zgrat | c9c660914e4d58a6e0dd460afae6e4af288c9f191ad8592dc95db5a69868fc70

max time kernel
1762s
max time network
1802s
platform
windows10-1703_x64
resource
win10-20240404-en
resource tags

arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system
submitted
13-05-2024 21:55

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Loader.exe
Size

347KB
MD5

1cb742cb95699d994e1cc6810c6f7642
SHA1

103ea603322859742a3e51c5e517a927b9dcd40c
SHA256

c9c660914e4d58a6e0dd460afae6e4af288c9f191ad8592dc95db5a69868fc70
SHA512

79f9a70232b3470ef9386d9b3d987b5370d0562959315d8239509000a1aa9274b13cecc4c6c871cd4d258a0cd19d30574e3280edd54fb108b6ffca7d8c7e4795
SSDEEP

6144:RrwFDD0tZzmf7GxMLEYaEzE2d9JK5/J1pZKM35QM6KkfiruhbOuzB:Rg07e7seE2dK71rKu5Q6kfirIbOuF

Score

10^/10

zgrat evasion execution persistence rat spyware stealer

Malware Config

Signatures

Detect ZGRat V1 5 IoCs

resource	yara_rule
behavioral2/files/0x000a00000001ab56-7.dat	family_zgrat_v1
behavioral2/memory/3824-25-0x00000000003B0000-0x0000000000752000-memory.dmp	family_zgrat_v1
behavioral2/files/0x000900000001ac41-24.dat	family_zgrat_v1
behavioral2/files/0x000700000001ac4a-569.dat	family_zgrat_v1
behavioral2/files/0x000700000001ac4c-570.dat	family_zgrat_v1

Modifies WinLogon for persistence 2 TTPs 5 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files\\Microsoft Office 15\\ClientX64\\Idle.exe\""	Sessionperf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files\\Microsoft Office 15\\ClientX64\\Idle.exe\", \"C:\\Recovery\\WindowsRE\\sppsvc.exe\""	Sessionperf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files\\Microsoft Office 15\\ClientX64\\Idle.exe\", \"C:\\Recovery\\WindowsRE\\sppsvc.exe\", \"C:\\Recovery\\WindowsRE\\dllhost.exe\""	Sessionperf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files\\Microsoft Office 15\\ClientX64\\Idle.exe\", \"C:\\Recovery\\WindowsRE\\sppsvc.exe\", \"C:\\Recovery\\WindowsRE\\dllhost.exe\", \"C:\\Program Files\\Windows Defender Advanced Threat Protection\\fr-FR\\csrss.exe\""	Sessionperf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files\\Microsoft Office 15\\ClientX64\\Idle.exe\", \"C:\\Recovery\\WindowsRE\\sppsvc.exe\", \"C:\\Recovery\\WindowsRE\\dllhost.exe\", \"C:\\Program Files\\Windows Defender Advanced Threat Protection\\fr-FR\\csrss.exe\", \"C:\\Windows\\TAPI\\unsecapp.exe\""	Sessionperf.exe

Process spawned unexpected child process 15 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3884	2784	schtasks.exe	79
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1504	2784	schtasks.exe	79
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1804	2784	schtasks.exe	79
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4908	2784	schtasks.exe	79
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2168	2784	schtasks.exe	79
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4956	2784	schtasks.exe	79
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4148	2784	schtasks.exe	79
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	824	2784	schtasks.exe	79
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2320	2784	schtasks.exe	79
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4232	2784	schtasks.exe	79
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4364	2784	schtasks.exe	79
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2512	2784	schtasks.exe	79
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2004	2784	schtasks.exe	79
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2240	2784	schtasks.exe	79
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3836	2784	schtasks.exe	79

ZGRat
ZGRat is remote access trojan written in C#.
rat zgrat

Command and Scripting Interpreter: PowerShell 1 TTPs 5 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
1768	powershell.exe
424	powershell.exe
4916	powershell.exe
804	powershell.exe
420	powershell.exe

