Overview

overview

10

Static

static

10

2026-11-09...ar.exe

windows10-2004-x64

9

2026-11-09...ar.exe

windows11-ltsc_2024-x64

9

Analysis

  • max time kernel
    150s
  • max time network
    155s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260911-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    10/11/2026, 12:16

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-11-09_9ad459ec1ecb95ae828d62a609f772ee_amadey_cobalt-strike_darkgate_glassworm_icedid_luca-stealer_njrat_stealc_vidar.exe
  • Size 10.3MB
  • Sample261110-pfty7sav6w
  • SHA256 32d0be66a2de2420d686a671dacff519377278664352a8401826ff526988ff48
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
discoveryexecutionmacropersistencespywarestealerupx

Malware Config

Signatures

  • Custom signature
    Detects executables embedding registry key / value combination indicative of disabling Windows Defen 2 IoCs
  • Custom signature
    detects Windows exceutables potentially bypassing UAC using eventvwr.exe 2 IoCs
  • Command and Scripting Interpreter: PowerShell 1 TTPs 6 IoCs

    Run Powershell and hide display window.

    execution
  • Suspicious Office macro 1 IoCs

    Office document equipped with macros.

    macro
  • Executes dropped EXE 16 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Enumerates connected drives 3 TTPs 64 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in System32 directory 48 IoCs
  • UPX packed file 22 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 27 IoCs
  • Launches sc.exe 7 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Executes a command shell one-liner 1 TTPs 4 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

