44caliber | 7503a5dc33aaafdaeeb0b45e3688ce8dc3c640d9d7323302a3055bd18b83f5a9

Analysis

max time kernel
149s
max time network
119s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
21-06-2024 12:54

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Nurik.exe
Size

1.4MB
MD5

9493802d03c38018bec6f0c378ecccb2
SHA1

3634874fe3f261f85549b4fa18de218c6e3a1023
SHA256

7503a5dc33aaafdaeeb0b45e3688ce8dc3c640d9d7323302a3055bd18b83f5a9
SHA512

190161d95cfa96022425d4bf0c9160a1758b07ffcb6954561203fded8f7046919aaf7253b682f99a52b8618649818814612b5a5d02de68ef4007d8ec2bb52140
SSDEEP

24576:Pz2ABe2G/nvxW3WckpJWjXbNQsVZy8v8BQSsZWcJ4LO:Pz9MbA3wvW+sVZy8fZW

Score

10^/10

44caliber dcrat infostealer rat spyware stealer

Malware Config

Extracted

Family

44caliber

https://discord.com/api/webhooks/1253689379948593173/lzPh5dDD7ETWYLRPMt2M_Ml82yS42YxolYTwBWldi4NXuLOvpMPhz7AlFtFln1RxcqaC

Signatures

44Caliber
An open source infostealer written in C#.
stealer 44caliber
DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat

Process spawned unexpected child process 57 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	756	800	schtasks.exe	36
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	880	800	schtasks.exe	36
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2720	800	schtasks.exe	36
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2872	800	schtasks.exe	36
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2808	800	schtasks.exe	36
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	752	800	schtasks.exe	36
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1672	800	schtasks.exe	36
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1608	800	schtasks.exe	36
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2124	800	schtasks.exe	36
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2284	800	schtasks.exe	36
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1964	800	schtasks.exe	36
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2300	800	schtasks.exe	36
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2844	800	schtasks.exe	36
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2816	800	schtasks.exe	36
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	768	800	schtasks.exe	36
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	968	800	schtasks.exe	36
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1464	800	schtasks.exe	36
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	544	800	schtasks.exe	36
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	324	800	schtasks.exe	36
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1124	800	schtasks.exe	36
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1696	800	schtasks.exe	36
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1704	800	schtasks.exe	36
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2376	800	schtasks.exe	36
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1296	800	schtasks.exe	36
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1912	800	schtasks.exe	36
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2044	800	schtasks.exe	36
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1908	800	schtasks.exe	36
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1904	800	schtasks.exe	36
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	888	800	schtasks.exe	36
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2356	800	schtasks.exe	36
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3004	800	schtasks.exe	36
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1116	800	schtasks.exe	36
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2144	800	schtasks.exe	36
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	540	800	schtasks.exe	36
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1640	800	schtasks.exe	36
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	860	800	schtasks.exe	36
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2936	800	schtasks.exe	36
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2428	800	schtasks.exe	36
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1804	800	schtasks.exe	36
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1272	800	schtasks.exe	36
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2224	800	schtasks.exe	36
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2168	800	schtasks.exe	36
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1384	800	schtasks.exe	36
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2712	800	schtasks.exe	36
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2704	800	schtasks.exe	36
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2288	800	schtasks.exe	36
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2780	800	schtasks.exe	36
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2660	800	schtasks.exe	36
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1512	800	schtasks.exe	36
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2240	800	schtasks.exe	36
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1052	800	schtasks.exe	36
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1276	800	schtasks.exe	36
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2892	800	schtasks.exe	36
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2072	800	schtasks.exe	36
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	788	800	schtasks.exe	36
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2840	800	schtasks.exe	36
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2856	800	schtasks.exe	36

DCRat payload 5 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral1/memory/1952-1-0x0000000001280000-0x00000000013F6000-memory.dmp	dcrat
behavioral1/files/0x0038000000015686-11.dat	dcrat
behavioral1/files/0x0007000000015cdf-46.dat	dcrat
behavioral1/memory/2060-50-0x00000000001A0000-0x0000000000276000-memory.dmp	dcrat
behavioral1/memory/1764-96-0x0000000000BB0000-0x0000000000C86000-memory.dmp	dcrat