Disables Task Manager via registry modification
evasion
Downloads MZ/PE file

Executes dropped EXE 21 IoCs

pid	Process
4332	Checker.exe
3824	Sessionperf.exe
3484	Idle.exe
4728	Idle.exe
4004	csrss.exe
2656	dllhost.exe
2892	unsecapp.exe
3196	Idle.exe
4172	csrss.exe
2008	sppsvc.exe
4316	Idle.exe
3204	dllhost.exe
1864	csrss.exe
2264	unsecapp.exe
1328	csrss.exe
4156	Idle.exe
4232	sppsvc.exe
1420	dllhost.exe
4824	csrss.exe
3588	unsecapp.exe
4408	Idle.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 10 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Idle = "\"C:\\Program Files\\Microsoft Office 15\\ClientX64\\Idle.exe\""	Sessionperf.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000\Software\Microsoft\Windows\CurrentVersion\Run\sppsvc = "\"C:\\Recovery\\WindowsRE\\sppsvc.exe\""	Sessionperf.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000\Software\Microsoft\Windows\CurrentVersion\Run\dllhost = "\"C:\\Recovery\\WindowsRE\\dllhost.exe\""	Sessionperf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dllhost = "\"C:\\Recovery\\WindowsRE\\dllhost.exe\""	Sessionperf.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000\Software\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Program Files\\Windows Defender Advanced Threat Protection\\fr-FR\\csrss.exe\""	Sessionperf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\unsecapp = "\"C:\\Windows\\TAPI\\unsecapp.exe\""	Sessionperf.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000\Software\Microsoft\Windows\CurrentVersion\Run\Idle = "\"C:\\Program Files\\Microsoft Office 15\\ClientX64\\Idle.exe\""	Sessionperf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sppsvc = "\"C:\\Recovery\\WindowsRE\\sppsvc.exe\""	Sessionperf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Program Files\\Windows Defender Advanced Threat Protection\\fr-FR\\csrss.exe\""	Sessionperf.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000\Software\Microsoft\Windows\CurrentVersion\Run\unsecapp = "\"C:\\Windows\\TAPI\\unsecapp.exe\""	Sessionperf.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	\??\c:\Windows\System32\CSCAF4A3B9470184FDD846F64B2D2A37A6C.TMP	csc.exe
File created	\??\c:\Windows\System32\b5-3tw.exe	csc.exe

Drops file in Program Files directory 6 IoCs

description	ioc	Process
File created	C:\Program Files\WindowsApps\sihost.exe	Sessionperf.exe
File created	C:\Program Files\Microsoft Office 15\ClientX64\Idle.exe	Sessionperf.exe
File opened for modification	C:\Program Files\Microsoft Office 15\ClientX64\Idle.exe	Sessionperf.exe
File created	C:\Program Files\Microsoft Office 15\ClientX64\6ccacd8608530f	Sessionperf.exe
File created	C:\Program Files\Windows Defender Advanced Threat Protection\fr-FR\csrss.exe	Sessionperf.exe
File created	C:\Program Files\Windows Defender Advanced Threat Protection\fr-FR\886983d96e3d3e	Sessionperf.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\TAPI\unsecapp.exe	Sessionperf.exe
File created	C:\Windows\TAPI\29c1c3cc0f7685	Sessionperf.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 15 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
824	schtasks.exe
3884	schtasks.exe
4148	schtasks.exe
2320	schtasks.exe
4364	schtasks.exe
2240	schtasks.exe
4956	schtasks.exe
1804	schtasks.exe
2168	schtasks.exe
3836	schtasks.exe
1504	schtasks.exe
4232	schtasks.exe
2512	schtasks.exe
2004	schtasks.exe
4908	schtasks.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings	Checker.exe
Key created	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings	Sessionperf.exe