    The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

    discovery
  • System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks processor information in registry 2 TTPs 4 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Modifies data under HKEY_USERS 64 IoCs
  • Runs net.exe
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: LoadsDriver 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 59 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-11-09_9ad459ec1ecb95ae828d62a609f772ee_amadey_cobalt-strike_darkgate_glassworm_icedid_luca-stealer_njrat_stealc_vidar.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-11-09_9ad459ec1ecb95ae828d62a609f772ee_amadey_cobalt-strike_darkgate_glassworm_icedid_luca-stealer_njrat_stealc_vidar.exe"
    1⤵
    • Enumerates connected drives
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Reads the TCP/IP host and domain name from the registry
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:3452
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "Set-Location 'C:\Users\Admin\AppData\Roaming\Sysmon'; & .\Sysmon.exe -i -accepteula"
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:4712
      • C:\Users\Admin\AppData\Roaming\Sysmon\Sysmon.exe
        "C:\Users\Admin\AppData\Roaming\Sysmon\Sysmon.exe" -i -accepteula
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:5068
        • C:\Users\Admin\AppData\Local\Temp\Sysmon.exe
          "C:\Users\Admin\AppData\Roaming\Sysmon\Sysmon.exe" -i -accepteula
          4⤵
          • Executes dropped EXE
          • Drops file in Windows directory
          • Suspicious use of WriteProcessMemory
          PID:944
          • C:\Windows\Sysmon.exe
            "C:\Windows\Sysmon.exe" -nologo -accepteula -m
            5⤵
            • Executes dropped EXE
            • Suspicious use of WriteProcessMemory
            PID:2432
            • C:\Windows\system32\wevtutil.exe
              "C:\Windows\system32\wevtutil.exe" um "C:\Users\Admin\AppData\Local\Temp\MANDE6F.tmp"
              6⤵
              • Suspicious use of AdjustPrivilegeToken
              PID:4084
            • C:\Windows\system32\wevtutil.exe
              "C:\Windows\system32\wevtutil.exe" im "C:\Users\Admin\AppData\Local\Temp\MANE43D.tmp"
              6⤵
              • Suspicious use of AdjustPrivilegeToken
              PID:1356
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "Set-Location 'C:\Users\Admin\AppData\Roaming\Sysmon'; & .\Sysmon.exe -c Keller.xml"
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:5580
      • C:\Users\Admin\AppData\Roaming\Sysmon\Sysmon.exe
        "C:\Users\Admin\AppData\Roaming\Sysmon\Sysmon.exe" -c Keller.xml
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:4368
        • C:\Users\Admin\AppData\Local\Temp\SYS1897210277\Sysmon.exe
          "C:\Users\Admin\AppData\Roaming\Sysmon\Sysmon.exe" -c Keller.xml
          4⤵
          • Executes dropped EXE
          • Suspicious use of AdjustPrivilegeToken
          PID:4160
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "Start-Process cmd.exe -ArgumentList '/c wevtutil sl "Microsoft-Windows-Sysmon/Operational" /ms:1073741824 /rt:false /ab:false' -WindowStyle Hidden -Verb RunAs"
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:3528
      • C:\Windows\system32\cmd.exe
        "C:\Windows\system32\cmd.exe" /c wevtutil sl Microsoft-Windows-Sysmon/Operational /ms:1073741824 /rt:false /ab:false
        3⤵
        • Executes a command shell one-liner
        • Suspicious use of WriteProcessMemory
        PID:2404
        • C:\Windows\system32\wevtutil.exe
          wevtutil sl Microsoft-Windows-Sysmon/Operational /ms:1073741824 /rt:false /ab:false
          4⤵
          • Suspicious use of AdjustPrivilegeToken
          PID:3164
    • C:\Windows\SYSTEM32\cmd.exe
      cmd.exe /c ativarservicos.bat
      2⤵
      • Executes a command shell one-liner
      • Suspicious use of WriteProcessMemory
      PID:52
      • C:\Windows\system32\sc.exe
        sc config PcaSvc start= auto
        3⤵
        • Launches sc.exe
        PID:2624
      • C:\Windows\system32\sc.exe
        sc config PlugPlay start= auto
        3⤵
        • Launches sc.exe
        PID:4664
      • C:\Windows\system32\sc.exe
        sc config DPS start= auto
        3⤵
        • Launches sc.exe
        PID:2252
      • C:\Windows\system32\sc.exe
        sc config DiagTrack start= auto
        3⤵
        • Launches sc.exe
        PID:2880
      • C:\Windows\system32\sc.exe
        sc config SysMain start= auto
        3⤵
        • Launches sc.exe
        PID:5268
      • C:\Windows\system32\sc.exe
        sc config EventLog start= auto
        3⤵
        • Launches sc.exe
        PID:3440
      • C:\Windows\system32\sc.exe
        sc config Sysmon start= auto
        3⤵
        • Launches sc.exe
        PID:4796
      • C:\Windows\system32\net.exe
        net start PcaSvc
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:3100
        • C:\Windows\system32\net1.exe
          C:\Windows\system32\net1 start PcaSvc
          4⤵
            PID:2304
        • C:\Windows\system32\net.exe
          net start PlugPlay
          3⤵
          • Suspicious use of WriteProcessMemory
          PID:1608
          • C:\Windows\system32\net1.exe
            C:\Windows\system32\net1 start PlugPlay
            4⤵
              PID:4392
          • C:\Windows\system32\net.exe
            net start DPS
            3⤵
            • Suspicious use of WriteProcessMemory
            PID:2956
            • C:\Windows\system32\net1.exe
              C:\Windows\system32\net1 start DPS
              4⤵
                PID:4456
            • C:\Windows\system32\net.exe
              net start DiagTrack
              3⤵
              • Suspicious use of WriteProcessMemory
              PID:6072
              • C:\Windows\system32\net1.exe
                C:\Windows\system32\net1 start DiagTrack
                4⤵
                  PID:4940
              • C:\Windows\system32\net.exe
                net start SysMain
                3⤵
                • Suspicious use of WriteProcessMemory
                PID:4840
                • C:\Windows\system32\net1.exe
                  C:\Windows\system32\net1 start SysMain
                  4⤵
                    PID:2852
                • C:\Windows\system32\net.exe
                  net start EventLog
                  3⤵
                  • Suspicious use of WriteProcessMemory
                  PID:2680
                  • C:\Windows\system32\net1.exe
                    C:\Windows\system32\net1 start EventLog
                    4⤵
                      PID:4540
                  • C:\Windows\system32\net.exe
                    net start Sysmon
                    3⤵
                    • Suspicious use of WriteProcessMemory
                    PID:1708
                    • C:\Windows\system32\net1.exe
                      C:\Windows\system32\net1 start Sysmon
                      4⤵
                        PID:4780
                  • C:\Windows\SYSTEM32\cmd.exe
                    cmd.exe /c ativarusn.bat
                    2⤵
                    • Executes a command shell one-liner
                    • Suspicious use of WriteProcessMemory
                    PID:1380
                    • C:\Windows\system32\fsutil.exe
                      fsutil fsinfo drivetype A:
                      3⤵
                      • Enumerates connected drives
                      PID:4412
                    • C:\Windows\system32\findstr.exe
                      findstr /i "Fixed"
                      3⤵
                        PID:4144
                      • C:\Windows\system32\fsutil.exe
                        fsutil fsinfo drivetype B:
                        3⤵
                        • Enumerates connected drives
                        PID:4296
                      • C:\Windows\system32\findstr.exe
                        findstr /i "Fixed"
                        3⤵
                          PID:892
                        • C:\Windows\system32\fsutil.exe
                          fsutil fsinfo drivetype C:
                          3⤵
                            PID:5264
                          • C:\Windows\system32\findstr.exe
                            findstr /i "Fixed"
                            3⤵
                              PID:4256
                            • C:\Windows\system32\fsutil.exe
                              fsutil fsinfo drivetype D:
                              3⤵
                              • Enumerates connected drives
                              PID:2624
                            • C:\Windows\system32\findstr.exe
                              findstr /i "Fixed"
                              3⤵
                                PID:1436
                              • C:\Windows\system32\fsutil.exe
                                fsutil fsinfo drivetype E:
                                3⤵
                                  PID:4904
                                • C:\Windows\system32\findstr.exe
                                  findstr /i "Fixed"
                                  3⤵
                                    PID:5808
                                  • C:\Windows\system32\fsutil.exe
                                    fsutil fsinfo drivetype F:
                                    3⤵
                                      PID:868
                                    • C:\Windows\system32\findstr.exe
                                      findstr /i "Fixed"
                                      3⤵
                                        PID:2484
                                      • C:\Windows\system32\fsutil.exe
                                        fsutil fsinfo drivetype G:
                                        3⤵
                                        • Enumerates connected drives
                                        PID:1860
                                      • C:\Windows\system32\findstr.exe
                                        findstr /i "Fixed"
                                        3⤵
                                          PID:1032
                                        • C:\Windows\system32\fsutil.exe
                                          fsutil fsinfo drivetype H:
                                          3⤵
                                          • Enumerates connected drives
                                          PID:5236
                                        • C:\Windows\system32\findstr.exe
                                          findstr /i "Fixed"
                                          3⤵
                                            PID:1904
                                          • C:\Windows\system32\fsutil.exe
                                            fsutil fsinfo drivetype I:
                                            3⤵
                                            • Enumerates connected drives
                                            PID:3036
                                          • C:\Windows\system32\findstr.exe
                                            findstr /i "Fixed"
                                            3⤵
                                              PID:1352
                                            • C:\Windows\system32\fsutil.exe
                                              fsutil fsinfo drivetype J:
                                              3⤵
                                              • Enumerates connected drives
                                              PID:1220
                                            • C:\Windows\system32\findstr.exe
                                              findstr /i "Fixed"
                                              3⤵
                                                PID:2756
                                              • C:\Windows\system32\fsutil.exe
                                                fsutil fsinfo drivetype K:
                                                3⤵
                                                • Enumerates connected drives
                                                PID:5392
                                              • C:\Windows\system32\findstr.exe
                                                findstr /i "Fixed"
                                                3⤵
                                                  PID:2816
                                                • C:\Windows\system32\fsutil.exe
                                                  fsutil fsinfo drivetype L:
                                                  3⤵
                                                    PID:3168
                                                  • C:\Windows\system32\findstr.exe
                                                    findstr /i "Fixed"
                                                    3⤵
                                                      PID:2468
                                                    • C:\Windows\system32\fsutil.exe
                                                      fsutil fsinfo drivetype M:
                                                      3⤵
                                                      • Enumerates connected drives
                                                      PID:4240
                                                    • C:\Windows\system32\findstr.exe
                                                      findstr /i "Fixed"
