27c0d07c25ec07af447a4b9b785261e448f73267d9ae9bad231b7273029ee84c

Analysis

max time kernel
142s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
20/09/2024, 12:33

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

00db28e5a7412cf4a6f87f8589244cd1.exe
Size

1.9MB
MD5

00db28e5a7412cf4a6f87f8589244cd1
SHA1

49a8344dac9b27ebe4962f4fce5c7e2ef9c023f7
SHA256

27c0d07c25ec07af447a4b9b785261e448f73267d9ae9bad231b7273029ee84c
SHA512

3c860c48ae7f37b023299455830310390c14ad69fa1e241e9f94041b9797ca415841c4b541b105b6ac84327015a97b1664aa098d3f2f4d918341e2dca65d60ba
SSDEEP

24576:mX7tyazXp4qrSJZHJTEyMkbjla5TA3fmpKuUJBU8uQgyfg29H4EG7FhfESrpBrmi:mqR1a5T+fvmr0p4BDfzjmIADb

Score

10^/10

credential_access execution persistence spyware stealer

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 6 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Users\\Public\\Desktop\\services.exe\""	00db28e5a7412cf4a6f87f8589244cd1.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Users\\Public\\Desktop\\services.exe\", \"C:\\Program Files\\Microsoft Office 15\\ClientX64\\dllhost.exe\""	00db28e5a7412cf4a6f87f8589244cd1.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Users\\Public\\Desktop\\services.exe\", \"C:\\Program Files\\Microsoft Office 15\\ClientX64\\dllhost.exe\", \"C:\\Windows\\L2Schemas\\Registry.exe\""	00db28e5a7412cf4a6f87f8589244cd1.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Users\\Public\\Desktop\\services.exe\", \"C:\\Program Files\\Microsoft Office 15\\ClientX64\\dllhost.exe\", \"C:\\Windows\\L2Schemas\\Registry.exe\", \"C:\\Users\\Default User\\services.exe\""	00db28e5a7412cf4a6f87f8589244cd1.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Users\\Public\\Desktop\\services.exe\", \"C:\\Program Files\\Microsoft Office 15\\ClientX64\\dllhost.exe\", \"C:\\Windows\\L2Schemas\\Registry.exe\", \"C:\\Users\\Default User\\services.exe\", \"C:\\Users\\All Users\\csrss.exe\""	00db28e5a7412cf4a6f87f8589244cd1.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Users\\Public\\Desktop\\services.exe\", \"C:\\Program Files\\Microsoft Office 15\\ClientX64\\dllhost.exe\", \"C:\\Windows\\L2Schemas\\Registry.exe\", \"C:\\Users\\Default User\\services.exe\", \"C:\\Users\\All Users\\csrss.exe\", \"C:\\Users\\Admin\\AppData\\Local\\Temp\\00db28e5a7412cf4a6f87f8589244cd1.exe\""	00db28e5a7412cf4a6f87f8589244cd1.exe

Process spawned unexpected child process 18 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4052	4988	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2864	4988	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4768	4988	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3364	4988	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5012	4988	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2288	4988	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3168	4988	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3120	4988	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4012	4988	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4584	4988	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2632	4988	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2736	4988	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2592	4988	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3184	4988	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	820	4988	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3128	4988	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4884	4988	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	940	4988	schtasks.exe	82

Credentials from Password Stores: Credentials from Web Browsers 1 TTPs
Malicious Access or copy of Web Browser Credential store.
credential_access stealer

Credentials from Web Browsers
T1555.003

Command and Scripting Interpreter: PowerShell 1 TTPs 17 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
1856	powershell.exe
3604	powershell.exe
4180	powershell.exe
4972	powershell.exe
2960	powershell.exe
4620	powershell.exe
2508	powershell.exe
1516	powershell.exe
4336	powershell.exe
5108	powershell.exe
368	powershell.exe
1816	powershell.exe
3868	powershell.exe
4932	powershell.exe
3040	powershell.exe
5016	powershell.exe
4816	powershell.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\Control Panel\International\Geo\Nation	00db28e5a7412cf4a6f87f8589244cd1.exe

