Overview

overview

10

Static

static

3

6f00291aa8...e6.exe

windows7-x64

10

6f00291aa8...e6.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    148s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    17-09-2024 22:12

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    6f00291aa8d783e5a5949251820dc4fe03a732a206890d7f4b3902f8994819e6.exe

  • Size

    4.9MB

  • MD5

    58bf250686082cc8e02eea346661ea7f

  • SHA1

    a465d280d33acc4ad04dc92ec4994703d8868ade

  • SHA256

    6f00291aa8d783e5a5949251820dc4fe03a732a206890d7f4b3902f8994819e6

  • SHA512

    881421c58bcc9570c5f4889a1bd79fad81fb2863c46369a84fd8a2506167fd749e72f4f75b8b2ededb79d7694baf54193057887d7f50dd7b786e67e09a1c392b

  • SSDEEP

    49152:jl5MTGChZpxtlBBgxchXb/zqP6DUtRgs5q289dAnSz44hnW1XgnYu6fYmPkMSx8E:

Score
10/10
colibridcratbuild1discoveryevasionexecutioninfostealerloaderrattrojan

Malware Config

Extracted

Family

colibri

Version

1.2.0

Botnet

Build1

C2

http://zpltcmgodhvvedxtfcygvbgjkvgvcguygytfigj.cc/gate.php

http://yugyuvyugguitgyuigtfyutdtoghghbbgyv.cx/gate.php
rc4.plain

Signatures

  • Colibri Loader

    A loader sold as MaaS first seen in August 2021.

    loadercolibri
  • DcRat

    DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

    ratinfostealerdcrat
  • Process spawned unexpected child process 6 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • UAC bypass 3 TTPs 42 IoCs
    evasiontrojan
  • DCRat payload 1 IoCs

    Detects payload of DCRat, commonly dropped by NSIS installers.

