Overview

overview

8

Static

static

3

2026-10-23...ra.exe

windows10-2004-x64

8

2026-10-23...ra.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    121s
  • max time network
    135s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260911-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    23/10/2026, 07:30

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-10-23_c952dfb6d5cb62eed97a1a6d78e7b57f_amadey_cobalt-strike_darkgate_elex_glassworm_icedid_kara.exe
  • Size 29.0MB
  • Sample261023-jb653scd84
  • SHA256 4bbccea6ff853e7b308c762882df82d6b4079cee0908f7664898f6f8820f16af
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
discoveryexecutionlateral_movementpersistence

Malware Config

Signatures

  • Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

    Run Powershell to get system information as a root user.

    execution
  • Drops file in Drivers directory 2 IoCs
  • Sets service image path in registry 3 TTPs 2 IoCs

    This determines the executable launched when a service starts. It can be used to establish persistence.

    persistence
  • Executes dropped EXE 5 IoCs
  • Loads dropped DLL 1 IoCs
  • Checks for any installed AV software in registry 1 TTPs 1 IoCs
  • Enumerates connected drives 3 TTPs 64 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Maps connected drives based on registry 3 TTPs 5 IoCs

    Disk information is often read in order to detect sandboxing environments.

  • Remote Services: SMB/Windows Admin Shares 1 TTPs 1 IoCs

    Adversaries may use Valid Accounts to interact with a remote network share using Server Message Block (SMB).

    lateral_movement
  • Discovers running processes 1 TTPs 2 IoCs

    Running process information can be used to identify security tools or plan follow-on actions.

    discovery
  • Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

    The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

    discovery
  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 6 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 4 IoCs
  • Gathers network information 2 TTPs 1 IoCs

    Uses commandline utility to view network configuration.