                                                      3⤵
                                                        PID:5156
                                                      • C:\Windows\system32\fsutil.exe
                                                        fsutil fsinfo drivetype N:
                                                        3⤵
                                                        • Enumerates connected drives
                                                        PID:6052
                                                      • C:\Windows\system32\findstr.exe
                                                        findstr /i "Fixed"
                                                        3⤵
                                                          PID:1304
                                                        • C:\Windows\system32\fsutil.exe
                                                          fsutil fsinfo drivetype O:
                                                          3⤵
                                                          • Enumerates connected drives
                                                          PID:2880
                                                        • C:\Windows\system32\findstr.exe
                                                          findstr /i "Fixed"
                                                          3⤵
                                                            PID:1900
                                                          • C:\Windows\system32\fsutil.exe
                                                            fsutil fsinfo drivetype P:
                                                            3⤵
                                                              PID:1756
                                                            • C:\Windows\system32\findstr.exe
                                                              findstr /i "Fixed"
                                                              3⤵
                                                                PID:5268
                                                              • C:\Windows\system32\fsutil.exe
                                                                fsutil fsinfo drivetype Q:
                                                                3⤵
                                                                • Enumerates connected drives
                                                                PID:3444
                                                              • C:\Windows\system32\findstr.exe
                                                                findstr /i "Fixed"
                                                                3⤵
                                                                  PID:5848
                                                                • C:\Windows\system32\fsutil.exe
                                                                  fsutil fsinfo drivetype R:
                                                                  3⤵
                                                                  • Enumerates connected drives
                                                                  PID:5288
                                                                • C:\Windows\system32\findstr.exe
                                                                  findstr /i "Fixed"
                                                                  3⤵
                                                                    PID:1892
                                                                  • C:\Windows\system32\fsutil.exe
                                                                    fsutil fsinfo drivetype S:
                                                                    3⤵
                                                                    • Enumerates connected drives
                                                                    PID:2332
                                                                  • C:\Windows\system32\findstr.exe
                                                                    findstr /i "Fixed"
                                                                    3⤵
                                                                      PID:4852
                                                                    • C:\Windows\system32\fsutil.exe
                                                                      fsutil fsinfo drivetype T:
                                                                      3⤵
                                                                      • Enumerates connected drives
                                                                      PID:4796
                                                                    • C:\Windows\system32\findstr.exe
                                                                      findstr /i "Fixed"
                                                                      3⤵
                                                                        PID:3048
                                                                      • C:\Windows\system32\fsutil.exe
                                                                        fsutil fsinfo drivetype U:
                                                                        3⤵
                                                                          PID:5340
                                                                        • C:\Windows\system32\findstr.exe
                                                                          findstr /i "Fixed"
                                                                          3⤵
                                                                            PID:1348
                                                                          • C:\Windows\system32\fsutil.exe
                                                                            fsutil fsinfo drivetype V:
                                                                            3⤵
                                                                            • Enumerates connected drives
                                                                            PID:5768
                                                                          • C:\Windows\system32\findstr.exe
                                                                            findstr /i "Fixed"
                                                                            3⤵
                                                                              PID:5612
                                                                            • C:\Windows\system32\fsutil.exe
                                                                              fsutil fsinfo drivetype W:
                                                                              3⤵
                                                                              • Enumerates connected drives
                                                                              PID:4936
                                                                            • C:\Windows\system32\findstr.exe
                                                                              findstr /i "Fixed"
                                                                              3⤵
                                                                                PID:1108
                                                                              • C:\Windows\system32\fsutil.exe
                                                                                fsutil fsinfo drivetype X:
                                                                                3⤵
                                                                                • Enumerates connected drives
                                                                                PID:1464
                                                                              • C:\Windows\system32\findstr.exe
                                                                                findstr /i "Fixed"
                                                                                3⤵
                                                                                  PID:3596
                                                                                • C:\Windows\system32\fsutil.exe
                                                                                  fsutil fsinfo drivetype Y:
                                                                                  3⤵
                                                                                  • Enumerates connected drives
                                                                                  PID:1868
                                                                                • C:\Windows\system32\findstr.exe
                                                                                  findstr /i "Fixed"
                                                                                  3⤵
                                                                                    PID:5104
                                                                                  • C:\Windows\system32\fsutil.exe
                                                                                    fsutil fsinfo drivetype Z:
                                                                                    3⤵
                                                                                    • Enumerates connected drives
                                                                                    PID:3144
                                                                                  • C:\Windows\system32\findstr.exe
                                                                                    findstr /i "Fixed"
                                                                                    3⤵
                                                                                      PID:2808
                                                                                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "Set-Location 'C:\Users\Admin\AppData\Roaming\Sysmon'; & .\Sysmon.exe -i -accepteula"
                                                                                    2⤵
                                                                                    • Command and Scripting Interpreter: PowerShell
                                                                                    • Suspicious behavior: EnumeratesProcesses
                                                                                    • Suspicious use of AdjustPrivilegeToken
                                                                                    PID:2156
                                                                                    • C:\Users\Admin\AppData\Roaming\Sysmon\Sysmon.exe
                                                                                      "C:\Users\Admin\AppData\Roaming\Sysmon\Sysmon.exe" -i -accepteula
                                                                                      3⤵
                                                                                      • Executes dropped EXE
                                                                                      • System Location Discovery: System Language Discovery
                                                                                      PID:2796
                                                                                      • C:\Users\Admin\AppData\Local\Temp\Sysmon.exe
                                                                                        "C:\Users\Admin\AppData\Roaming\Sysmon\Sysmon.exe" -i -accepteula
                                                                                        4⤵
                                                                                        • Executes dropped EXE
                                                                                        PID:5108
                                                                                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "Set-Location 'C:\Users\Admin\AppData\Roaming\Sysmon'; & .\Sysmon.exe -c Keller.xml"
                                                                                    2⤵
                                                                                    • Command and Scripting Interpreter: PowerShell
                                                                                    • Suspicious behavior: EnumeratesProcesses
                                                                                    • Suspicious use of AdjustPrivilegeToken
                                                                                    PID:5984
                                                                                    • C:\Users\Admin\AppData\Roaming\Sysmon\Sysmon.exe
                                                                                      "C:\Users\Admin\AppData\Roaming\Sysmon\Sysmon.exe" -c Keller.xml