Executes dropped EXE 4 IoCs

pid	Process
2216	steal.exe
2640	tidayn.exe
2060	ServercrtDll.exe
1764	csrss.exe

Loads dropped DLL 4 IoCs

pid	Process
1952	Nurik.exe
1952	Nurik.exe
2252	cmd.exe
2252	cmd.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Drops file in Program Files directory 10 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Windows Mail\cmd.exe	ServercrtDll.exe
File created	C:\Program Files (x86)\Windows Mail\ebf1f9fa8afd6d	ServercrtDll.exe
File created	C:\Program Files (x86)\Adobe\Reader 9.0\Esl\886983d96e3d3e	ServercrtDll.exe
File created	C:\Program Files (x86)\Windows NT\TableTextService\csrss.exe	ServercrtDll.exe
File created	C:\Program Files\VideoLAN\42af1c969fbb7b	ServercrtDll.exe
File created	C:\Program Files (x86)\Windows NT\TableTextService\886983d96e3d3e	ServercrtDll.exe
File created	C:\Program Files (x86)\Microsoft Synchronization Services\ADO.NET\v1.0\lsass.exe	ServercrtDll.exe
File created	C:\Program Files (x86)\Microsoft Synchronization Services\ADO.NET\v1.0\6203df4a6bafc7	ServercrtDll.exe
File created	C:\Program Files (x86)\Adobe\Reader 9.0\Esl\csrss.exe	ServercrtDll.exe
File created	C:\Program Files\VideoLAN\audiodg.exe	ServercrtDll.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File created	C:\Windows\PolicyDefinitions\en-US\wininit.exe	ServercrtDll.exe
File created	C:\Windows\PolicyDefinitions\en-US\56085415360792	ServercrtDll.exe
File created	C:\Windows\Vss\Writers\System\taskmgr.exe	ServercrtDll.exe
File created	C:\Windows\Vss\Writers\System\9a52d3f036c812	ServercrtDll.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Scheduled Task/Job: Scheduled Task 1 TTPs 57 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
1608	schtasks.exe
968	schtasks.exe
1804	schtasks.exe
2300	schtasks.exe
1464	schtasks.exe
1912	schtasks.exe
2288	schtasks.exe
788	schtasks.exe
2284	schtasks.exe
768	schtasks.exe
1904	schtasks.exe
1272	schtasks.exe
2168	schtasks.exe
2712	schtasks.exe
2720	schtasks.exe
1964	schtasks.exe
1696	schtasks.exe
3004	schtasks.exe
1640	schtasks.exe
2428	schtasks.exe
1384	schtasks.exe
2780	schtasks.exe
880	schtasks.exe
2124	schtasks.exe
860	schtasks.exe
1052	schtasks.exe
2856	schtasks.exe
2808	schtasks.exe
888	schtasks.exe
752	schtasks.exe
1704	schtasks.exe
2224	schtasks.exe
1672	schtasks.exe
2376	schtasks.exe
2356	schtasks.exe
2704	schtasks.exe
1124	schtasks.exe
2144	schtasks.exe
2840	schtasks.exe
2844	schtasks.exe
324	schtasks.exe
1296	schtasks.exe
2240	schtasks.exe
1276	schtasks.exe
2044	schtasks.exe
1908	schtasks.exe
1116	schtasks.exe
540	schtasks.exe
2660	schtasks.exe
2072	schtasks.exe
2872	schtasks.exe
2816	schtasks.exe
544	schtasks.exe
2892	schtasks.exe
756	schtasks.exe
2936	schtasks.exe
1512	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2216	steal.exe
2216	steal.exe
2216	steal.exe
1600	taskmgr.exe
1600	taskmgr.exe
1600	taskmgr.exe
1600	taskmgr.exe
1600	taskmgr.exe
1600	taskmgr.exe
1600	taskmgr.exe
1600	taskmgr.exe
2060	ServercrtDll.exe
2060	ServercrtDll.exe
2060	ServercrtDll.exe
1600	taskmgr.exe
1600	taskmgr.exe
1600	taskmgr.exe
1600	taskmgr.exe
1600	taskmgr.exe
1600	taskmgr.exe
1600	taskmgr.exe
1764	csrss.exe
1600	taskmgr.exe
1600	taskmgr.exe
1600	taskmgr.exe