  • Suspicious behavior: EnumeratesProcesses 30 IoCs
  • Suspicious behavior: LoadsDriver 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 43 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-10-23_c952dfb6d5cb62eed97a1a6d78e7b57f_amadey_cobalt-strike_darkgate_elex_glassworm_icedid_kara.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-10-23_c952dfb6d5cb62eed97a1a6d78e7b57f_amadey_cobalt-strike_darkgate_elex_glassworm_icedid_kara.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:2156
    • C:\Users\Admin\AppData\Local\Temp\cwte58dada\CisWarrantyTool.exe
      C:\Users\Admin\AppData\Local\Temp\cwte58dada\CisWarrantyTool.exe --out "C:\Users\Admin\AppData\Local\Temp\CisReportData_OPSJLZUQ_2026-10-23_08-30-57.zip"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Checks for any installed AV software in registry
      • Enumerates connected drives
      • Reads the TCP/IP host and domain name from the registry
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:2256
      • C:\Windows\SYSTEM32\reg.exe
        reg.exe export "HKLM\SYSTEM\CurrentControlSet\Services\CmdAgent" "C:\Users\Admin\AppData\Local\Temp\CisReportData_OPSJLZUQ_2026-10-23_08-30-57\Configs\Config_1.reg.tmp" /y
        3⤵
          PID:5076
        • C:\Windows\SYSTEM32\reg.exe
          reg.exe export "HKLM\SOFTWARE\COMODO" "C:\Users\Admin\AppData\Local\Temp\CisReportData_OPSJLZUQ_2026-10-23_08-30-57\Configs\Config_2.reg.tmp" /y
          3⤵
            PID:4932
          • C:\Windows\SYSTEM32\cmd.exe
            cmd
            3⤵
              PID:4052
            • C:\Windows\SYSTEM32\netstat.exe
              netstat.exe -a -n -o
              3⤵
              • Gathers network information
              • Suspicious use of AdjustPrivilegeToken
              PID:2044
            • C:\Windows\SYSTEM32\msinfo32.exe
              msinfo32.exe /nfo "C:\Users\Admin\AppData\Local\Temp\CisReportData_OPSJLZUQ_2026-10-23_08-30-57\WindowsState\MsInfo32\msinfo32.nfo"
              3⤵
              • Checks SCSI registry key(s)
              • Enumerates system info in registry
              PID:1860
            • C:\Windows\SYSTEM32\wevtutil.exe
              wevtutil.exe epl "Application" "C:\Users\Admin\AppData\Local\Temp\CisReportData_OPSJLZUQ_2026-10-23_08-30-57\WindowsState\WindowsEvents\Application.evtx"
              3⤵
              • Suspicious use of AdjustPrivilegeToken
              PID:5072
            • C:\Windows\SYSTEM32\wevtutil.exe
              wevtutil.exe epl "Security" "C:\Users\Admin\AppData\Local\Temp\CisReportData_OPSJLZUQ_2026-10-23_08-30-57\WindowsState\WindowsEvents\Security.evtx"
              3⤵
              • Suspicious use of AdjustPrivilegeToken
              PID:3736
            • C:\Windows\SYSTEM32\wevtutil.exe
              wevtutil.exe epl "Setup" "C:\Users\Admin\AppData\Local\Temp\CisReportData_OPSJLZUQ_2026-10-23_08-30-57\WindowsState\WindowsEvents\Setup.evtx"
              3⤵
              • Suspicious use of AdjustPrivilegeToken
              PID:4608
            • C:\Windows\SYSTEM32\wevtutil.exe
              wevtutil.exe epl "System" "C:\Users\Admin\AppData\Local\Temp\CisReportData_OPSJLZUQ_2026-10-23_08-30-57\WindowsState\WindowsEvents\System.evtx"
              3⤵
              • Suspicious use of AdjustPrivilegeToken
              PID:1600
            • C:\Windows\SYSTEM32\wevtutil.exe
              wevtutil.exe epl "COMODO Client - Security CEF" "C:\Users\Admin\AppData\Local\Temp\CisReportData_OPSJLZUQ_2026-10-23_08-30-57\WindowsState\WindowsEvents\COMODO Client - Security CEF.evtx"
              3⤵
              • Suspicious use of AdjustPrivilegeToken
              PID:3528
            • C:\Windows\SYSTEM32\wevtutil.exe
              wevtutil.exe epl "COMODO Internet Security CEF" "C:\Users\Admin\AppData\Local\Temp\CisReportData_OPSJLZUQ_2026-10-23_08-30-57\WindowsState\WindowsEvents\COMODO Internet Security CEF.evtx"
              3⤵
              • Suspicious use of AdjustPrivilegeToken
              PID:3632
            • C:\Windows\SYSTEM32\wevtutil.exe
              wevtutil.exe epl "COMODO Client - Security Trace" "C:\Users\Admin\AppData\Local\Temp\CisReportData_OPSJLZUQ_2026-10-23_08-30-57\WindowsState\WindowsEvents\COMODO Client - Security Trace.evtx"
              3⤵
              • Suspicious use of AdjustPrivilegeToken
              PID:4928
            • C:\Windows\SYSTEM32\wevtutil.exe
              wevtutil.exe epl "COMODO Internet Security Trace" "C:\Users\Admin\AppData\Local\Temp\CisReportData_OPSJLZUQ_2026-10-23_08-30-57\WindowsState\WindowsEvents\COMODO Internet Security Trace.evtx"
              3⤵
              • Suspicious use of AdjustPrivilegeToken
              PID:2060
            • C:\Windows\SYSTEM32\schtasks.exe
              schtasks.exe /query /FO CSV /V
              3⤵
                PID:3388
              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                powershell "$FormatEnumerationLimit=-1; Get-HotFix"
                3⤵
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of AdjustPrivilegeToken
                PID:4144
              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                powershell "$FormatEnumerationLimit=-1; Get-WindowsUpdateLog"
                3⤵
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of AdjustPrivilegeToken
                • Suspicious use of WriteProcessMemory
                PID:2508
                • C:\Windows\system32\tracerpt.exe
                  "C:\Windows\system32\tracerpt.exe" C:\Windows\logs\WindowsUpdate\WindowsUpdate.20260911.153228.502.1.etl C:\Windows\logs\WindowsUpdate\WindowsUpdate.20260911.153445.541.1.etl C:\Windows\logs\WindowsUpdate\WindowsUpdate.20260911.153709.607.1.etl C:\Windows\logs\WindowsUpdate\WindowsUpdate.20260911.153931.527.1.etl C:\Windows\logs\WindowsUpdate\WindowsUpdate.20260911.154155.576.1.etl C:\Windows\logs\WindowsUpdate\WindowsUpdate.20260911.154358.559.1.etl C:\Windows\logs\WindowsUpdate\WindowsUpdate.20261023.083101.083.1.etl -of CSV -o C:\Users\Admin\AppData\Local\Temp\WindowsUpdateLog\wuetl.CSV.tmp.00000 -i C:\Windows\System32\wuaueng.dll;C:\Windows\System32\wuapi.dll;C:\Windows\System32\wuuhext.dll;C:\Windows\System32\wuuhmobile.dll;C:\Windows\System32\wuautoappupdate.dll;C:\Windows\System32\storewuauth.dll;C:\Windows\System32\wuauclt.exe; -y
                  4⤵
                    PID:1064
                • C:\Users\Admin\AppData\Local\Temp\cwte58dada\handle.exe
                  "C:\Users\Admin\AppData\Local\Temp\cwte58dada\handle.exe" -accepteula -a -u
                  3⤵
                  • Executes dropped EXE
                  • System Location Discovery: System Language Discovery
                  • Suspicious use of WriteProcessMemory
                  PID:1676
                  • C:\Users\Admin\AppData\Local\Temp\handle64.exe
                    "C:\Users\Admin\AppData\Local\Temp\cwte58dada\handle.exe" -accepteula -a -u
                    4⤵
                    • Drops file in Drivers directory
                    • Sets service image path in registry
                    • Executes dropped EXE
                    • Enumerates connected drives
                    • Suspicious behavior: EnumeratesProcesses
                    • Suspicious behavior: LoadsDriver
                    • Suspicious use of AdjustPrivilegeToken
                    PID:4832
                • C:\Users\Admin\AppData\Local\Temp\cwte58dada\handle.exe
                  "C:\Users\Admin\AppData\Local\Temp\cwte58dada\handle.exe" -accepteula -s
                  3⤵
                  • Executes dropped EXE
                  • System Location Discovery: System Language Discovery
                  • Suspicious use of WriteProcessMemory
                  PID:2216
                  • C:\Users\Admin\AppData\Local\Temp\handle64.exe
                    "C:\Users\Admin\AppData\Local\Temp\cwte58dada\handle.exe" -accepteula -s
                    4⤵
                    • Drops file in Drivers directory
                    • Sets service image path in registry
                    • Executes dropped EXE
                    • Enumerates connected drives
                    • Suspicious behavior: EnumeratesProcesses
                    • Suspicious behavior: LoadsDriver
                    PID:2372
                • C:\Windows\SYSTEM32\tasklist.exe
                  tasklist.exe /svc
                  3⤵
                  • Discovers running processes
                  PID:3452
                • C:\Windows\SYSTEM32\tasklist.exe
                  tasklist.exe /v
                  3⤵
                  • Discovers running processes
                  • Suspicious behavior: EnumeratesProcesses
                  PID:1864
                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                  powershell "$FormatEnumerationLimit=-1; [Environment]::GetEnvironmentVariables('Machine') | Out-String -Width 4096"
                  3⤵
                  • Suspicious behavior: EnumeratesProcesses
                  PID:4044
                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                  powershell "$FormatEnumerationLimit=-1; [Environment]::GetEnvironmentVariables('User') | Out-String -Width 4096"
                  3⤵
                  • Suspicious behavior: EnumeratesProcesses
                  PID:4340