                                                                                      3⤵
                                                                                      • Executes dropped EXE
                                                                                      • System Location Discovery: System Language Discovery
                                                                                      PID:3672
                                                                                      • C:\Users\Admin\AppData\Local\Temp\Sysmon.exe
                                                                                        "C:\Users\Admin\AppData\Roaming\Sysmon\Sysmon.exe" -c Keller.xml
                                                                                        4⤵
                                                                                        • Executes dropped EXE
                                                                                        • Suspicious use of AdjustPrivilegeToken
                                                                                        PID:2236
                                                                                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "Start-Process cmd.exe -ArgumentList '/c wevtutil sl "Microsoft-Windows-Sysmon/Operational" /ms:1073741824 /rt:false /ab:false' -WindowStyle Hidden -Verb RunAs"
                                                                                    2⤵
                                                                                    • Command and Scripting Interpreter: PowerShell
                                                                                    • Suspicious behavior: EnumeratesProcesses
                                                                                    • Suspicious use of AdjustPrivilegeToken
                                                                                    PID:5152
                                                                                    • C:\Windows\system32\cmd.exe
                                                                                      "C:\Windows\system32\cmd.exe" /c wevtutil sl Microsoft-Windows-Sysmon/Operational /ms:1073741824 /rt:false /ab:false
                                                                                      3⤵
                                                                                      • Executes a command shell one-liner
                                                                                      PID:3260
                                                                                      • C:\Windows\system32\wevtutil.exe
                                                                                        wevtutil sl Microsoft-Windows-Sysmon/Operational /ms:1073741824 /rt:false /ab:false
                                                                                        4⤵
                                                                                        • Suspicious use of AdjustPrivilegeToken
                                                                                        PID:1124
                                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
                                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
                                                                                  1⤵
                                                                                  • Executes dropped EXE
                                                                                  • Drops file in System32 directory
                                                                                  • Drops file in Program Files directory
                                                                                  • Drops file in Windows directory
                                                                                  • Reads the TCP/IP host and domain name from the registry
                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                  PID:2660
                                                                                • C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
                                                                                  "C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
                                                                                  1⤵
                                                                                  • Executes dropped EXE
                                                                                  PID:5488
                                                                                • \??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
                                                                                  "c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
                                                                                  1⤵
                                                                                  • Executes dropped EXE
                                                                                  PID:1996
                                                                                • C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
                                                                                  C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
                                                                                  1⤵
                                                                                  • Executes dropped EXE
                                                                                  PID:2284
                                                                                • C:\Windows\SysWow64\perfhost.exe
                                                                                  C:\Windows\SysWow64\perfhost.exe
                                                                                  1⤵
                                                                                  • Executes dropped EXE
                                                                                  • System Location Discovery: System Language Discovery
                                                                                  PID:5804
                                                                                • C:\Windows\System32\ReFsDedupSvc.exe
                                                                                  C:\Windows\System32\ReFsDedupSvc.exe
                                                                                  1⤵
                                                                                  • Executes dropped EXE
                                                                                  • Checks processor information in registry
                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                  PID:3012
                                                                                • C:\Windows\system32\SearchIndexer.exe
                                                                                  C:\Windows\system32\SearchIndexer.exe /Embedding
                                                                                  1⤵
                                                                                  • Executes dropped EXE
                                                                                  • Enumerates connected drives
                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                  • Suspicious use of WriteProcessMemory
                                                                                  PID:4764
                                                                                  • C:\Windows\System32\SearchProtocolHost.exe
                                                                                    "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
                                                                                    2⤵
                                                                                    • Modifies data under HKEY_USERS
                                                                                    PID:5284
                                                                                  • C:\Windows\System32\SearchProtocolHost.exe
                                                                                    "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-1404337215-1550464601-2805570857-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-1404337215-1550464601-2805570857-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
                                                                                    2⤵
                                                                                      PID:4332
                                                                                    • C:\Windows\System32\SearchFilterHost.exe
                                                                                      "C:\Windows\System32\SearchFilterHost.exe" 944 2880 2872 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
                                                                                      2⤵
                                                                                      • Modifies data under HKEY_USERS
                                                                                      PID:1756
                                                                                    • C:\Windows\System32\SearchFilterHost.exe
                                                                                      "C:\Windows\System32\SearchFilterHost.exe" 944 2856 2876 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
                                                                                      2⤵
                                                                                      • Modifies data under HKEY_USERS
                                                                                      PID:2292
                                                                                  • C:\Windows\System32\svchost.exe
                                                                                    C:\Windows\System32\svchost.exe -k LocalServiceNoNetwork -p -s DPS
                                                                                    1⤵
                                                                                    • Drops file in System32 directory
                                                                                    • Checks processor information in registry
                                                                                    • Suspicious behavior: EnumeratesProcesses
                                                                                    • Suspicious use of AdjustPrivilegeToken
                                                                                    PID:4896
                                                                                  • C:\Windows\System32\svchost.exe
                                                                                    C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s WdiSystemHost
                                                                                    1⤵
                                                                                      PID:4084
                                                                                    • C:\Windows\System32\svchost.exe
                                                                                      C:\Windows\System32\svchost.exe -k utcsvc -p
                                                                                      1⤵
                                                                                        PID:2088
                                                                                      • C:\Windows\system32\svchost.exe
                                                                                        C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s SysMain
                                                                                        1⤵
                                                                                        • Drops file in Windows directory
                                                                                        • Suspicious behavior: EnumeratesProcesses
                                                                                        • Suspicious use of AdjustPrivilegeToken
                                                                                        PID:1328
                                                                                      • C:\Windows\system32\svchost.exe
                                                                                        C:\Windows\system32\svchost.exe -k GPSvcGroup
                                                                                        1⤵
                                                                                          PID:4736