1600	taskmgr.exe
1600	taskmgr.exe
1600	taskmgr.exe
1600	taskmgr.exe
1600	taskmgr.exe
1600	taskmgr.exe
1600	taskmgr.exe
1600	taskmgr.exe
1600	taskmgr.exe
1600	taskmgr.exe
1600	taskmgr.exe
1600	taskmgr.exe
1600	taskmgr.exe
1600	taskmgr.exe
1600	taskmgr.exe
1600	taskmgr.exe
1600	taskmgr.exe
1600	taskmgr.exe
1600	taskmgr.exe
1600	taskmgr.exe
1600	taskmgr.exe
1600	taskmgr.exe
1600	taskmgr.exe
1600	taskmgr.exe
1600	taskmgr.exe
1600	taskmgr.exe
1600	taskmgr.exe
1600	taskmgr.exe
1600	taskmgr.exe
1600	taskmgr.exe
1600	taskmgr.exe
1600	taskmgr.exe
1600	taskmgr.exe
1600	taskmgr.exe
1600	taskmgr.exe
1600	taskmgr.exe
1600	taskmgr.exe
1600	taskmgr.exe
1600	taskmgr.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1600	taskmgr.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	2216	steal.exe
Token: SeDebugPrivilege	1600	taskmgr.exe
Token: SeDebugPrivilege	2060	ServercrtDll.exe
Token: SeDebugPrivilege	1764	csrss.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
1600	taskmgr.exe
1600	taskmgr.exe
1600	taskmgr.exe
1600	taskmgr.exe
1600	taskmgr.exe
1600	taskmgr.exe
1600	taskmgr.exe
1600	taskmgr.exe
1600	taskmgr.exe
1600	taskmgr.exe
1600	taskmgr.exe
1600	taskmgr.exe
1600	taskmgr.exe
1600	taskmgr.exe
1600	taskmgr.exe
1600	taskmgr.exe
1600	taskmgr.exe
1600	taskmgr.exe
1600	taskmgr.exe
1600	taskmgr.exe
1600	taskmgr.exe
1600	taskmgr.exe
1600	taskmgr.exe
1600	taskmgr.exe
1600	taskmgr.exe
1600	taskmgr.exe
1600	taskmgr.exe
1600	taskmgr.exe
1600	taskmgr.exe
1600	taskmgr.exe
1600	taskmgr.exe
1600	taskmgr.exe
1600	taskmgr.exe
1600	taskmgr.exe
1600	taskmgr.exe
1600	taskmgr.exe
1600	taskmgr.exe
1600	taskmgr.exe
1600	taskmgr.exe
1600	taskmgr.exe
1600	taskmgr.exe
1600	taskmgr.exe
1600	taskmgr.exe
1600	taskmgr.exe
1600	taskmgr.exe
1600	taskmgr.exe
1600	taskmgr.exe
1600	taskmgr.exe
1600	taskmgr.exe
1600	taskmgr.exe
1600	taskmgr.exe
1600	taskmgr.exe
1600	taskmgr.exe
1600	taskmgr.exe
1600	taskmgr.exe
1600	taskmgr.exe
1600	taskmgr.exe
1600	taskmgr.exe
1600	taskmgr.exe
1600	taskmgr.exe
1600	taskmgr.exe
1600	taskmgr.exe
1600	taskmgr.exe
1600	taskmgr.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
1600	taskmgr.exe
1600	taskmgr.exe
1600	taskmgr.exe
1600	taskmgr.exe
1600	taskmgr.exe
1600	taskmgr.exe
1600	taskmgr.exe
1600	taskmgr.exe
1600	taskmgr.exe
1600	taskmgr.exe
1600	taskmgr.exe
1600	taskmgr.exe
1600	taskmgr.exe
1600	taskmgr.exe
1600	taskmgr.exe
1600	taskmgr.exe
1600	taskmgr.exe
1600	taskmgr.exe
1600	taskmgr.exe
1600	taskmgr.exe
1600	taskmgr.exe
1600	taskmgr.exe
1600	taskmgr.exe
1600	taskmgr.exe
1600	taskmgr.exe
1600	taskmgr.exe
1600	taskmgr.exe
1600	taskmgr.exe
1600	taskmgr.exe
1600	taskmgr.exe
1600	taskmgr.exe
1600	taskmgr.exe
1600	taskmgr.exe
1600	taskmgr.exe
1600	taskmgr.exe
1600	taskmgr.exe
1600	taskmgr.exe
1600	taskmgr.exe
1600	taskmgr.exe
1600	taskmgr.exe
1600	taskmgr.exe
1600	taskmgr.exe
1600	taskmgr.exe
1600	taskmgr.exe
1600	taskmgr.exe
1600	taskmgr.exe
1600	taskmgr.exe
1600	taskmgr.exe
1600	taskmgr.exe
1600	taskmgr.exe
1600	taskmgr.exe
1600	taskmgr.exe
1600	taskmgr.exe
1600	taskmgr.exe
1600	taskmgr.exe
1600	taskmgr.exe
1600	taskmgr.exe
1600	taskmgr.exe
1600	taskmgr.exe
1600	taskmgr.exe
1600	taskmgr.exe
1600	taskmgr.exe
1600	taskmgr.exe
1600	taskmgr.exe