                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                  powershell "$FormatEnumerationLimit=-1; [Environment]::GetEnvironmentVariables() | Out-String -Width 4096"
                  3⤵
                  • Suspicious behavior: EnumeratesProcesses
                  PID:1956
                • C:\Windows\SYSTEM32\reg.exe
                  reg.exe export "HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Uninstall" "C:\Users\Admin\AppData\Local\Temp\CisReportData_OPSJLZUQ_2026-10-23_08-30-57\WindowsState\WindowsInstallerHives\HKU_.DEFAULT_Software_Microsoft_Windows_CurrentVersion_Uninstall.reg" /y
                  3⤵
                    PID:3824
                  • C:\Windows\SYSTEM32\reg.exe
                    reg.exe export "HKU\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Uninstall" "C:\Users\Admin\AppData\Local\Temp\CisReportData_OPSJLZUQ_2026-10-23_08-30-57\WindowsState\WindowsInstallerHives\HKU_S-1-5-19_Software_Microsoft_Windows_CurrentVersion_Uninstall.reg" /y
                    3⤵
                      PID:928
                    • C:\Windows\SYSTEM32\reg.exe
                      reg.exe export "HKU\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Uninstall" "C:\Users\Admin\AppData\Local\Temp\CisReportData_OPSJLZUQ_2026-10-23_08-30-57\WindowsState\WindowsInstallerHives\HKU_S-1-5-20_Software_Microsoft_Windows_CurrentVersion_Uninstall.reg" /y
                      3⤵
                        PID:1832
                      • C:\Windows\SYSTEM32\reg.exe
                        reg.exe export "HKU\S-1-5-21-240542094-4193773837-3211495583-1000\Software\Microsoft\Windows\CurrentVersion\Uninstall" "C:\Users\Admin\AppData\Local\Temp\CisReportData_OPSJLZUQ_2026-10-23_08-30-57\WindowsState\WindowsInstallerHives\HKU_S-1-5-21-240542094-4193773837-3211495583-1000_Software_Microsoft_Windows_CurrentVersion_Uninstall.reg" /y
                        3⤵
                          PID:1744
                        • C:\Windows\SYSTEM32\reg.exe
                          reg.exe export "HKU\S-1-5-21-240542094-4193773837-3211495583-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Uninstall" "C:\Users\Admin\AppData\Local\Temp\CisReportData_OPSJLZUQ_2026-10-23_08-30-57\WindowsState\WindowsInstallerHives\HKU_S-1-5-21-240542094-4193773837-3211495583-1000_Classes_Software_Microsoft_Windows_CurrentVersion_Uninstall.reg" /y
                          3⤵
                            PID:3424
                          • C:\Windows\SYSTEM32\reg.exe
                            reg.exe export "HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Uninstall" "C:\Users\Admin\AppData\Local\Temp\CisReportData_OPSJLZUQ_2026-10-23_08-30-57\WindowsState\WindowsInstallerHives\HKU_S-1-5-18_Software_Microsoft_Windows_CurrentVersion_Uninstall.reg" /y
                            3⤵
                              PID:1884
                            • C:\Windows\SYSTEM32\reg.exe
                              reg.exe export "HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall" "C:\Users\Admin\AppData\Local\Temp\CisReportData_OPSJLZUQ_2026-10-23_08-30-57\WindowsState\WindowsInstallerHives\HKLM_Software_Microsoft_Windows_CurrentVersion_Uninstall.reg" /y
                              3⤵
                                PID:1792
                              • C:\Windows\SYSTEM32\reg.exe
                                reg.exe export "HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall" "C:\Users\Admin\AppData\Local\Temp\CisReportData_OPSJLZUQ_2026-10-23_08-30-57\WindowsState\WindowsInstallerHives\HKLM_SOFTWARE_WOW6432Node_Microsoft_Windows_CurrentVersion_Uninstall.reg" /y
                                3⤵
                                  PID:3276
                                • C:\Windows\SYSTEM32\reg.exe
                                  reg.exe export "HKLM\SYSTEM\CurrentControlSet\Services" "C:\Users\Admin\AppData\Local\Temp\CisReportData_OPSJLZUQ_2026-10-23_08-30-57\WindowsState\WindowsInstallerHives\HKLM_SYSTEM_CurrentControlSet_Services.reg" /y
                                  3⤵
                                  • Maps connected drives based on registry
                                  • Remote Services: SMB/Windows Admin Shares
                                  PID:752
                                • C:\Windows\SYSTEM32\reg.exe
                                  reg.exe export "HKLM\SYSTEM\VritualRoot" "C:\Users\Admin\AppData\Local\Temp\CisReportData_OPSJLZUQ_2026-10-23_08-30-57\WindowsState\WindowsInstallerHives\HKLM_SYSTEM_VritualRoot.reg" /y
                                  3⤵
                                    PID:2068
                                  • C:\Windows\SYSTEM32\reg.exe
                                    reg.exe export "HKLM\SYSTEM\VirtualRoot" "C:\Users\Admin\AppData\Local\Temp\CisReportData_OPSJLZUQ_2026-10-23_08-30-57\WindowsState\WindowsInstallerHives\HKLM_SYSTEM_VirtualRoot.reg" /y
                                    3⤵
                                      PID:1148
                                    • C:\Windows\SYSTEM32\reg.exe
                                      reg.exe export "HKLM\SOFTWARE\Classes\Installer\Products" "C:\Users\Admin\AppData\Local\Temp\CisReportData_OPSJLZUQ_2026-10-23_08-30-57\WindowsState\WindowsInstallerHives\HKLM_SOFTWARE_Classes_Installer_Products.reg" /y
                                      3⤵
                                        PID:3528
                                      • C:\Windows\SYSTEM32\reg.exe
                                        reg.exe export "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options" "C:\Users\Admin\AppData\Local\Temp\CisReportData_OPSJLZUQ_2026-10-23_08-30-57\WindowsState\WindowsInstallerHives\HKLM_SOFTWARE_Microsoft_Windows NT_CurrentVersion_Image File Execution Options.reg" /y
                                        3⤵
                                          PID:1396
                                        • C:\Windows\SYSTEM32\reg.exe
                                          reg.exe export "HKCR\Installer\Products" "C:\Users\Admin\AppData\Local\Temp\CisReportData_OPSJLZUQ_2026-10-23_08-30-57\WindowsState\WindowsInstallerHives\HKCR_Installer_Products.reg" /y
                                          3⤵
                                            PID:1212
                                          • C:\Windows\SYSTEM32\reg.exe
                                            reg.exe export "HKLM\SYSTEM\CurrentControlSet\Control\Class\{4d36e96b-e325-11ce-bfc1-08002be10318}" "C:\Users\Admin\AppData\Local\Temp\CisReportData_OPSJLZUQ_2026-10-23_08-30-57\WindowsState\WindowsInstallerHives\HKLM_SYSTEM_CurrentControlSet_Control_Class_{4d36e96b-e325-11ce-bfc1-08002be10318}.reg" /y
                                            3⤵
                                              PID:4908
                                            • C:\Windows\SYSTEM32\reg.exe
                                              reg.exe export "HKCR\CLSID" "C:\Users\Admin\AppData\Local\Temp\CisReportData_OPSJLZUQ_2026-10-23_08-30-57\WindowsState\WindowsInstallerHives\HKCR_CLSID.reg" /y
                                              3⤵
                                                PID:2992
                                              • C:\Windows\SYSTEM32\reg.exe
                                                reg.exe export "HKLM\SOFTWARE\Classes\CLSID" "C:\Users\Admin\AppData\Local\Temp\CisReportData_OPSJLZUQ_2026-10-23_08-30-57\WindowsState\WindowsInstallerHives\HKLM_SOFTWARE_Classes_CLSID.reg" /y
                                                3⤵
                                                  PID:5000
                                                • C:\Windows\SYSTEM32\reg.exe
                                                  reg.exe export "SOFTWARE\Classes\CLSID" "C:\Users\Admin\AppData\Local\Temp\CisReportData_OPSJLZUQ_2026-10-23_08-30-57\WindowsState\WindowsInstallerHives\SOFTWARE_Classes_CLSID.reg" /y
                                                  3⤵
                                                    PID:4288
                                                  • C:\Windows\SYSTEM32\reg.exe
                                                    reg.exe export "HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management" "C:\Users\Admin\AppData\Local\Temp\CisReportData_OPSJLZUQ_2026-10-23_08-30-57\WindowsState\WindowsInstallerHives\HKLM_SYSTEM_CurrentControlSet_Control_Session Manager_Memory Management.reg" /y
                                                    3⤵
                                                      PID:2344
                                                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                      powershell "$FormatEnumerationLimit=-1; Get-CimInstance -Namespace root/SecurityCenter2 -ClassName FirewallProduct"
                                                      3⤵
                                                      • Command and Scripting Interpreter: PowerShell
                                                      PID:1752
                                                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                      powershell "$FormatEnumerationLimit=-1; Get-CimInstance -Namespace root/SecurityCenter2 -ClassName AntivirusProduct"
                                                      3⤵
                                                      • Command and Scripting Interpreter: PowerShell
                                                      PID:4280

