Overview

overview

10

Static

static

3

LisectAVT_...68.exe

windows7-x64

10

LisectAVT_...68.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    150s
  • max time network
    154s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240709-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
  • submitted
    25-07-2024 00:25

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    LisectAVT_2403002A_368.exe

  • Size

    3.3MB

  • MD5

    db8da2d409c3dc46afe0dd3454388f9c

  • SHA1

    baa1e8196412a06919e37d888651916aae021b69

  • SHA256

    4ce4afc5fd856ed5951e35c3efd45fdc03662abf43050fddc564023ef40e6823

  • SHA512

    016d678636fafc456e146802da7b5d1b8be3f0b474e335158d65c1df4ae8bb241af43fdd278e99f6d50c6610f0fc775c48621b5d45c5841b904a7e1a971edfc0

  • SSDEEP

    98304:oZ1HRsp8NbXaaIptoNMrF4NOgmwCof84h:oZVIaIpeOrmNOTwCol

Score
10/10
dcratumbralcredential_accessdiscoveryevasionexecutioninfostealerratspywarestealertrojan

Malware Config

Signatures

  • DcRat

    DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

    ratinfostealerdcrat
  • Detect Umbral payload 2 IoCs
  • Process spawned unexpected child process 45 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • UAC bypass 3 TTPs 12 IoCs
    evasiontrojan
  • Umbral

    Umbral stealer is an opensource moduler stealer written in C#.

    stealerumbral
  • Credentials from Password Stores: Credentials from Web Browsers 1 TTPs

    Malicious Access or copy of Web Browser Credential store.

    credential_accessstealer
  • DCRat payload 3 IoCs

    Detects payload of DCRat, commonly dropped by NSIS installers.

    rat
  • Command and Scripting Interpreter: PowerShell 1 TTPs 6 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution
  • Drops file in Drivers directory 1 IoCs
  • Checks computer location settings 2 TTPs 7 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 6 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Checks whether UAC is enabled 1 TTPs 8 IoCs
    evasiontrojan
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Drops file in Program Files directory 10 IoCs
  • Drops file in Windows directory 8 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs

    Adversaries may check for Internet connectivity on compromised systems.

    discovery
  • Detects videocard installed 1 TTPs 1 IoCs

    Uses WMIC.exe to determine videocard installed.

  • Modifies registry class 4 IoCs
  • Runs ping.exe 1 TTPs 1 IoCs
  • Scheduled Task/Job: Scheduled Task 1 TTPs 45 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistenceexecution
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • System policy modification 1 TTPs 12 IoCs
    evasion
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • Views/modifies file attributes 1 TTPs 1 IoCs
    evasion