                                                                                        Network

                                                                                              MITRE ATT&CK Enterprise v16

                                                                                              Replay Monitor

                                                                                              Loading Replay Monitor...

                                                                                              Downloads

                                                                                              elevation_service.exe
                                                                                              • Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
                                                                                              • Size 2.7MB
                                                                                              • SHA256 68887e49db1696ad34d7eb3d6caa95ccc0c83db426a7f6be5ae17f07baa49429
                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                              Submit Download

                                                                                              maintenanceservice.exe
                                                                                              • Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
                                                                                              • Size 2.2MB
                                                                                              • SHA256 26f69256035f7ee1b4dd3dce93fe412317bc39ca16cbfc0f7693fc7fb23c2bc0
                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                              Submit Download

                                                                                              maintenanceservice.exe
                                                                                              • Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
                                                                                              • Size 1.4MB
                                                                                              • SHA256 2a4bbd8f3d7895d7cef87160fe8ca0f398890f3017af1910fccbd640788ef8b9
                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                              Submit Download

                                                                                              maintenanceservice.exe
                                                                                              • Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
                                                                                              • Size 2.2MB
                                                                                              • SHA256 811a903ec6db65c12f16bfcbf62011cbe9b1c5616ef01de331748051fb5a3549
                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                              Submit Download

                                                                                              OSE.EXE
                                                                                              • Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
                                                                                              • Size 1.4MB
                                                                                              • SHA256 869e1aa2a227a6193abf2d35573046c869520008fb86ab59ef22acead054f498
                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                              Submit Download

                                                                                              elevation_service.exe
                                                                                              • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
                                                                                              • Size 3.0MB
                                                                                              • SHA256 2aa446cebd27c48e223d3270fe5b9055bc10c9429e9399cc66a3605ffb4517d1
                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                              Submit Download

                                                                                              MsSense.exe
                                                                                              • Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
                                                                                              • Size 1.2MB
                                                                                              • SHA256 f17feae40a17a5aa208ef55f993a8ac36163a53eae4259e44177f65cd8f0160a
                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                              Submit Download

                                                                                              NisSrv.exe
                                                                                              • Path C:\Program Files\Windows Defender\NisSrv.exe
                                                                                              • Size 3.5MB
                                                                                              • SHA256 9426049ac43272b2c5c3468deb6d9bbf5d8c823c41960962aa7d921717ea3b9f
                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                              Submit Download

                                                                                              NisSrv.exe
                                                                                              • Path C:\Program Files\Windows Defender\NisSrv.exe
                                                                                              • Size 4.3MB
                                                                                              • SHA256 14eabb375fe28a5e1747585ec1d689b40c563257d39819e9a6abdb6dfc40c252
                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                              Submit Download