                                                Network

                                                      MITRE ATT&CK Enterprise v16

                                                      Reconnaissance

                                                      Resource Development

                                                      Initial Access

                                                      Execution

                                                      Command and Scripting Interpreter

                                                      2
                                                      T1059

                                                      PowerShell

                                                      1
                                                      T1059.001

                                                      Persistence

                                                      Boot or Logon Autostart Execution

                                                      1
                                                      T1547

                                                      Registry Run Keys / Startup Folder

                                                      1
                                                      T1547.001

                                                      Create or Modify System Process

                                                      1
                                                      T1543

                                                      Windows Service

                                                      1
                                                      T1543.003

                                                      Privilege Escalation

                                                      Boot or Logon Autostart Execution

                                                      1
                                                      T1547

                                                      Registry Run Keys / Startup Folder

                                                      1
                                                      T1547.001

                                                      Create or Modify System Process

                                                      1
                                                      T1543

                                                      Windows Service

                                                      1
                                                      T1543.003

                                                      Defense Evasion

                                                      Modify Registry

                                                      1
                                                      T1112

                                                      Credential Access

                                                      Discovery

                                                      Peripheral Device Discovery

                                                      3
                                                      T1120

                                                      Process Discovery

                                                      1
                                                      T1057

                                                      Query Registry

                                                      5
                                                      T1012

                                                      Software Discovery

                                                      1
                                                      T1518

                                                      Security Software Discovery

                                                      1
                                                      T1518.001

                                                      System Information Discovery

                                                      5
                                                      T1082

                                                      System Location Discovery

                                                      1
                                                      T1614

                                                      System Language Discovery

                                                      1
                                                      T1614.001

                                                      System Network Configuration Discovery

                                                      1
                                                      T1016

                                                      Lateral Movement

                                                      Remote Services

                                                      1
                                                      T1021

                                                      SMB/Windows Admin Shares

                                                      1
                                                      T1021.002

                                                      Collection

                                                      Command and Control

                                                      Exfiltration

                                                      Impact

                                                      Replay Monitor

                                                      Loading Replay Monitor...

