platform
windows10-ltsc_2021_x64
resource
win10ltsc2021-20260911-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20260911-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows
submitted
18/09/2026, 16:08

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
SS.exe
Size 5.6MB
Sample260918-tk67jshe42
SHA256 aa8f493aa9999c347111187cd8af93e6818da502820431c91400dc0b8b939365
MD5 47439fc3b9d0045a2c6a69fd1f8182db
SHA1 7615cefa5a4cbaa5ae29deb8efcab027452799a3
SHA512 42ad85463d4def6f99117d63a4d8340d122fb6d9e4aabd90907d8164c355fb1375f3cf6ed153ef17b789925546989c554e25bfd6533f3190a7a70f1d5c623b85
SSDEEP 98304:zC7YA26J0Djx3ZMNPDZsrR7z9IGh8A0/KeszS3sGwSpUGNV3IIXu8yNuungdoj:uh2b2sNH7yWSwMUGv4wy+O
TLSH
T1D1463350A21436B0F7D9A23EABB3E827467B565600F36DCF5B4981F7653F1C12AB8036
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery execution webrat persistence rat trojan upx

Malware Config

Signatures

Family: WebRAT
WebRAT is a Windows RAT written in Golang.
rat webrat

Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
944	powershell.exe
3304	powershell.exe
4512	powershell.exe
4236	powershell.exe

Executes dropped EXE 4 IoCs

pid	Process
4164	Updater.exe
1676	Updater.exe
3872	Updater.exe
2480	Updater.exe

Checks whether UAC is enabled 1 TTPs 4 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	SS.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Updater.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Updater.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Updater.exe

Discovers running processes 1 TTPs 64 IoCs

Running process information can be used to identify security tools or plan follow-on actions.

discovery

Process Discovery

T1057

pid	Process
632	tasklist.exe
3656	tasklist.exe
844	tasklist.exe
4292	tasklist.exe
1688	tasklist.exe
4080	tasklist.exe
232	tasklist.exe
2488	tasklist.exe
2644	tasklist.exe
3488	tasklist.exe
2604	tasklist.exe
644	tasklist.exe
4632	tasklist.exe
3844	tasklist.exe
3408	tasklist.exe
3304	tasklist.exe
3612	tasklist.exe
968	tasklist.exe
2752	tasklist.exe
4348	tasklist.exe
3488	tasklist.exe
1720	tasklist.exe
1912	tasklist.exe
4004	tasklist.exe
1992	tasklist.exe
688	tasklist.exe
968	tasklist.exe
1912	tasklist.exe
3712	tasklist.exe
1944	tasklist.exe
320	tasklist.exe
3640	tasklist.exe
3456	tasklist.exe
4088	tasklist.exe
3076	tasklist.exe
2472	tasklist.exe
3900	tasklist.exe
3236	tasklist.exe
1292	tasklist.exe
4772	tasklist.exe
3932	tasklist.exe
2624	tasklist.exe
4752	tasklist.exe
876	tasklist.exe
3252	tasklist.exe
3028	tasklist.exe
4628	tasklist.exe
5032	tasklist.exe
2648	tasklist.exe
3392	tasklist.exe
4704	tasklist.exe
4508	tasklist.exe
4360	tasklist.exe
4056	tasklist.exe
1632	tasklist.exe
3712	tasklist.exe
2232	tasklist.exe
4480	tasklist.exe
5008	tasklist.exe
4300	tasklist.exe
3360	tasklist.exe
4568	tasklist.exe
3456	tasklist.exe
756	tasklist.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/748-0-0x00000000005A0000-0x00000000013A0000-memory.dmp	upx
behavioral1/memory/748-1-0x00000000005A0000-0x00000000013A0000-memory.dmp	upx
behavioral1/memory/748-2-0x00000000005A0000-0x00000000013A0000-memory.dmp	upx
behavioral1/files/0x00080000000284df-8.dat	upx
behavioral1/memory/748-11-0x00000000005A0000-0x00000000013A0000-memory.dmp	upx
behavioral1/memory/4164-10-0x0000000000060000-0x0000000000E60000-memory.dmp	upx
behavioral1/memory/1676-13-0x0000000000060000-0x0000000000E60000-memory.dmp	upx
behavioral1/memory/3872-15-0x0000000000060000-0x0000000000E60000-memory.dmp	upx
behavioral1/memory/4164-16-0x0000000000060000-0x0000000000E60000-memory.dmp	upx
behavioral1/memory/1676-17-0x0000000000060000-0x0000000000E60000-memory.dmp	upx
behavioral1/memory/4164-18-0x0000000000060000-0x0000000000E60000-memory.dmp	upx
behavioral1/memory/1676-19-0x0000000000060000-0x0000000000E60000-memory.dmp	upx
behavioral1/memory/3872-21-0x0000000000060000-0x0000000000E60000-memory.dmp	upx
behavioral1/memory/3872-20-0x0000000000060000-0x0000000000E60000-memory.dmp	upx
behavioral1/memory/2480-27-0x0000000000060000-0x0000000000E60000-memory.dmp	upx
behavioral1/memory/4164-67-0x0000000000060000-0x0000000000E60000-memory.dmp	upx
behavioral1/memory/1676-68-0x0000000000060000-0x0000000000E60000-memory.dmp	upx
behavioral1/memory/3872-69-0x0000000000060000-0x0000000000E60000-memory.dmp	upx
behavioral1/memory/2480-71-0x0000000000060000-0x0000000000E60000-memory.dmp	upx
behavioral1/memory/4164-73-0x0000000000060000-0x0000000000E60000-memory.dmp	upx
behavioral1/memory/1676-74-0x0000000000060000-0x0000000000E60000-memory.dmp	upx
behavioral1/memory/3872-75-0x0000000000060000-0x0000000000E60000-memory.dmp	upx
behavioral1/memory/2480-76-0x0000000000060000-0x0000000000E60000-memory.dmp	upx
behavioral1/memory/1676-77-0x0000000000060000-0x0000000000E60000-memory.dmp	upx
behavioral1/memory/3872-78-0x0000000000060000-0x0000000000E60000-memory.dmp	upx
behavioral1/memory/2480-79-0x0000000000060000-0x0000000000E60000-memory.dmp	upx
behavioral1/memory/3872-80-0x0000000000060000-0x0000000000E60000-memory.dmp	upx
behavioral1/memory/2480-81-0x0000000000060000-0x0000000000E60000-memory.dmp	upx
behavioral1/memory/3872-82-0x0000000000060000-0x0000000000E60000-memory.dmp	upx
behavioral1/memory/2480-83-0x0000000000060000-0x0000000000E60000-memory.dmp	upx
behavioral1/memory/3872-84-0x0000000000060000-0x0000000000E60000-memory.dmp	upx
behavioral1/memory/2480-86-0x0000000000060000-0x0000000000E60000-memory.dmp	upx
behavioral1/memory/3872-87-0x0000000000060000-0x0000000000E60000-memory.dmp	upx
behavioral1/memory/2480-88-0x0000000000060000-0x0000000000E60000-memory.dmp	upx
behavioral1/memory/3872-89-0x0000000000060000-0x0000000000E60000-memory.dmp	upx
behavioral1/memory/2480-90-0x0000000000060000-0x0000000000E60000-memory.dmp	upx
behavioral1/memory/3872-91-0x0000000000060000-0x0000000000E60000-memory.dmp	upx
behavioral1/memory/2480-92-0x0000000000060000-0x0000000000E60000-memory.dmp	upx
behavioral1/memory/3872-93-0x0000000000060000-0x0000000000E60000-memory.dmp	upx
behavioral1/memory/2480-94-0x0000000000060000-0x0000000000E60000-memory.dmp	upx
behavioral1/memory/3872-95-0x0000000000060000-0x0000000000E60000-memory.dmp	upx
behavioral1/memory/2480-96-0x0000000000060000-0x0000000000E60000-memory.dmp	upx
behavioral1/memory/3872-97-0x0000000000060000-0x0000000000E60000-memory.dmp	upx
behavioral1/memory/2480-98-0x0000000000060000-0x0000000000E60000-memory.dmp	upx
behavioral1/memory/3872-99-0x0000000000060000-0x0000000000E60000-memory.dmp	upx
behavioral1/memory/2480-100-0x0000000000060000-0x0000000000E60000-memory.dmp	upx
behavioral1/memory/3872-101-0x0000000000060000-0x0000000000E60000-memory.dmp	upx
behavioral1/memory/2480-102-0x0000000000060000-0x0000000000E60000-memory.dmp	upx
behavioral1/memory/3872-103-0x0000000000060000-0x0000000000E60000-memory.dmp	upx
behavioral1/memory/2480-104-0x0000000000060000-0x0000000000E60000-memory.dmp	upx
behavioral1/memory/3872-105-0x0000000000060000-0x0000000000E60000-memory.dmp	upx
behavioral1/memory/2480-106-0x0000000000060000-0x0000000000E60000-memory.dmp	upx
behavioral1/memory/3872-107-0x0000000000060000-0x0000000000E60000-memory.dmp	upx
behavioral1/memory/2480-108-0x0000000000060000-0x0000000000E60000-memory.dmp	upx
behavioral1/memory/3872-109-0x0000000000060000-0x0000000000E60000-memory.dmp	upx
behavioral1/memory/2480-110-0x0000000000060000-0x0000000000E60000-memory.dmp	upx
behavioral1/memory/3872-111-0x0000000000060000-0x0000000000E60000-memory.dmp	upx
behavioral1/memory/2480-112-0x0000000000060000-0x0000000000E60000-memory.dmp	upx
behavioral1/memory/3872-113-0x0000000000060000-0x0000000000E60000-memory.dmp	upx
behavioral1/memory/2480-114-0x0000000000060000-0x0000000000E60000-memory.dmp	upx
behavioral1/memory/3872-115-0x0000000000060000-0x0000000000E60000-memory.dmp	upx
behavioral1/memory/2480-116-0x0000000000060000-0x0000000000E60000-memory.dmp	upx
behavioral1/memory/3872-117-0x0000000000060000-0x0000000000E60000-memory.dmp	upx
behavioral1/memory/2480-118-0x0000000000060000-0x0000000000E60000-memory.dmp	upx