Processes

  • C:\Users\Admin\AppData\Local\Temp\LisectAVT_2403002A_368.exe
    "C:\Users\Admin\AppData\Local\Temp\LisectAVT_2403002A_368.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:396
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Saransk.exe'
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2172
    • C:\Users\Admin\AppData\Local\Temp\Saransk.exe
      "C:\Users\Admin\AppData\Local\Temp\Saransk.exe"
      2⤵
      • Drops file in Drivers directory
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:3304
      • C:\Windows\System32\Wbem\wmic.exe
        "wmic.exe" csproduct get uuid
        3⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:4772
      • C:\Windows\SYSTEM32\attrib.exe
        "attrib.exe" +h +s "C:\Users\Admin\AppData\Local\Temp\Saransk.exe"
        3⤵
        • Views/modifies file attributes
        PID:4224
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "powershell.exe" Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Saransk.exe'
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:2916
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "powershell.exe" Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:2732
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "powershell.exe" Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:1524
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "powershell.exe" Get-ItemPropertyValue -Path HKLN:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
        3⤵
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:1640
      • C:\Windows\System32\Wbem\wmic.exe
        "wmic.exe" os get Caption
        3⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:396
      • C:\Windows\System32\Wbem\wmic.exe
        "wmic.exe" computersystem get totalphysicalmemory
        3⤵
          PID:1716
        • C:\Windows\System32\Wbem\wmic.exe
          "wmic.exe" csproduct get uuid
          3⤵
            PID:1264
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell.exe" Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER
            3⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            PID:2004
          • C:\Windows\System32\Wbem\wmic.exe
            "wmic" path win32_VideoController get name
            3⤵
            • Detects videocard installed
            PID:3364
          • C:\Windows\SYSTEM32\cmd.exe
            "cmd.exe" /c ping localhost && del /F /A h "C:\Users\Admin\AppData\Local\Temp\Saransk.exe" && pause
            3⤵
            • System Network Configuration Discovery: Internet Connection Discovery
            • Suspicious use of WriteProcessMemory
            PID:3544
            • C:\Windows\system32\PING.EXE
              ping localhost
              4⤵
              • System Network Configuration Discovery: Internet Connection Discovery
              • Runs ping.exe
              PID:2732
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Injector.exe'
          2⤵
          • Command and Scripting Interpreter: PowerShell
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:668
        • C:\Users\Admin\AppData\Local\Temp\Injector.exe
          "C:\Users\Admin\AppData\Local\Temp\Injector.exe"
          2⤵
          • Checks computer location settings
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Modifies registry class
          • Suspicious use of WriteProcessMemory
          PID:3568
          • C:\Windows\SysWOW64\WScript.exe
            "C:\Windows\System32\WScript.exe" "C:\Chainnet\8f9Z3.vbe"
            3⤵
            • Checks computer location settings
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:4476
            • C:\Windows\SysWOW64\cmd.exe
              C:\Windows\system32\cmd.exe /c ""C:\Chainnet\oniRrs8nIuzVsaH8sYiTK.bat" "
              4⤵
              • System Location Discovery: System Language Discovery
              • Suspicious use of WriteProcessMemory
              PID:2728
              • C:\Chainnet\hyperInto.exe
                "C:\Chainnet\hyperInto.exe"
                5⤵
                • UAC bypass
                • Checks computer location settings
                • Executes dropped EXE
                • Checks whether UAC is enabled
                • Drops file in Program Files directory
                • Drops file in Windows directory
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of WriteProcessMemory
                • System policy modification
                PID:1936
                • C:\Program Files (x86)\WindowsPowerShell\Configuration\Schema\dllhost.exe
                  "C:\Program Files (x86)\WindowsPowerShell\Configuration\Schema\dllhost.exe"
                  6⤵
                  • UAC bypass
                  • Checks computer location settings
                  • Executes dropped EXE
                  • Checks whether UAC is enabled
                  • Modifies registry class
                  • Suspicious behavior: EnumeratesProcesses
                  • Suspicious use of WriteProcessMemory
                  • System policy modification
                  PID:4836
                  • C:\Windows\System32\WScript.exe
                    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\c8bd2c64-dbba-4708-85bb-03977b002916.vbs"
                    7⤵
                    • Suspicious use of WriteProcessMemory
                    PID:3716
                    • C:\Program Files (x86)\WindowsPowerShell\Configuration\Schema\dllhost.exe
                      "C:\Program Files (x86)\WindowsPowerShell\Configuration\Schema\dllhost.exe"
                      8⤵
                      • UAC bypass
                      • Checks computer location settings
                      • Executes dropped EXE
                      • Checks whether UAC is enabled
                      • Modifies registry class
                      • Suspicious use of WriteProcessMemory
                      • System policy modification
                      PID:3804
                      • C:\Windows\System32\WScript.exe
                        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\239c9bdb-f619-466d-a1c4-a66339bd5e81.vbs"
                        9⤵
                        • Suspicious use of WriteProcessMemory
                        PID:3668
                        • C:\Program Files (x86)\WindowsPowerShell\Configuration\Schema\dllhost.exe
                          "C:\Program Files (x86)\WindowsPowerShell\Configuration\Schema\dllhost.exe"
                          10⤵
                          • UAC bypass
                          • Checks computer location settings
                          • Executes dropped EXE
                          • Checks whether UAC is enabled
                          • Modifies registry class
                          • Suspicious use of WriteProcessMemory
                          • System policy modification
                          PID:1180
                          • C:\Windows\System32\WScript.exe
                            "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\1d45fa18-0966-4190-8aeb-07ed4c11c73c.vbs"
                            11⤵
                              PID:4848
                            • C:\Windows\System32\WScript.exe
                              "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\cc860c12-8c8d-4301-802c-f06dd7cbd395.vbs"
                              11⤵
                                PID:3656
                          • C:\Windows\System32\WScript.exe
                            "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\a1e13c61-681a-49a3-849e-441aaa2ca4fd.vbs"
                            9⤵
                              PID:2856
                        • C:\Windows\System32\WScript.exe
                          "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\381b15b1-0e87-4c8d-8650-e5e628f3274b.vbs"
                          7⤵