                                                      Downloads

                                                      powershell.exe.log
                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
                                                      • Size 2KB
                                                      • SHA256 b1f292b6199aa29c7fafbca007e5f9e3f68edcbbca1965bc828cc92dc0f18bb8
                                                      • MD5 SHA1 SHA512 TLSH
                                                      Submit Download

                                                      StartupProfileData-NonInteractive
                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                      • Size 1KB
                                                      • SHA256 f891a36b1c9871c4aee44d59723c6847b84c7635c705d11095cc8e1517274dcc
                                                      • MD5 SHA1 SHA512 TLSH
                                                      Submit Download

                                                      StartupProfileData-NonInteractive
                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                      • Size 1KB
                                                      • SHA256 f7bc65b2962543bb5165f2b1bb6b3390ed3b55801475b2fd7701129cc8a081fd
                                                      • MD5 SHA1 SHA512 TLSH
                                                      Submit Download

                                                      StartupProfileData-NonInteractive
                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                      • Size 1KB
                                                      • SHA256 5950586396814b38bfdbb86757839fc8c7ce3eb73577775473c29ce6be81fe3e
                                                      • MD5 SHA1 SHA512 TLSH
                                                      Submit Download

                                                      StartupProfileData-NonInteractive
                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                      • Size 1KB
                                                      • SHA256 65b99e1cd03f7c62b83098b1e5fa357f9983b523a017e1043842f73de9686be8
                                                      • MD5 SHA1 SHA512 TLSH
                                                      Submit Download

                                                      StartupProfileData-NonInteractive
                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                      • Size 1KB
                                                      • SHA256 218d487f881ce9640acd16f7476b445471b83671569e99973f77d0bbf6c42ffa
                                                      • MD5 SHA1 SHA512 TLSH
                                                      Submit Download

                                                      StartupProfileData-NonInteractive
                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                      • Size 1KB
                                                      • SHA256 48034bc4dc62498ef7b9583fe448d03e79b12c9ed102a837a86be5d4eb3a24cc
                                                      • MD5 SHA1 SHA512 TLSH
                                                      Submit Download

                                                      C__VTROOT.txt
                                                      • Path C:\Users\Admin\AppData\Local\Temp\CisReportData_OPSJLZUQ_2026-10-23_08-30-57\DirectoryTree\C__VTROOT.txt
                                                      • Size 22B
                                                      • SHA256 83110204fbfcf242d593765cdc8dd866f257c38480bb1b9cba15d15163d4a13e
                                                      • MD5 SHA1 SHA512
                                                      Submit Download

                                                      Output.txt
                                                      • Path C:\Users\Admin\AppData\Local\Temp\CisReportData_OPSJLZUQ_2026-10-23_08-30-57\Output.txt
                                                      • Size 4KB
                                                      • SHA256 c43a8c6746147705102fa18bbd5bbc1b7346445e010a7b290df8ecbd649bf968
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                      Submit Download

                                                      Machine.txt
                                                      • Path C:\Users\Admin\AppData\Local\Temp\CisReportData_OPSJLZUQ_2026-10-23_08-30-57\WindowsState\Environment\Machine.txt
                                                      • Size 68KB
                                                      • SHA256 665f2cb09d5b90efe459cfa437af95c859d37f64c90058b7ee700e61925c1d64
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                      Submit Download

                                                      msinfo32.nfo
                                                      • Path C:\Users\Admin\AppData\Local\Temp\CisReportData_OPSJLZUQ_2026-10-23_08-30-57\WindowsState\MsInfo32\msinfo32.nfo
                                                      • Size 625KB
                                                      • SHA256 58997ff0e0239667e5edc9fc0e8dc03d12bf3c66f2c125a11902123e4deedad9
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                      Submit Download

                                                      handle.exe -a -u.txt
                                                      • Path C:\Users\Admin\AppData\Local\Temp\CisReportData_OPSJLZUQ_2026-10-23_08-30-57\WindowsState\Sysinternals\handle\handle.exe -a -u.txt
                                                      • Size 947KB
                                                      • SHA256 062540576c9abfc4f3d0ebe1f39a1c20d1d79019ecabf9e86cefa801ee2c06d7
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                      Submit Download

                                                      Internet Explorer.evtx
                                                      • Path C:\Users\Admin\AppData\Local\Temp\CisReportData_OPSJLZUQ_2026-10-23_08-30-57\WindowsState\WindowsEvents\Logs\Internet Explorer.evtx
                                                      • Size 68KB
                                                      • SHA256 f5f9e97a6b1ec8d46a9bd5b9d4ccae96521b85517b0337b248814d2e974a968b
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                      Submit Download

                                                      Microsoft-Windows-Biometrics%4Operational.evtx
                                                      • Path C:\Users\Admin\AppData\Local\Temp\CisReportData_OPSJLZUQ_2026-10-23_08-30-57\WindowsState\WindowsEvents\Logs\Microsoft-Windows-Biometrics%4Operational.evtx
                                                      • Size 68KB
                                                      • SHA256 584df1a1227290310b53262b249fd8d06d6fd9c8b3fc1d503265e6c55e565424
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                      Submit Download