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2932	schtasks.exe
1288	schtasks.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
944	powershell.exe
944	powershell.exe
3304	powershell.exe
3304	powershell.exe
4512	powershell.exe
4512	powershell.exe
4236	powershell.exe
4236	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	2308	tasklist.exe
Token: SeDebugPrivilege	2400	tasklist.exe
Token: SeDebugPrivilege	2212	tasklist.exe
Token: SeDebugPrivilege	4040	tasklist.exe
Token: SeDebugPrivilege	2680	tasklist.exe
Token: SeDebugPrivilege	4056	tasklist.exe
Token: SeDebugPrivilege	4088	tasklist.exe
Token: SeDebugPrivilege	2864	tasklist.exe
Token: SeDebugPrivilege	4796	tasklist.exe
Token: SeDebugPrivilege	2524	tasklist.exe
Token: SeDebugPrivilege	3932	tasklist.exe
Token: SeDebugPrivilege	1912	tasklist.exe
Token: SeDebugPrivilege	4976	tasklist.exe
Token: SeDebugPrivilege	1632	tasklist.exe
Token: SeDebugPrivilege	1936	tasklist.exe
Token: SeDebugPrivilege	3076	tasklist.exe
Token: SeDebugPrivilege	5108	tasklist.exe
Token: SeDebugPrivilege	1768	tasklist.exe
Token: SeDebugPrivilege	2968	tasklist.exe
Token: SeDebugPrivilege	2472	tasklist.exe
Token: SeDebugPrivilege	876	tasklist.exe
Token: SeDebugPrivilege	3900	tasklist.exe
Token: SeDebugPrivilege	892	tasklist.exe
Token: SeDebugPrivilege	4568	tasklist.exe
Token: SeDebugPrivilege	3628	tasklist.exe
Token: SeDebugPrivilege	3872	tasklist.exe
Token: SeDebugPrivilege	2212	tasklist.exe
Token: SeDebugPrivilege	2420	tasklist.exe
Token: SeDebugPrivilege	3304	tasklist.exe
Token: SeDebugPrivilege	1664	tasklist.exe
Token: SeDebugPrivilege	4024	tasklist.exe
Token: SeDebugPrivilege	4432	tasklist.exe
Token: SeDebugPrivilege	1556	tasklist.exe
Token: SeDebugPrivilege	4956	tasklist.exe
Token: SeDebugPrivilege	3028	tasklist.exe
Token: SeDebugPrivilege	4776	tasklist.exe
Token: SeDebugPrivilege	3712	tasklist.exe
Token: SeDebugPrivilege	3964	tasklist.exe
Token: SeDebugPrivilege	4628	tasklist.exe
Token: SeDebugPrivilege	2488	tasklist.exe
Token: SeDebugPrivilege	320	tasklist.exe
Token: SeDebugPrivilege	3236	tasklist.exe
Token: SeDebugPrivilege	5032	tasklist.exe
Token: SeDebugPrivilege	4004	tasklist.exe
Token: SeDebugPrivilege	3076	tasklist.exe
Token: SeDebugPrivilege	756	tasklist.exe
Token: SeDebugPrivilege	1988	tasklist.exe
Token: SeDebugPrivilege	4832	tasklist.exe
Token: SeDebugPrivilege	2644	tasklist.exe
Token: SeDebugPrivilege	3764	tasklist.exe
Token: SeDebugPrivilege	2640	tasklist.exe
Token: SeDebugPrivilege	2212	tasklist.exe
Token: SeDebugPrivilege	2648	tasklist.exe
Token: SeDebugPrivilege	4828	tasklist.exe
Token: SeDebugPrivilege	3896	tasklist.exe
Token: SeDebugPrivilege	1612	tasklist.exe
Token: SeDebugPrivilege	4568	tasklist.exe
Token: SeDebugPrivilege	4080	tasklist.exe
Token: SeDebugPrivilege	3456	tasklist.exe
Token: SeDebugPrivilege	2620	tasklist.exe
Token: SeDebugPrivilege	2232	tasklist.exe
Token: SeDebugPrivilege	3612	tasklist.exe
Token: SeDebugPrivilege	2752	tasklist.exe
Token: SeDebugPrivilege	3488	tasklist.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 748 wrote to memory of 2308	748	SS.exe	82
PID 748 wrote to memory of 2400	748	SS.exe	85
PID 748 wrote to memory of 2212	748	SS.exe	87
PID 748 wrote to memory of 4040	748	SS.exe	89
PID 748 wrote to memory of 2680	748	SS.exe	91
PID 748 wrote to memory of 4056	748	SS.exe	93
PID 748 wrote to memory of 4088	748	SS.exe	95
PID 748 wrote to memory of 2864	748	SS.exe	97
PID 748 wrote to memory of 4796	748	SS.exe	99
PID 748 wrote to memory of 2524	748	SS.exe	101
PID 748 wrote to memory of 3932	748	SS.exe	103
PID 748 wrote to memory of 1912	748	SS.exe	105
PID 748 wrote to memory of 4976	748	SS.exe	107
PID 748 wrote to memory of 1632	748	SS.exe	109
PID 748 wrote to memory of 1936	748	SS.exe	111
PID 748 wrote to memory of 3076	748	SS.exe	113
PID 748 wrote to memory of 5108	748	SS.exe	115
PID 748 wrote to memory of 1768	748	SS.exe	117
PID 748 wrote to memory of 2968	748	SS.exe	119
PID 748 wrote to memory of 2472	748	SS.exe	121
PID 748 wrote to memory of 876	748	SS.exe	123
PID 748 wrote to memory of 3900	748	SS.exe	125
PID 748 wrote to memory of 892	748	SS.exe	127
PID 748 wrote to memory of 4568	748	SS.exe	129
PID 748 wrote to memory of 3628	748	SS.exe	131
PID 748 wrote to memory of 3872	748	SS.exe	133
PID 748 wrote to memory of 2212	748	SS.exe	135
PID 748 wrote to memory of 2420	748	SS.exe	137
PID 748 wrote to memory of 3304	748	SS.exe	139
PID 748 wrote to memory of 1664	748	SS.exe	141
PID 748 wrote to memory of 4024	748	SS.exe	143
PID 748 wrote to memory of 4432	748	SS.exe	145
PID 748 wrote to memory of 1556	748	SS.exe	147
PID 748 wrote to memory of 4956	748	SS.exe	149
PID 748 wrote to memory of 3028	748	SS.exe	151
PID 748 wrote to memory of 4776	748	SS.exe	153
PID 748 wrote to memory of 3712	748	SS.exe	155
PID 748 wrote to memory of 3964	748	SS.exe	157
PID 748 wrote to memory of 4628	748	SS.exe	159
PID 748 wrote to memory of 2488	748	SS.exe	161
PID 748 wrote to memory of 320	748	SS.exe	163
PID 748 wrote to memory of 3236	748	SS.exe	165
PID 748 wrote to memory of 5032	748	SS.exe	167
PID 748 wrote to memory of 4004	748	SS.exe	169
PID 748 wrote to memory of 3076	748	SS.exe	171
PID 748 wrote to memory of 756	748	SS.exe	233
PID 748 wrote to memory of 1988	748	SS.exe	175
PID 748 wrote to memory of 4832	748	SS.exe	177
PID 748 wrote to memory of 2644	748	SS.exe	179
PID 748 wrote to memory of 2932	748	SS.exe	181
PID 748 wrote to memory of 4164	748	SS.exe	183
PID 4164 wrote to memory of 3764	4164	Updater.exe	185
PID 1676 wrote to memory of 4568	1676	Updater.exe	187
PID 4164 wrote to memory of 2640	4164	Updater.exe	247
PID 3872 wrote to memory of 2212	3872	Updater.exe	193
PID 4164 wrote to memory of 2648	4164	Updater.exe	195
PID 3872 wrote to memory of 4828	3872	Updater.exe	421
PID 4164 wrote to memory of 3896	4164	Updater.exe	199
PID 3872 wrote to memory of 1612	3872	Updater.exe	258
PID 4164 wrote to memory of 4080	4164	Updater.exe	203
PID 3872 wrote to memory of 3456	3872	Updater.exe	317
PID 1676 wrote to memory of 3612	1676	Updater.exe	207
PID 4164 wrote to memory of 2620	4164	Updater.exe	209
PID 3872 wrote to memory of 2232	3872	Updater.exe	429