Modifies registry key 1 TTPs 1 IoCs

Modify Registry

T1112

pid	Process
3840	reg.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3824	Sessionperf.exe
3824	Sessionperf.exe
3824	Sessionperf.exe
3824	Sessionperf.exe
3824	Sessionperf.exe
3824	Sessionperf.exe
3824	Sessionperf.exe
3824	Sessionperf.exe
3824	Sessionperf.exe
3824	Sessionperf.exe
3824	Sessionperf.exe
3824	Sessionperf.exe
3824	Sessionperf.exe
3824	Sessionperf.exe
3824	Sessionperf.exe
3824	Sessionperf.exe
3824	Sessionperf.exe
3824	Sessionperf.exe
3824	Sessionperf.exe
3824	Sessionperf.exe
3824	Sessionperf.exe
3824	Sessionperf.exe
3824	Sessionperf.exe
3824	Sessionperf.exe
3824	Sessionperf.exe
3824	Sessionperf.exe
3824	Sessionperf.exe
3824	Sessionperf.exe
3824	Sessionperf.exe
3824	Sessionperf.exe
3824	Sessionperf.exe
3824	Sessionperf.exe
3824	Sessionperf.exe
3824	Sessionperf.exe
3824	Sessionperf.exe
3824	Sessionperf.exe
3824	Sessionperf.exe
3824	Sessionperf.exe
3824	Sessionperf.exe
3824	Sessionperf.exe
3824	Sessionperf.exe
3824	Sessionperf.exe
3824	Sessionperf.exe
3824	Sessionperf.exe
3824	Sessionperf.exe
3824	Sessionperf.exe
3824	Sessionperf.exe
3824	Sessionperf.exe
3824	Sessionperf.exe
3824	Sessionperf.exe
3824	Sessionperf.exe
3824	Sessionperf.exe
3824	Sessionperf.exe
3824	Sessionperf.exe
3824	Sessionperf.exe
3824	Sessionperf.exe
3824	Sessionperf.exe
3824	Sessionperf.exe
3824	Sessionperf.exe
3824	Sessionperf.exe
3824	Sessionperf.exe
3824	Sessionperf.exe
3824	Sessionperf.exe
3824	Sessionperf.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3484	Idle.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	4092	Loader.exe
Token: SeDebugPrivilege	3824	Sessionperf.exe
Token: SeDebugPrivilege	1768	powershell.exe
Token: SeDebugPrivilege	420	powershell.exe
Token: SeDebugPrivilege	4916	powershell.exe
Token: SeDebugPrivilege	804	powershell.exe
Token: SeDebugPrivilege	424	powershell.exe
Token: SeIncreaseQuotaPrivilege	1768	powershell.exe
Token: SeSecurityPrivilege	1768	powershell.exe
Token: SeTakeOwnershipPrivilege	1768	powershell.exe
Token: SeLoadDriverPrivilege	1768	powershell.exe
Token: SeSystemProfilePrivilege	1768	powershell.exe
Token: SeSystemtimePrivilege	1768	powershell.exe
Token: SeProfSingleProcessPrivilege	1768	powershell.exe
Token: SeIncBasePriorityPrivilege	1768	powershell.exe
Token: SeCreatePagefilePrivilege	1768	powershell.exe
Token: SeBackupPrivilege	1768	powershell.exe
Token: SeRestorePrivilege	1768	powershell.exe
Token: SeShutdownPrivilege	1768	powershell.exe
Token: SeDebugPrivilege	1768	powershell.exe
Token: SeSystemEnvironmentPrivilege	1768	powershell.exe
Token: SeRemoteShutdownPrivilege	1768	powershell.exe
Token: SeUndockPrivilege	1768	powershell.exe
Token: SeManageVolumePrivilege	1768	powershell.exe
Token: 33	1768	powershell.exe
Token: 34	1768	powershell.exe
Token: 35	1768	powershell.exe
Token: 36	1768	powershell.exe
Token: SeIncreaseQuotaPrivilege	424	powershell.exe
Token: SeSecurityPrivilege	424	powershell.exe
Token: SeTakeOwnershipPrivilege	424	powershell.exe
Token: SeLoadDriverPrivilege	424	powershell.exe
Token: SeSystemProfilePrivilege	424	powershell.exe
Token: SeSystemtimePrivilege	424	powershell.exe
Token: SeProfSingleProcessPrivilege	424	powershell.exe
Token: SeIncBasePriorityPrivilege	424	powershell.exe
Token: SeCreatePagefilePrivilege	424	powershell.exe
Token: SeBackupPrivilege	424	powershell.exe
Token: SeRestorePrivilege	424	powershell.exe
Token: SeShutdownPrivilege	424	powershell.exe
Token: SeDebugPrivilege	424	powershell.exe
Token: SeSystemEnvironmentPrivilege	424	powershell.exe
Token: SeRemoteShutdownPrivilege	424	powershell.exe
Token: SeUndockPrivilege	424	powershell.exe
Token: SeManageVolumePrivilege	424	powershell.exe
Token: 33	424	powershell.exe
Token: 34	424	powershell.exe
Token: 35	424	powershell.exe
Token: 36	424	powershell.exe
Token: SeIncreaseQuotaPrivilege	4916	powershell.exe
Token: SeSecurityPrivilege	4916	powershell.exe
Token: SeTakeOwnershipPrivilege	4916	powershell.exe
Token: SeLoadDriverPrivilege	4916	powershell.exe
Token: SeSystemProfilePrivilege	4916	powershell.exe
Token: SeSystemtimePrivilege	4916	powershell.exe
Token: SeProfSingleProcessPrivilege	4916	powershell.exe
Token: SeIncBasePriorityPrivilege	4916	powershell.exe
Token: SeCreatePagefilePrivilege	4916	powershell.exe
Token: SeBackupPrivilege	4916	powershell.exe
Token: SeRestorePrivilege	4916	powershell.exe
Token: SeShutdownPrivilege	4916	powershell.exe
Token: SeDebugPrivilege	4916	powershell.exe
Token: SeSystemEnvironmentPrivilege	4916	powershell.exe
Token: SeRemoteShutdownPrivilege	4916	powershell.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3484	Idle.exe