Executes dropped EXE 1 IoCs

pid	Process
1932	dllhost.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 12 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\services = "\"C:\\Users\\Public\\Desktop\\services.exe\""	00db28e5a7412cf4a6f87f8589244cd1.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dllhost = "\"C:\\Program Files\\Microsoft Office 15\\ClientX64\\dllhost.exe\""	00db28e5a7412cf4a6f87f8589244cd1.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Registry = "\"C:\\Windows\\L2Schemas\\Registry.exe\""	00db28e5a7412cf4a6f87f8589244cd1.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\services = "\"C:\\Users\\Default User\\services.exe\""	00db28e5a7412cf4a6f87f8589244cd1.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Users\\All Users\\csrss.exe\""	00db28e5a7412cf4a6f87f8589244cd1.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Users\\All Users\\csrss.exe\""	00db28e5a7412cf4a6f87f8589244cd1.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\services = "\"C:\\Users\\Public\\Desktop\\services.exe\""	00db28e5a7412cf4a6f87f8589244cd1.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dllhost = "\"C:\\Program Files\\Microsoft Office 15\\ClientX64\\dllhost.exe\""	00db28e5a7412cf4a6f87f8589244cd1.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Registry = "\"C:\\Windows\\L2Schemas\\Registry.exe\""	00db28e5a7412cf4a6f87f8589244cd1.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\services = "\"C:\\Users\\Default User\\services.exe\""	00db28e5a7412cf4a6f87f8589244cd1.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\00db28e5a7412cf4a6f87f8589244cd1 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\00db28e5a7412cf4a6f87f8589244cd1.exe\""	00db28e5a7412cf4a6f87f8589244cd1.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\00db28e5a7412cf4a6f87f8589244cd1 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\00db28e5a7412cf4a6f87f8589244cd1.exe\""	00db28e5a7412cf4a6f87f8589244cd1.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	\??\c:\Windows\System32\CSCC9FB5358F7C04145BAC2C9AB65144D5.TMP	csc.exe
File created	\??\c:\Windows\System32\-ue4vv.exe	csc.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files\Microsoft Office 15\ClientX64\dllhost.exe	00db28e5a7412cf4a6f87f8589244cd1.exe
File created	C:\Program Files\Microsoft Office 15\ClientX64\5940a34987c991	00db28e5a7412cf4a6f87f8589244cd1.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\L2Schemas\Registry.exe	00db28e5a7412cf4a6f87f8589244cd1.exe
File created	C:\Windows\L2Schemas\ee2ad38f3d4382	00db28e5a7412cf4a6f87f8589244cd1.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000_Classes\Local Settings	00db28e5a7412cf4a6f87f8589244cd1.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 18 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
3120	schtasks.exe
4584	schtasks.exe
2632	schtasks.exe
820	schtasks.exe
4052	schtasks.exe
2864	schtasks.exe
3364	schtasks.exe