    rat
  • Command and Scripting Interpreter: PowerShell 1 TTPs 11 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution
  • Checks computer location settings 2 TTPs 14 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 41 IoCs
  • Checks whether UAC is enabled 1 TTPs 28 IoCs
    evasiontrojan
  • Suspicious use of SetThreadContext 13 IoCs
  • Drops file in Program Files directory 8 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 15 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies registry class 14 IoCs
  • Scheduled Task/Job: Scheduled Task 1 TTPs 6 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistenceexecution
  • Suspicious behavior: EnumeratesProcesses 47 IoCs
  • Suspicious use of AdjustPrivilegeToken 25 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • System policy modification 1 TTPs 42 IoCs
    evasion
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\6f00291aa8d783e5a5949251820dc4fe03a732a206890d7f4b3902f8994819e6.exe
    "C:\Users\Admin\AppData\Local\Temp\6f00291aa8d783e5a5949251820dc4fe03a732a206890d7f4b3902f8994819e6.exe"
    1⤵
    • UAC bypass
    • Checks computer location settings
    • Checks whether UAC is enabled
    • Drops file in Program Files directory
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    • System policy modification
    PID:1848
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:/'
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:3600
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:/$Recycle.Bin/'
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:3256
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Documents and Settings/'
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2812
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:/PerfLogs/'
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2144
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files/'
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:1708
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files (x86)/'
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2524
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:/ProgramData/'
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:8
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Recovery/'
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:4936
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:/System Volume Information/'
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:1536
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Users/'
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:4588
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Windows/'
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2208
    • C:\Users\Admin\AppData\Local\Temp\tmp9936.tmp.exe
      "C:\Users\Admin\AppData\Local\Temp\tmp9936.tmp.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious use of SetThreadContext
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:2744
      • C:\Users\Admin\AppData\Local\Temp\tmp9936.tmp.exe
        "C:\Users\Admin\AppData\Local\Temp\tmp9936.tmp.exe"
        3⤵
        • Executes dropped EXE
        PID:1940
    • C:\Program Files\Windows Photo Viewer\smss.exe
      "C:\Program Files\Windows Photo Viewer\smss.exe"
      2⤵
      • UAC bypass
      • Checks computer location settings
      • Executes dropped EXE
      • Checks whether UAC is enabled
      • Modifies registry class
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      • System policy modification
      PID:4828
      • C:\Windows\System32\WScript.exe
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\8fa5c618-a436-4b2c-951f-0cf7dacc2e87.vbs"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:4344
        • C:\Program Files\Windows Photo Viewer\smss.exe
          "C:\Program Files\Windows Photo Viewer\smss.exe"
          4⤵
          • UAC bypass
          • Checks computer location settings
          • Executes dropped EXE
          • Checks whether UAC is enabled
          • Modifies registry class
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          • System policy modification
          PID:2424
          • C:\Windows\System32\WScript.exe
            "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\7f455782-f6ed-4016-850a-f20631b5ef20.vbs"
            5⤵
              PID:5020
              • C:\Program Files\Windows Photo Viewer\smss.exe
                "C:\Program Files\Windows Photo Viewer\smss.exe"
                6⤵
                • UAC bypass
                • Checks computer location settings
                • Executes dropped EXE
                • Checks whether UAC is enabled
                • Modifies registry class
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of AdjustPrivilegeToken
                • System policy modification
                PID:5028
                • C:\Windows\System32\WScript.exe
                  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\f974b033-972a-436b-a36e-273668f97e8b.vbs"
                  7⤵
                    PID:1432
                    • C:\Program Files\Windows Photo Viewer\smss.exe
                      "C:\Program Files\Windows Photo Viewer\smss.exe"
                      8⤵
                      • UAC bypass
                      • Checks computer location settings
                      • Executes dropped EXE
                      • Checks whether UAC is enabled
                      • Modifies registry class
                      • Suspicious behavior: EnumeratesProcesses
                      • Suspicious use of AdjustPrivilegeToken
                      • System policy modification
                      PID:2744
                      • C:\Windows\System32\WScript.exe
                        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\1b437ad9-4c73-4fce-bad2-9c98c5419567.vbs"
                        9⤵
                          PID:1584
                          • C:\Program Files\Windows Photo Viewer\smss.exe
                            "C:\Program Files\Windows Photo Viewer\smss.exe"
                            10⤵
                            • UAC bypass
                            • Checks computer location settings
                            • Executes dropped EXE
                            • Checks whether UAC is enabled
                            • Modifies registry class
                            • Suspicious behavior: EnumeratesProcesses
                            • Suspicious use of AdjustPrivilegeToken
                            • System policy modification
                            PID:4116
                            • C:\Windows\System32\WScript.exe
                              "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\4f3bc62a-4e9e-4029-9aa7-826aa0bfe50f.vbs"
                              11⤵
                                PID:4948
                                • C:\Program Files\Windows Photo Viewer\smss.exe
                                  "C:\Program Files\Windows Photo Viewer\smss.exe"
                                  12⤵
                                  • UAC bypass
                                  • Checks computer location settings
                                  • Executes dropped EXE
                                  • Checks whether UAC is enabled
                                  • Modifies registry class
                                  • Suspicious behavior: EnumeratesProcesses
                                  • Suspicious use of AdjustPrivilegeToken
                                  • System policy modification
                                  PID:2668
                                  • C:\Windows\System32\WScript.exe
                                    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\996f53e9-7468-4150-b849-a3b1ceca4abe.vbs"
                                    13⤵
                                      PID:4032
                                      • C:\Program Files\Windows Photo Viewer\smss.exe
                                        "C:\Program Files\Windows Photo Viewer\smss.exe"
                                        14⤵
                                        • UAC bypass
                                        • Checks computer location settings
                                        • Executes dropped EXE
                                        • Checks whether UAC is enabled
                                        • Modifies registry class
                                        • Suspicious behavior: EnumeratesProcesses
                                        • Suspicious use of AdjustPrivilegeToken
                                        • System policy modification
                                        PID:908
                                        • C:\Windows\System32\WScript.exe
                                          "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\7e7aea5d-fd2f-4d74-becd-3e4bb449319e.vbs"
                                          15⤵
                                            PID:3884
                                            • C:\Program Files\Windows Photo Viewer\smss.exe
                                              "C:\Program Files\Windows Photo Viewer\smss.exe"
                                              16⤵
                                              • UAC bypass
                                              • Checks computer location settings
                                              • Executes dropped EXE
                                              • Checks whether UAC is enabled
                                              • Modifies registry class
                                              • Suspicious behavior: EnumeratesProcesses
                                              • Suspicious use of AdjustPrivilegeToken
                                              • System policy modification
                                              PID:1808
                                              • C:\Windows\System32\WScript.exe
                                                "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\c755a373-e81b-4c8d-adce-cb63c9aa7ca1.vbs"
                                                17⤵
                                                  PID:2244
                                                  • C:\Program Files\Windows Photo Viewer\smss.exe
                                                    "C:\Program Files\Windows Photo Viewer\smss.exe"
                                                    18⤵
                                                    • UAC bypass