Suspicious use of WriteProcessMemory 36 IoCs

description	pid	Process	procid_target
PID 4092 wrote to memory of 4332	4092	Loader.exe	73
PID 4092 wrote to memory of 4332	4092	Loader.exe	73
PID 4092 wrote to memory of 4332	4092	Loader.exe	73
PID 4332 wrote to memory of 3632	4332	Checker.exe	74
PID 4332 wrote to memory of 3632	4332	Checker.exe	74
PID 4332 wrote to memory of 3632	4332	Checker.exe	74
PID 3632 wrote to memory of 932	3632	WScript.exe	75
PID 3632 wrote to memory of 932	3632	WScript.exe	75
PID 3632 wrote to memory of 932	3632	WScript.exe	75
PID 932 wrote to memory of 3840	932	cmd.exe	77
PID 932 wrote to memory of 3840	932	cmd.exe	77
PID 932 wrote to memory of 3840	932	cmd.exe	77
PID 932 wrote to memory of 3824	932	cmd.exe	78
PID 932 wrote to memory of 3824	932	cmd.exe	78
PID 3824 wrote to memory of 1252	3824	Sessionperf.exe	83
PID 3824 wrote to memory of 1252	3824	Sessionperf.exe	83
PID 1252 wrote to memory of 596	1252	csc.exe	85
PID 1252 wrote to memory of 596	1252	csc.exe	85
PID 3824 wrote to memory of 420	3824	Sessionperf.exe	98
PID 3824 wrote to memory of 420	3824	Sessionperf.exe	98
PID 3824 wrote to memory of 804	3824	Sessionperf.exe	99
PID 3824 wrote to memory of 804	3824	Sessionperf.exe	99
PID 3824 wrote to memory of 4916	3824	Sessionperf.exe	100
PID 3824 wrote to memory of 4916	3824	Sessionperf.exe	100
PID 3824 wrote to memory of 424	3824	Sessionperf.exe	102
PID 3824 wrote to memory of 424	3824	Sessionperf.exe	102
PID 3824 wrote to memory of 1768	3824	Sessionperf.exe	103
PID 3824 wrote to memory of 1768	3824	Sessionperf.exe	103
PID 3824 wrote to memory of 208	3824	Sessionperf.exe	108
PID 3824 wrote to memory of 208	3824	Sessionperf.exe	108
PID 208 wrote to memory of 3636	208	cmd.exe	110
PID 208 wrote to memory of 3636	208	cmd.exe	110
PID 208 wrote to memory of 3196	208	cmd.exe	111
PID 208 wrote to memory of 3196	208	cmd.exe	111
PID 208 wrote to memory of 3484	208	cmd.exe	113
PID 208 wrote to memory of 3484	208	cmd.exe	113

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\Loader.exe
"C:\Users\Admin\AppData\Local\Temp\Loader.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4092
- C:\Users\Admin\AppData\Roaming\Checker.exe
  "C:\Users\Admin\AppData\Roaming\Checker.exe"
  2⤵
  - Executes dropped EXE
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:4332
- - C:\Windows\SysWOW64\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\blockcontainerWincrtdll\SFUqxLlNpV20NJ9uCnUYCbrkrl1WOe98n.vbe"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3632
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\blockcontainerWincrtdll\TudTneFnbF0PE5UTQ8BUoLqStO6.bat" "
      4⤵
      Suspicious use of WriteProcessMemory
      PID:932
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f
        5⤵
        Modifies registry key
        
        PID:3840
    - - C:\blockcontainerWincrtdll\Sessionperf.exe
        
        "C:\blockcontainerWincrtdll/Sessionperf.exe"
        5⤵
        Modifies WinLogon for persistence
        Executes dropped EXE
        Adds Run key to start application
        Drops file in Program Files directory
        Drops file in Windows directory
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3824
      - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\1oale0bx\1oale0bx.cmdline"
        6⤵
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:1252
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES759D.tmp" "c:\Windows\System32\CSCAF4A3B9470184FDD846F64B2D2A37A6C.TMP"
        7⤵
        
        PID:596
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Microsoft Office 15\ClientX64\Idle.exe'
        6⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious use of AdjustPrivilegeToken
        
        PID:420
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\WindowsRE\sppsvc.exe'
        6⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious use of AdjustPrivilegeToken
        
        PID:804
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\WindowsRE\dllhost.exe'
        6⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious use of AdjustPrivilegeToken
        
        PID:4916
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Windows Defender Advanced Threat Protection\fr-FR\csrss.exe'
        6⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious use of AdjustPrivilegeToken
        
        PID:424
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\TAPI\unsecapp.exe'
        6⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious use of AdjustPrivilegeToken
        
        PID:1768
      - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\j4UmrhIDPF.bat"
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:208
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        7⤵
        
        PID:3636
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        7⤵
        
        PID:3196
        
        C:\Program Files\Microsoft Office 15\ClientX64\Idle.exe
        
        "C:\Program Files\Microsoft Office 15\ClientX64\Idle.exe"
        7⤵
        Executes dropped EXE
        Suspicious behavior: GetForegroundWindowSpam
        Suspicious use of SetWindowsHookEx
        