4012	schtasks.exe
2592	schtasks.exe
2736	schtasks.exe
3184	schtasks.exe
4884	schtasks.exe
3168	schtasks.exe
3128	schtasks.exe
940	schtasks.exe
4768	schtasks.exe
5012	schtasks.exe
2288	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3052	00db28e5a7412cf4a6f87f8589244cd1.exe
3052	00db28e5a7412cf4a6f87f8589244cd1.exe
3052	00db28e5a7412cf4a6f87f8589244cd1.exe
3052	00db28e5a7412cf4a6f87f8589244cd1.exe
3052	00db28e5a7412cf4a6f87f8589244cd1.exe
3052	00db28e5a7412cf4a6f87f8589244cd1.exe
3052	00db28e5a7412cf4a6f87f8589244cd1.exe
3052	00db28e5a7412cf4a6f87f8589244cd1.exe
3052	00db28e5a7412cf4a6f87f8589244cd1.exe
3052	00db28e5a7412cf4a6f87f8589244cd1.exe
3052	00db28e5a7412cf4a6f87f8589244cd1.exe
3052	00db28e5a7412cf4a6f87f8589244cd1.exe
3052	00db28e5a7412cf4a6f87f8589244cd1.exe
3052	00db28e5a7412cf4a6f87f8589244cd1.exe
3052	00db28e5a7412cf4a6f87f8589244cd1.exe
3052	00db28e5a7412cf4a6f87f8589244cd1.exe
3052	00db28e5a7412cf4a6f87f8589244cd1.exe
3052	00db28e5a7412cf4a6f87f8589244cd1.exe
3052	00db28e5a7412cf4a6f87f8589244cd1.exe
3052	00db28e5a7412cf4a6f87f8589244cd1.exe
3052	00db28e5a7412cf4a6f87f8589244cd1.exe
3052	00db28e5a7412cf4a6f87f8589244cd1.exe
3052	00db28e5a7412cf4a6f87f8589244cd1.exe
3052	00db28e5a7412cf4a6f87f8589244cd1.exe
3052	00db28e5a7412cf4a6f87f8589244cd1.exe
3052	00db28e5a7412cf4a6f87f8589244cd1.exe
3052	00db28e5a7412cf4a6f87f8589244cd1.exe
3052	00db28e5a7412cf4a6f87f8589244cd1.exe
3052	00db28e5a7412cf4a6f87f8589244cd1.exe
3052	00db28e5a7412cf4a6f87f8589244cd1.exe
3052	00db28e5a7412cf4a6f87f8589244cd1.exe
3052	00db28e5a7412cf4a6f87f8589244cd1.exe
3052	00db28e5a7412cf4a6f87f8589244cd1.exe
3052	00db28e5a7412cf4a6f87f8589244cd1.exe
3052	00db28e5a7412cf4a6f87f8589244cd1.exe
3052	00db28e5a7412cf4a6f87f8589244cd1.exe
3052	00db28e5a7412cf4a6f87f8589244cd1.exe
3052	00db28e5a7412cf4a6f87f8589244cd1.exe
3052	00db28e5a7412cf4a6f87f8589244cd1.exe
3052	00db28e5a7412cf4a6f87f8589244cd1.exe
3052	00db28e5a7412cf4a6f87f8589244cd1.exe
3052	00db28e5a7412cf4a6f87f8589244cd1.exe
3052	00db28e5a7412cf4a6f87f8589244cd1.exe
3052	00db28e5a7412cf4a6f87f8589244cd1.exe
3052	00db28e5a7412cf4a6f87f8589244cd1.exe
3052	00db28e5a7412cf4a6f87f8589244cd1.exe
3052	00db28e5a7412cf4a6f87f8589244cd1.exe
3052	00db28e5a7412cf4a6f87f8589244cd1.exe
3052	00db28e5a7412cf4a6f87f8589244cd1.exe
3052	00db28e5a7412cf4a6f87f8589244cd1.exe
3052	00db28e5a7412cf4a6f87f8589244cd1.exe
3052	00db28e5a7412cf4a6f87f8589244cd1.exe
3052	00db28e5a7412cf4a6f87f8589244cd1.exe
3052	00db28e5a7412cf4a6f87f8589244cd1.exe
3052	00db28e5a7412cf4a6f87f8589244cd1.exe
3052	00db28e5a7412cf4a6f87f8589244cd1.exe
3052	00db28e5a7412cf4a6f87f8589244cd1.exe
3052	00db28e5a7412cf4a6f87f8589244cd1.exe
3052	00db28e5a7412cf4a6f87f8589244cd1.exe
3052	00db28e5a7412cf4a6f87f8589244cd1.exe
3052	00db28e5a7412cf4a6f87f8589244cd1.exe
3052	00db28e5a7412cf4a6f87f8589244cd1.exe
3052	00db28e5a7412cf4a6f87f8589244cd1.exe
3052	00db28e5a7412cf4a6f87f8589244cd1.exe