                            PID:1640
                  • C:\Windows\SysWOW64\WScript.exe
                    "C:\Windows\System32\WScript.exe" "C:\Chainnet\file.vbs"
                    3⤵
                    • System Location Discovery: System Language Discovery
                    PID:3824
              • C:\Windows\system32\schtasks.exe
                schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 10 /tr "'C:\Windows\RemotePackages\RemoteApps\dllhost.exe'" /f
                1⤵
                • Process spawned unexpected child process
                • Scheduled Task/Job: Scheduled Task
                PID:4716
              • C:\Windows\system32\schtasks.exe
                schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Windows\RemotePackages\RemoteApps\dllhost.exe'" /rl HIGHEST /f
                1⤵
                • Process spawned unexpected child process
                • Scheduled Task/Job: Scheduled Task
                PID:4836
              • C:\Windows\system32\schtasks.exe
                schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 5 /tr "'C:\Windows\RemotePackages\RemoteApps\dllhost.exe'" /rl HIGHEST /f
                1⤵
                • Process spawned unexpected child process
                • Scheduled Task/Job: Scheduled Task
                PID:4196
              • C:\Windows\system32\schtasks.exe
                schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 12 /tr "'C:\Program Files (x86)\WindowsPowerShell\Configuration\Schema\dllhost.exe'" /f
                1⤵
                • Process spawned unexpected child process
                • Scheduled Task/Job: Scheduled Task
                PID:1344
              • C:\Windows\system32\schtasks.exe
                schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Program Files (x86)\WindowsPowerShell\Configuration\Schema\dllhost.exe'" /rl HIGHEST /f
                1⤵
                • Process spawned unexpected child process
                • Scheduled Task/Job: Scheduled Task
                PID:464
              • C:\Windows\system32\schtasks.exe
                schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 5 /tr "'C:\Program Files (x86)\WindowsPowerShell\Configuration\Schema\dllhost.exe'" /rl HIGHEST /f
                1⤵
                • Process spawned unexpected child process
                • Scheduled Task/Job: Scheduled Task
                PID:4700
              • C:\Windows\system32\schtasks.exe
                schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 12 /tr "'C:\Chainnet\fontdrvhost.exe'" /f
                1⤵
                • Process spawned unexpected child process
                • Scheduled Task/Job: Scheduled Task
                PID:4460
              • C:\Windows\system32\schtasks.exe
                schtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\Chainnet\fontdrvhost.exe'" /rl HIGHEST /f
                1⤵
                • Process spawned unexpected child process
                • Scheduled Task/Job: Scheduled Task
                PID:2984
              • C:\Windows\system32\schtasks.exe
                schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 7 /tr "'C:\Chainnet\fontdrvhost.exe'" /rl HIGHEST /f
                1⤵
                • Process spawned unexpected child process
                • Scheduled Task/Job: Scheduled Task
                PID:848
              • C:\Windows\system32\schtasks.exe
                schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 14 /tr "'C:\Users\Admin\dllhost.exe'" /f
                1⤵
                • Process spawned unexpected child process
                • Scheduled Task/Job: Scheduled Task
                PID:4076
              • C:\Windows\system32\schtasks.exe
                schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Users\Admin\dllhost.exe'" /rl HIGHEST /f
                1⤵
                • Process spawned unexpected child process
                • Scheduled Task/Job: Scheduled Task
                PID:2560
              • C:\Windows\system32\schtasks.exe
                schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 13 /tr "'C:\Users\Admin\dllhost.exe'" /rl HIGHEST /f
                1⤵
                • Process spawned unexpected child process
                • Scheduled Task/Job: Scheduled Task
                PID:1572
              • C:\Windows\system32\schtasks.exe
                schtasks.exe /create /tn "WaaSMedicAgentW" /sc MINUTE /mo 7 /tr "'C:\Windows\de-DE\WaaSMedicAgent.exe'" /f
                1⤵
                • Process spawned unexpected child process
                • Scheduled Task/Job: Scheduled Task
                PID:668
              • C:\Windows\system32\schtasks.exe
                schtasks.exe /create /tn "WaaSMedicAgent" /sc ONLOGON /tr "'C:\Windows\de-DE\WaaSMedicAgent.exe'" /rl HIGHEST /f
                1⤵
                • Process spawned unexpected child process
                • Scheduled Task/Job: Scheduled Task
                PID:1908
              • C:\Windows\system32\schtasks.exe
                schtasks.exe /create /tn "WaaSMedicAgentW" /sc MINUTE /mo 6 /tr "'C:\Windows\de-DE\WaaSMedicAgent.exe'" /rl HIGHEST /f
                1⤵
                • Process spawned unexpected child process
                • Scheduled Task/Job: Scheduled Task
                PID:2028
              • C:\Windows\system32\schtasks.exe
                schtasks.exe /create /tn "SaranskS" /sc MINUTE /mo 6 /tr "'C:\Users\Public\Saransk.exe'" /f
                1⤵
                • Process spawned unexpected child process
                • Scheduled Task/Job: Scheduled Task
                PID:3256
              • C:\Windows\system32\schtasks.exe
                schtasks.exe /create /tn "Saransk" /sc ONLOGON /tr "'C:\Users\Public\Saransk.exe'" /rl HIGHEST /f
                1⤵
                • Process spawned unexpected child process
                • Scheduled Task/Job: Scheduled Task
                PID:1524
              • C:\Windows\system32\schtasks.exe
                schtasks.exe /create /tn "SaranskS" /sc MINUTE /mo 11 /tr "'C:\Users\Public\Saransk.exe'" /rl HIGHEST /f
                1⤵
                • Process spawned unexpected child process
                • Scheduled Task/Job: Scheduled Task
                PID:1328
              • C:\Windows\system32\schtasks.exe
                schtasks.exe /create /tn "TextInputHostT" /sc MINUTE /mo 11 /tr "'C:\Users\Admin\Cookies\TextInputHost.exe'" /f
                1⤵
                • Process spawned unexpected child process
                • Scheduled Task/Job: Scheduled Task
                PID:4768
              • C:\Windows\system32\schtasks.exe
                schtasks.exe /create /tn "TextInputHost" /sc ONLOGON /tr "'C:\Users\Admin\Cookies\TextInputHost.exe'" /rl HIGHEST /f
                1⤵
                • Process spawned unexpected child process
                • Scheduled Task/Job: Scheduled Task
                PID:4360
              • C:\Windows\system32\schtasks.exe
                schtasks.exe /create /tn "TextInputHostT" /sc MINUTE /mo 5 /tr "'C:\Users\Admin\Cookies\TextInputHost.exe'" /rl HIGHEST /f
                1⤵
                • Process spawned unexpected child process
                • Scheduled Task/Job: Scheduled Task
                PID:4948
              • C:\Windows\system32\schtasks.exe
                schtasks.exe /create /tn "backgroundTaskHostb" /sc MINUTE /mo 7 /tr "'C:\Program Files\Windows Media Player\Network Sharing\backgroundTaskHost.exe'" /f
                1⤵
                • Process spawned unexpected child process
                • Scheduled Task/Job: Scheduled Task
                PID:1952
              • C:\Windows\system32\schtasks.exe