        PID:3484

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 5 /tr "'C:\Program Files\Microsoft Office 15\ClientX64\Idle.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1804

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Idle" /sc ONLOGON /tr "'C:\Program Files\Microsoft Office 15\ClientX64\Idle.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1504

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 6 /tr "'C:\Program Files\Microsoft Office 15\ClientX64\Idle.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3884

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 7 /tr "'C:\Recovery\WindowsRE\sppsvc.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4908

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvc" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\sppsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3836

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 12 /tr "'C:\Recovery\WindowsRE\sppsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2240

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 11 /tr "'C:\Recovery\WindowsRE\dllhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2168

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2004

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 9 /tr "'C:\Recovery\WindowsRE\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2512

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 14 /tr "'C:\Program Files\Windows Defender Advanced Threat Protection\fr-FR\csrss.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4364

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Program Files\Windows Defender Advanced Threat Protection\fr-FR\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4232

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 6 /tr "'C:\Program Files\Windows Defender Advanced Threat Protection\fr-FR\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2320

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "unsecappu" /sc MINUTE /mo 13 /tr "'C:\Windows\TAPI\unsecapp.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:824

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "unsecapp" /sc ONLOGON /tr "'C:\Windows\TAPI\unsecapp.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4148

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "unsecappu" /sc MINUTE /mo 10 /tr "'C:\Windows\TAPI\unsecapp.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4956

C:\Program Files\Microsoft Office 15\ClientX64\Idle.exe
"C:\Program Files\Microsoft Office 15\ClientX64\Idle.exe"
1⤵
- Executes dropped EXE
PID:4728

C:\Program Files\Windows Defender Advanced Threat Protection\fr-FR\csrss.exe
"C:\Program Files\Windows Defender Advanced Threat Protection\fr-FR\csrss.exe"
1⤵
- Executes dropped EXE
PID:4004

C:\Recovery\WindowsRE\dllhost.exe
C:\Recovery\WindowsRE\dllhost.exe
1⤵
- Executes dropped EXE
PID:2656

C:\Windows\TAPI\unsecapp.exe
C:\Windows\TAPI\unsecapp.exe
1⤵
- Executes dropped EXE
PID:2892

C:\Program Files\Microsoft Office 15\ClientX64\Idle.exe
"C:\Program Files\Microsoft Office 15\ClientX64\Idle.exe"
1⤵
- Executes dropped EXE
PID:3196

C:\Program Files\Windows Defender Advanced Threat Protection\fr-FR\csrss.exe
"C:\Program Files\Windows Defender Advanced Threat Protection\fr-FR\csrss.exe"
1⤵
- Executes dropped EXE
PID:4172

C:\Recovery\WindowsRE\sppsvc.exe
C:\Recovery\WindowsRE\sppsvc.exe
1⤵
- Executes dropped EXE
PID:2008

C:\Program Files\Microsoft Office 15\ClientX64\Idle.exe
"C:\Program Files\Microsoft Office 15\ClientX64\Idle.exe"
1⤵
- Executes dropped EXE
PID:4316

C:\Recovery\WindowsRE\dllhost.exe
C:\Recovery\WindowsRE\dllhost.exe
1⤵
- Executes dropped EXE
PID:3204

C:\Program Files\Windows Defender Advanced Threat Protection\fr-FR\csrss.exe
"C:\Program Files\Windows Defender Advanced Threat Protection\fr-FR\csrss.exe"
1⤵
- Executes dropped EXE
PID:1864

C:\Windows\TAPI\unsecapp.exe
C:\Windows\TAPI\unsecapp.exe
1⤵
- Executes dropped EXE
PID:2264

C:\Program Files\Windows Defender Advanced Threat Protection\fr-FR\csrss.exe
"C:\Program Files\Windows Defender Advanced Threat Protection\fr-FR\csrss.exe"
1⤵
- Executes dropped EXE
PID:1328

C:\Program Files\Microsoft Office 15\ClientX64\Idle.exe
"C:\Program Files\Microsoft Office 15\ClientX64\Idle.exe"
1⤵
- Executes dropped EXE
PID:4156

C:\Recovery\WindowsRE\sppsvc.exe
C:\Recovery\WindowsRE\sppsvc.exe
1⤵
- Executes dropped EXE
PID:4232

C:\Recovery\WindowsRE\dllhost.exe
C:\Recovery\WindowsRE\dllhost.exe
1⤵
- Executes dropped EXE
PID:1420

C:\Program Files\Windows Defender Advanced Threat Protection\fr-FR\csrss.exe
"C:\Program Files\Windows Defender Advanced Threat Protection\fr-FR\csrss.exe"
1⤵
- Executes dropped EXE
PID:4824

C:\Windows\TAPI\unsecapp.exe
C:\Windows\TAPI\unsecapp.exe
1⤵
- Executes dropped EXE
PID:3588

