Overview

overview

10

Static

static

3

b8a5a65f1c...eN.exe

windows7-x64

10

b8a5a65f1c...eN.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    119s
  • max time network
    122s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    22-09-2024 12:46

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    b8a5a65f1c36e6e16080dfa07bbcb2296023b1092006dcdf5ea49c9b46be166eN.exe

  • Size

    4.9MB

  • MD5

    c31fedba9ce9222a356e7715a3c34920

  • SHA1

    0461a57e40a68464e8bd0c1a8450013da3b343d7

  • SHA256

    b8a5a65f1c36e6e16080dfa07bbcb2296023b1092006dcdf5ea49c9b46be166e

  • SHA512

    86a6e7190b99a8f204871f28b6614e7c44d9fb6bbf9118afdcc1d81094aa2de72b5ca0e415bf408b84fcfc3fd715482139f69f11e64189f60c1bc647bffc0632

  • SSDEEP

    49152:jl5MTGChZpxtlBBgxchXb/zqP6DUtRgs5q289dAnSz44hnW1XgnYu6fYmPkMSx8E:

Score
10/10
colibridcratbuild1discoveryevasionexecutioninfostealerloaderrattrojan

Malware Config

Extracted

Family

colibri

Version

1.2.0

Botnet

Build1

C2

http://zpltcmgodhvvedxtfcygvbgjkvgvcguygytfigj.cc/gate.php

http://yugyuvyugguitgyuigtfyutdtoghghbbgyv.cx/gate.php
rc4.plain

Signatures

  • Colibri Loader

    A loader sold as MaaS first seen in August 2021.

    loadercolibri
  • DcRat

    DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

    ratinfostealerdcrat
  • Process spawned unexpected child process 24 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • UAC bypass 3 TTPs 33 IoCs
    evasiontrojan
  • DCRat payload 1 IoCs

    Detects payload of DCRat, commonly dropped by NSIS installers.