                schtasks.exe /create /tn "backgroundTaskHost" /sc ONLOGON /tr "'C:\Program Files\Windows Media Player\Network Sharing\backgroundTaskHost.exe'" /rl HIGHEST /f
                1⤵
                • Process spawned unexpected child process
                • Scheduled Task/Job: Scheduled Task
                PID:2568
              • C:\Windows\system32\schtasks.exe
                schtasks.exe /create /tn "backgroundTaskHostb" /sc MINUTE /mo 5 /tr "'C:\Program Files\Windows Media Player\Network Sharing\backgroundTaskHost.exe'" /rl HIGHEST /f
                1⤵
                • Process spawned unexpected child process
                • Scheduled Task/Job: Scheduled Task
                PID:1456
              • C:\Windows\system32\schtasks.exe
                schtasks.exe /create /tn "RegistryR" /sc MINUTE /mo 8 /tr "'C:\Users\Admin\Pictures\Camera Roll\Registry.exe'" /f
                1⤵
                • Process spawned unexpected child process
                • Scheduled Task/Job: Scheduled Task
                PID:4004
              • C:\Windows\system32\schtasks.exe
                schtasks.exe /create /tn "Registry" /sc ONLOGON /tr "'C:\Users\Admin\Pictures\Camera Roll\Registry.exe'" /rl HIGHEST /f
                1⤵
                • Process spawned unexpected child process
                • Scheduled Task/Job: Scheduled Task
                PID:1760
              • C:\Windows\system32\schtasks.exe
                schtasks.exe /create /tn "RegistryR" /sc MINUTE /mo 9 /tr "'C:\Users\Admin\Pictures\Camera Roll\Registry.exe'" /rl HIGHEST /f
                1⤵
                • Process spawned unexpected child process
                • Scheduled Task/Job: Scheduled Task
                PID:1552
              • C:\Windows\system32\schtasks.exe
                schtasks.exe /create /tn "taskhostwt" /sc MINUTE /mo 14 /tr "'C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\taskhostw.exe'" /f
                1⤵
                • Process spawned unexpected child process
                • Scheduled Task/Job: Scheduled Task
                PID:3568
              • C:\Windows\system32\schtasks.exe
                schtasks.exe /create /tn "taskhostw" /sc ONLOGON /tr "'C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\taskhostw.exe'" /rl HIGHEST /f
                1⤵
                • Process spawned unexpected child process
                • Scheduled Task/Job: Scheduled Task
                PID:2740
              • C:\Windows\system32\schtasks.exe
                schtasks.exe /create /tn "taskhostwt" /sc MINUTE /mo 14 /tr "'C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\taskhostw.exe'" /rl HIGHEST /f
                1⤵
                • Process spawned unexpected child process
                • Scheduled Task/Job: Scheduled Task
                PID:3576
              • C:\Windows\system32\schtasks.exe
                schtasks.exe /create /tn "sysmons" /sc MINUTE /mo 8 /tr "'C:\Windows\Offline Web Pages\sysmon.exe'" /f
                1⤵
                • Process spawned unexpected child process
                • Scheduled Task/Job: Scheduled Task
                PID:1720
              • C:\Windows\system32\schtasks.exe
                schtasks.exe /create /tn "sysmon" /sc ONLOGON /tr "'C:\Windows\Offline Web Pages\sysmon.exe'" /rl HIGHEST /f
                1⤵
                • Process spawned unexpected child process
                • Scheduled Task/Job: Scheduled Task
                PID:4552
              • C:\Windows\system32\schtasks.exe
                schtasks.exe /create /tn "sysmons" /sc MINUTE /mo 5 /tr "'C:\Windows\Offline Web Pages\sysmon.exe'" /rl HIGHEST /f
                1⤵
                • Process spawned unexpected child process
                • Scheduled Task/Job: Scheduled Task
                PID:5092
              • C:\Windows\system32\schtasks.exe
                schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 8 /tr "'C:\Users\Public\Idle.exe'" /f
                1⤵
                • Process spawned unexpected child process
                • Scheduled Task/Job: Scheduled Task
                PID:1164
              • C:\Windows\system32\schtasks.exe
                schtasks.exe /create /tn "Idle" /sc ONLOGON /tr "'C:\Users\Public\Idle.exe'" /rl HIGHEST /f
                1⤵
                • Process spawned unexpected child process
                • Scheduled Task/Job: Scheduled Task
                PID:2276
              • C:\Windows\system32\schtasks.exe
                schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 5 /tr "'C:\Users\Public\Idle.exe'" /rl HIGHEST /f
                1⤵
                • Process spawned unexpected child process
                • Scheduled Task/Job: Scheduled Task
                PID:3644
              • C:\Windows\system32\schtasks.exe
                schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 7 /tr "'C:\Program Files\Google\Chrome\Application\fontdrvhost.exe'" /f
                1⤵
                • Process spawned unexpected child process
                • Scheduled Task/Job: Scheduled Task
                PID:556
              • C:\Windows\system32\schtasks.exe
                schtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\Program Files\Google\Chrome\Application\fontdrvhost.exe'" /rl HIGHEST /f
                1⤵
                • Process spawned unexpected child process
                • Scheduled Task/Job: Scheduled Task
                PID:4840
              • C:\Windows\system32\schtasks.exe
                schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 9 /tr "'C:\Program Files\Google\Chrome\Application\fontdrvhost.exe'" /rl HIGHEST /f
                1⤵
                • Process spawned unexpected child process
                • Scheduled Task/Job: Scheduled Task
                PID:3428
              • C:\Windows\system32\schtasks.exe
                schtasks.exe /create /tn "WaaSMedicAgentW" /sc MINUTE /mo 6 /tr "'C:\Recovery\WindowsRE\WaaSMedicAgent.exe'" /f
                1⤵
                • Process spawned unexpected child process
                • Scheduled Task/Job: Scheduled Task
                PID:4088
              • C:\Windows\system32\schtasks.exe
                schtasks.exe /create /tn "WaaSMedicAgent" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\WaaSMedicAgent.exe'" /rl HIGHEST /f
                1⤵
                • Process spawned unexpected child process
                • Scheduled Task/Job: Scheduled Task
                PID:4408
              • C:\Windows\system32\schtasks.exe
                schtasks.exe /create /tn "WaaSMedicAgentW" /sc MINUTE /mo 13 /tr "'C:\Recovery\WindowsRE\WaaSMedicAgent.exe'" /rl HIGHEST /f
                1⤵
                • Process spawned unexpected child process
                • Scheduled Task/Job: Scheduled Task
                PID:1940
              • C:\Windows\system32\schtasks.exe
                schtasks.exe /create /tn "RegistryR" /sc MINUTE /mo 13 /tr "'C:\Program Files (x86)\Common Files\System\fr-FR\Registry.exe'" /f
                1⤵
                • Process spawned unexpected child process
                • Scheduled Task/Job: Scheduled Task
                PID:208
              • C:\Windows\system32\schtasks.exe
                schtasks.exe /create /tn "Registry" /sc ONLOGON /tr "'C:\Program Files (x86)\Common Files\System\fr-FR\Registry.exe'" /rl HIGHEST /f
                1⤵
                • Process spawned unexpected child process
                • Scheduled Task/Job: Scheduled Task
                PID:1956
              • C:\Windows\system32\schtasks.exe
                schtasks.exe /create /tn "RegistryR" /sc MINUTE /mo 10 /tr "'C:\Program Files (x86)\Common Files\System\fr-FR\Registry.exe'" /rl HIGHEST /f
                1⤵
                • Process spawned unexpected child process
                • Scheduled Task/Job: Scheduled Task
                PID:2832