C:\Program Files\Microsoft Office 15\ClientX64\Idle.exe
"C:\Program Files\Microsoft Office 15\ClientX64\Idle.exe"
1⤵
- Executes dropped EXE
PID:4408

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Scheduled Task/Job

T1053

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Scheduled Task/Job

T1053

Defense Evasion

Modify Registry

T1112

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\Microsoft Office 15\ClientX64\Idle.exe

Filesize
480KB

MD5
2acfbb2069bcd9959053e99c530a057e

SHA1
fcf9c4d0a6c69bd176d1cb44ba1409a70554f396

SHA256
0d09de24c2dd7d63a191cdcae32cc2cf97bc56aa708da1274f06487464b3f9a1

SHA512
df9a556795a3b951c1b540679831b07d4425ef5a9e4f76ed81e7f9cda6759c029a1f5427d2993bc6259cde04442f02e4d14be1f054746f8a68881cd384565d18

Download Submit
C:\Program Files\Windows Defender Advanced Threat Protection\fr-FR\csrss.exe

Filesize
614KB

MD5
ad16eec72e840f58a47e5907877bb856

SHA1
c454807c34b2f305e4a5c9efe55faef6957191f5

SHA256
6df6076f255ed0548ac2057bd5bf84841f009228949c444ec58a2aa4bea358f4

SHA512
9672b124a203e993eaabdedf67b40432dde78d9c442fbd305e80989e440255fe8bb9b63e8e5cda2e7e42dee01b54944cc618c919045cf88341df83505b90c456

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
3KB

MD5
8592ba100a78835a6b94d5949e13dfc1

SHA1
63e901200ab9a57c7dd4c078d7f75dcd3b357020

SHA256
fdd7d9def6f9f0c0f2e60dbc8a2d1999071cd7d3095e9e087bb1cda7a614ac3c

SHA512
87f98e6cb61b2a2a7d65710c4d33881d89715eb7a06e00d492259f35c3902498baabffc5886be0ec5a14312ad4c262e3fc40cd3a5cb91701af0fb229726b88c3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\unsecapp.exe.log

Filesize
847B

MD5
ffd07202965cc8d2106fe0866224d425

SHA1
102aae2319ed83e56a862b2525d58e57d8fe9f9a

SHA256
3e8458b928401cad08ef5cfc2c86706a15ef67d03f0c010b6ca4651370b97df2

SHA512
fdcab2ce6f65f28ec9da146b04ab4f38e0ee857a4fa70ced68abddfc16156ae466dca072f0820f83d935f89002484e9ade1e9f35a5df516793090ec95fafcbbb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
968b5bac828ef676c637e8e55d8dcde9

SHA1
05e3307a0c2a29dae1af455196d8cf8dbb648561

SHA256
b315d9542388259fe099abd49bf0a750b56bde61ef74c18a2e301358e4ea6f93

SHA512
c8b097d88f961747d3ac16a3530aa687420015a142aa86a25285a93da404507cd7800d82370727a320eaa4e427df95de418f4991c21a527b7ed60060da8249f6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
aaa4d2221eccaebb8f96c6942d1fa864

SHA1
c01724fc031e03a57d3bbc64640cb304861e06d1

SHA256
b1fc8416708cfa2acfa37b7edecd2e31c17c6ad5f043e0c4e6a3247f09b461be

SHA512
190186eb3e455127244e1dd6a5a18c4b35a364a685514b14e1e4545a2ffbeff78ab20b304abd1eea5d68099c0666883361b694292121cd774e919e20693d7726

Download Submit
C:\Users\Admin\AppData\Local\Temp\RES759D.tmp

Filesize
1KB

MD5
13fe99d52fd818005ca78db7fdb1f99a

SHA1
9f5fce1f08a236e4807ac0e6ad47084c35d1f12d

SHA256
630ea2145b810734dde7e00b6abea93ebde6f01ab2a15c3445cd60e6cb991ada

SHA512
71fc73a9831702023682c5a43eb8270a45dfc4e143f4beb8e59bb4f154d56e789e8be1a6292eb43a9e415f0fbdc7ee8b2af654d42726591bc04f3b490cfda23c

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_vsxosudt.qbw.ps1

Filesize
1B

MD5
c4ca4238a0b923820dcc509a6f75849b

SHA1
356a192b7913b04c54574d18c28d46e6395428ab

SHA256
6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b

SHA512
4dff4ea340f0a823f15d3f4f01ab62eae0e5da579ccb851f8db9dfe84c58b2b37b89903a740e1ee172da793a6e79d560e5f7f9bd058a12a280433ed6fa46510a