                                                    • Checks computer location settings
                                                    • Executes dropped EXE
                                                    • Checks whether UAC is enabled
                                                    • Modifies registry class
                                                    • Suspicious behavior: EnumeratesProcesses
                                                    • Suspicious use of AdjustPrivilegeToken
                                                    • System policy modification
                                                    PID:3124
                                                    • C:\Windows\System32\WScript.exe
                                                      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\886ceae8-34e9-4c00-82e9-4f232dc4fc39.vbs"
                                                      19⤵
                                                        PID:4068
                                                        • C:\Program Files\Windows Photo Viewer\smss.exe
                                                          "C:\Program Files\Windows Photo Viewer\smss.exe"
                                                          20⤵
                                                          • UAC bypass
                                                          • Checks computer location settings
                                                          • Executes dropped EXE
                                                          • Checks whether UAC is enabled
                                                          • Modifies registry class
                                                          • Suspicious behavior: EnumeratesProcesses
                                                          • Suspicious use of AdjustPrivilegeToken
                                                          • System policy modification
                                                          PID:1364
                                                          • C:\Windows\System32\WScript.exe
                                                            "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\7d29b706-9dcc-4629-b177-1fa9bf4ae2f2.vbs"
                                                            21⤵
                                                              PID:2692
                                                              • C:\Program Files\Windows Photo Viewer\smss.exe
                                                                "C:\Program Files\Windows Photo Viewer\smss.exe"
                                                                22⤵
                                                                • UAC bypass
                                                                • Checks computer location settings
                                                                • Executes dropped EXE
                                                                • Checks whether UAC is enabled
                                                                • Modifies registry class
                                                                • Suspicious behavior: EnumeratesProcesses
                                                                • Suspicious use of AdjustPrivilegeToken
                                                                • System policy modification
                                                                PID:4232
                                                                • C:\Windows\System32\WScript.exe
                                                                  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\61c75381-4c62-4f5b-a6ab-909e25e0b290.vbs"
                                                                  23⤵
                                                                    PID:1592
                                                                    • C:\Program Files\Windows Photo Viewer\smss.exe
                                                                      "C:\Program Files\Windows Photo Viewer\smss.exe"
                                                                      24⤵
                                                                      • UAC bypass
                                                                      • Checks computer location settings
                                                                      • Executes dropped EXE
                                                                      • Checks whether UAC is enabled
                                                                      • Modifies registry class
                                                                      • Suspicious behavior: EnumeratesProcesses
                                                                      • Suspicious use of AdjustPrivilegeToken
                                                                      • System policy modification
                                                                      PID:3336
                                                                      • C:\Windows\System32\WScript.exe
                                                                        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\f34b957b-c285-4663-8955-d01da7dce9e3.vbs"
                                                                        25⤵
                                                                          PID:860
                                                                          • C:\Program Files\Windows Photo Viewer\smss.exe
                                                                            "C:\Program Files\Windows Photo Viewer\smss.exe"
                                                                            26⤵
                                                                            • UAC bypass
                                                                            • Checks computer location settings
                                                                            • Executes dropped EXE
                                                                            • Checks whether UAC is enabled
                                                                            • Modifies registry class
                                                                            • Suspicious behavior: EnumeratesProcesses
                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                            • System policy modification
                                                                            PID:3776
                                                                            • C:\Windows\System32\WScript.exe
                                                                              "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\6c862ce6-9e71-47a1-86d1-d8b89de18210.vbs"
                                                                              27⤵
                                                                                PID:4856
                                                                              • C:\Windows\System32\WScript.exe
                                                                                "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\71bad911-1e1b-4589-9422-2dec01d80c52.vbs"
                                                                                27⤵
                                                                                  PID:2352
                                                                            • C:\Windows\System32\WScript.exe
                                                                              "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\b27f0b40-ef03-416a-850c-f5f54ec84ade.vbs"
                                                                              25⤵
                                                                                PID:3520
                                                                              • C:\Users\Admin\AppData\Local\Temp\tmp96E7.tmp.exe
                                                                                "C:\Users\Admin\AppData\Local\Temp\tmp96E7.tmp.exe"
                                                                                25⤵
                                                                                • Executes dropped EXE
                                                                                • Suspicious use of SetThreadContext
                                                                                • System Location Discovery: System Language Discovery
                                                                                PID:5092
                                                                                • C:\Users\Admin\AppData\Local\Temp\tmp96E7.tmp.exe
                                                                                  "C:\Users\Admin\AppData\Local\Temp\tmp96E7.tmp.exe"
                                                                                  26⤵
                                                                                  • Executes dropped EXE
                                                                                  PID:2240
                                                                          • C:\Windows\System32\WScript.exe
                                                                            "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\1c9587e5-c3a1-4c53-9f33-8e022954da2f.vbs"
                                                                            23⤵
                                                                              PID:716
                                                                            • C:\Users\Admin\AppData\Local\Temp\tmp6642.tmp.exe
                                                                              "C:\Users\Admin\AppData\Local\Temp\tmp6642.tmp.exe"
                                                                              23⤵
                                                                              • Executes dropped EXE
                                                                              • Suspicious use of SetThreadContext
                                                                              • System Location Discovery: System Language Discovery
                                                                              PID:3252