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\SS.exe
"C:\Users\Admin\AppData\Local\Temp\SS.exe"
1⤵
- Checks whether UAC is enabled
- Suspicious use of WriteProcessMemory
PID:748
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq wireshark.exe" /NH
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:2308
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq dumpcap.exe" /NH
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:2400
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq procmon.exe" /NH
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:2212
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq procmon64.exe" /NH
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:4040
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq procexp.exe" /NH
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:2680
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq procexp64.exe" /NH
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:4056
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq processhacker.exe" /NH
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:4088
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq x64dbg.exe" /NH
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:2864
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq x32dbg.exe" /NH
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:4796
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq ollydbg.exe" /NH
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:2524
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq ida.exe" /NH
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:3932
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq ida64.exe" /NH
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:1912
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq idag.exe" /NH
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:4976
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq idag64.exe" /NH
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:1632
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq idaw.exe" /NH
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:1936
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq idaw64.exe" /NH
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:3076
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq fiddler.exe" /NH
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:5108
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq httpdebugger.exe" /NH
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:1768
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq httpdebuggerui.exe" /NH
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:2968
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq dnspy.exe" /NH
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:2472
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq pestudio.exe" /NH
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:876
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq cheatengine.exe" /NH
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:3900
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq hxd.exe" /NH
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:892
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq devenv.exe" /NH
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:4568
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq windbg.exe" /NH
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:3628
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq immunitydebugger.exe" /NH
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:3872
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq apimonitor.exe" /NH
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:2212
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq autoruns.exe" /NH
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:2420
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq autorunsc.exe" /NH
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:3304
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq filemon.exe" /NH
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:1664
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq regmon.exe" /NH
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:4024
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq resourcehacker.exe" /NH
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:4432
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq vmtoolsd.exe" /NH
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:1556
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq vmwaretray.exe" /NH
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:4956
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq vmwareuser.exe" /NH
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:3028
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq vmusrvc.exe" /NH
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:4776
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq vmsrvc.exe" /NH
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:3712
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq vboxservice.exe" /NH
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:3964
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq vboxtray.exe" /NH
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:4628
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq xenservice.exe" /NH
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:2488
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq qemu-ga.exe" /NH
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:320
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq sandboxie.exe" /NH
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:3236
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq sandboxiedcomlaunch.exe" /NH
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:5032
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq sandboxierpcss.exe" /NH
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:4004
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq joeboxcontrol.exe" /NH
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:3076
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq joeboxserver.exe" /NH
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:756
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq prl_tools.exe" /NH
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:1988
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq prl_cc.exe" /NH
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:4832
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq vmacthlp.exe" /NH