                                                                                              wmpnetwk.exe
                                                                                              • Path C:\Program Files\Windows Media Player\wmpnetwk.exe
                                                                                              • Size 1.4MB
                                                                                              • SHA256 b5ca3fa874442447f1fe1644a3a97bd4037532448bbf6a5c0df73e79606b5f1c
                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                              Submit Download

                                                                                              wmpnetwk.exe
                                                                                              • Path C:\Program Files\Windows Media Player\wmpnetwk.exe
                                                                                              • Size 2.2MB
                                                                                              • SHA256 9ccc32027727465a2bda083263e9ffd12db1ea7c913e90cb1fd763ffcf54f652
                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                              Submit Download

                                                                                              Windows.db
                                                                                              • Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
                                                                                              • Size 1.2MB
                                                                                              • SHA256 04c11474a8d3ba656b4212f792824580baf758df08694f5028c78b9be02f3d62
                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                              Submit Download

                                                                                              Windows.db-wal
                                                                                              • Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
                                                                                              • Size 4KB
                                                                                              • SHA256 d83ec9c6f2f48c70c132c1145e1823fb8cef7405b9407a707e1d1c6061fa3f49
                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                              Submit Download

                                                                                              Windows.db-wal
                                                                                              • Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
                                                                                              • Size 1.4MB
                                                                                              • SHA256 532a126a355e6a2642ece49fb0c28beabb8c84a1c2f9bce14ea6d0414308b3cc
                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                              Submit Download

                                                                                              StartupProfileData-NonInteractive
                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                                              • Size 1KB
                                                                                              • SHA256 60292489db6d4ba2a3e4448639fbe7fa2261be477f63ef09bca0b55e520a4777
                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                              Submit Download

                                                                                              StartupProfileData-NonInteractive
                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                                              • Size 1KB
                                                                                              • SHA256 8ea1e00a502eeb96c5b8b4af9611d6c5c973355cc67fd9e0eb021de35771b2a8
                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                              Submit Download

                                                                                              StartupProfileData-NonInteractive
                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                                              • Size 1KB
                                                                                              • SHA256 54aa570220e696de49a9a588711123e43032522c4578b6fa4f918d2666c1cb32
                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                              Submit Download

                                                                                              StartupProfileData-NonInteractive
                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                                              • Size 1KB
                                                                                              • SHA256 bcf8325db72c06bb7f6a8df3c4648a150d766a1857214c6b533c467029424ce8
                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                              Submit Download

                                                                                              MANDE6F.tmp
                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\MANDE6F.tmp
                                                                                              • Size 99KB
                                                                                              • SHA256 f7eae416e5a3d9bfb2bfe8a9753dc2f381361a8e81c9921d874ebf1d1125b9d0
                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                              Submit Download

                                                                                              Sysmon.exe
                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\Sysmon.exe
                                                                                              • Size 4.3MB
                                                                                              • SHA256 39b094613132377bc236f4ad940a3e02c544f86347c0179a9425edc1bd3b85cd
                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                              Submit Download

                                                                                              __PSScriptPolicyTest_gttk0yq4.gai.psm1
                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_gttk0yq4.gai.psm1
                                                                                              • Size 60B
                                                                                              • SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                              Submit Download

                                                                                              ativarservicos.bat
                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\ativarservicos.bat
                                                                                              • Size 248B
                                                                                              • SHA256 2ab823c89be788710ff2f383683ede1407fc26555ba1ec7bcbd59911caf91007
                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                              Submit Download

                                                                                              ativarusn.bat
                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\ativarusn.bat
                                                                                              • Size 442B
                                                                                              • SHA256 14e3abcace921ecd3517a011cbbac6f21d794bd9ca7f3d37d19b52da1d175c33
                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                              Submit Download

                                                                                              Keller.xml
                                                                                              • Path C:\Users\Admin\AppData\Roaming\Sysmon\Keller.xml
                                                                                              • Size 391KB
                                                                                              • SHA256 070f46bee7a0cc212f2c392221cbc91e3c8630c6a747a1aea52cd88d76287a6a
                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                              Submit Download

                                                                                              Sysmon.exe
                                                                                              • Path C:\Users\Admin\AppData\Roaming\Sysmon\Sysmon.exe
                                                                                              • Size 8.1MB
                                                                                              • SHA256 71485d919102387e71f20ddc809bd849b7694d2b3f2cdd45a15a4ef9f9c788f2
                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                              Submit Download

                                                                                              SelectStart.docm
                                                                                              • Path C:\Users\Admin\Documents\SelectStart.docm
                                                                                              • Size 777KB
                                                                                              • SHA256 3d48edea968b1c67ca7185eceec5b30508fcab1a3f1ae46f5101f42af7a9f09b
                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                              Submit Download

                                                                                              perfhost.exe
                                                                                              • Path C:\Windows\SysWOW64\perfhost.exe
                                                                                              • Size 1.2MB
                                                                                              • SHA256 9baa57fd05f366d81cb9d2563a7bc5f1dd220470b30b19fb16d00bc4672c8a24
                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                              Submit Download

                                                                                              GameInputSvc.exe
                                                                                              • Path C:\Windows\System32\GameInputSvc.exe
                                                                                              • Size 832KB
                                                                                              • SHA256 f216040dd88d1aabaa099d5e78e120b2896f08c4bc9f273571d33a1853cd5680
                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                              Submit Download