Suspicious use of AdjustPrivilegeToken 19 IoCs

description	pid	Process
Token: SeDebugPrivilege	3052	00db28e5a7412cf4a6f87f8589244cd1.exe
Token: SeDebugPrivilege	4336	powershell.exe
Token: SeDebugPrivilege	5016	powershell.exe
Token: SeDebugPrivilege	2960	powershell.exe
Token: SeDebugPrivilege	1856	powershell.exe
Token: SeDebugPrivilege	4932	powershell.exe
Token: SeDebugPrivilege	1816	powershell.exe
Token: SeDebugPrivilege	4620	powershell.exe
Token: SeDebugPrivilege	2508	powershell.exe
Token: SeDebugPrivilege	4816	powershell.exe
Token: SeDebugPrivilege	3040	powershell.exe
Token: SeDebugPrivilege	1516	powershell.exe
Token: SeDebugPrivilege	5108	powershell.exe
Token: SeDebugPrivilege	368	powershell.exe
Token: SeDebugPrivilege	3868	powershell.exe
Token: SeDebugPrivilege	4972	powershell.exe
Token: SeDebugPrivilege	4180	powershell.exe
Token: SeDebugPrivilege	3604	powershell.exe
Token: SeDebugPrivilege	1932	dllhost.exe

Suspicious use of WriteProcessMemory 46 IoCs

description	pid	Process	procid_target
PID 3052 wrote to memory of 2964	3052	00db28e5a7412cf4a6f87f8589244cd1.exe	86
PID 3052 wrote to memory of 2964	3052	00db28e5a7412cf4a6f87f8589244cd1.exe	86
PID 2964 wrote to memory of 2100	2964	csc.exe	88
PID 2964 wrote to memory of 2100	2964	csc.exe	88
PID 3052 wrote to memory of 3604	3052	00db28e5a7412cf4a6f87f8589244cd1.exe	104
PID 3052 wrote to memory of 3604	3052	00db28e5a7412cf4a6f87f8589244cd1.exe	104
PID 3052 wrote to memory of 4336	3052	00db28e5a7412cf4a6f87f8589244cd1.exe	105
PID 3052 wrote to memory of 4336	3052	00db28e5a7412cf4a6f87f8589244cd1.exe	105
PID 3052 wrote to memory of 4932	3052	00db28e5a7412cf4a6f87f8589244cd1.exe	106
PID 3052 wrote to memory of 4932	3052	00db28e5a7412cf4a6f87f8589244cd1.exe	106
PID 3052 wrote to memory of 1516	3052	00db28e5a7412cf4a6f87f8589244cd1.exe	107
PID 3052 wrote to memory of 1516	3052	00db28e5a7412cf4a6f87f8589244cd1.exe	107
PID 3052 wrote to memory of 1856	3052	00db28e5a7412cf4a6f87f8589244cd1.exe	108
PID 3052 wrote to memory of 1856	3052	00db28e5a7412cf4a6f87f8589244cd1.exe	108
PID 3052 wrote to memory of 2960	3052	00db28e5a7412cf4a6f87f8589244cd1.exe	111
PID 3052 wrote to memory of 2960	3052	00db28e5a7412cf4a6f87f8589244cd1.exe	111
PID 3052 wrote to memory of 2508	3052	00db28e5a7412cf4a6f87f8589244cd1.exe	112
PID 3052 wrote to memory of 2508	3052	00db28e5a7412cf4a6f87f8589244cd1.exe	112
PID 3052 wrote to memory of 3868	3052	00db28e5a7412cf4a6f87f8589244cd1.exe	113
PID 3052 wrote to memory of 3868	3052	00db28e5a7412cf4a6f87f8589244cd1.exe	113
PID 3052 wrote to memory of 4816	3052	00db28e5a7412cf4a6f87f8589244cd1.exe	114
PID 3052 wrote to memory of 4816	3052	00db28e5a7412cf4a6f87f8589244cd1.exe	114
PID 3052 wrote to memory of 4972	3052	00db28e5a7412cf4a6f87f8589244cd1.exe	115
PID 3052 wrote to memory of 4972	3052	00db28e5a7412cf4a6f87f8589244cd1.exe	115
PID 3052 wrote to memory of 4180	3052	00db28e5a7412cf4a6f87f8589244cd1.exe	116
PID 3052 wrote to memory of 4180	3052	00db28e5a7412cf4a6f87f8589244cd1.exe	116
PID 3052 wrote to memory of 1816	3052	00db28e5a7412cf4a6f87f8589244cd1.exe	117
PID 3052 wrote to memory of 1816	3052	00db28e5a7412cf4a6f87f8589244cd1.exe	117
PID 3052 wrote to memory of 368	3052	00db28e5a7412cf4a6f87f8589244cd1.exe	118
PID 3052 wrote to memory of 368	3052	00db28e5a7412cf4a6f87f8589244cd1.exe	118
PID 3052 wrote to memory of 4620	3052	00db28e5a7412cf4a6f87f8589244cd1.exe	119
PID 3052 wrote to memory of 4620	3052	00db28e5a7412cf4a6f87f8589244cd1.exe	119
PID 3052 wrote to memory of 5016	3052	00db28e5a7412cf4a6f87f8589244cd1.exe	120
PID 3052 wrote to memory of 5016	3052	00db28e5a7412cf4a6f87f8589244cd1.exe	120
PID 3052 wrote to memory of 3040	3052	00db28e5a7412cf4a6f87f8589244cd1.exe	121
PID 3052 wrote to memory of 3040	3052	00db28e5a7412cf4a6f87f8589244cd1.exe	121
PID 3052 wrote to memory of 5108	3052	00db28e5a7412cf4a6f87f8589244cd1.exe	122
PID 3052 wrote to memory of 5108	3052	00db28e5a7412cf4a6f87f8589244cd1.exe	122
PID 3052 wrote to memory of 656	3052	00db28e5a7412cf4a6f87f8589244cd1.exe	138
PID 3052 wrote to memory of 656	3052	00db28e5a7412cf4a6f87f8589244cd1.exe	138
PID 656 wrote to memory of 3420	656	cmd.exe	141
PID 656 wrote to memory of 3420	656	cmd.exe	141
PID 656 wrote to memory of 3068	656	cmd.exe	142
PID 656 wrote to memory of 3068	656	cmd.exe	142
PID 656 wrote to memory of 1932	656	cmd.exe	147
PID 656 wrote to memory of 1932	656	cmd.exe	147