Suspicious use of WriteProcessMemory 32 IoCs

description	pid	Process	procid_target
PID 1952 wrote to memory of 2216	1952	Nurik.exe	28
PID 1952 wrote to memory of 2216	1952	Nurik.exe	28
PID 1952 wrote to memory of 2216	1952	Nurik.exe	28
PID 1952 wrote to memory of 2216	1952	Nurik.exe	28
PID 1952 wrote to memory of 2640	1952	Nurik.exe	29
PID 1952 wrote to memory of 2640	1952	Nurik.exe	29
PID 1952 wrote to memory of 2640	1952	Nurik.exe	29
PID 1952 wrote to memory of 2640	1952	Nurik.exe	29
PID 2640 wrote to memory of 2620	2640	tidayn.exe	30
PID 2640 wrote to memory of 2620	2640	tidayn.exe	30
PID 2640 wrote to memory of 2620	2640	tidayn.exe	30
PID 2640 wrote to memory of 2620	2640	tidayn.exe	30
PID 2216 wrote to memory of 2516	2216	steal.exe	31
PID 2216 wrote to memory of 2516	2216	steal.exe	31
PID 2216 wrote to memory of 2516	2216	steal.exe	31
PID 2620 wrote to memory of 2252	2620	WScript.exe	33
PID 2620 wrote to memory of 2252	2620	WScript.exe	33
PID 2620 wrote to memory of 2252	2620	WScript.exe	33
PID 2620 wrote to memory of 2252	2620	WScript.exe	33
PID 2252 wrote to memory of 2060	2252	cmd.exe	35
PID 2252 wrote to memory of 2060	2252	cmd.exe	35
PID 2252 wrote to memory of 2060	2252	cmd.exe	35
PID 2252 wrote to memory of 2060	2252	cmd.exe	35
PID 2060 wrote to memory of 1552	2060	ServercrtDll.exe	94
PID 2060 wrote to memory of 1552	2060	ServercrtDll.exe	94
PID 2060 wrote to memory of 1552	2060	ServercrtDll.exe	94
PID 1552 wrote to memory of 2564	1552	cmd.exe	96
PID 1552 wrote to memory of 2564	1552	cmd.exe	96
PID 1552 wrote to memory of 2564	1552	cmd.exe	96
PID 1552 wrote to memory of 1764	1552	cmd.exe	97
PID 1552 wrote to memory of 1764	1552	cmd.exe	97
PID 1552 wrote to memory of 1764	1552	cmd.exe	97