                                                                                              ssh-agent.exe
                                                                                              • Path C:\Windows\System32\OpenSSH\ssh-agent.exe
                                                                                              • Size 1.3MB
                                                                                              • SHA256 15f86453bfa25de9eef4ba60f9f3cd2376c9eec3016dd6ee30f99152510575b2
                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                              Submit Download

                                                                                              ReFsDedupSvc.exe
                                                                                              • Path C:\Windows\System32\ReFsDedupSvc.exe
                                                                                              • Size 2.6MB
                                                                                              • SHA256 033a954de833d96c4c275417a81895b6533be3198555e781c45efc1fa1045371
                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                              Submit Download

                                                                                              SearchIndexer.exe
                                                                                              • Path C:\Windows\System32\SearchIndexer.exe
                                                                                              • Size 1.4MB
                                                                                              • SHA256 8da72d347387e1975c9e448da47d884f3b9ea26745961590c92fe02aeb42a50f
                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                              Submit Download

                                                                                              SensorDataService.exe
                                                                                              • Path C:\Windows\System32\SensorDataService.exe
                                                                                              • Size 1.9MB
                                                                                              • SHA256 5b2088b115264222f021937f166e5d406bf673ed287c1ffed132c080604690a4
                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                              Submit Download

                                                                                              alg.exe
                                                                                              • Path C:\Windows\System32\alg.exe
                                                                                              • Size 948KB
                                                                                              • SHA256 eebfe9832ac7b70b0daeb0abe132eed7675253a0febfbcc61901d26851d30f52
                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                              Submit Download

                                                                                              msdtc.exe
                                                                                              • Path C:\Windows\System32\msdtc.exe
                                                                                              • Size 932KB
                                                                                              • SHA256 2dfaa3c72d5659711cea67f481f076b8e23dd731c0d150c5d389996557a275fc
                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                              Submit Download

                                                                                              snmptrap.exe
                                                                                              • Path C:\Windows\System32\snmptrap.exe
                                                                                              • Size 804KB
                                                                                              • SHA256 3d21c3ec8f4159480d85a3cc5b31c1c8e4e2ff3ed46288229f63c8ea17c80f33
                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                              Submit Download

                                                                                              vds.exe
                                                                                              • Path C:\Windows\System32\vds.exe
                                                                                              • Size 1.4MB
                                                                                              • SHA256 3e97ffdd3fe3da1767d72404500fae4b4972c03184bb8408dbdda582b8399dfe
                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                              Submit Download

                                                                                              AgentService.exe
                                                                                              • Path C:\Windows\system32\AgentService.exe
                                                                                              • Size 1.6MB
                                                                                              • SHA256 eb081b8d12f10c26768ced880d9f821f7950e06025b5dac799a73e813fe83147
                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                              Submit Download

                                                                                              AppVClient.exe
                                                                                              • Path C:\Windows\system32\AppVClient.exe
                                                                                              • Size 1.5MB
                                                                                              • SHA256 6471a839df79bc62d60e7cf2e485b516205cc9d814889780f84431d80cf180df
                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                              Submit Download

                                                                                              PerceptionSimulationService.exe
                                                                                              • Path C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
                                                                                              • Size 1.4MB
                                                                                              • SHA256 237af5d0d766f27b5b2ed2f7d86fd30594f6798e745ac6a610c62f9161f351ba
                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                              Submit Download

                                                                                              SgrmBroker.exe
                                                                                              • Path C:\Windows\system32\Sgrm\SgrmBroker.exe
                                                                                              • Size 1.1MB
                                                                                              • SHA256 743cae711bfb796a0b25a317cebae76f7b115c8ff48a241f38b820f566e22f8f
                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                              Submit Download

                                                                                              TieringEngineService.exe
                                                                                              • Path C:\Windows\system32\TieringEngineService.exe
                                                                                              • Size 1.1MB
                                                                                              • SHA256 1161ddbc94a58ed98c80015867d06681a98dbd17529faf4a064f6bbbd8fcea21
                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                              Submit Download

                                                                                              locator.exe
                                                                                              • Path C:\Windows\system32\locator.exe
                                                                                              • Size 796KB
                                                                                              • SHA256 e1c0bbc8cb180bec2282e03d941bc8c6b41915be7a4adc42c9dde81fca50e48c
                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                              Submit Download

                                                                                              msiexec.exe
                                                                                              • Path C:\Windows\system32\msiexec.exe
                                                                                              • Size 940KB
                                                                                              • SHA256 7efec13ca039147a8de48697eafddc3768279095af25afbbe946786f3f66d37c
                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                              Submit Download

                                                                                              vssvc.exe
                                                                                              • Path C:\Windows\system32\vssvc.exe
                                                                                              • Size 2.2MB
                                                                                              • SHA256 ea3924af3ecefb1df3e7b186a4a47437845e895eb39a149bd20c1290eb64bcf0
                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                              Submit Download

                                                                                              WmiApSrv.exe
                                                                                              • Path C:\Windows\system32\wbem\WmiApSrv.exe
                                                                                              • Size 964KB
                                                                                              • SHA256 e0f3b9612efa5431f4b6580abfb3906cb063dbb88fb313c0030106690beb4e4e
                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                              Submit Download

                                                                                              wbengine.exe
                                                                                              • Path C:\Windows\system32\wbengine.exe
                                                                                              • Size 2.2MB
                                                                                              • SHA256 ba8994f59dae3917a42b1a09521e2df7998cc5d48d2bdd2241a786b4458ad53f
                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                              Submit Download