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\00db28e5a7412cf4a6f87f8589244cd1.exe
"C:\Users\Admin\AppData\Local\Temp\00db28e5a7412cf4a6f87f8589244cd1.exe"
1⤵
- Modifies WinLogon for persistence
- Checks computer location settings
- Adds Run key to start application
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3052
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\ixamppmj\ixamppmj.cmdline"
  2⤵
  - Drops file in System32 directory
  - Suspicious use of WriteProcessMemory
  PID:2964
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES9105.tmp" "c:\Windows\System32\CSCC9FB5358F7C04145BAC2C9AB65144D5.TMP"
    3⤵
    PID:2100
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of AdjustPrivilegeToken
  PID:3604
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/$Recycle.Bin/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of AdjustPrivilegeToken
  PID:4336
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Documents and Settings/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of AdjustPrivilegeToken
  PID:4932
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/PerfLogs/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of AdjustPrivilegeToken
  PID:1516
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of AdjustPrivilegeToken
  PID:1856
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files (x86)/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of AdjustPrivilegeToken
  PID:2960
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/ProgramData/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of AdjustPrivilegeToken
  PID:2508
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Recovery/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of AdjustPrivilegeToken
  PID:3868
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/System Volume Information/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of AdjustPrivilegeToken
  PID:4816
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Users/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of AdjustPrivilegeToken
  PID:4972
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Windows/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of AdjustPrivilegeToken
  PID:4180
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Public\Desktop\services.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of AdjustPrivilegeToken
  PID:1816
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Microsoft Office 15\ClientX64\dllhost.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of AdjustPrivilegeToken
  PID:368
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\L2Schemas\Registry.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of AdjustPrivilegeToken
  PID:4620
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Default User\services.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of AdjustPrivilegeToken
  PID:5016
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\All Users\csrss.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of AdjustPrivilegeToken
  PID:3040
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\00db28e5a7412cf4a6f87f8589244cd1.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of AdjustPrivilegeToken
  PID:5108
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\y59zrhHcIx.bat"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:656
- - C:\Windows\system32\chcp.com
    chcp 65001
    3⤵
    PID:3420
- - C:\Windows\system32\w32tm.exe
    w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
    3⤵
    PID:3068
- - C:\Program Files\Microsoft Office 15\ClientX64\dllhost.exe
    "C:\Program Files\Microsoft Office 15\ClientX64\dllhost.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of AdjustPrivilegeToken
    PID:1932