                                                      Microsoft-Windows-BitLocker%4BitLocker Management.evtx
                                                      • Path C:\Users\Admin\AppData\Local\Temp\CisReportData_OPSJLZUQ_2026-10-23_08-30-57\WindowsState\WindowsEvents\Logs\Microsoft-Windows-BitLocker%4BitLocker Management.evtx
                                                      • Size 68KB
                                                      • SHA256 43983915a6aa28149caba549785ce2e37a3570cdf3058bbeb6d57848624738db
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                      Submit Download

                                                      Microsoft-Windows-Containers-BindFlt%4Operational.evtx
                                                      • Path C:\Users\Admin\AppData\Local\Temp\CisReportData_OPSJLZUQ_2026-10-23_08-30-57\WindowsState\WindowsEvents\Logs\Microsoft-Windows-Containers-BindFlt%4Operational.evtx
                                                      • Size 68KB
                                                      • SHA256 08abadd44dd70a149dda2a1f453698be9dc73662a60129012763f7d9cbe1c36c
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                      Submit Download

                                                      Microsoft-Windows-DeviceSetupManager%4Operational.evtx
                                                      • Path C:\Users\Admin\AppData\Local\Temp\CisReportData_OPSJLZUQ_2026-10-23_08-30-57\WindowsState\WindowsEvents\Logs\Microsoft-Windows-DeviceSetupManager%4Operational.evtx
                                                      • Size 68KB
                                                      • SHA256 30d57f4b590aee9671ce360bf1609c3d07333f31550ad12436cedaa7cda73430
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                      Submit Download

                                                      Microsoft-Windows-Kernel-EventTracing%4Admin.evtx
                                                      • Path C:\Users\Admin\AppData\Local\Temp\CisReportData_OPSJLZUQ_2026-10-23_08-30-57\WindowsState\WindowsEvents\Logs\Microsoft-Windows-Kernel-EventTracing%4Admin.evtx
                                                      • Size 68KB
                                                      • SHA256 6a19d2b337e4442e84b341b3513b5de87799fdaa2e8dd0c5854dabacbf76fa28
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                      Submit Download

                                                      Microsoft-Windows-MUI%4Operational.evtx
                                                      • Path C:\Users\Admin\AppData\Local\Temp\CisReportData_OPSJLZUQ_2026-10-23_08-30-57\WindowsState\WindowsEvents\Logs\Microsoft-Windows-MUI%4Operational.evtx
                                                      • Size 68KB
                                                      • SHA256 4d377166e1a8a956f5a5c8c3b407ee8ef2e5a9ec7116308a8527574b2c6db4ae
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                      Submit Download

                                                      Microsoft-Windows-SMBServer%4Operational.evtx
                                                      • Path C:\Users\Admin\AppData\Local\Temp\CisReportData_OPSJLZUQ_2026-10-23_08-30-57\WindowsState\WindowsEvents\Logs\Microsoft-Windows-SMBServer%4Operational.evtx
                                                      • Size 68KB
                                                      • SHA256 fee851e9c1e545aa5b22b51b22fb57a15bf5fde7fc8d92da452a0da74078e1d0
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                      Submit Download

                                                      Microsoft-Windows-UserPnp%4DeviceInstall.evtx
                                                      • Path C:\Users\Admin\AppData\Local\Temp\CisReportData_OPSJLZUQ_2026-10-23_08-30-57\WindowsState\WindowsEvents\Logs\Microsoft-Windows-UserPnp%4DeviceInstall.evtx
                                                      • Size 68KB
                                                      • SHA256 3d0cc67796a0d153791be0c88cd4e4a6f9dcdc50cd0624d3d9a10d70d1723c03
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                      Submit Download

                                                      Microsoft-Windows-VHDMP-Operational.evtx
                                                      • Path C:\Users\Admin\AppData\Local\Temp\CisReportData_OPSJLZUQ_2026-10-23_08-30-57\WindowsState\WindowsEvents\Logs\Microsoft-Windows-VHDMP-Operational.evtx
                                                      • Size 1.0MB
                                                      • SHA256 26cab2a11979cb3f3e03218fcd3700a55de888a88f0c86dab592ef93796972e8
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                      Submit Download

                                                      HKCR_CLSID.reg
                                                      • Path C:\Users\Admin\AppData\Local\Temp\CisReportData_OPSJLZUQ_2026-10-23_08-30-57\WindowsState\WindowsInstallerHives\HKCR_CLSID.reg
                                                      • Size 9.3MB
                                                      • SHA256 604026f10a9bf71dd6424cd5630c089b47aca88fa87d24d20d7ca1c05200eef1
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                      Submit Download

                                                      HKCR_Installer_Products.reg
                                                      • Path C:\Users\Admin\AppData\Local\Temp\CisReportData_OPSJLZUQ_2026-10-23_08-30-57\WindowsState\WindowsInstallerHives\HKCR_Installer_Products.reg
                                                      • Size 134KB
                                                      • SHA256 d8b51ba46c1d1acee9a11029f714e77f2947c758b602f7251d4f7da06c9955b1
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                      Submit Download

                                                      HKLM_SOFTWARE_Classes_CLSID.reg
                                                      • Path C:\Users\Admin\AppData\Local\Temp\CisReportData_OPSJLZUQ_2026-10-23_08-30-57\WindowsState\WindowsInstallerHives\HKLM_SOFTWARE_Classes_CLSID.reg
                                                      • Size 10.3MB
                                                      • SHA256 edc4054b6c66afab8a2c1a946b58c985d26e28de35a8ed4e8500aae106ae2da9
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                      Submit Download