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:2644
- C:\Windows\system32\schtasks.exe
  schtasks /Create /XML C:\Users\Admin\AppData\Local\Temp\Updater_task.xml /TN Updater /F
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:2932
- C:\Users\Admin\AppData\Local\Discord\Updater.exe
  C:\Users\Admin\AppData\Local\Discord\Updater.exe --installed
  2⤵
  - Executes dropped EXE
  - Checks whether UAC is enabled
  - Suspicious use of WriteProcessMemory
  PID:4164
- - C:\Windows\system32\tasklist.exe
    tasklist /FI "IMAGENAME eq wireshark.exe" /NH
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:3764
- - C:\Windows\system32\tasklist.exe
    tasklist /FI "IMAGENAME eq dumpcap.exe" /NH
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2640
- - C:\Windows\system32\tasklist.exe
    tasklist /FI "IMAGENAME eq procmon.exe" /NH
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:2648
- - C:\Windows\system32\tasklist.exe
    tasklist /FI "IMAGENAME eq procmon64.exe" /NH
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:3896
- - C:\Windows\system32\tasklist.exe
    tasklist /FI "IMAGENAME eq procexp.exe" /NH
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:4080
- - C:\Windows\system32\tasklist.exe
    tasklist /FI "IMAGENAME eq procexp64.exe" /NH
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2620
- - C:\Windows\system32\tasklist.exe
    tasklist /FI "IMAGENAME eq processhacker.exe" /NH
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:3488
- - C:\Windows\system32\tasklist.exe
    tasklist /FI "IMAGENAME eq x64dbg.exe" /NH
    3⤵
    - Discovers running processes
    PID:3392
- - C:\Windows\system32\tasklist.exe
    tasklist /FI "IMAGENAME eq x32dbg.exe" /NH
    3⤵
    PID:3832
- - C:\Windows\system32\tasklist.exe
    tasklist /FI "IMAGENAME eq ollydbg.exe" /NH
    3⤵
    PID:4416
- - C:\Windows\system32\tasklist.exe
    tasklist /FI "IMAGENAME eq ida.exe" /NH
    3⤵
    - Discovers running processes
    PID:5008
- - C:\Windows\system32\tasklist.exe
    tasklist /FI "IMAGENAME eq ida64.exe" /NH
    3⤵
    PID:876
- - C:\Windows\system32\tasklist.exe
    tasklist /FI "IMAGENAME eq idag.exe" /NH
    3⤵
    - Discovers running processes
    PID:4300
- - C:\Windows\system32\tasklist.exe
    tasklist /FI "IMAGENAME eq idag64.exe" /NH
    3⤵
    PID:2640
- - C:\Windows\system32\tasklist.exe
    tasklist /FI "IMAGENAME eq idaw.exe" /NH
    3⤵
    - Discovers running processes
    PID:688
- - C:\Windows\system32\tasklist.exe
    tasklist /FI "IMAGENAME eq idaw64.exe" /NH
    3⤵
    - Discovers running processes
    PID:2624
- - C:\Windows\system32\tasklist.exe
    tasklist /FI "IMAGENAME eq fiddler.exe" /NH
    3⤵
    PID:2664
- - C:\Windows\system32\tasklist.exe
    tasklist /FI "IMAGENAME eq httpdebugger.exe" /NH
    3⤵
    PID:612
- - C:\Windows\system32\tasklist.exe
    tasklist /FI "IMAGENAME eq httpdebuggerui.exe" /NH
    3⤵
    - Discovers running processes
    PID:4704
- - C:\Windows\system32\tasklist.exe
    tasklist /FI "IMAGENAME eq dnspy.exe" /NH
    3⤵
    - Discovers running processes
    PID:4292
- - C:\Windows\system32\tasklist.exe
    tasklist /FI "IMAGENAME eq pestudio.exe" /NH
    3⤵
    - Discovers running processes
    PID:3360
- - C:\Windows\system32\tasklist.exe
    tasklist /FI "IMAGENAME eq cheatengine.exe" /NH
    3⤵
    PID:3384
- - C:\Windows\system32\tasklist.exe
    tasklist /FI "IMAGENAME eq hxd.exe" /NH
    3⤵
    PID:3676
- - C:\Windows\system32\tasklist.exe
    tasklist /FI "IMAGENAME eq devenv.exe" /NH
    3⤵
    PID:1988
- - C:\Windows\system32\tasklist.exe
    tasklist /FI "IMAGENAME eq windbg.exe" /NH
    3⤵
    PID:3648
- - C:\Windows\system32\tasklist.exe
    tasklist /FI "IMAGENAME eq immunitydebugger.exe" /NH
    3⤵
    PID:2052
- - C:\Windows\system32\tasklist.exe
    tasklist /FI "IMAGENAME eq apimonitor.exe" /NH
    3⤵
    PID:1972
- - C:\Windows\system32\tasklist.exe
    tasklist /FI "IMAGENAME eq autoruns.exe" /NH
    3⤵
    PID:2764
- - C:\Windows\system32\tasklist.exe
    tasklist /FI "IMAGENAME eq autorunsc.exe" /NH
    3⤵
    PID:1664
- - C:\Windows\system32\tasklist.exe
    tasklist /FI "IMAGENAME eq filemon.exe" /NH
    3⤵
    - Discovers running processes
    PID:3640
- - C:\Windows\system32\tasklist.exe
    tasklist /FI "IMAGENAME eq regmon.exe" /NH
    3⤵
    - Discovers running processes
    PID:4348
- - C:\Windows\system32\tasklist.exe
    tasklist /FI "IMAGENAME eq resourcehacker.exe" /NH
    3⤵
    PID:2848
- - C:\Windows\system32\tasklist.exe
    tasklist /FI "IMAGENAME eq vmtoolsd.exe" /NH
    3⤵
    - Discovers running processes
    PID:4508
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:2752
- - C:\Windows\system32\tasklist.exe
    tasklist /FI "IMAGENAME eq vmwaretray.exe" /NH
    3⤵
    PID:1936
- - C:\Windows\system32\tasklist.exe
    tasklist /FI "IMAGENAME eq vmwareuser.exe" /NH
    3⤵
    - Discovers running processes
    PID:3656
- - C:\Windows\system32\tasklist.exe
    tasklist /FI "IMAGENAME eq vmusrvc.exe" /NH
    3⤵
    PID:2468
- - C:\Windows\system32\tasklist.exe
    tasklist /FI "IMAGENAME eq vmsrvc.exe" /NH
    3⤵
    PID:5108
- - C:\Windows\system32\tasklist.exe
    tasklist /FI "IMAGENAME eq vboxservice.exe" /NH
    3⤵
    PID:4328
- - C:\Windows\system32\tasklist.exe
    tasklist /FI "IMAGENAME eq vboxtray.exe" /NH
    3⤵
    PID:4340
- - C:\Windows\system32\tasklist.exe
    tasklist /FI "IMAGENAME eq xenservice.exe" /NH
    3⤵
    - Discovers running processes
    PID:1720
- - C:\Windows\system32\tasklist.exe
    tasklist /FI "IMAGENAME eq qemu-ga.exe" /NH
    3⤵
    - Discovers running processes
    PID:2604
- - C:\Windows\system32\tasklist.exe
    tasklist /FI "IMAGENAME eq sandboxie.exe" /NH
    3⤵
    PID:4056
- - C:\Windows\system32\tasklist.exe
    tasklist /FI "IMAGENAME eq sandboxiedcomlaunch.exe" /NH
    3⤵
    PID:4928
- - C:\Windows\system32\tasklist.exe
    tasklist /FI "IMAGENAME eq sandboxierpcss.exe" /NH
    3⤵
    PID:696
- - C:\Windows\system32\tasklist.exe
    tasklist /FI "IMAGENAME eq joeboxcontrol.exe" /NH
    3⤵
    PID:2120
- - C:\Windows\system32\tasklist.exe
    tasklist /FI "IMAGENAME eq joeboxserver.exe" /NH
    3⤵
    PID:3476
- - C:\Windows\system32\tasklist.exe
    tasklist /FI "IMAGENAME eq prl_tools.exe" /NH
    3⤵
    PID:4156
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:632
- - C:\Windows\system32\tasklist.exe
    tasklist /FI "IMAGENAME eq prl_cc.exe" /NH
    3⤵
    PID:2668
- - C:\Windows\system32\tasklist.exe
    tasklist /FI "IMAGENAME eq vmacthlp.exe" /NH
    3⤵
    PID:4640