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 9 /tr "'C:\Users\Public\Desktop\services.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4052

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "services" /sc ONLOGON /tr "'C:\Users\Public\Desktop\services.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2864

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 12 /tr "'C:\Users\Public\Desktop\services.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4768

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 11 /tr "'C:\Program Files\Microsoft Office 15\ClientX64\dllhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3364

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Program Files\Microsoft Office 15\ClientX64\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5012

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 9 /tr "'C:\Program Files\Microsoft Office 15\ClientX64\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2288

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RegistryR" /sc MINUTE /mo 8 /tr "'C:\Windows\L2Schemas\Registry.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3168

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Registry" /sc ONLOGON /tr "'C:\Windows\L2Schemas\Registry.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3120

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RegistryR" /sc MINUTE /mo 8 /tr "'C:\Windows\L2Schemas\Registry.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4012

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 9 /tr "'C:\Users\Default User\services.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4584

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "services" /sc ONLOGON /tr "'C:\Users\Default User\services.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3184

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 13 /tr "'C:\Users\Default User\services.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2632

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 7 /tr "'C:\Users\All Users\csrss.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2736

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Users\All Users\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2592

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 12 /tr "'C:\Users\All Users\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:820

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "00db28e5a7412cf4a6f87f8589244cd10" /sc MINUTE /mo 14 /tr "'C:\Users\Admin\AppData\Local\Temp\00db28e5a7412cf4a6f87f8589244cd1.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3128

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "00db28e5a7412cf4a6f87f8589244cd1" /sc ONLOGON /tr "'C:\Users\Admin\AppData\Local\Temp\00db28e5a7412cf4a6f87f8589244cd1.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4884

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "00db28e5a7412cf4a6f87f8589244cd10" /sc MINUTE /mo 11 /tr "'C:\Users\Admin\AppData\Local\Temp\00db28e5a7412cf4a6f87f8589244cd1.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:940

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
d85ba6ff808d9e5444a4b369f5bc2730

SHA1
31aa9d96590fff6981b315e0b391b575e4c0804a

SHA256
84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

SHA512
8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
77d622bb1a5b250869a3238b9bc1402b

SHA1
d47f4003c2554b9dfc4c16f22460b331886b191b

SHA256
f97ff12a8abf4bf88bb6497bd2ac2da12628c8847a8ba5a9026bdbb76507cdfb

SHA512
d6789b5499f23c9035375a102271e17a8a82e57d6f5312fa24242e08a83efdeb8becb7622f55c4cf1b89c7d864b445df11f4d994cf7e2f87a900535bcca12fd9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
3a6bad9528f8e23fb5c77fbd81fa28e8

SHA1
f127317c3bc6407f536c0f0600dcbcf1aabfba36

SHA256
986366767de5873f1b170a63f2a33ce05132d1afd90c8f5017afbca8ef1beb05

SHA512
846002154a0ece6f3e9feda6f115d3161dc21b3789525dd62ae1d9188495171293efdbe7be4710666dd8a15e66b557315b5a02918a741ed1d5f3ff0c515b98e2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
cadef9abd087803c630df65264a6c81c

SHA1
babbf3636c347c8727c35f3eef2ee643dbcc4bd2

SHA256
cce65b73cdfe9304bcd5207913e8b60fb69faa20cd3b684f2b0343b755b99438

SHA512
7278aa87124abb382d9024a645e881e7b7cf1b84e8894943b36e018dbf0399e6858392f77980b599fa5488e2e21bf757a0702fe6419417edac93b68e0c2ec085

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
bd5940f08d0be56e65e5f2aaf47c538e

SHA1
d7e31b87866e5e383ab5499da64aba50f03e8443

SHA256
2d2f364c75bd2897504249f42cdf1d19374f5230aad68fa9154ea3d03e3031a6

SHA512
c34d10c7e07da44a180fae9889b61f08903aa84e8ddfa80c31c272b1ef9d491b8cec6b8a4c836c3cb1583fe8f4955c6a8db872515de3a9e10eae09610c959406