    rat
  • Command and Scripting Interpreter: PowerShell 1 TTPs 11 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution
  • Checks computer location settings 2 TTPs 11 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 34 IoCs
  • Checks whether UAC is enabled 1 TTPs 22 IoCs
    evasiontrojan
  • Suspicious use of SetThreadContext 11 IoCs
  • Drops file in Program Files directory 16 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 13 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies registry class 11 IoCs
  • Scheduled Task/Job: Scheduled Task 1 TTPs 24 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistenceexecution
  • Suspicious behavior: EnumeratesProcesses 51 IoCs
  • Suspicious use of AdjustPrivilegeToken 22 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • System policy modification 1 TTPs 33 IoCs
    evasion
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\b8a5a65f1c36e6e16080dfa07bbcb2296023b1092006dcdf5ea49c9b46be166eN.exe
    "C:\Users\Admin\AppData\Local\Temp\b8a5a65f1c36e6e16080dfa07bbcb2296023b1092006dcdf5ea49c9b46be166eN.exe"
    1⤵
    • UAC bypass
    • Checks computer location settings
    • Checks whether UAC is enabled
    • Drops file in Program Files directory
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    • System policy modification
    PID:3840
    • C:\Users\Admin\AppData\Local\Temp\tmpD323.tmp.exe
      "C:\Users\Admin\AppData\Local\Temp\tmpD323.tmp.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious use of SetThreadContext
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:1340
      • C:\Users\Admin\AppData\Local\Temp\tmpD323.tmp.exe
        "C:\Users\Admin\AppData\Local\Temp\tmpD323.tmp.exe"
        3⤵
        • Executes dropped EXE
        PID:2032
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:/'
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:4784
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:/$Recycle.Bin/'
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:3924
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Documents and Settings/'
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:3884
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:/PerfLogs/'
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2644
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files/'
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:628
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files (x86)/'
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:3284
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:/ProgramData/'
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2668
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Recovery/'
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:1220
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:/System Volume Information/'
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2628
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Users/'
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:4896
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Windows/'
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:4176
    • C:\Recovery\WindowsRE\lsass.exe
      "C:\Recovery\WindowsRE\lsass.exe"
      2⤵
      • UAC bypass
      • Checks computer location settings
      • Executes dropped EXE
      • Checks whether UAC is enabled
      • Modifies registry class
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      • System policy modification
      PID:1588
      • C:\Windows\System32\WScript.exe
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\f7a4c93c-747c-4f90-b4f5-5c7bd717bf65.vbs"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:3380
        • C:\Recovery\WindowsRE\lsass.exe
          C:\Recovery\WindowsRE\lsass.exe
          4⤵
          • UAC bypass
          • Checks computer location settings
          • Executes dropped EXE
          • Checks whether UAC is enabled
          • Modifies registry class
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          • System policy modification
          PID:3504
          • C:\Windows\System32\WScript.exe
            "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\9252cbac-2212-49c9-80dc-192084cc267c.vbs"
            5⤵
              PID:4320
              • C:\Recovery\WindowsRE\lsass.exe
                C:\Recovery\WindowsRE\lsass.exe
                6⤵
                • UAC bypass
                • Checks computer location settings
                • Executes dropped EXE
                • Checks whether UAC is enabled
                • Modifies registry class
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of AdjustPrivilegeToken
                • System policy modification
                PID:4684
                • C:\Windows\System32\WScript.exe
                  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\fecad07b-38a8-42c0-8849-6f4582ce073e.vbs"
                  7⤵
                    PID:884
                    • C:\Recovery\WindowsRE\lsass.exe
                      C:\Recovery\WindowsRE\lsass.exe
                      8⤵
                      • UAC bypass
                      • Checks computer location settings
                      • Executes dropped EXE
                      • Checks whether UAC is enabled
                      • Modifies registry class
                      • Suspicious behavior: EnumeratesProcesses
                      • Suspicious use of AdjustPrivilegeToken
                      • System policy modification
                      PID:3240
                      • C:\Windows\System32\WScript.exe
                        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\aeace238-c64e-4b8e-a9b8-49da7cb0cc3d.vbs"
                        9⤵
                          PID:2056
                          • C:\Recovery\WindowsRE\lsass.exe
                            C:\Recovery\WindowsRE\lsass.exe
                            10⤵
                            • UAC bypass
                            • Checks computer location settings
                            • Executes dropped EXE
                            • Checks whether UAC is enabled
                            • Modifies registry class
                            • Suspicious behavior: EnumeratesProcesses
                            • Suspicious use of AdjustPrivilegeToken
                            • System policy modification
                            PID:1288
                            • C:\Windows\System32\WScript.exe
                              "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\efc5a4dc-483f-4081-9f5b-0b1adbc6a434.vbs"
                              11⤵
                                PID:3628
                                • C:\Recovery\WindowsRE\lsass.exe
                                  C:\Recovery\WindowsRE\lsass.exe
                                  12⤵
                                  • UAC bypass
                                  • Checks computer location settings
                                  • Executes dropped EXE
                                  • Checks whether UAC is enabled
                                  • Modifies registry class
                                  • Suspicious behavior: EnumeratesProcesses
                                  • Suspicious use of AdjustPrivilegeToken
                                  • System policy modification
                                  PID:636
                                  • C:\Windows\System32\WScript.exe
                                    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\d0db82cd-a824-489e-afe4-2109503284e5.vbs"
                                    13⤵
                                      PID:4268
                                      • C:\Recovery\WindowsRE\lsass.exe
                                        C:\Recovery\WindowsRE\lsass.exe
                                        14⤵
                                        • UAC bypass
                                        • Checks computer location settings
                                        • Executes dropped EXE
                                        • Checks whether UAC is enabled
                                        • Modifies registry class
                                        • Suspicious behavior: EnumeratesProcesses
                                        • Suspicious use of AdjustPrivilegeToken
                                        • System policy modification
                                        PID:4744
                                        • C:\Windows\System32\WScript.exe
                                          "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\aed15a0d-69e6-4e2c-905e-e89610dff3eb.vbs"
                                          15⤵
                                            PID:4516
                                            • C:\Recovery\WindowsRE\lsass.exe
                                              C:\Recovery\WindowsRE\lsass.exe
                                              16⤵
                                              • UAC bypass