              Network

              MITRE ATT&CK Enterprise v15

              Reconnaissance

              Resource Development

              Initial Access

              Execution

              Command and Scripting Interpreter

              1
              T1059

              PowerShell

              1
              T1059.001

              Scheduled Task/Job

              1
              T1053

              Scheduled Task

              1
              T1053.005

              Persistence

              Scheduled Task/Job

              1
              T1053

              Scheduled Task

              1
              T1053.005

              Privilege Escalation

              Abuse Elevation Control Mechanism

              1
              T1548

              Bypass User Account Control

              1
              T1548.002

              Scheduled Task/Job

              1
              T1053

              Scheduled Task

              1
              T1053.005

              Defense Evasion

              Abuse Elevation Control Mechanism

              1
              T1548

              Bypass User Account Control

              1
              T1548.002

              Hide Artifacts

              1
              T1564

              Hidden Files and Directories

              1
              T1564.001

              Impair Defenses

              1
              T1562

              Disable or Modify Tools

              1
              T1562.001

              Modify Registry

              2
              T1112

              Credential Access

              Credentials from Password Stores

              1
              T1555

              Credentials from Web Browsers

              1
              T1555.003

              Unsecured Credentials

              1
              T1552

              Credentials In Files

              1
              T1552.001

              Discovery

              Query Registry

              2
              T1012

              Remote System Discovery

              1
              T1018

              System Information Discovery

              4
              T1082

              System Location Discovery

              1
              T1614

              System Language Discovery

              1
              T1614.001

              System Network Configuration Discovery

              1
              T1016

              Internet Connection Discovery

              1
              T1016.001

              Lateral Movement

              Collection

              Data from Local System

              1
              T1005

              Command and Control

              Web Service

              1
              T1102

              Exfiltration

              Impact

              Replay Monitor

              Loading Replay Monitor...

              Downloads

              • C:\Chainnet\8f9Z3.vbe
                Filesize

                206B

                MD5

                b3080903ab3740f3f1346f2f61834c2b

                SHA1

                a5b37c9ea7a58c9194de44382d75dc4863d3d5b7

                SHA256

                505642ffc3c57426bb6575eb3ac48ea1f3e303fa5b34ea6ccd3fe2f7021619a1

                SHA512

                a33ace44bf4936bb2747586d590d762da473840179d9553d0b213f12f11a2d10713fb6bb5637058a40bf0b12f710dfe07930476d8ea5765f0dba816389f9e419

                Download Submit

              • C:\Chainnet\file.vbs
                Filesize

                34B

                MD5

                677cc4360477c72cb0ce00406a949c61

                SHA1

                b679e8c3427f6c5fc47c8ac46cd0e56c9424de05

                SHA256

                f1cccb5ae4aa51d293bd3c7d2a1a04cb7847d22c5db8e05ac64e9a6d7455aa0b

                SHA512

                7cfe2cc92f9e659f0a15a295624d611b3363bd01eb5bcf9bc7681ea9b70b0564d192d570d294657c8dc2c93497fa3b4526c975a9bf35d69617c31d9936573c6a

                Download Submit

              • C:\Chainnet\hyperInto.exe
                Filesize

                3.4MB

                MD5

                d63861446161da73423a6378ab06af5e

                SHA1

                8d3116fa2ac5d4e7fb9684498f69edf3e976f977

                SHA256

                c46e261e262516989fb8205f6e939b13fc19326f936229f024b41b9d4956f8bd

                SHA512

                7bf3f16a5c455dbf902284ba581097b7ecdefcfb9df55053c868f4ae84e9097b4fb6214c9896cc344ea65979516b20df8e35d19c97de79d52ee27fb86e61eb88