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
2e907f77659a6601fcc408274894da2e

SHA1
9f5b72abef1cd7145bf37547cdb1b9254b4efe9d

SHA256
385da35673330e21ac02545220552fe301fe54dedefbdafc097ac4342a295233

SHA512
34fa0fff24f6550f55f828541aaefe5d75c86f8f0842d54b50065e9746f9662bb7209c74c9a9571540b9855bb3851f01db613190024e89b198d485bb5dc07721

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
a8e8360d573a4ff072dcc6f09d992c88

SHA1
3446774433ceaf0b400073914facab11b98b6807

SHA256
bf5e284e8f95122bf75ead61c7e2b40f55c96742b05330b5b1cb7915991df13b

SHA512
4ee5167643d82082f57c42616007ef9be57f43f9731921bdf7bca611a914724ad94072d3c8f5b130fa54129e5328ccdebf37ba74339c37deb53e79df5cdf0dbe

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
e448fe0d240184c6597a31d3be2ced58

SHA1
372b8d8c19246d3e38cd3ba123cc0f56070f03cd

SHA256
c660f0db85a1e7f0f68db19868979bf50bd541531babf77a701e1b1ce5e6a391

SHA512
0b7f7eae7700d32b18eee3677cb7f89b46ace717fa7e6b501d6c47d54f15dff7e12b49f5a7d36a6ffe4c16165c7d55162db4f3621db545b6af638035752beab4

Download Submit
C:\Users\Admin\AppData\Local\Temp\RES9105.tmp

Filesize
1KB

MD5
baa35ad79a6147725f2f4e8da360424f

SHA1
6df2f68fd73dc595f185e8e8841940a1ac8bb004

SHA256
c5bc00c225ca0cb9ea8a2c6343d02cbbe4f32afe9ea5525592f84121fd627f1b

SHA512
cfd7a26a9111db240c0c5392d4ce7a7074f4007765255b6369f2bf5affb4309528db9a99aa2628e2ec3879d49880265d3d6f6780e973ee9fbbe09077620711f9

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_cignyj4w.0ho.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\y59zrhHcIx.bat

Filesize
234B

MD5
563d35e71e608abc229058bcb356b966

SHA1
f8c991b6302c7c4b41c1a52198a6d9b2a16406ae

SHA256
ec11ffbd8f40d70e63337bbdf342335818145158a408d7255018369296dee29e

SHA512
d6c44dcac62eca80b86dafd284079a2e0b71cedd79c4b158a794fffb41912d66febb5b8b32521db23da67d60a20de012c6e3b4ca2d00a969c83ddad4d8682b76

Download Submit
C:\Users\Public\Desktop\services.exe

Filesize
1.9MB

MD5
00db28e5a7412cf4a6f87f8589244cd1

SHA1
49a8344dac9b27ebe4962f4fce5c7e2ef9c023f7

SHA256
27c0d07c25ec07af447a4b9b785261e448f73267d9ae9bad231b7273029ee84c

SHA512
3c860c48ae7f37b023299455830310390c14ad69fa1e241e9f94041b9797ca415841c4b541b105b6ac84327015a97b1664aa098d3f2f4d918341e2dca65d60ba

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\ixamppmj\ixamppmj.0.cs

Filesize
368B

MD5
6a98ccaed07acb28d2e259a6cb25b8e7

SHA1
bab7dc3f6edd98ffd2c1712e342c739020c98519

SHA256
04923ab5ac741ad7771ca4631c0b500a1a212d19ee8eaea19b366eabf2a5b3eb

SHA512
841e2912e8e915590398b7bf63a1f0f58eff141a3c24c88c036795997c01c90b921a74b8b5de45e2470070e34bb15beb37384e3ff35cf4ce757a2a5e0b035c43