                                                                              • C:\Users\Admin\AppData\Local\Temp\tmp6642.tmp.exe
                                                                                "C:\Users\Admin\AppData\Local\Temp\tmp6642.tmp.exe"
                                                                                24⤵
                                                                                • Executes dropped EXE
                                                                                PID:2836
                                                                        • C:\Windows\System32\WScript.exe
                                                                          "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\a0974e3d-47b7-4e51-89ca-eee7a65cab8a.vbs"
                                                                          21⤵
                                                                            PID:2796
                                                                          • C:\Users\Admin\AppData\Local\Temp\tmp4AAB.tmp.exe
                                                                            "C:\Users\Admin\AppData\Local\Temp\tmp4AAB.tmp.exe"
                                                                            21⤵
                                                                            • Executes dropped EXE
                                                                            • Suspicious use of SetThreadContext
                                                                            • System Location Discovery: System Language Discovery
                                                                            PID:4660
                                                                            • C:\Users\Admin\AppData\Local\Temp\tmp4AAB.tmp.exe
                                                                              "C:\Users\Admin\AppData\Local\Temp\tmp4AAB.tmp.exe"
                                                                              22⤵
                                                                              • Executes dropped EXE
                                                                              PID:1020
                                                                      • C:\Windows\System32\WScript.exe
                                                                        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\c7b17f2c-dc2c-4913-a6b4-abe82e5fb435.vbs"
                                                                        19⤵
                                                                          PID:2564
                                                                        • C:\Users\Admin\AppData\Local\Temp\tmp2EC7.tmp.exe
                                                                          "C:\Users\Admin\AppData\Local\Temp\tmp2EC7.tmp.exe"
                                                                          19⤵
                                                                          • Executes dropped EXE
                                                                          • System Location Discovery: System Language Discovery
                                                                          PID:2336
                                                                          • C:\Users\Admin\AppData\Local\Temp\tmp2EC7.tmp.exe
                                                                            "C:\Users\Admin\AppData\Local\Temp\tmp2EC7.tmp.exe"
                                                                            20⤵
                                                                            • Executes dropped EXE
                                                                            • Suspicious use of SetThreadContext
                                                                            • System Location Discovery: System Language Discovery
                                                                            PID:4560
                                                                            • C:\Users\Admin\AppData\Local\Temp\tmp2EC7.tmp.exe
                                                                              "C:\Users\Admin\AppData\Local\Temp\tmp2EC7.tmp.exe"
                                                                              21⤵
                                                                              • Executes dropped EXE
                                                                              PID:4476
                                                                    • C:\Windows\System32\WScript.exe
                                                                      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\d0c6cb06-1342-4a17-951e-b5c2df72123d.vbs"
                                                                      17⤵
                                                                        PID:3848
                                                                      • C:\Users\Admin\AppData\Local\Temp\tmpFECD.tmp.exe
                                                                        "C:\Users\Admin\AppData\Local\Temp\tmpFECD.tmp.exe"
                                                                        17⤵
                                                                        • Executes dropped EXE
                                                                        • Suspicious use of SetThreadContext
                                                                        • System Location Discovery: System Language Discovery
                                                                        PID:5056
                                                                        • C:\Users\Admin\AppData\Local\Temp\tmpFECD.tmp.exe
                                                                          "C:\Users\Admin\AppData\Local\Temp\tmpFECD.tmp.exe"
                                                                          18⤵
                                                                          • Executes dropped EXE
                                                                          PID:5044
                                                                  • C:\Windows\System32\WScript.exe
                                                                    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\8e8b72e3-c5d0-45f0-9d18-4929dc6bfd67.vbs"
                                                                    15⤵
                                                                      PID:3440
                                                                    • C:\Users\Admin\AppData\Local\Temp\tmpCD4E.tmp.exe
                                                                      "C:\Users\Admin\AppData\Local\Temp\tmpCD4E.tmp.exe"
                                                                      15⤵
                                                                      • Executes dropped EXE
                                                                      • Suspicious use of SetThreadContext
                                                                      • System Location Discovery: System Language Discovery
                                                                      PID:1748
                                                                      • C:\Users\Admin\AppData\Local\Temp\tmpCD4E.tmp.exe
                                                                        "C:\Users\Admin\AppData\Local\Temp\tmpCD4E.tmp.exe"
                                                                        16⤵
                                                                        • Executes dropped EXE
                                                                        PID:3340
                                                                • C:\Windows\System32\WScript.exe
                                                                  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\99e36b74-d151-40bb-af53-84b08fb8cae7.vbs"
                                                                  13⤵
                                                                    PID:4640
                                                                  • C:\Users\Admin\AppData\Local\Temp\tmp9C4B.tmp.exe
                                                                    "C:\Users\Admin\AppData\Local\Temp\tmp9C4B.tmp.exe"
                                                                    13⤵
                                                                    • Executes dropped EXE
                                                                    • Suspicious use of SetThreadContext
                                                                    • System Location Discovery: System Language Discovery
                                                                    PID:3784
                                                                    • C:\Users\Admin\AppData\Local\Temp\tmp9C4B.tmp.exe
                                                                      "C:\Users\Admin\AppData\Local\Temp\tmp9C4B.tmp.exe"
                                                                      14⤵
                                                                      • Executes dropped EXE
                                                                      PID:1100
                                                              • C:\Windows\System32\WScript.exe
                                                                "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\1ac9280a-ba76-47dc-a9d8-34b81156eb96.vbs"
                                                                11⤵
                                                                  PID:752
                                                                • C:\Users\Admin\AppData\Local\Temp\tmp5956.tmp.exe
                                                                  "C:\Users\Admin\AppData\Local\Temp\tmp5956.tmp.exe"
                                                                  11⤵
                                                                  • Executes dropped EXE
                                                                  • Suspicious use of SetThreadContext
                                                                  • System Location Discovery: System Language Discovery
                                                                  PID:4556