                                                                                              memory/1756-452-0x000001E670FB0000-0x000001E671630000-memory.dmp
                                                                                              Download

                                                                                              memory/1996-75-0x0000000000990000-0x00000000009F0000-memory.dmp
                                                                                              Download

                                                                                              memory/1996-65-0x0000000140000000-0x000000014016E000-memory.dmp
                                                                                              Download

                                                                                              memory/1996-327-0x0000000140000000-0x000000014016E000-memory.dmp
                                                                                              Download

                                                                                              memory/1996-69-0x0000000000990000-0x00000000009F0000-memory.dmp
                                                                                              Download

                                                                                              memory/2284-80-0x00000000006C0000-0x0000000000720000-memory.dmp
                                                                                              Download

                                                                                              memory/2284-89-0x0000000140000000-0x0000000140169000-memory.dmp
                                                                                              Download

                                                                                              memory/2284-86-0x00000000006C0000-0x0000000000720000-memory.dmp
                                                                                              Download

                                                                                              memory/2284-330-0x0000000140000000-0x0000000140169000-memory.dmp
                                                                                              Download

                                                                                              memory/2660-217-0x0000000140000000-0x00000001402D4000-memory.dmp
                                                                                              Download

                                                                                              memory/2660-45-0x00000000006E0000-0x0000000000740000-memory.dmp
                                                                                              Download

                                                                                              memory/2660-39-0x00000000006E0000-0x0000000000740000-memory.dmp
                                                                                              Download

                                                                                              memory/2660-38-0x0000000140000000-0x00000001402D4000-memory.dmp
                                                                                              Download

                                                                                              memory/3012-124-0x0000000000560000-0x00000000005C0000-memory.dmp
                                                                                              Download

                                                                                              memory/3012-118-0x0000000000560000-0x00000000005C0000-memory.dmp
                                                                                              Download

                                                                                              memory/3012-352-0x0000000140000000-0x00000001402C9000-memory.dmp
                                                                                              Download

                                                                                              memory/3012-448-0x0000000000560000-0x00000000005C0000-memory.dmp
                                                                                              Download

                                                                                              memory/3012-450-0x0000000140000000-0x00000001402C9000-memory.dmp
                                                                                              Download

                                                                                              memory/3012-117-0x0000000140000000-0x00000001402C9000-memory.dmp
                                                                                              Download

                                                                                              memory/3452-7-0x0000000002020000-0x00000000020A4000-memory.dmp
                                                                                              Download

                                                                                              memory/3452-1-0x0000000002020000-0x00000000020A4000-memory.dmp
                                                                                              Download

                                                                                              memory/3452-88-0x0000000140000000-0x0000000141D68000-memory.dmp
                                                                                              Download

                                                                                              memory/3452-8-0x0000000002020000-0x00000000020A4000-memory.dmp
                                                                                              Download

                                                                                              memory/3452-14-0x00000000028E0000-0x0000000002940000-memory.dmp
                                                                                              Download

                                                                                              memory/3452-0-0x0000000140000000-0x0000000141D68000-memory.dmp
                                                                                              Download

                                                                                              memory/3452-22-0x00000000028E0000-0x0000000002940000-memory.dmp
                                                                                              Download

                                                                                              memory/4712-68-0x000001AC70240000-0x000001AC70262000-memory.dmp
                                                                                              Download

                                                                                              memory/4764-178-0x0000000140000000-0x0000000140172000-memory.dmp
                                                                                              Download

                                                                                              memory/4764-179-0x0000000000620000-0x0000000000680000-memory.dmp
                                                                                              Download

                                                                                              memory/4764-185-0x0000000000620000-0x0000000000680000-memory.dmp
                                                                                              Download

                                                                                              memory/4764-370-0x0000000140000000-0x0000000140172000-memory.dmp
                                                                                              Download

                                                                                              memory/4896-379-0x000001B660630000-0x000001B660631000-memory.dmp
                                                                                              Download

                                                                                              memory/4896-371-0x000001B660030000-0x000001B660040000-memory.dmp
                                                                                              Download

                                                                                              memory/4896-375-0x000001B660070000-0x000001B660080000-memory.dmp
                                                                                              Download

                                                                                              memory/5488-61-0x0000000001AF0000-0x0000000001B50000-memory.dmp
                                                                                              Download

                                                                                              memory/5488-50-0x0000000140000000-0x0000000140174000-memory.dmp
                                                                                              Download

                                                                                              memory/5488-51-0x0000000001AF0000-0x0000000001B50000-memory.dmp
                                                                                              Download

                                                                                              memory/5488-57-0x0000000001AF0000-0x0000000001B50000-memory.dmp
                                                                                              Download

                                                                                              memory/5488-63-0x0000000140000000-0x0000000140174000-memory.dmp
                                                                                              Download

                                                                                              memory/5804-104-0x0000000000870000-0x00000000008D7000-memory.dmp
                                                                                              Download

                                                                                              memory/5804-99-0x0000000000870000-0x00000000008D7000-memory.dmp
                                                                                              Download

                                                                                              memory/5804-98-0x0000000000400000-0x0000000000535000-memory.dmp
                                                                                              Download

                                                                                              memory/5804-346-0x0000000000400000-0x0000000000535000-memory.dmp
                                                                                              Download