                Download Submit

              • C:\Chainnet\oniRrs8nIuzVsaH8sYiTK.bat
                Filesize

                27B

                MD5

                94db4d897ca54289c945a06574084128

                SHA1

                d4168950c994dacea1402a9570a4735350b86c10

                SHA256

                a759a78b129faaa486102e6486d595070e7c923bf4159ae7b8eb78fec3c2a461

                SHA512

                2548059003c4bff60dbe0e9aa5c097bac130ecb7bae7896b83f577bb2aa0e3c1b356545ebc92e3487ef937026c96ef48d2df750b31f0acea9166bfb9342cd28a

                Download Submit

              • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\dllhost.exe.log
                Filesize

                1KB

                MD5

                49b64127208271d8f797256057d0b006

                SHA1

                b99bd7e2b4e9ed24de47fb3341ea67660b84cca1

                SHA256

                2a5d403a2e649d8eceef8f785eeb0f6d33888ec6bbf251b3c347e34cb32b1e77

                SHA512

                f7c728923c893dc9bc88ad2159e0abcda41e1b40ff7e7756e6252d135ed238a2248a2662b3392449836dd1b0b580f0c866cc33e409527484fe4602e3d3f10e3e

                Download Submit

              • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
                Filesize

                2KB

                MD5

                d85ba6ff808d9e5444a4b369f5bc2730

                SHA1

                31aa9d96590fff6981b315e0b391b575e4c0804a

                SHA256

                84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

                SHA512

                8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

                Download Submit

              • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                Filesize

                948B

                MD5

                5824a6037c081fda5d46de274b6e2799

                SHA1

                526367a09300cbde430e8fb44e41cbe7a0937aac

                SHA256

                4d610d9cd32a20279c7133a726ff61820d6930e5aa18253ee1422f3a6f54953f

                SHA512

                a109b150f730cda78d5bee106bd232f9dca7500dfb7899c6919de2bd542e345ca271aa11809a24ea0a27dca158067ab3a2d5688ac0a2325185143245f1665582

                Download Submit

              • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                Filesize

                1KB

                MD5

                276798eeb29a49dc6e199768bc9c2e71

                SHA1

                5fdc8ccb897ac2df7476fbb07517aca5b7a6205b

                SHA256

                cd0a1056e8f1b6cb5cb328532239d802f4e2aa8f8fcdc0fcb487684bd68e0dcc

                SHA512

                0d34fce64bbefc57d64fa6e03ca886952263d5f24df9c1c4cce6a1e8f5a47a9a21e9820f8d38caa7f7b43a52336ce00b738ea18419aaa7c788b72e04ce19e4f2

                Download Submit

              • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                Filesize

                1KB

                MD5

                14096fbe470a190011f31dba4c4307ae

                SHA1

                83e2c46b3e1c14779d7aea8497ad802fbc89d01e

                SHA256

                8b66640600b8c05b4af2c978d3bdb778ddc2f835ea65297e6d9e9e060a256f39

                SHA512

                1687e378b3c0e92a30018f40092546c5cbfa38a5b5371d424834fd5c5cd02ebd52901f189385661e624a05e4ecb54f12841f970afae6e92a53da9551d95a3f75

                Download Submit

              • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                Filesize

                944B

                MD5

                6c47b3f4e68eebd47e9332eebfd2dd4e

                SHA1

                67f0b143336d7db7b281ed3de5e877fa87261834

                SHA256

                8c48b1f2338e5b24094821f41121d2221f1cb3200338f46df49f64d1c4bc3e0c

                SHA512

                0acf302a9fc971ef9df65ed42c47ea17828e54dff685f4434f360556fd27cdc26a75069f00dcdc14ba174893c6fd7a2cfd8c6c07be3ce35dafee0a006914eaca

                Download Submit

              • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                Filesize

                944B

                MD5

                6f3b96b24f06e2d37a46e43e8b784f56

                SHA1

                7be6702c5867f359e913eeeecdd5b76698589295

                SHA256

                8e386afeed28e1d282d9a0294dd2e9402dcb807f7c77aca8426314c20057e720

                SHA512

                d760999531a77a9adf2b4dc019ce3b43ac3a8cad825398b3a09818afe8deaa177d37219a26dd8a432c00c9cff7858efc43cae2375edc996bb0136c92c39c9dfb

                Download Submit

              • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                Filesize

                944B

                MD5

                15dde0683cd1ca19785d7262f554ba93

                SHA1

                d039c577e438546d10ac64837b05da480d06bf69

                SHA256

                d6fa39eab7ee36f44dc3f9f2839d098433db95c1eba924e4bcf4e5c0d268d961

                SHA512

                57c0e1b87bc1c136f0d39f3ce64bb8f8274a0491e4ca6e45e5c7f9070aa9d9370c6f590ce37cd600b252df2638d870205249a514c43245ca7ed49017024a4672

                Download Submit

              • C:\Users\Admin\AppData\Local\Temp\1d45fa18-0966-4190-8aeb-07ed4c11c73c.vbs
                Filesize

                749B

                MD5

                e45cb2e8418d371932412a26adc0b515

                SHA1

                ef32a9ca65a6ce768a2fd2ea753e34edcb087faf

                SHA256

                1db2f3c3d02d6622682653972c2467861eb01c5b016e432e8a196e490849ce7b

                SHA512

                76e40dbe0c8adeea3534f6618a361a428abc3b64b26f2f454974f7e7e7f10bc16071851287a15b5da71ab5803974e59b38954c50bda08abf47842bf9839a517d