                                                                  • C:\Users\Admin\AppData\Local\Temp\tmp5956.tmp.exe
                                                                    "C:\Users\Admin\AppData\Local\Temp\tmp5956.tmp.exe"
                                                                    12⤵
                                                                    • Executes dropped EXE
                                                                    PID:408
                                                            • C:\Windows\System32\WScript.exe
                                                              "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\73d3738a-818a-4c19-982c-2d2b83d885a8.vbs"
                                                              9⤵
                                                                PID:768
                                                              • C:\Users\Admin\AppData\Local\Temp\tmp27C7.tmp.exe
                                                                "C:\Users\Admin\AppData\Local\Temp\tmp27C7.tmp.exe"
                                                                9⤵
                                                                • Executes dropped EXE
                                                                • System Location Discovery: System Language Discovery
                                                                PID:5000
                                                                • C:\Users\Admin\AppData\Local\Temp\tmp27C7.tmp.exe
                                                                  "C:\Users\Admin\AppData\Local\Temp\tmp27C7.tmp.exe"
                                                                  10⤵
                                                                  • Executes dropped EXE
                                                                  • Suspicious use of SetThreadContext
                                                                  • System Location Discovery: System Language Discovery
                                                                  PID:1928
                                                                  • C:\Users\Admin\AppData\Local\Temp\tmp27C7.tmp.exe
                                                                    "C:\Users\Admin\AppData\Local\Temp\tmp27C7.tmp.exe"
                                                                    11⤵
                                                                    • Executes dropped EXE
                                                                    PID:1748
                                                          • C:\Windows\System32\WScript.exe
                                                            "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\9ae4cf27-09ee-48d8-ac61-f485701200ba.vbs"
                                                            7⤵
                                                              PID:4084
                                                            • C:\Users\Admin\AppData\Local\Temp\tmpC30.tmp.exe
                                                              "C:\Users\Admin\AppData\Local\Temp\tmpC30.tmp.exe"
                                                              7⤵
                                                              • Executes dropped EXE
                                                              • Suspicious use of SetThreadContext
                                                              • System Location Discovery: System Language Discovery
                                                              PID:2552
                                                              • C:\Users\Admin\AppData\Local\Temp\tmpC30.tmp.exe
                                                                "C:\Users\Admin\AppData\Local\Temp\tmpC30.tmp.exe"
                                                                8⤵
                                                                • Executes dropped EXE
                                                                PID:4488
                                                        • C:\Windows\System32\WScript.exe
                                                          "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\51804d25-5cb9-4233-9c39-5d404c2ac3c0.vbs"
                                                          5⤵
                                                            PID:1908
                                                          • C:\Users\Admin\AppData\Local\Temp\tmpDBBA.tmp.exe
                                                            "C:\Users\Admin\AppData\Local\Temp\tmpDBBA.tmp.exe"
                                                            5⤵
                                                            • Executes dropped EXE
                                                            • Suspicious use of SetThreadContext
                                                            • System Location Discovery: System Language Discovery
                                                            • Suspicious use of WriteProcessMemory
                                                            PID:2516
                                                            • C:\Users\Admin\AppData\Local\Temp\tmpDBBA.tmp.exe
                                                              "C:\Users\Admin\AppData\Local\Temp\tmpDBBA.tmp.exe"
                                                              6⤵
                                                              • Executes dropped EXE
                                                              PID:3552
                                                      • C:\Windows\System32\WScript.exe
                                                        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\a8ea21a0-d0e0-4fac-9a38-5e94aa2df967.vbs"
                                                        3⤵
                                                          PID:3620
                                                        • C:\Users\Admin\AppData\Local\Temp\tmpA9EC.tmp.exe
                                                          "C:\Users\Admin\AppData\Local\Temp\tmpA9EC.tmp.exe"
                                                          3⤵
                                                          • Executes dropped EXE
                                                          • Suspicious use of SetThreadContext
                                                          • System Location Discovery: System Language Discovery
                                                          • Suspicious use of WriteProcessMemory
                                                          PID:2948
                                                          • C:\Users\Admin\AppData\Local\Temp\tmpA9EC.tmp.exe
                                                            "C:\Users\Admin\AppData\Local\Temp\tmpA9EC.tmp.exe"
                                                            4⤵
                                                            • Executes dropped EXE
                                                            PID:1076
                                                    • C:\Windows\system32\schtasks.exe
                                                      schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 13 /tr "'C:\Program Files\Windows Sidebar\spoolsv.exe'" /f
                                                      1⤵
                                                      • Process spawned unexpected child process
                                                      • Scheduled Task/Job: Scheduled Task
                                                      PID:1208
                                                    • C:\Windows\system32\schtasks.exe
                                                      schtasks.exe /create /tn "spoolsv" /sc ONLOGON /tr "'C:\Program Files\Windows Sidebar\spoolsv.exe'" /rl HIGHEST /f
                                                      1⤵
                                                      • Process spawned unexpected child process
                                                      • Scheduled Task/Job: Scheduled Task
                                                      PID:4572
                                                    • C:\Windows\system32\schtasks.exe
                                                      schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 8 /tr "'C:\Program Files\Windows Sidebar\spoolsv.exe'" /rl HIGHEST /f
                                                      1⤵
                                                      • Process spawned unexpected child process
                                                      • Scheduled Task/Job: Scheduled Task
                                                      PID:2216
                                                    • C:\Windows\system32\schtasks.exe
                                                      schtasks.exe /create /tn "smsss" /sc MINUTE /mo 8 /tr "'C:\Program Files\Windows Photo Viewer\smss.exe'" /f
                                                      1⤵
                                                      • Process spawned unexpected child process
                                                      • Scheduled Task/Job: Scheduled Task
                                                      PID:3620
                                                    • C:\Windows\system32\schtasks.exe
                                                      schtasks.exe /create /tn "smss" /sc ONLOGON /tr "'C:\Program Files\Windows Photo Viewer\smss.exe'" /rl HIGHEST /f
                                                      1⤵
                                                      • Process spawned unexpected child process
                                                      • Scheduled Task/Job: Scheduled Task
                                                      PID:1412
                                                    • C:\Windows\system32\schtasks.exe
                                                      schtasks.exe /create /tn "smsss" /sc MINUTE /mo 7 /tr "'C:\Program Files\Windows Photo Viewer\smss.exe'" /rl HIGHEST /f
                                                      1⤵
                                                      • Process spawned unexpected child process
                                                      • Scheduled Task/Job: Scheduled Task
                                                      PID:3568