Download Submit
C:\Users\Admin\AppData\Local\Temp\j4UmrhIDPF.bat

Filesize
231B

MD5
739a2ccf51f12175033a28bbccc44521

SHA1
1da8650a3a8fe08bddc887f7df06d9e930978b3d

SHA256
91afb18ef42c6b12f6272096ff3f2cea03cd505a6fcee4f3f22128ba9af485d2

SHA512
da5bd6f7d6bcad4d090c0699bfb5adb441912b1829a99ad2a7db9c01d2df52315f270ca7712cd1502b15fc73bae311e9f68331b4225a26db9fb121ab6c677c15

Download Submit
C:\Users\Admin\AppData\Roaming\Checker.exe

Filesize
3.9MB

MD5
1003b37d9d942d41a38a83670eaa285c

SHA1
a4ee7ef69fc681caf1116d59578667abb9080ad6

SHA256
d822b616ee7e10b00fead9be9eb0cf9780fdb0b3fec3001ff31c9ce0cb7255ae

SHA512
0c6f4e063cc22ee3c076c95bf5ea1cb593e5b6f40e4f2b8d3723a5c18c14eeecf568dad2a16599967c56588f4918cecd996e475fd20615b07c99de4800309f9a

Download Submit
C:\Windows\TAPI\unsecapp.exe

Filesize
1.3MB

MD5
993a54b20dc325b6b3157f68bfda3ee3

SHA1
3894aa294eb1a23ac88053b467dc2fe6bc437c72

SHA256
13614b041601e8856d5cca01903b8408cd8988730ea4d82358889062880b85a8

SHA512
0efb51ef81be0b15b3a47a1a980edb855603bad56983a42aa3db4d1296fcbda2441b5b4296d0c8f332472221af1f7191daa4c99338708fb0899114cad8efd323

Download Submit
C:\blockcontainerWincrtdll\SFUqxLlNpV20NJ9uCnUYCbrkrl1WOe98n.vbe

Filesize
228B

MD5
4f702b152f4098393712e3fe99b04fbd

SHA1
fec2f913e1fac5053127e175f1ba048c9d8dd25c

SHA256
f0e2bfb22d22aed8ac10eff5a010fad081a5798706b3a6fd7764798cab716eb2

SHA512
7c0844d6591b694d77ecf3d070eb3f70fd99427e41d62167aa58c98c1966a8065d90beb82ab0aa0a42bb80edb3c205dd07bb1d4fc03d989a0cb4df8993635fbf

Download Submit
C:\blockcontainerWincrtdll\Sessionperf.exe

Filesize
3.6MB

MD5
bf0f63bb48eb95aaec6fc6a001c974ce

SHA1
19baab2b0c129ecbd6a1aa21bada3e2e5cdd1136

SHA256
bbb080aed81b8f4d0f5d590c7cb0e56e68da5a27d32d964c32e50e1cb2015edc

SHA512
130f08a7c4901ef47e7d21effe83c19fa442f2ade97967c11e646f949a9e8c2c46e8272a31a5b75f6c279009530cd101a562f1ab31a28fe410273cd69bf6c28c

Download Submit
C:\blockcontainerWincrtdll\TudTneFnbF0PE5UTQ8BUoLqStO6.bat

Filesize
201B

MD5
159297f9e35114bf97d74622097780d8

SHA1
2aaaf993b9ecb9bae43ccd41585734512ff08355

SHA256
650c37c1afde471e40f77d7aec8603382214e9ec318b7f08ab7653f9c4e87f81

SHA512
a82faa2f64caf669d44eac03705e34bea213c9a74ed73950bd8d2158d1c256ca290b7ffece866c3a03c36a091be70d92157353782061e184e5d44ac937949f69

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\1oale0bx\1oale0bx.0.cs

Filesize
387B

MD5
290e63695f641f67c761f61d38652170

SHA1
743ba10b39e4a4f57be0ac8823faecdfd3c2914a

SHA256
b2dfa0a45c77dee25d425382fa5db77e7ed89a0d30135d5b5f9b5640e68dbed5

SHA512
ced0098553372ed289127d8a715ed928e9a357325bfb31e652b056a0e2f9d48266736c3d915999527e640967691f4bef268faad5925b88278171f9a552fb3cec

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\1oale0bx\1oale0bx.cmdline

Filesize
235B

MD5
d86a2f746f0e0e173acf8553aaff45f8

SHA1
c9a2fe3a5121ef26d7c2d73d54629dac5fc5e5f5

SHA256
413d03f6916051fbb569e7465d549ed115e4a34368c05e011850ceb822cccd96

SHA512
e2a54c9b15a8287b7ae63fe8b2306ebb860b915dc6a86583271dd49864f4eb9bc966fda8e29a0278d895e336077692de3b47414ab2fa0f1da3e39a7170d84562