                Download Submit

              • C:\Users\Admin\AppData\Local\Temp\239c9bdb-f619-466d-a1c4-a66339bd5e81.vbs
                Filesize

                749B

                MD5

                0823a6cb7ee9935582b3943823456a68

                SHA1

                8b306bc6a09327395d4949068957f4c999bc734e

                SHA256

                c37814766dc092d5fa2e517def110e23fba5513e7866cd999d4f805cd6bfac7f

                SHA512

                4df1ae5d35ab1d186017dfa0480e0e7da9ad2adb4d8cf13d65b399eda140e4c8c1e71655a72de711c86370a95796cb7da061b697d455df572f3e60612808e707

                Download Submit

              • C:\Users\Admin\AppData\Local\Temp\381b15b1-0e87-4c8d-8650-e5e628f3274b.vbs
                Filesize

                525B

                MD5

                19c891c70497eee8bde006753a39ee76

                SHA1

                c97f368b8a96ef422b22e5ad209d4b2b26e49ace

                SHA256

                32ae5905ec50ffb7969d75658c9947f3ff69a4027671631be512e77c22217944

                SHA512

                e23203cf2f65eade43a3e1c990a3578aca5f71c43a9567738d2ddab222f1b1dc6b38bc8abd3841b5e832e2715c51696218e73505e63348f33ec2b4f91e528396

                Download Submit

              • C:\Users\Admin\AppData\Local\Temp\Injector.exe
                Filesize

                3.7MB

                MD5

                323e22b442e4d4f9930c5b65f6d1028c

                SHA1

                7dadf78756dd00c68d5094a59dc7bcccf3c8346d

                SHA256

                eaedca12a90cf9afa1d7e42358571269e726ccd5a5c96b6d98c7b242f08e9e00

                SHA512

                2da37cfe8005ed1e299ad6c3e676abeafd6160b47bb9888d1cbdcb7a82e7955feedb4286ee6dfbe64a1b62814ff1af11a718074854d2699a4a2975d4fbfd5b2e

                Download Submit

              • C:\Users\Admin\AppData\Local\Temp\Saransk.exe
                Filesize

                227KB

                MD5

                05c183f8c0d871d6081f1ea4096805e4

                SHA1

                4a05aba815c8471fca4fcc9a789683385b0c24ca

                SHA256

                eff59569967501a5e21ff3f8be9cc487e30d23e1538aeb121f9ab0955c308849

                SHA512

                ef35359087662c4213f667c49182ab794fbb28dfe2a5b9e1fad5729e516b1ef08c2d7230a84e4808b693832d7b4ad43530377886cd2c993407a7fe38333ad347

                Download Submit

              • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_pb0f4clj.rs0.ps1
                Filesize

                60B

                MD5

                d17fe0a3f47be24a6453e9ef58c94641

                SHA1

                6ab83620379fc69f80c0242105ddffd7d98d5d9d

                SHA256

                96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

                SHA512

                5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

                Download Submit

              • C:\Users\Admin\AppData\Local\Temp\c8bd2c64-dbba-4708-85bb-03977b002916.vbs
                Filesize

                749B

                MD5

                903f39e2484cce254d266816ecefb87c

                SHA1

                e5394b575c4e9345970e42713519e87fac61e0b0

                SHA256

                a3209a204ad5faa6eae2312276f580f1c26feab2406fe58613bf61a4fcdf9e23

                SHA512

                a6ce9eabd6fa078e2a724e85043a42a72c7580f056b0e8ef737c9771e9416d823b0f82ec6aad16238683ce843e24a6c206625c3da7984c27843928827324f60c