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\Nurik.exe
"C:\Users\Admin\AppData\Local\Temp\Nurik.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1952
- C:\Users\Admin\AppData\Local\Temp\steal.exe
  "C:\Users\Admin\AppData\Local\Temp\steal.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2216
- - C:\Windows\system32\WerFault.exe
    C:\Windows\system32\WerFault.exe -u -p 2216 -s 1048
    3⤵
    PID:2516
- C:\Users\Admin\AppData\Local\Temp\tidayn.exe
  "C:\Users\Admin\AppData\Local\Temp\tidayn.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:2640
- - C:\Windows\SysWOW64\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Hypercommon\s6qV8wojz3Yx3vhyfOAzGuFvxlJ5l.vbe"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2620
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c ""C:\Hypercommon\Udwe1ynNPaETo.bat" "
      4⤵
      Loads dropped DLL
      Suspicious use of WriteProcessMemory
      PID:2252
    - - C:\Hypercommon\ServercrtDll.exe
        
        "C:\Hypercommon\ServercrtDll.exe"
        5⤵
        Executes dropped EXE
        Drops file in Program Files directory
        Drops file in Windows directory
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2060
      - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\FuEInxV2Lw.bat"
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:1552
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        7⤵
        
        PID:2564
        
        C:\Program Files (x86)\Windows NT\TableTextService\csrss.exe
        
        "C:\Program Files (x86)\Windows NT\TableTextService\csrss.exe"
        7⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1764

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /4
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1600

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 10 /tr "'C:\Users\Default\smss.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:756

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smss" /sc ONLOGON /tr "'C:\Users\Default\smss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:880

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 8 /tr "'C:\Users\Default\smss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2720

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsml" /sc MINUTE /mo 8 /tr "'C:\Recovery\8f60a382-0d98-11ef-817d-5aba25856535\lsm.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2872

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsm" /sc ONLOGON /tr "'C:\Recovery\8f60a382-0d98-11ef-817d-5aba25856535\lsm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2808

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsml" /sc MINUTE /mo 13 /tr "'C:\Recovery\8f60a382-0d98-11ef-817d-5aba25856535\lsm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:752

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WerFaultW" /sc MINUTE /mo 5 /tr "'C:\Recovery\8f60a382-0d98-11ef-817d-5aba25856535\WerFault.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1672

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WerFault" /sc ONLOGON /tr "'C:\Recovery\8f60a382-0d98-11ef-817d-5aba25856535\WerFault.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1608

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WerFaultW" /sc MINUTE /mo 11 /tr "'C:\Recovery\8f60a382-0d98-11ef-817d-5aba25856535\WerFault.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2124

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskmgrt" /sc MINUTE /mo 8 /tr "'C:\MSOCache\All Users\{90140000-00BA-0409-0000-0000000FF1CE}-C\taskmgr.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2284

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskmgr" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-00BA-0409-0000-0000000FF1CE}-C\taskmgr.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1964

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskmgrt" /sc MINUTE /mo 8 /tr "'C:\MSOCache\All Users\{90140000-00BA-0409-0000-0000000FF1CE}-C\taskmgr.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2300

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 9 /tr "'C:\Windows\PolicyDefinitions\en-US\wininit.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2844

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininit" /sc ONLOGON /tr "'C:\Windows\PolicyDefinitions\en-US\wininit.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2816

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 6 /tr "'C:\Windows\PolicyDefinitions\en-US\wininit.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:768

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "audiodga" /sc MINUTE /mo 11 /tr "'C:\Program Files\VideoLAN\audiodg.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:968

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "audiodg" /sc ONLOGON /tr "'C:\Program Files\VideoLAN\audiodg.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1464

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "audiodga" /sc MINUTE /mo 9 /tr "'C:\Program Files\VideoLAN\audiodg.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:544

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskmgrt" /sc MINUTE /mo 9 /tr "'C:\Windows\Vss\Writers\System\taskmgr.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:324

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskmgr" /sc ONLOGON /tr "'C:\Windows\Vss\Writers\System\taskmgr.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1124

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskmgrt" /sc MINUTE /mo 13 /tr "'C:\Windows\Vss\Writers\System\taskmgr.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1696

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 14 /tr "'C:\MSOCache\All Users\{90140000-00BA-0409-0000-0000000FF1CE}-C\smss.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1704