C:\Users\Admin\AppData\Local\Discord\Updater.exe
"C:\Users\Admin\AppData\Local\Discord\Updater.exe"
1⤵
- Executes dropped EXE
- Checks whether UAC is enabled
- Suspicious use of WriteProcessMemory
PID:1676
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq wireshark.exe" /NH
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:4568
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq dumpcap.exe" /NH
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:3612
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq procmon.exe" /NH
  2⤵
  - Discovers running processes
  PID:1992
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq procmon64.exe" /NH
  2⤵
  PID:4532
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq procexp.exe" /NH
  2⤵
  PID:564
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq procexp64.exe" /NH
  2⤵
  PID:2968
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq processhacker.exe" /NH
  2⤵
  - Discovers running processes
  PID:632
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq x64dbg.exe" /NH
  2⤵
  PID:1988
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq x32dbg.exe" /NH
  2⤵
  PID:2932
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq ollydbg.exe" /NH
  2⤵
  - Discovers running processes
  PID:4360
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq ida.exe" /NH
  2⤵
  PID:4060
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq ida64.exe" /NH
  2⤵
  PID:3012
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq idag.exe" /NH
  2⤵
  PID:2484
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq idag64.exe" /NH
  2⤵
  PID:3196
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:1688
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq idaw.exe" /NH
  2⤵
  PID:2472
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq idaw64.exe" /NH
  2⤵
  PID:1076
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq fiddler.exe" /NH
  2⤵
  PID:4120
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:4828
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq httpdebugger.exe" /NH
  2⤵
  PID:2524
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq httpdebuggerui.exe" /NH
  2⤵
  PID:404
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:2232
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq dnspy.exe" /NH
  2⤵
  PID:1032
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq pestudio.exe" /NH
  2⤵
  PID:1316
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq cheatengine.exe" /NH
  2⤵
  PID:2484
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq hxd.exe" /NH
  2⤵
  PID:2436
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq devenv.exe" /NH
  2⤵
  PID:924
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq windbg.exe" /NH
  2⤵
  - Discovers running processes
  PID:3252
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:3004
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq immunitydebugger.exe" /NH
  2⤵
  - Discovers running processes
  PID:644
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq apimonitor.exe" /NH
  2⤵
  PID:1172
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq autoruns.exe" /NH
  2⤵
  PID:2112
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq autorunsc.exe" /NH
  2⤵
  PID:4620
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq filemon.exe" /NH
  2⤵
  PID:4640
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq regmon.exe" /NH
  2⤵
  PID:4340
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq resourcehacker.exe" /NH
  2⤵
  PID:3408
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq vmtoolsd.exe" /NH
  2⤵
  PID:4728
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq vmwaretray.exe" /NH
  2⤵
  PID:4932
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq vmwareuser.exe" /NH
  2⤵
  - Discovers running processes
  PID:4632
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq vmusrvc.exe" /NH
  2⤵
  PID:4828
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq vmsrvc.exe" /NH
  2⤵
  PID:3748
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq vboxservice.exe" /NH
  2⤵
  PID:1664
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:3304
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq vboxtray.exe" /NH
  2⤵
  PID:3964
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq xenservice.exe" /NH
  2⤵
  - Discovers running processes
  PID:1912
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq qemu-ga.exe" /NH
  2⤵
  PID:1808
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq sandboxie.exe" /NH
  2⤵
  PID:812
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:4928
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq sandboxiedcomlaunch.exe" /NH
  2⤵
  - Discovers running processes
  PID:3712
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq sandboxierpcss.exe" /NH
  2⤵
  - Discovers running processes
  PID:3844
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:4508
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq joeboxcontrol.exe" /NH
  2⤵
  - Discovers running processes
  PID:1944
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq joeboxserver.exe" /NH
  2⤵
  PID:1752
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq prl_tools.exe" /NH
  2⤵
  - Discovers running processes
  PID:844
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq prl_cc.exe" /NH
  2⤵
  - Discovers running processes
  PID:4080
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:4480
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq vmacthlp.exe" /NH
  2⤵
  PID:4236