                                                    Network

                                                    MITRE ATT&CK Enterprise v15

                                                    Replay Monitor

                                                    Loading Replay Monitor...

                                                    Downloads

                                                    • C:\Program Files\Windows Photo Viewer\smss.exe
                                                      Filesize

                                                      4.9MB

                                                      MD5

                                                      4eab4546d9cd85202632896014af0328

                                                      SHA1

                                                      a8bfd63b5016c937145a40c6248a559f96bc2bcf

                                                      SHA256

                                                      59997eb70454fbf5250374155c6bc1611fc5bb0703cffaf9873c6eb486d9433e

                                                      SHA512

                                                      b39db538bc6015765bf34bdd0b4fad6215fb5e9f2b14f45338f89130a4655d4afc8aa4afbe668cef31f418064953cbe822a07b9b619a915b8688fb221f410ed9

                                                      Download Submit

                                                    • C:\Program Files\Windows Sidebar\spoolsv.exe
                                                      Filesize

                                                      4.9MB

                                                      MD5

                                                      58bf250686082cc8e02eea346661ea7f

                                                      SHA1

                                                      a465d280d33acc4ad04dc92ec4994703d8868ade

                                                      SHA256

                                                      6f00291aa8d783e5a5949251820dc4fe03a732a206890d7f4b3902f8994819e6

                                                      SHA512

                                                      881421c58bcc9570c5f4889a1bd79fad81fb2863c46369a84fd8a2506167fd749e72f4f75b8b2ededb79d7694baf54193057887d7f50dd7b786e67e09a1c392b

                                                      Download Submit

                                                    • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
                                                      Filesize

                                                      2KB

                                                      MD5

                                                      d85ba6ff808d9e5444a4b369f5bc2730

                                                      SHA1

                                                      31aa9d96590fff6981b315e0b391b575e4c0804a

                                                      SHA256

                                                      84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

                                                      SHA512

                                                      8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

                                                      Download Submit

                                                    • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\smss.exe.log
                                                      Filesize

                                                      1KB

                                                      MD5

                                                      4a667f150a4d1d02f53a9f24d89d53d1

                                                      SHA1

                                                      306e125c9edce66f28fdb63e6c4ca5c9ad6e8c97

                                                      SHA256

                                                      414659decfd237dde09625a49811e03b5b30ee06ee2ee97ea8bcfac394d281fd

                                                      SHA512

                                                      4edd8e73ce03488a6d92750a782cd4042fbb54a5b3f8d8ba3ea227fda0653c2cd84f0c5d64976c7cdc1f518a2fdc8ff10e2a015ec7acf3cd01b0d62bc98542d8

                                                      Download Submit

                                                    • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                      Filesize

                                                      944B

                                                      MD5

                                                      77d622bb1a5b250869a3238b9bc1402b

                                                      SHA1

                                                      d47f4003c2554b9dfc4c16f22460b331886b191b

                                                      SHA256

                                                      f97ff12a8abf4bf88bb6497bd2ac2da12628c8847a8ba5a9026bdbb76507cdfb

                                                      SHA512

                                                      d6789b5499f23c9035375a102271e17a8a82e57d6f5312fa24242e08a83efdeb8becb7622f55c4cf1b89c7d864b445df11f4d994cf7e2f87a900535bcca12fd9

                                                      Download Submit

                                                    • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                      Filesize

                                                      944B

                                                      MD5

                                                      d28a889fd956d5cb3accfbaf1143eb6f

                                                      SHA1

                                                      157ba54b365341f8ff06707d996b3635da8446f7

                                                      SHA256

                                                      21e5d7ccf80a293e6ba30ed728846ca19c929c52b96e2c8d34e27cd2234f1d45

                                                      SHA512

                                                      0b6d88deb9be85722e6a78d5886d49f2caf407a59e128d2b4ed74c1356f9928c40048a62731959f2460e9ff9d9feee311043d2a37abe3bb92c2b76a44281478c

                                                      Download Submit

                                                    • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                      Filesize

                                                      944B

                                                      MD5

                                                      3a6bad9528f8e23fb5c77fbd81fa28e8

                                                      SHA1

                                                      f127317c3bc6407f536c0f0600dcbcf1aabfba36

                                                      SHA256

                                                      986366767de5873f1b170a63f2a33ce05132d1afd90c8f5017afbca8ef1beb05

                                                      SHA512

                                                      846002154a0ece6f3e9feda6f115d3161dc21b3789525dd62ae1d9188495171293efdbe7be4710666dd8a15e66b557315b5a02918a741ed1d5f3ff0c515b98e2

                                                      Download Submit

                                                    • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                      Filesize

                                                      944B

                                                      MD5

                                                      bd5940f08d0be56e65e5f2aaf47c538e

                                                      SHA1

                                                      d7e31b87866e5e383ab5499da64aba50f03e8443

                                                      SHA256

                                                      2d2f364c75bd2897504249f42cdf1d19374f5230aad68fa9154ea3d03e3031a6

                                                      SHA512

                                                      c34d10c7e07da44a180fae9889b61f08903aa84e8ddfa80c31c272b1ef9d491b8cec6b8a4c836c3cb1583fe8f4955c6a8db872515de3a9e10eae09610c959406

                                                      Download Submit

                                                    • C:\Users\Admin\AppData\Local\Temp\1b437ad9-4c73-4fce-bad2-9c98c5419567.vbs
                                                      Filesize

                                                      722B

                                                      MD5

                                                      77fe08e8757299c27b9add28930b73de

                                                      SHA1

                                                      ee2f1fe897e76f8b6cebf24152a01a1f1aac0d75

                                                      SHA256

                                                      2eeab626b6ec91cce5cf07a9a2a5565ff149bb3d4837d615e1feebf7fe468331

                                                      SHA512

                                                      54f662f2c386183a23d13e34927ac8257e3d1742db1206bae4fbad42d695e7d583cec733eb1b5f12b64b3a9f08efe1ebdf04d6087f527bc7a8529e941fd8dd7e