                                              • Checks computer location settings
                                              • Executes dropped EXE
                                              • Checks whether UAC is enabled
                                              • Modifies registry class
                                              • Suspicious behavior: EnumeratesProcesses
                                              • Suspicious use of AdjustPrivilegeToken
                                              • System policy modification
                                              PID:4636
                                              • C:\Windows\System32\WScript.exe
                                                "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\8ac2ae4d-c780-4cfe-9612-0573b912e218.vbs"
                                                17⤵
                                                  PID:3320
                                                  • C:\Recovery\WindowsRE\lsass.exe
                                                    C:\Recovery\WindowsRE\lsass.exe
                                                    18⤵
                                                    • UAC bypass
                                                    • Checks computer location settings
                                                    • Executes dropped EXE
                                                    • Checks whether UAC is enabled
                                                    • Modifies registry class
                                                    • Suspicious behavior: EnumeratesProcesses
                                                    • Suspicious use of AdjustPrivilegeToken
                                                    • System policy modification
                                                    PID:1904
                                                    • C:\Windows\System32\WScript.exe
                                                      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\7c5a6355-11c9-4e57-af1d-de42ac94accc.vbs"
                                                      19⤵
                                                        PID:4564
                                                        • C:\Recovery\WindowsRE\lsass.exe
                                                          C:\Recovery\WindowsRE\lsass.exe
                                                          20⤵
                                                          • UAC bypass
                                                          • Checks computer location settings
                                                          • Executes dropped EXE
                                                          • Checks whether UAC is enabled
                                                          • Modifies registry class
                                                          • Suspicious behavior: EnumeratesProcesses
                                                          • Suspicious use of AdjustPrivilegeToken
                                                          • System policy modification
                                                          PID:4468
                                                          • C:\Windows\System32\WScript.exe
                                                            "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\f8eb2a6a-6a36-4186-bae0-f09dcd28b3a2.vbs"
                                                            21⤵
                                                              PID:3848
                                                            • C:\Windows\System32\WScript.exe
                                                              "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\84e41098-0428-4b77-b2f1-6c93e2f9d140.vbs"
                                                              21⤵
                                                                PID:4632
                                                              • C:\Users\Admin\AppData\Local\Temp\tmp87A5.tmp.exe
                                                                "C:\Users\Admin\AppData\Local\Temp\tmp87A5.tmp.exe"
                                                                21⤵
                                                                • Executes dropped EXE
                                                                • Suspicious use of SetThreadContext
                                                                • System Location Discovery: System Language Discovery
                                                                PID:4428
                                                                • C:\Users\Admin\AppData\Local\Temp\tmp87A5.tmp.exe
                                                                  "C:\Users\Admin\AppData\Local\Temp\tmp87A5.tmp.exe"
                                                                  22⤵
                                                                  • Executes dropped EXE
                                                                  PID:4932
                                                          • C:\Windows\System32\WScript.exe
                                                            "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\6e4b4eab-f7dc-433e-8767-70385fd5bf6b.vbs"
                                                            19⤵
                                                              PID:2128
                                                            • C:\Users\Admin\AppData\Local\Temp\tmp5615.tmp.exe
                                                              "C:\Users\Admin\AppData\Local\Temp\tmp5615.tmp.exe"
                                                              19⤵
                                                              • Executes dropped EXE
                                                              • Suspicious use of SetThreadContext
                                                              • System Location Discovery: System Language Discovery
                                                              PID:2372
                                                              • C:\Users\Admin\AppData\Local\Temp\tmp5615.tmp.exe
                                                                "C:\Users\Admin\AppData\Local\Temp\tmp5615.tmp.exe"
                                                                20⤵
                                                                • Executes dropped EXE
                                                                PID:1040
                                                        • C:\Windows\System32\WScript.exe
                                                          "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\e6401746-0413-4e21-8c99-0b73a4de8386.vbs"
                                                          17⤵
                                                            PID:4768
                                                          • C:\Users\Admin\AppData\Local\Temp\tmp2409.tmp.exe
                                                            "C:\Users\Admin\AppData\Local\Temp\tmp2409.tmp.exe"
                                                            17⤵
                                                            • Executes dropped EXE
                                                            • Suspicious use of SetThreadContext
                                                            • System Location Discovery: System Language Discovery
                                                            PID:4644
                                                            • C:\Users\Admin\AppData\Local\Temp\tmp2409.tmp.exe
                                                              "C:\Users\Admin\AppData\Local\Temp\tmp2409.tmp.exe"
                                                              18⤵
                                                              • Executes dropped EXE
                                                              PID:2196
                                                      • C:\Windows\System32\WScript.exe
                                                        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\0cefdd1e-0b54-42e3-83e0-5b45e64d4234.vbs"
                                                        15⤵
                                                          PID:3816
                                                        • C:\Users\Admin\AppData\Local\Temp\tmpF373.tmp.exe
                                                          "C:\Users\Admin\AppData\Local\Temp\tmpF373.tmp.exe"
                                                          15⤵
                                                          • Executes dropped EXE
                                                          • System Location Discovery: System Language Discovery
                                                          PID:3052