C:\Users\Admin\AppData\Local\Discord\Updater.exe
C:\Users\Admin\AppData\Local\Discord\Updater.exe
1⤵
- Executes dropped EXE
- Checks whether UAC is enabled
- Suspicious use of WriteProcessMemory
PID:3872
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq wireshark.exe" /NH
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:2212
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq dumpcap.exe" /NH
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:4828
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq procmon.exe" /NH
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:1612
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq procmon64.exe" /NH
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:3456
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq procexp.exe" /NH
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:2232
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq procexp64.exe" /NH
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:2752
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq processhacker.exe" /NH
  2⤵
  - Discovers running processes
  PID:968
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq x64dbg.exe" /NH
  2⤵
  PID:2484
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq x32dbg.exe" /NH
  2⤵
  PID:468
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq ollydbg.exe" /NH
  2⤵
  - Discovers running processes
  PID:4480
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq ida.exe" /NH
  2⤵
  - Discovers running processes
  PID:756
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq ida64.exe" /NH
  2⤵
  PID:2112
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq idag.exe" /NH
  2⤵
  PID:1700
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq idag64.exe" /NH
  2⤵
  PID:4192
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq idaw.exe" /NH
  2⤵
  PID:1356
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq idaw64.exe" /NH
  2⤵
  PID:4056
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:1612
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq fiddler.exe" /NH
  2⤵
  PID:896
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq httpdebugger.exe" /NH
  2⤵
  - Discovers running processes
  PID:1292
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq httpdebuggerui.exe" /NH
  2⤵
  - Discovers running processes
  PID:2752
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq dnspy.exe" /NH
  2⤵
  PID:1608
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq pestudio.exe" /NH
  2⤵
  PID:2192
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq cheatengine.exe" /NH
  2⤵
  - Discovers running processes
  PID:232
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:3832
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq hxd.exe" /NH
  2⤵
  PID:1768
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq devenv.exe" /NH
  2⤵
  PID:3104
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq windbg.exe" /NH
  2⤵
  PID:1348
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq immunitydebugger.exe" /NH
  2⤵
  PID:3040
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:4300
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq apimonitor.exe" /NH
  2⤵
  PID:2672
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq autoruns.exe" /NH
  2⤵
  - Discovers running processes
  PID:3408
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:688
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq autorunsc.exe" /NH
  2⤵
  PID:4500
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq filemon.exe" /NH
  2⤵
  - Discovers running processes
  PID:3456
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq regmon.exe" /NH
  2⤵
  PID:2256
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq resourcehacker.exe" /NH
  2⤵
  - Discovers running processes
  PID:4772
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq vmtoolsd.exe" /NH
  2⤵
  - Discovers running processes
  PID:3488
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq vmwaretray.exe" /NH
  2⤵
  PID:4904
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq vmwareuser.exe" /NH
  2⤵
  - Discovers running processes
  PID:1688
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq vmusrvc.exe" /NH
  2⤵
  PID:3004
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq vmsrvc.exe" /NH
  2⤵
  PID:1604
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq vboxservice.exe" /NH
  2⤵
  PID:3628
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq vboxtray.exe" /NH
  2⤵
  PID:4760
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq xenservice.exe" /NH
  2⤵
  PID:64
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq qemu-ga.exe" /NH
  2⤵
  PID:2356
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq sandboxie.exe" /NH
  2⤵
  PID:3788
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq sandboxiedcomlaunch.exe" /NH
  2⤵
  PID:376
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq sandboxierpcss.exe" /NH
  2⤵
  - Discovers running processes
  PID:968
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq joeboxcontrol.exe" /NH
  2⤵
  - Discovers running processes
  PID:4752
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq joeboxserver.exe" /NH
  2⤵
  PID:4480
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq prl_tools.exe" /NH
  2⤵
  PID:3480
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq prl_cc.exe" /NH
  2⤵
  PID:1988
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:3104
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq vmacthlp.exe" /NH
  2⤵
  PID:3764
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:1348
- C:\Windows\system32\schtasks.exe
  schtasks /Create /XML C:\Users\Admin\AppData\Local\Temp\Updater_task.xml /TN Updater /F
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:1288
- C:\Users\Admin\AppData\Local\Discord\Updater.exe
  C:\Users\Admin\AppData\Local\Discord\Updater.exe --watchdog 3872 --wd-target C:\Users\Admin\AppData\Local\Discord\Updater.exe
  2⤵
  - Executes dropped EXE
  PID:2480
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -NonInteractive -WindowStyle Hidden -Command "(Get-WmiObject -Query \"select Name from Win32_Processor\").Name"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:944
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -NonInteractive -WindowStyle Hidden -Command "(Get-WmiObject -Query \"Select Name from Win32_VideoController\").Name"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:3304
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -NonInteractive -WindowStyle Hidden -Command "(Get-WmiObject -Query \"select Caption from Win32_OperatingSystem\").Caption"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:4512
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -NonInteractive -WindowStyle Hidden -Command "(Get-WmiObject -Query \"select TotalPhysicalMemory from Win32_ComputerSystem\").TotalPhysicalMemory"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:4236