                                                      Download Submit

                                                    • C:\Users\Admin\AppData\Local\Temp\4f3bc62a-4e9e-4029-9aa7-826aa0bfe50f.vbs
                                                      Filesize

                                                      722B

                                                      MD5

                                                      0c5e7672cc27a9fd81c757728226117f

                                                      SHA1

                                                      387a4af41f8762bb93e882eb4b8b6213bf97df7c

                                                      SHA256

                                                      923201657d15734fdafcd1254b7e39488db82e82b0aad64583d3c8967195f7e3

                                                      SHA512

                                                      45c4a738414134839dd4da1e4c3c4b6e34b3e2e1f35c7babd8548a80e43325af9a4e53591dfd47e9a835f8e9ee358cd6b69fbca8c70be804473f4bef2ff9ba91

                                                      Download Submit

                                                    • C:\Users\Admin\AppData\Local\Temp\7e7aea5d-fd2f-4d74-becd-3e4bb449319e.vbs
                                                      Filesize

                                                      721B

                                                      MD5

                                                      5c848e2f4d913e2df67286e5c8100b60

                                                      SHA1

                                                      d4452d01f66ed81902b72e108e9970588a0f3b62

                                                      SHA256

                                                      160a3c8a4329eeac50c6c0ab66be7b46ed6940eee177676a0ae5ca58068662d6

                                                      SHA512

                                                      f30520fe2c4440c511c1b220a7d9e06b7a0ee12da0251152d3ea08e013d849b3c5514120993e9f0102a38e881a28f3b21ee6cb3b5b0c89570e0a4da4efd32f73

                                                      Download Submit

                                                    • C:\Users\Admin\AppData\Local\Temp\7f455782-f6ed-4016-850a-f20631b5ef20.vbs
                                                      Filesize

                                                      722B

                                                      MD5

                                                      9da3f7996ceea370bc68452f66e7071b

                                                      SHA1

                                                      73eb8a6cd1b0d3326f713ed9e791f07543611739

                                                      SHA256

                                                      c75ff33dd969ac48187f3529fc3d8fe2dbe244d564ca9ec6da0eb38dc8bbf25f

                                                      SHA512

                                                      83be4e6bb004417dcf11ca0551aa6033a8ccb03708f9848a0cf432c1a4cc7cadc1ac2e06ee468f8228f1d148fe30bbdc3594d78ddbb1ed557844a02e60aec8f6

                                                      Download Submit

                                                    • C:\Users\Admin\AppData\Local\Temp\8fa5c618-a436-4b2c-951f-0cf7dacc2e87.vbs
                                                      Filesize

                                                      722B

                                                      MD5

                                                      05abf37fa0ee131c9b7c516975ec0251

                                                      SHA1

                                                      4d8dec1a41f1dab75f797b5caf3e8891060508d9

                                                      SHA256

                                                      f1fa4768a2a0fcab9747ce201e95d265537b9c88e6cb6cc36e3cdbaea3bacf24

                                                      SHA512

                                                      d9838851308511144e416320f72fc59535c525eb41030fb1e437b527ebc46b2e8a3e96479e7b55a779b937bf36926dfd85cc8b319d501d5feee565a9ed9f269e

                                                      Download Submit

                                                    • C:\Users\Admin\AppData\Local\Temp\996f53e9-7468-4150-b849-a3b1ceca4abe.vbs
                                                      Filesize

                                                      722B

                                                      MD5

                                                      5033716d9097fddd55ecfe115c7032d6

                                                      SHA1

                                                      181d94ca642013206b6338b071383f2663c3e33d

                                                      SHA256

                                                      4b553d58905d4ab7cdd4a8dfdbd40c3c075639f342474106e2525ff00a579d9c

                                                      SHA512

                                                      f9fe9477eaea42f4e6a4c1cd639886504c1e21b10697d0a73a15fb0c8706a350374a561708ccdc5cd97e562c093c33efa23e58f5ee71cabc261512f9377f911d

                                                      Download Submit

                                                    • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_kkcclqbo.w4q.ps1
                                                      Filesize

                                                      60B

                                                      MD5

                                                      d17fe0a3f47be24a6453e9ef58c94641

                                                      SHA1

                                                      6ab83620379fc69f80c0242105ddffd7d98d5d9d

                                                      SHA256

                                                      96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

                                                      SHA512

                                                      5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

                                                      Download Submit

                                                    • C:\Users\Admin\AppData\Local\Temp\a8ea21a0-d0e0-4fac-9a38-5e94aa2df967.vbs
                                                      Filesize

                                                      498B

                                                      MD5

                                                      b1faf991196452c906458a1a61d9982b

                                                      SHA1

                                                      b327281bbef19c7eebb937cb70465f5a56fbafa5

                                                      SHA256

                                                      ef1dfef955a776ef1f6f1843b20890c21a9651205270266c18be29f1130401c4

                                                      SHA512

                                                      c1b78c324e3336779d0e9c9ffea71eef9979ba4a2c6c58a4496ba08c466d9b252943db810a21614a679de3f7abb18bdd29e9fadd67f834f91cf02f6ee4930c21