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smss" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-00BA-0409-0000-0000000FF1CE}-C\smss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2376

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 12 /tr "'C:\MSOCache\All Users\{90140000-00BA-0409-0000-0000000FF1CE}-C\smss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1296

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 9 /tr "'C:\MSOCache\All Users\{90140000-0116-0409-1000-0000000FF1CE}-C\winlogon.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1912

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogon" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-0116-0409-1000-0000000FF1CE}-C\winlogon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2044

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 6 /tr "'C:\MSOCache\All Users\{90140000-0116-0409-1000-0000000FF1CE}-C\winlogon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1908

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 12 /tr "'C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\Proof.fr\spoolsv.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1904

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsv" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\Proof.fr\spoolsv.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:888

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 10 /tr "'C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\Proof.fr\spoolsv.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2356

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 5 /tr "'C:\Program Files (x86)\Windows NT\TableTextService\csrss.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3004

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows NT\TableTextService\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1116

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 10 /tr "'C:\Program Files (x86)\Windows NT\TableTextService\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2144

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "cmdc" /sc MINUTE /mo 12 /tr "'C:\Program Files (x86)\Windows Mail\cmd.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:540

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "cmd" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Mail\cmd.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1640

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "cmdc" /sc MINUTE /mo 10 /tr "'C:\Program Files (x86)\Windows Mail\cmd.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:860

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 11 /tr "'C:\MSOCache\All Users\{90140000-0115-0409-0000-0000000FF1CE}-C\1033\csrss.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2936

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-0115-0409-0000-0000000FF1CE}-C\1033\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2428

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 14 /tr "'C:\MSOCache\All Users\{90140000-0115-0409-0000-0000000FF1CE}-C\1033\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1804

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 11 /tr "'C:\Program Files (x86)\Microsoft Synchronization Services\ADO.NET\v1.0\lsass.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1272

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsass" /sc ONLOGON /tr "'C:\Program Files (x86)\Microsoft Synchronization Services\ADO.NET\v1.0\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2224

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 12 /tr "'C:\Program Files (x86)\Microsoft Synchronization Services\ADO.NET\v1.0\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2168

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 9 /tr "'C:\Hypercommon\csrss.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1384

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Hypercommon\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2712

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 11 /tr "'C:\Hypercommon\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2704

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 6 /tr "'C:\Hypercommon\wininit.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2288

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininit" /sc ONLOGON /tr "'C:\Hypercommon\wininit.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2780

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 14 /tr "'C:\Hypercommon\wininit.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2660

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 8 /tr "'C:\Hypercommon\winlogon.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1512

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogon" /sc ONLOGON /tr "'C:\Hypercommon\winlogon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2240

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 14 /tr "'C:\Hypercommon\winlogon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1052

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 14 /tr "'C:\Program Files (x86)\Adobe\Reader 9.0\Esl\csrss.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1276

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Program Files (x86)\Adobe\Reader 9.0\Esl\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2892

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 6 /tr "'C:\Program Files (x86)\Adobe\Reader 9.0\Esl\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2072

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 9 /tr "'C:\Recovery\8f60a382-0d98-11ef-817d-5aba25856535\System.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:788

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "System" /sc ONLOGON /tr "'C:\Recovery\8f60a382-0d98-11ef-817d-5aba25856535\System.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2840

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 11 /tr "'C:\Recovery\8f60a382-0d98-11ef-817d-5aba25856535\System.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2856

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Hypercommon\Udwe1ynNPaETo.bat

Filesize
33B

MD5
1af82b77403306ff43f68bf7a0786c52

SHA1
730a3bd4b524ffa024657c1fc27ffd82e25f3f81

SHA256
e358e4c2fc541cc4e5614b1af9360a85a32fc53babbc57ecf5858fe71d334f96

SHA512
0e33b779aceb2a42f5c42e07bcd3ac70a3dbb1fd2bbd4ae154979735f58eeaab5abea05cea682f4b73f6b54174ace8ac3046c6e9a84c4a729a6ed2bffa1a9ec1