C:\Windows\System32\sihclient.exe
C:\Windows\System32\sihclient.exe /cv +9yMqLKqRUGC01tkS6KTUA.0.1
1⤵
PID:2932

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Updater.exe

Path C:\Users\Admin\AppData\Local\Discord\Updater.exe
Size 5.6MB
SHA256 aa8f493aa9999c347111187cd8af93e6818da502820431c91400dc0b8b939365
MD5 47439fc3b9d0045a2c6a69fd1f8182db
SHA1 7615cefa5a4cbaa5ae29deb8efcab027452799a3
SHA512 42ad85463d4def6f99117d63a4d8340d122fb6d9e4aabd90907d8164c355fb1375f3cf6ed153ef17b789925546989c554e25bfd6533f3190a7a70f1d5c623b85
SSDEEP 98304:zC7YA26J0Djx3ZMNPDZsrR7z9IGh8A0/KeszS3sGwSpUGNV3IIXu8yNuungdoj:uh2b2sNH7yWSwMUGv4wy+O
TLSH
T1D1463350A21436B0F7D9A23EABB3E827467B565600F36DCF5B4981F7653F1C12AB8036
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 2KB
SHA256 56572269ec031c63d966c6d3b4712600b908d38826c59c0f9a8225d0a783e9f4
MD5 713ad359b75fe6d947468ec1825202b9
SHA1 19dcd19f18a2ad6deb581451aad724bd44a592a4
SHA512 4df344dec422bed85b186909dc7f9c35126b3bb45e100f18fb95b4a9943ace242479adf5f0194b054d38b67032498f897a5a54b49026efee0c4797cb5a5e54e8
TLSH
T18A51DB313375B1E4895A7F47192819C023BF8355FA98AF5CB65C621ED92740B9F222F3
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 64B
SHA256 787628c3dd129679416857bcb63c52f8477a02cfeadfe0d4d5d98eb7902c61d8
MD5 40588a42cb8549ecc094e7d45f28c74c
SHA1 65d5d1f79fe82009c3c4c6d2c7ce874939926b8b
SHA512 e77dd348027e9df604520e228061f2e9c3d87ad695567c81dd95976eaba7df580eb565bff8b485558a0561bdd0de6ac202ead1965f6c23f746e5542ff9bea3c6
MD5 SHA1 SHA512

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 64B
SHA256 a7de5177c68a64bd48b36d49e2853799f4ebcfa8e4761f7cc472f333dc5f65cf
MD5 446dd1cf97eaba21cf14d03aebc79f27
SHA1 36e4cc7367e0c7b40f4a8ace272941ea46373799
SHA512 a6d754709f30b122112ae30e5ab22486393c5021d33da4d1304c061863d2e1e79e8aeb029cae61261bb77d0e7becd53a7b0106d6ea4368b4c302464e3d941cf7
MD5 SHA1 SHA512

Submit Download

Updater_task.xml

Path C:\Users\Admin\AppData\Local\Temp\Updater_task.xml
Size 1KB
SHA256 c073886326054400298c946fd3ef0603df6bc4f6968457fcba1e82d65606ce74
MD5 f1911ec98cd6bbb4806c8aaf8b89c67f
SHA1 dee0e954cf207672553a3a01aaff844ae8bf0c83
SHA512 b6382a1f71375a0f57681eaeea245e3097795e2f28c5a0d85bf7e83935cfad53047d0cd58fcd4006d30b4cc9293ae02fbf5b2e2a7d3c0b6fe5a4f4d68767c74a
TLSH
T1F32132905C15F52F755A973ECB9153C3273E5B694AB64038D8CC4DBC648A1CA710397B
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_ii1qndcn.ghe.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_ii1qndcn.ghe.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

wruntime.log

Path C:\Users\Admin\AppData\Local\Temp\wruntime.log
Size 918B
SHA256 3dd774b2cc29df057bcd960a774c64a0442bfe64437a0198d98cfa55b385b61b
MD5 e72f3220174b85533b743b9c8e9609d3
SHA1 e74c92121cc3d2de2b939e2c39a9d88a90e09de6
SHA512 bb8b433ddd48d097a047e1466a3109c8ddcbe4baa5cc9475d738af406980db95c2d72939a9562e3eb66078913594d2e5712aeda25b2d2629c051e76fabb8b938
TLSH
T1261136C62CDE8B2045C592B7C5E3578B8570E80A1EC97A31DA7C824E32D551D7E87279
MD5 SHA1 SHA512 TLSH

Submit Download

wruntime.log

Path C:\Users\Admin\AppData\Local\Temp\wruntime.log
Size 1KB
SHA256 d8706a496b4b7d9907ce6e91eaac06f6922c6141a970b159d39593155d29d5b0
MD5 df740236aaecd49bccd6f007e585731d
SHA1 30bcee7b99ce517a213bb944b972834379f5fc8e
SHA512 9b8968797bec06691b3d06ed0b1941e40fb7ded28dc37a22839f49d90ad3846098c6c86945fb779cba49033d9f57c4e4b276a564a56f27e8875abf73af9906ab
TLSH
T13E215EC62CCE8F2099C596A7C193178B8530ED190EC93931EE78928E31E551D7D87279
MD5 SHA1 SHA512 TLSH

Submit Download

wruntime.log

Path C:\Users\Admin\AppData\Local\Temp\wruntime.log
Size 1KB
SHA256 a28db3fe4854d3fdc43b558091331ade80cace4b8806b3e3dcb3be3b5662d7d0
MD5 7e6e057b3f82c734abf68df74dc9c35c
SHA1 7cdc5f16fc8c5be8bcf057cffa7ea499f9a824b6
SHA512 e9d7d00fe597f5b882b1970cab0c8a3f7b7fec487447105ff6c2f007bd2448bf39284fbac257022ba8a92c4427931a1e3fadb820145a25252c192f3aa3c4eb04
TLSH
T130417BC56CDD8F209685A267C1A3178B8670AC190ECD3A31EEB891CE32E541D7E87279
MD5 SHA1 SHA512 TLSH

Submit Download

wruntime.log

Path C:\Users\Admin\AppData\Local\Temp\wruntime.log
Size 3KB
SHA256 c65de083e5127ce2d137922e58ffdb3c2569475cfc023afaac16fc9228a61fb2
MD5 0f6afe81c7d4e2940cb78a3307680f91
SHA1 759aaf6d83af75d7cbd3e9d082c9003adbea8e8d
SHA512 b4e29baaadd0e9177b7b4c12191849fe658044db8a01e8cf4222a483754bad30228d6f2eced3b8b90c235f632d142756b3383f917c6aeab174643cfb0c5ee883
TLSH
T1A251CE8178DA8D20A3C5619792E2075781779C780ECD2E31B9BD96CD31E403D7AABB7C
MD5 SHA1 SHA512 TLSH