Download Submit
\??\c:\Windows\System32\CSCAF4A3B9470184FDD846F64B2D2A37A6C.TMP

Filesize
1KB

MD5
6d2e1afd58a144bc17ed280b510c7ca8

SHA1
8f0802f6a4e75cd6870573a8e8ed51c634ef5653

SHA256
09d6068e26bfa3a6148b45d54c66d9f8ca9e8792869d7b22da28aa73373e0895

SHA512
5a3622b68416e2190f1fa793319f4b4813e0000ed67452e1a7716e8726488d1e929f5ff0a6f299d7132054de84aace4b21d3b5e2ea939da050cb65076b76a1de

Download Submit
memory/424-135-0x00000297A4D20000-0x00000297A4D96000-memory.dmp

Filesize
472KB

Download
memory/3484-347-0x000000001C0D0000-0x000000001C18F000-memory.dmp

Filesize
764KB

Download
memory/3824-31-0x000000001B5C0000-0x000000001B5DC000-memory.dmp

Filesize
112KB

Download
memory/3824-50-0x000000001B620000-0x000000001B630000-memory.dmp

Filesize
64KB

Download
memory/3824-52-0x000000001B6C0000-0x000000001B6D6000-memory.dmp

Filesize
88KB

Download
memory/3824-44-0x000000001B600000-0x000000001B60E000-memory.dmp

Filesize
56KB

Download
memory/3824-54-0x000000001B6E0000-0x000000001B6F2000-memory.dmp

Filesize
72KB

Download
memory/3824-55-0x000000001BC30000-0x000000001C156000-memory.dmp

Filesize
5.1MB

Download
memory/3824-57-0x000000001B6A0000-0x000000001B6AE000-memory.dmp

Filesize
56KB

Download
memory/3824-59-0x000000001B6B0000-0x000000001B6C0000-memory.dmp

Filesize
64KB

Download
memory/3824-61-0x000000001B700000-0x000000001B710000-memory.dmp

Filesize
64KB

Download
memory/3824-63-0x000000001B770000-0x000000001B7CA000-memory.dmp

Filesize
360KB

Download
memory/3824-29-0x00000000028C0000-0x00000000028CE000-memory.dmp

Filesize
56KB

Download
memory/3824-65-0x000000001B710000-0x000000001B71E000-memory.dmp

Filesize
56KB

Download
memory/3824-67-0x000000001B720000-0x000000001B730000-memory.dmp

Filesize
64KB

Download
memory/3824-71-0x000000001B9D0000-0x000000001B9E8000-memory.dmp

Filesize
96KB

Download
memory/3824-75-0x000000001BA40000-0x000000001BA8E000-memory.dmp

Filesize
312KB

Download
memory/3824-73-0x000000001B740000-0x000000001B74C000-memory.dmp

Filesize
48KB

Download
memory/3824-69-0x000000001B730000-0x000000001B73E000-memory.dmp

Filesize
56KB

Download
memory/3824-48-0x000000001B610000-0x000000001B61C000-memory.dmp

Filesize
48KB

Download
memory/3824-46-0x000000001B680000-0x000000001B692000-memory.dmp

Filesize
72KB

Download
memory/3824-42-0x000000001B270000-0x000000001B27E000-memory.dmp

Filesize
56KB

Download
memory/3824-36-0x000000001B5E0000-0x000000001B5F8000-memory.dmp

Filesize
96KB

Download
memory/3824-40-0x000000001B260000-0x000000001B270000-memory.dmp

Filesize
64KB

Download
memory/3824-124-0x000000001C460000-0x000000001C51F000-memory.dmp

Filesize
764KB

Download
memory/3824-25-0x00000000003B0000-0x0000000000752000-memory.dmp

Filesize
3.6MB

Download
memory/3824-38-0x000000001B250000-0x000000001B260000-memory.dmp

Filesize
64KB

Download
memory/3824-27-0x000000001B280000-0x000000001B2A6000-memory.dmp

Filesize
152KB

Download
memory/3824-34-0x0000000002920000-0x0000000002930000-memory.dmp

Filesize
64KB

Download
memory/3824-32-0x000000001B630000-0x000000001B680000-memory.dmp

Filesize
320KB

Download
memory/4092-0-0x0000000000AA0000-0x0000000000AFE000-memory.dmp

Filesize
376KB

Download
memory/4092-11-0x00007FFA56F60000-0x00007FFA5794C000-memory.dmp

Filesize
9.9MB

Download
memory/4092-3-0x00007FFA56F60000-0x00007FFA5794C000-memory.dmp

Filesize
9.9MB

Download
memory/4092-2-0x00007FFA56F60000-0x00007FFA5794C000-memory.dmp

Filesize
9.9MB

Download
memory/4092-1-0x00007FFA56F63000-0x00007FFA56F64000-memory.dmp

Filesize
4KB

Download
memory/4916-122-0x00000259C6510000-0x00000259C6532000-memory.dmp

Filesize
136KB

Download