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\ixamppmj\ixamppmj.cmdline

Filesize
235B

MD5
70f7382fad65c9b15abb04a27691dda7

SHA1
6b5bd26d164ca4dc6403fd82d1a818da04533a1b

SHA256
0bd7e8a7e287621d3b24dd01412ef4e02b2ee715d1e346cc21b9786a566e73c7

SHA512
feb7716de8735ee5ccb0a72a2aeb90ab5d846c922dda721283d99bb99c2f2b4838d2cd79e37a8b9a8b4a28da3b0b8ba36944bd0367be4165ff703a7995d05f14

Download Submit
\??\c:\Windows\System32\CSCC9FB5358F7C04145BAC2C9AB65144D5.TMP

Filesize
1KB

MD5
55e11cb90667f1fab678a4e828c56cef

SHA1
1f604ad1253c81d68cc69ddc038c36170d5c5a6f

SHA256
1ef1fa61853aecf37e821aa7a8ddc1b59f0633e534599c09d94511a9c83f5106

SHA512
571bc673fabcaeed34d40803150692fe9b5bc8208870ee1673dd2a8c5f4675d3a55cbedf5b6cd28e0d937eb8565647b96ff3deecb45c658a05d66c7c2e4591df

Download Submit
memory/1932-257-0x000000001C2F0000-0x000000001C3BD000-memory.dmp

Filesize
820KB

Download
memory/3052-14-0x00000000018B0000-0x00000000018BE000-memory.dmp

Filesize
56KB

Download
memory/3052-17-0x00007FFDB9DB0000-0x00007FFDBA871000-memory.dmp

Filesize
10.8MB

Download
memory/3052-35-0x00007FFDB9DB0000-0x00007FFDBA871000-memory.dmp

Filesize
10.8MB

Download
memory/3052-36-0x00007FFDB9DB0000-0x00007FFDBA871000-memory.dmp

Filesize
10.8MB

Download
memory/3052-37-0x00007FFDB9DB0000-0x00007FFDBA871000-memory.dmp

Filesize
10.8MB

Download
memory/3052-22-0x00007FFDB9DB0000-0x00007FFDBA871000-memory.dmp

Filesize
10.8MB

Download
memory/3052-16-0x0000000003170000-0x000000000317C000-memory.dmp

Filesize
48KB

Download
memory/3052-19-0x0000000003180000-0x000000000318E000-memory.dmp

Filesize
56KB

Download
memory/3052-21-0x0000000003190000-0x000000000319C000-memory.dmp

Filesize
48KB

Download
memory/3052-55-0x000000001C180000-0x000000001C24D000-memory.dmp

Filesize
820KB

Download
memory/3052-56-0x00007FFDB9DB0000-0x00007FFDBA871000-memory.dmp

Filesize
10.8MB

Download
memory/3052-26-0x00007FFDB9DB0000-0x00007FFDBA871000-memory.dmp

Filesize
10.8MB

Download
memory/3052-1-0x0000000000D60000-0x0000000000F5A000-memory.dmp

Filesize
2.0MB

Download
memory/3052-12-0x000000001BBD0000-0x000000001BBE8000-memory.dmp

Filesize
96KB

Download
memory/3052-0-0x00007FFDB9DB3000-0x00007FFDB9DB5000-memory.dmp

Filesize
8KB

Download
memory/3052-10-0x000000001BC20000-0x000000001BC70000-memory.dmp

Filesize
320KB

Download
memory/3052-9-0x00000000032C0000-0x00000000032DC000-memory.dmp

Filesize
112KB

Download
memory/3052-7-0x00007FFDB9DB0000-0x00007FFDBA871000-memory.dmp

Filesize
10.8MB

Download
memory/3052-6-0x0000000001860000-0x000000000186E000-memory.dmp

Filesize
56KB

Download
memory/3052-4-0x00007FFDB9DB0000-0x00007FFDBA871000-memory.dmp

Filesize
10.8MB

Download
memory/3052-3-0x00007FFDB9DB0000-0x00007FFDBA871000-memory.dmp

Filesize
10.8MB

Download
memory/3052-2-0x00007FFDB9DB0000-0x00007FFDBA871000-memory.dmp

Filesize
10.8MB

Download
memory/4336-66-0x0000028D79350000-0x0000028D79372000-memory.dmp

Filesize
136KB

Download