Submit Download

memory/748-11-0x00000000005A0000-0x00000000013A0000-memory.dmp

Download

memory/748-0-0x00000000005A0000-0x00000000013A0000-memory.dmp

Download

memory/748-2-0x00000000005A0000-0x00000000013A0000-memory.dmp

Download

memory/748-1-0x00000000005A0000-0x00000000013A0000-memory.dmp

Download

memory/944-29-0x000001FBE85F0000-0x000001FBE8612000-memory.dmp

Download

memory/1676-17-0x0000000000060000-0x0000000000E60000-memory.dmp

Download

memory/1676-19-0x0000000000060000-0x0000000000E60000-memory.dmp

Download

memory/1676-68-0x0000000000060000-0x0000000000E60000-memory.dmp

Download

memory/1676-74-0x0000000000060000-0x0000000000E60000-memory.dmp

Download

memory/1676-77-0x0000000000060000-0x0000000000E60000-memory.dmp

Download

memory/1676-13-0x0000000000060000-0x0000000000E60000-memory.dmp

Download

memory/2480-88-0x0000000000060000-0x0000000000E60000-memory.dmp

Download

memory/2480-94-0x0000000000060000-0x0000000000E60000-memory.dmp

Download

memory/2480-128-0x0000000000060000-0x0000000000E60000-memory.dmp

Download

memory/2480-126-0x0000000000060000-0x0000000000E60000-memory.dmp

Download

memory/2480-124-0x0000000000060000-0x0000000000E60000-memory.dmp

Download

memory/2480-122-0x0000000000060000-0x0000000000E60000-memory.dmp

Download

memory/2480-120-0x0000000000060000-0x0000000000E60000-memory.dmp

Download

memory/2480-71-0x0000000000060000-0x0000000000E60000-memory.dmp

Download

memory/2480-118-0x0000000000060000-0x0000000000E60000-memory.dmp

Download

memory/2480-116-0x0000000000060000-0x0000000000E60000-memory.dmp

Download

memory/2480-114-0x0000000000060000-0x0000000000E60000-memory.dmp

Download

memory/2480-76-0x0000000000060000-0x0000000000E60000-memory.dmp

Download

memory/2480-112-0x0000000000060000-0x0000000000E60000-memory.dmp

Download

memory/2480-110-0x0000000000060000-0x0000000000E60000-memory.dmp

Download

memory/2480-79-0x0000000000060000-0x0000000000E60000-memory.dmp

Download

memory/2480-27-0x0000000000060000-0x0000000000E60000-memory.dmp

Download

memory/2480-81-0x0000000000060000-0x0000000000E60000-memory.dmp

Download

memory/2480-108-0x0000000000060000-0x0000000000E60000-memory.dmp

Download

memory/2480-83-0x0000000000060000-0x0000000000E60000-memory.dmp

Download

memory/2480-106-0x0000000000060000-0x0000000000E60000-memory.dmp

Download

memory/2480-86-0x0000000000060000-0x0000000000E60000-memory.dmp

Download

memory/2480-104-0x0000000000060000-0x0000000000E60000-memory.dmp

Download

memory/2480-102-0x0000000000060000-0x0000000000E60000-memory.dmp

Download

memory/2480-100-0x0000000000060000-0x0000000000E60000-memory.dmp

Download

memory/2480-90-0x0000000000060000-0x0000000000E60000-memory.dmp

Download

memory/2480-98-0x0000000000060000-0x0000000000E60000-memory.dmp

Download

memory/2480-92-0x0000000000060000-0x0000000000E60000-memory.dmp

Download

memory/2480-96-0x0000000000060000-0x0000000000E60000-memory.dmp

Download

memory/3872-80-0x0000000000060000-0x0000000000E60000-memory.dmp

Download

memory/3872-111-0x0000000000060000-0x0000000000E60000-memory.dmp

Download

memory/3872-93-0x0000000000060000-0x0000000000E60000-memory.dmp

Download

memory/3872-97-0x0000000000060000-0x0000000000E60000-memory.dmp

Download

memory/3872-91-0x0000000000060000-0x0000000000E60000-memory.dmp

Download

memory/3872-99-0x0000000000060000-0x0000000000E60000-memory.dmp

Download

memory/3872-89-0x0000000000060000-0x0000000000E60000-memory.dmp

Download

memory/3872-101-0x0000000000060000-0x0000000000E60000-memory.dmp

Download

memory/3872-20-0x0000000000060000-0x0000000000E60000-memory.dmp

Download

memory/3872-103-0x0000000000060000-0x0000000000E60000-memory.dmp

Download

memory/3872-87-0x0000000000060000-0x0000000000E60000-memory.dmp

Download

memory/3872-105-0x0000000000060000-0x0000000000E60000-memory.dmp

Download

memory/3872-84-0x0000000000060000-0x0000000000E60000-memory.dmp

Download

memory/3872-107-0x0000000000060000-0x0000000000E60000-memory.dmp

Download

memory/3872-82-0x0000000000060000-0x0000000000E60000-memory.dmp

Download

memory/3872-109-0x0000000000060000-0x0000000000E60000-memory.dmp

Download

memory/3872-78-0x0000000000060000-0x0000000000E60000-memory.dmp

Download

memory/3872-95-0x0000000000060000-0x0000000000E60000-memory.dmp

Download

memory/3872-15-0x0000000000060000-0x0000000000E60000-memory.dmp

Download

memory/3872-113-0x0000000000060000-0x0000000000E60000-memory.dmp

Download

memory/3872-75-0x0000000000060000-0x0000000000E60000-memory.dmp

Download

memory/3872-115-0x0000000000060000-0x0000000000E60000-memory.dmp

Download

memory/3872-127-0x0000000000060000-0x0000000000E60000-memory.dmp

Download

memory/3872-117-0x0000000000060000-0x0000000000E60000-memory.dmp

Download

memory/3872-125-0x0000000000060000-0x0000000000E60000-memory.dmp

Download

memory/3872-119-0x0000000000060000-0x0000000000E60000-memory.dmp

Download

memory/3872-21-0x0000000000060000-0x0000000000E60000-memory.dmp

Download

memory/3872-121-0x0000000000060000-0x0000000000E60000-memory.dmp

Download

memory/3872-69-0x0000000000060000-0x0000000000E60000-memory.dmp

Download

memory/3872-123-0x0000000000060000-0x0000000000E60000-memory.dmp

Download

memory/4164-18-0x0000000000060000-0x0000000000E60000-memory.dmp

Download

memory/4164-73-0x0000000000060000-0x0000000000E60000-memory.dmp

Download

memory/4164-67-0x0000000000060000-0x0000000000E60000-memory.dmp

Download

memory/4164-16-0x0000000000060000-0x0000000000E60000-memory.dmp

Download

memory/4164-10-0x0000000000060000-0x0000000000E60000-memory.dmp

Download