Download Submit
C:\Hypercommon\s6qV8wojz3Yx3vhyfOAzGuFvxlJ5l.vbe

Filesize
201B

MD5
0f314eb5d52ce9cd85095eadff4f908c

SHA1
272d25d43f789dd5fad479ab31e96214f82302b3

SHA256
f17ea2d9d889ef2012cb57191ad3a1d2d3351df8539b4029d6f7080d66217e89

SHA512
471b72558c045bc4acd276087d82e564aa7685373dea3ac3e90390df0f7f42ea06ae0254d3a4a9dc57312c7b1485916f4d470bd353b4b8c0b35d705573105f09

Download Submit
C:\Users\Admin\AppData\Local\Temp\FuEInxV2Lw.bat

Filesize
225B

MD5
d149009fb8e97b7f5a210164fee11fbe

SHA1
fa4eac09959db3d951db7a6d9d181b9490d372b0

SHA256
7c3b1963a4cd3bf883dfe964d93b5868dafe7299f778d8b702d9c638adfb541a

SHA512
1554ac02598f6e1700c317663c92f366962f22b8e77ff9e9835147bed9379d061a5c9129f1655c0d72061b22f508ffe337e076f5e2dc69640adfb46e1bd65a55

Download Submit
\Hypercommon\ServercrtDll.exe

Filesize
828KB

MD5
801d5740c780d09b1cc6d971ce8b280f

SHA1
c7188e6f5998405d9dcbe83ce5d29267861be07d

SHA256
b678bee38602b80df34f15e4555bb689e2eb6aef26f4c273d652c88f8825c33f

SHA512
3296e517a6e0d6d3feb1f9d1544664b87589130d8a28f205626b2182ecdf333ff404f311ce69730d509e3072432024d3ed16db7068d35925375d9ecc5fe82b49

Download Submit
\Users\Admin\AppData\Local\Temp\steal.exe

Filesize
303KB

MD5
7d9282b8529bbb4ac06a3994fbcd0622

SHA1
d38d467c5e533f3bc247b6ed245fb08412a479d7

SHA256
ca5820bbbcbefd08f5ec820b833b23f7f97556a247da39510a70cbe7b809e3a9

SHA512
aec2d63548176dc1a8ad3d2dfce0bc41973230c6898c55171dec7fc2919b84a8061d4308449c9551cc40ac7c08ad773fd6a7818bbd748ede9be64acc11dcfca5

Download Submit
\Users\Admin\AppData\Local\Temp\tidayn.exe

Filesize
1.1MB

MD5
3ee661f4a9794c72a91fa1f783f54969

SHA1
35780f52351da65b60cc63b302018950cbfe849f

SHA256
ebcaf07121ce2483989e7a71d00b83c54b942f71e51271d5b28886ef03e45b51

SHA512
0b53edac853f257b3c40b8b8014f0b0d53f546410d352965eace8eb251b2d75aa02e171586750a70dd97a4bc103b4b7707e90d5bd7a47c786858514f83281bde

Download Submit
memory/1600-43-0x0000000140000000-0x00000001405E8000-memory.dmp

Filesize
5.9MB

Download
memory/1600-44-0x0000000140000000-0x00000001405E8000-memory.dmp

Filesize
5.9MB

Download
memory/1600-98-0x0000000140000000-0x00000001405E8000-memory.dmp

Filesize
5.9MB

Download
memory/1764-96-0x0000000000BB0000-0x0000000000C86000-memory.dmp

Filesize
856KB

Download
memory/1952-0-0x0000000073F4E000-0x0000000073F4F000-memory.dmp

Filesize
4KB

Download
memory/1952-1-0x0000000001280000-0x00000000013F6000-memory.dmp

Filesize
1.5MB

Download
memory/2060-50-0x00000000001A0000-0x0000000000276000-memory.dmp

Filesize
856KB

Download
memory/2216-14-0x0000000000810000-0x0000000000862000-memory.dmp

Filesize
328KB

Download
memory/2216-9-0x000007FEF50E3000-0x000007FEF50E4000-memory.dmp

Filesize
4KB

Download
memory/2216-97-0x000007FEF50E3000-0x000007FEF50E4000-memory.dmp

Filesize
4KB

Download