                                                      HKLM_SOFTWARE_Classes_Installer_Products.reg
                                                      • Path C:\Users\Admin\AppData\Local\Temp\CisReportData_OPSJLZUQ_2026-10-23_08-30-57\WindowsState\WindowsInstallerHives\HKLM_SOFTWARE_Classes_Installer_Products.reg
                                                      • Size 139KB
                                                      • SHA256 7818b43114de77ebef54d21e2aba14f95e449fe5c472a09961bde6dbc2614f9b
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                      Submit Download

                                                      HKLM_SOFTWARE_Microsoft_Windows NT_CurrentVersion_Image File Execution Options.reg
                                                      • Path C:\Users\Admin\AppData\Local\Temp\CisReportData_OPSJLZUQ_2026-10-23_08-30-57\WindowsState\WindowsInstallerHives\HKLM_SOFTWARE_Microsoft_Windows NT_CurrentVersion_Image File Execution Options.reg
                                                      • Size 16KB
                                                      • SHA256 52893bb2d606c48c0f3075769a03332de84d130084a09d6f78514bab56e41def
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                      Submit Download

                                                      HKLM_SOFTWARE_WOW6432Node_Microsoft_Windows_CurrentVersion_Uninstall.reg
                                                      • Path C:\Users\Admin\AppData\Local\Temp\CisReportData_OPSJLZUQ_2026-10-23_08-30-57\WindowsState\WindowsInstallerHives\HKLM_SOFTWARE_WOW6432Node_Microsoft_Windows_CurrentVersion_Uninstall.reg
                                                      • Size 74KB
                                                      • SHA256 297181a7d96be18668809bc246058dcf056f655f2b92b090f996391812fe8b77
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                      Submit Download

                                                      HKLM_SYSTEM_CurrentControlSet_Control_Class_{4d36e96b-e325-11ce-bfc1-08002be10318}.reg
                                                      • Path C:\Users\Admin\AppData\Local\Temp\CisReportData_OPSJLZUQ_2026-10-23_08-30-57\WindowsState\WindowsInstallerHives\HKLM_SYSTEM_CurrentControlSet_Control_Class_{4d36e96b-e325-11ce-bfc1-08002be10318}.reg
                                                      • Size 2KB
                                                      • SHA256 4e55af11973cb2d2cff26443ff8690f68370fdab3a28dacfc55c67b7d7dd517d
                                                      • MD5 SHA1 SHA512 TLSH
                                                      Submit Download

                                                      HKLM_SYSTEM_CurrentControlSet_Control_Session Manager_Memory Management.reg
                                                      • Path C:\Users\Admin\AppData\Local\Temp\CisReportData_OPSJLZUQ_2026-10-23_08-30-57\WindowsState\WindowsInstallerHives\HKLM_SYSTEM_CurrentControlSet_Control_Session Manager_Memory Management.reg
                                                      • Size 2KB
                                                      • SHA256 238ce6451d3df0b19def585521aebd709b5736d14d83faf5f16befd13b34aae2
                                                      • MD5 SHA1 SHA512 TLSH
                                                      Submit Download

                                                      HKLM_SYSTEM_CurrentControlSet_Services.reg
                                                      • Path C:\Users\Admin\AppData\Local\Temp\CisReportData_OPSJLZUQ_2026-10-23_08-30-57\WindowsState\WindowsInstallerHives\HKLM_SYSTEM_CurrentControlSet_Services.reg
                                                      • Size 4.7MB
                                                      • SHA256 77a1533f75a53e1ac0f694745883fa60b12d4811f4c11ed0bef9d9c2d23648a1
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                      Submit Download

                                                      HKLM_Software_Microsoft_Windows_CurrentVersion_Uninstall.reg
                                                      • Path C:\Users\Admin\AppData\Local\Temp\CisReportData_OPSJLZUQ_2026-10-23_08-30-57\WindowsState\WindowsInstallerHives\HKLM_Software_Microsoft_Windows_CurrentVersion_Uninstall.reg
                                                      • Size 101KB
                                                      • SHA256 1e852b9c0bb08fdc77b33ac73e215886e2069081fed8b26329dd2d6ed8778e3f
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                      Submit Download

                                                      HKU_.DEFAULT_Software_Microsoft_Windows_CurrentVersion_Uninstall.reg
                                                      • Path C:\Users\Admin\AppData\Local\Temp\CisReportData_OPSJLZUQ_2026-10-23_08-30-57\WindowsState\WindowsInstallerHives\HKU_.DEFAULT_Software_Microsoft_Windows_CurrentVersion_Uninstall.reg
                                                      • Size 236B
                                                      • SHA256 2811e6a50770509497268a79bae7dc4aeaf963a7fb6b0a9a51ecc4c1b7b50dfe
                                                      • MD5 SHA1 SHA512 TLSH
                                                      Submit Download

                                                      HKU_S-1-5-18_Software_Microsoft_Windows_CurrentVersion_Uninstall.reg
                                                      • Path C:\Users\Admin\AppData\Local\Temp\CisReportData_OPSJLZUQ_2026-10-23_08-30-57\WindowsState\WindowsInstallerHives\HKU_S-1-5-18_Software_Microsoft_Windows_CurrentVersion_Uninstall.reg
                                                      • Size 236B
                                                      • SHA256 f94be6a11a412b79874e79b4371a2baa8818d45df3678860d67324fc8483df90
                                                      • MD5 SHA1 SHA512 TLSH
                                                      Submit Download

                                                      HKU_S-1-5-19_Software_Microsoft_Windows_CurrentVersion_Uninstall.reg
                                                      • Path C:\Users\Admin\AppData\Local\Temp\CisReportData_OPSJLZUQ_2026-10-23_08-30-57\WindowsState\WindowsInstallerHives\HKU_S-1-5-19_Software_Microsoft_Windows_CurrentVersion_Uninstall.reg
                                                      • Size 236B
                                                      • SHA256 44fd9be209ab259c5412b91e3225b1f1cbf563758e1ee0ed47b201213366aed2
                                                      • MD5 SHA1 SHA512 TLSH
                                                      Submit Download