                Download Submit

              • memory/396-53-0x00007FFDF3420000-0x00007FFDF3EE1000-memory.dmp

                Filesize

                10.8MB

                Download

              • memory/396-2-0x00007FFDF3420000-0x00007FFDF3EE1000-memory.dmp

                Filesize

                10.8MB

                Download

              • memory/396-1-0x00000000000B0000-0x00000000003FA000-memory.dmp

                Filesize

                3.3MB

                Download

              • memory/396-0-0x00007FFDF3423000-0x00007FFDF3425000-memory.dmp

                Filesize

                8KB

                Download

              • memory/1180-252-0x000000001BA90000-0x000000001BAA2000-memory.dmp

                Filesize

                72KB

                Download

              • memory/1936-152-0x000000001B0A0000-0x000000001B0A8000-memory.dmp

                Filesize

                32KB

                Download

              • memory/1936-165-0x000000001C020000-0x000000001C548000-memory.dmp

                Filesize

                5.2MB

                Download

              • memory/1936-180-0x000000001BD00000-0x000000001BD08000-memory.dmp

                Filesize

                32KB

                Download

              • memory/1936-182-0x000000001BD10000-0x000000001BD1C000-memory.dmp

                Filesize

                48KB

                Download

              • memory/1936-134-0x00000000001B0000-0x000000000051A000-memory.dmp

                Filesize

                3.4MB

                Download

              • memory/1936-181-0x000000001BE10000-0x000000001BE1A000-memory.dmp

                Filesize

                40KB

                Download

              • memory/1936-145-0x0000000002730000-0x000000000273E000-memory.dmp

                Filesize

                56KB

                Download

              • memory/1936-146-0x000000001B020000-0x000000001B02E000-memory.dmp

                Filesize

                56KB

                Download

              • memory/1936-147-0x000000001B030000-0x000000001B038000-memory.dmp

                Filesize

                32KB

                Download

              • memory/1936-148-0x000000001B040000-0x000000001B05C000-memory.dmp

                Filesize

                112KB

                Download

              • memory/1936-149-0x000000001B060000-0x000000001B068000-memory.dmp

                Filesize

                32KB

                Download

              • memory/1936-150-0x000000001B070000-0x000000001B080000-memory.dmp

                Filesize

                64KB

                Download

              • memory/1936-179-0x000000001BCF0000-0x000000001BCFC000-memory.dmp

                Filesize

                48KB

                Download

              • memory/1936-151-0x000000001B080000-0x000000001B096000-memory.dmp

                Filesize

                88KB

                Download

              • memory/1936-153-0x000000001B210000-0x000000001B222000-memory.dmp

                Filesize

                72KB

                Download

              • memory/1936-154-0x000000001B240000-0x000000001B24C000-memory.dmp

                Filesize

                48KB

                Download

              • memory/1936-155-0x000000001B220000-0x000000001B228000-memory.dmp

                Filesize

                32KB

                Download

              • memory/1936-157-0x000000001B960000-0x000000001B96A000-memory.dmp

                Filesize

                40KB

                Download

              • memory/1936-156-0x000000001B230000-0x000000001B240000-memory.dmp

                Filesize

                64KB

                Download

              • memory/1936-159-0x000000001B970000-0x000000001B9C6000-memory.dmp

                Filesize

                344KB

                Download

              • memory/1936-160-0x000000001B9C0000-0x000000001B9CC000-memory.dmp

                Filesize

                48KB

                Download

              • memory/1936-162-0x000000001BAE0000-0x000000001BAEC000-memory.dmp

                Filesize

                48KB

                Download

              • memory/1936-161-0x000000001B9D0000-0x000000001B9D8000-memory.dmp

                Filesize

                32KB

                Download

              • memory/1936-164-0x000000001B9F0000-0x000000001BA02000-memory.dmp

                Filesize

                72KB

                Download

              • memory/1936-163-0x000000001B9E0000-0x000000001B9E8000-memory.dmp

                Filesize

                32KB

                Download

              • memory/1936-178-0x000000001BAD0000-0x000000001BAD8000-memory.dmp

                Filesize

                32KB

                Download

              • memory/1936-167-0x000000001BA30000-0x000000001BA3C000-memory.dmp

                Filesize

                48KB

                Download

              • memory/1936-169-0x000000001BA50000-0x000000001BA5C000-memory.dmp

                Filesize

                48KB

                Download

              • memory/1936-168-0x000000001BA40000-0x000000001BA48000-memory.dmp

                Filesize

                32KB

                Download

              • memory/1936-166-0x000000001BA20000-0x000000001BA2C000-memory.dmp

                Filesize

                48KB

                Download

              • memory/1936-170-0x000000001BA60000-0x000000001BA6C000-memory.dmp

                Filesize

                48KB

                Download

              • memory/1936-171-0x000000001BA70000-0x000000001BA78000-memory.dmp

                Filesize

                32KB

                Download

              • memory/1936-176-0x000000001BAC0000-0x000000001BACE000-memory.dmp

                Filesize

                56KB

                Download

              • memory/1936-175-0x000000001BAB0000-0x000000001BAB8000-memory.dmp

                Filesize

                32KB

                Download

              • memory/1936-174-0x000000001BAA0000-0x000000001BAAE000-memory.dmp

                Filesize

                56KB

                Download

              • memory/1936-173-0x000000001BA90000-0x000000001BA9A000-memory.dmp

                Filesize

                40KB

                Download

              • memory/1936-172-0x000000001BA80000-0x000000001BA8C000-memory.dmp

                Filesize

                48KB

                Download

              • memory/2172-18-0x00007FFDF3420000-0x00007FFDF3EE1000-memory.dmp

                Filesize

                10.8MB

                Download

              • memory/2172-15-0x00007FFDF3420000-0x00007FFDF3EE1000-memory.dmp

                Filesize

                10.8MB

                Download

              • memory/2172-14-0x00007FFDF3420000-0x00007FFDF3EE1000-memory.dmp

                Filesize

                10.8MB

                Download

              • memory/2172-13-0x00007FFDF3420000-0x00007FFDF3EE1000-memory.dmp

                Filesize

                10.8MB

                Download

              • memory/2172-12-0x000001DDBE1F0000-0x000001DDBE212000-memory.dmp

                Filesize

                136KB

                Download

              • memory/3304-127-0x0000027C73540000-0x0000027C73552000-memory.dmp

                Filesize

                72KB

                Download

              • memory/3304-91-0x0000027C74020000-0x0000027C74096000-memory.dmp

                Filesize

                472KB

                Download

              • memory/3304-92-0x0000027C73560000-0x0000027C735B0000-memory.dmp

                Filesize

                320KB

                Download

              • memory/3304-93-0x0000027C734B0000-0x0000027C734CE000-memory.dmp

                Filesize

                120KB

                Download

              • memory/3304-126-0x0000027C73510000-0x0000027C7351A000-memory.dmp

                Filesize

                40KB

                Download

              • memory/3304-32-0x0000027C71830000-0x0000027C71870000-memory.dmp

                Filesize

                256KB

                Download

              • memory/4836-228-0x000000001C580000-0x000000001C592000-memory.dmp

                Filesize

                72KB

                Download