                                                      Download Submit

                                                    • C:\Users\Admin\AppData\Local\Temp\f974b033-972a-436b-a36e-273668f97e8b.vbs
                                                      Filesize

                                                      722B

                                                      MD5

                                                      d40950c9626e37bd0c8b918d4a936633

                                                      SHA1

                                                      05d5aa0318e3c40caea600977770fcd92b1a12df

                                                      SHA256

                                                      02c2837a2d2c17a23a68e936e6a3ae9a847ee568451a3aed4de5b51bd63b9e12

                                                      SHA512

                                                      2f4322847fe2a21db3dc16e56294bdce4321f6eee893824b64a4ebb9deb001047be4370669220774a4e44530c69da039f1921482d5c22a2c78b1ff772af3f3d7

                                                      Download Submit

                                                    • C:\Users\Admin\AppData\Local\Temp\tmp9936.tmp.exe
                                                      Filesize

                                                      75KB

                                                      MD5

                                                      e0a68b98992c1699876f818a22b5b907

                                                      SHA1

                                                      d41e8ad8ba51217eb0340f8f69629ccb474484d0

                                                      SHA256

                                                      2b00d8c2bcc6b48e90524cdd41a07735dc94548ed41925baff86e43a61a4c37f

                                                      SHA512

                                                      856854f5fd89ae1669e4b2db10b73b4a78496bf80117003244c83e781f75e533e2e2bea9aa6c1b3aba3db1ed92ea0ed9755fbfd78cd6c86ba95867d07fc0ece2

                                                      Download Submit

                                                    • memory/1708-98-0x000001A59BFE0000-0x000001A59C002000-memory.dmp

                                                      Filesize

                                                      136KB

                                                      Download

                                                    • memory/1848-2-0x000000001B390000-0x000000001B4BE000-memory.dmp

                                                      Filesize

                                                      1.2MB

                                                      Download

                                                    • memory/1848-9-0x000000001B340000-0x000000001B350000-memory.dmp

                                                      Filesize

                                                      64KB

                                                      Download

                                                    • memory/1848-16-0x000000001BB30000-0x000000001BB38000-memory.dmp

                                                      Filesize

                                                      32KB

                                                      Download

                                                    • memory/1848-6-0x0000000002680000-0x0000000002688000-memory.dmp

                                                      Filesize

                                                      32KB

                                                      Download

                                                    • memory/1848-5-0x000000001BAC0000-0x000000001BB10000-memory.dmp

                                                      Filesize

                                                      320KB

                                                      Download

                                                    • memory/1848-18-0x000000001BB50000-0x000000001BB5C000-memory.dmp

                                                      Filesize

                                                      48KB

                                                      Download

                                                    • memory/1848-8-0x000000001B320000-0x000000001B336000-memory.dmp

                                                      Filesize

                                                      88KB

                                                      Download

                                                    • memory/1848-3-0x00007FFA53610000-0x00007FFA540D1000-memory.dmp

                                                      Filesize

                                                      10.8MB

                                                      Download

                                                    • memory/1848-11-0x000000001B360000-0x000000001B372000-memory.dmp

                                                      Filesize

                                                      72KB

                                                      Download

                                                    • memory/1848-7-0x00000000027A0000-0x00000000027B0000-memory.dmp

                                                      Filesize

                                                      64KB

                                                      Download

                                                    • memory/1848-211-0x00007FFA53610000-0x00007FFA540D1000-memory.dmp

                                                      Filesize

                                                      10.8MB

                                                      Download

                                                    • memory/1848-0-0x00007FFA53613000-0x00007FFA53615000-memory.dmp

                                                      Filesize

                                                      8KB

                                                      Download

                                                    • memory/1848-17-0x000000001BB40000-0x000000001BB48000-memory.dmp

                                                      Filesize

                                                      32KB

                                                      Download

                                                    • memory/1848-13-0x000000001B370000-0x000000001B37A000-memory.dmp

                                                      Filesize

                                                      40KB

                                                      Download

                                                    • memory/1848-14-0x000000001BB10000-0x000000001BB1E000-memory.dmp

                                                      Filesize

                                                      56KB

                                                      Download

                                                    • memory/1848-1-0x00000000000C0000-0x00000000005B4000-memory.dmp

                                                      Filesize

                                                      5.0MB

                                                      Download

                                                    • memory/1848-15-0x000000001BB20000-0x000000001BB2E000-memory.dmp

                                                      Filesize

                                                      56KB

                                                      Download

                                                    • memory/1848-10-0x000000001B350000-0x000000001B35A000-memory.dmp

                                                      Filesize

                                                      40KB

                                                      Download

                                                    • memory/1848-12-0x000000001C040000-0x000000001C568000-memory.dmp

                                                      Filesize

                                                      5.2MB

                                                      Download

                                                    • memory/1848-4-0x0000000002660000-0x000000000267C000-memory.dmp

                                                      Filesize

                                                      112KB

                                                      Download

                                                    • memory/1940-197-0x0000000000400000-0x0000000000407000-memory.dmp

                                                      Filesize

                                                      28KB

                                                      Download

                                                    • memory/4828-210-0x0000000000C80000-0x0000000001174000-memory.dmp

                                                      Filesize

                                                      5.0MB

                                                      Download

                                                    • memory/5028-282-0x000000001D670000-0x000000001D682000-memory.dmp

                                                      Filesize

                                                      72KB

                                                      Download