                                                      HKU_S-1-5-20_Software_Microsoft_Windows_CurrentVersion_Uninstall.reg
                                                      • Path C:\Users\Admin\AppData\Local\Temp\CisReportData_OPSJLZUQ_2026-10-23_08-30-57\WindowsState\WindowsInstallerHives\HKU_S-1-5-20_Software_Microsoft_Windows_CurrentVersion_Uninstall.reg
                                                      • Size 236B
                                                      • SHA256 bf3825b456c3212c8810ec4291ac0fb7fa0d1ad714958fb951942aed264ad42f
                                                      • MD5 SHA1 SHA512 TLSH
                                                      Submit Download

                                                      HKU_S-1-5-21-240542094-4193773837-3211495583-1000_Software_Microsoft_Windows_CurrentVersion_Uninstall.reg
                                                      • Path C:\Users\Admin\AppData\Local\Temp\CisReportData_OPSJLZUQ_2026-10-23_08-30-57\WindowsState\WindowsInstallerHives\HKU_S-1-5-21-240542094-4193773837-3211495583-1000_Software_Microsoft_Windows_CurrentVersion_Uninstall.reg
                                                      • Size 1KB
                                                      • SHA256 8770fa6467719f7eea4fde77a2a5b873b4564588bf511f471ac4ff567ad7e7bd
                                                      • MD5 SHA1 SHA512 TLSH
                                                      Submit Download

                                                      Get-WindowsUpdateLog.log
                                                      • Path C:\Users\Admin\AppData\Local\Temp\CisReportData_OPSJLZUQ_2026-10-23_08-30-57\WindowsState\WindowsUpdates\Get-WindowsUpdateLog.log
                                                      • Size 1KB
                                                      • SHA256 7631a1119da86f12299d189135e4f05a086dc064636f2ac218851385650e1cfa
                                                      • MD5 SHA1 SHA512 TLSH
                                                      Submit Download

                                                      WindowsUpdatesList.txt
                                                      • Path C:\Users\Admin\AppData\Local\Temp\CisReportData_OPSJLZUQ_2026-10-23_08-30-57\WindowsState\WindowsUpdates\WindowsUpdatesList.txt
                                                      • Size 664B
                                                      • SHA256 5fe04435528327cafdb895c604820e7ddc3f2a989d490da871391ed34978865a
                                                      • MD5 SHA1 SHA512 TLSH
                                                      Submit Download

                                                      wuetl.CSV.tmp.00000
                                                      • Path C:\Users\Admin\AppData\Local\Temp\WindowsUpdateLog\wuetl.CSV.tmp.00000
                                                      • Size 129KB
                                                      • SHA256 6c435101395b0ab887a2129cb3cc1f467f1766e10e0312df21c103b35405293e
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                      Submit Download

                                                      __PSScriptPolicyTest_cophy0rk.csn.ps1
                                                      • Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_cophy0rk.csn.ps1
                                                      • Size 60B
                                                      • SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
                                                      • MD5 SHA1 SHA512 TLSH
                                                      Submit Download

                                                      CisWarrantyTool.exe
                                                      • Path C:\Users\Admin\AppData\Local\Temp\cwte58dada\CisWarrantyTool.exe
                                                      • Size 3.8MB
                                                      • SHA256 9057dc841439c52e1a27d4f9413417cdc60f2d2174d5085a71a8da488605f254
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                      Submit Download

                                                      cmdres.DLL
                                                      • Path C:\Users\Admin\AppData\Local\Temp\cwte58dada\cmdres.DLL
                                                      • Size 469KB
                                                      • SHA256 7d3562140961f3746c3df8a34f2e0b7e409b3ad67cfd72dd06fc83558e0c66ad
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                      Submit Download

                                                      handle.exe
                                                      • Path C:\Users\Admin\AppData\Local\Temp\cwte58dada\handle.exe
                                                      • Size 743KB
                                                      • SHA256 84c22579ca09f4fd8a8d9f56a6348c4ad2a92d4722c9f1213dd73c2f68a381e3
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                      Submit Download

                                                      handle64.exe
                                                      • Path C:\Users\Admin\AppData\Local\Temp\handle64.exe
                                                      • Size 406KB
                                                      • SHA256 24bafcc570cc9bbb6b6e6652a57a519e0464e3996891aaba6f55299cce20b04f
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                      Submit Download

                                                      WindowsUpdate.log
                                                      • Path C:\Users\Admin\Desktop\WindowsUpdate.log
                                                      • Size 31KB
                                                      • SHA256 298ee00011d2f5548138aa9d57962883de7955c657c21574ed48faa653bc2949
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                      Submit Download

                                                      memory/1752-545-0x000001F37FEB0000-0x000001F37FEDA000-memory.dmp
                                                      Download

                                                      memory/1752-546-0x000001F37FEB0000-0x000001F37FED4000-memory.dmp
                                                      Download

                                                      memory/1752-548-0x000001F300020000-0x000001F30023C000-memory.dmp
                                                      Download

                                                      memory/1956-442-0x00000218EBF40000-0x00000218EC15C000-memory.dmp
                                                      Download

                                                      memory/2508-345-0x0000018F7A510000-0x0000018F7A72C000-memory.dmp
                                                      Download

                                                      memory/4044-415-0x0000016022FE0000-0x00000160231FC000-memory.dmp
                                                      Download

                                                      memory/4144-316-0x000001B2C3BF0000-0x000001B2C3C12000-memory.dmp
                                                      Download