                                                          • C:\Users\Admin\AppData\Local\Temp\tmpF373.tmp.exe
                                                            "C:\Users\Admin\AppData\Local\Temp\tmpF373.tmp.exe"
                                                            16⤵
                                                            • Executes dropped EXE
                                                            • Suspicious use of SetThreadContext
                                                            • System Location Discovery: System Language Discovery
                                                            PID:8
                                                            • C:\Users\Admin\AppData\Local\Temp\tmpF373.tmp.exe
                                                              "C:\Users\Admin\AppData\Local\Temp\tmpF373.tmp.exe"
                                                              17⤵
                                                              • Executes dropped EXE
                                                              PID:3656
                                                    • C:\Windows\System32\WScript.exe
                                                      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\93e8484e-fd03-45ad-95c0-815556c63eb3.vbs"
                                                      13⤵
                                                        PID:3972
                                                      • C:\Users\Admin\AppData\Local\Temp\tmpD472.tmp.exe
                                                        "C:\Users\Admin\AppData\Local\Temp\tmpD472.tmp.exe"
                                                        13⤵
                                                        • Executes dropped EXE
                                                        • Suspicious use of SetThreadContext
                                                        • System Location Discovery: System Language Discovery
                                                        PID:3800
                                                        • C:\Users\Admin\AppData\Local\Temp\tmpD472.tmp.exe
                                                          "C:\Users\Admin\AppData\Local\Temp\tmpD472.tmp.exe"
                                                          14⤵
                                                          • Executes dropped EXE
                                                          PID:3984
                                                  • C:\Windows\System32\WScript.exe
                                                    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\8b9b4c95-676a-4490-804d-996bfb43a028.vbs"
                                                    11⤵
                                                      PID:1776
                                                    • C:\Users\Admin\AppData\Local\Temp\tmpA246.tmp.exe
                                                      "C:\Users\Admin\AppData\Local\Temp\tmpA246.tmp.exe"
                                                      11⤵
                                                      • Executes dropped EXE
                                                      • System Location Discovery: System Language Discovery
                                                      PID:3652
                                                      • C:\Users\Admin\AppData\Local\Temp\tmpA246.tmp.exe
                                                        "C:\Users\Admin\AppData\Local\Temp\tmpA246.tmp.exe"
                                                        12⤵
                                                        • Executes dropped EXE
                                                        • Suspicious use of SetThreadContext
                                                        • System Location Discovery: System Language Discovery
                                                        PID:4840
                                                        • C:\Users\Admin\AppData\Local\Temp\tmpA246.tmp.exe
                                                          "C:\Users\Admin\AppData\Local\Temp\tmpA246.tmp.exe"
                                                          13⤵
                                                          • Executes dropped EXE
                                                          PID:2836
                                                • C:\Windows\System32\WScript.exe
                                                  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\babb3cf4-f9a8-4226-ae78-6f2b1f2ec78a.vbs"
                                                  9⤵
                                                    PID:2336
                                                  • C:\Users\Admin\AppData\Local\Temp\tmp8613.tmp.exe
                                                    "C:\Users\Admin\AppData\Local\Temp\tmp8613.tmp.exe"
                                                    9⤵
                                                    • Executes dropped EXE
                                                    • Suspicious use of SetThreadContext
                                                    • System Location Discovery: System Language Discovery
                                                    PID:4540
                                                    • C:\Users\Admin\AppData\Local\Temp\tmp8613.tmp.exe
                                                      "C:\Users\Admin\AppData\Local\Temp\tmp8613.tmp.exe"
                                                      10⤵
                                                      • Executes dropped EXE
                                                      PID:4340
                                              • C:\Windows\System32\WScript.exe
                                                "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\fd481f6e-693e-47b8-b0b7-44a4c42e4c97.vbs"
                                                7⤵
                                                  PID:1596
                                                • C:\Users\Admin\AppData\Local\Temp\tmp537A.tmp.exe
                                                  "C:\Users\Admin\AppData\Local\Temp\tmp537A.tmp.exe"
                                                  7⤵
                                                  • Executes dropped EXE
                                                  • Suspicious use of SetThreadContext
                                                  • System Location Discovery: System Language Discovery
                                                  PID:2880
                                                  • C:\Users\Admin\AppData\Local\Temp\tmp537A.tmp.exe
                                                    "C:\Users\Admin\AppData\Local\Temp\tmp537A.tmp.exe"
                                                    8⤵
                                                    • Executes dropped EXE
                                                    PID:4712
                                            • C:\Windows\System32\WScript.exe
                                              "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\c6ef60ae-261b-49ce-8f80-7f38dcfd1002.vbs"
                                              5⤵
                                                PID:2632
                                              • C:\Users\Admin\AppData\Local\Temp\tmp241D.tmp.exe
                                                "C:\Users\Admin\AppData\Local\Temp\tmp241D.tmp.exe"
                                                5⤵
                                                • Executes dropped EXE
                                                • Suspicious use of SetThreadContext
                                                • System Location Discovery: System Language Discovery
                                                • Suspicious use of WriteProcessMemory
                                                PID:2680
                                                • C:\Users\Admin\AppData\Local\Temp\tmp241D.tmp.exe
                                                  "C:\Users\Admin\AppData\Local\Temp\tmp241D.tmp.exe"
                                                  6⤵
                                                  • Executes dropped EXE
                                                  PID:5048
                                          • C:\Windows\System32\WScript.exe
                                            "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\086d9cee-336c-4b9f-9fde-acddfc0f99cb.vbs"
                                            3⤵
                                              PID:3648
                                            • C:\Users\Admin\AppData\Local\Temp\tmpF01D.tmp.exe
                                              "C:\Users\Admin\AppData\Local\Temp\tmpF01D.tmp.exe"
                                              3⤵
                                              • Executes dropped EXE
                                              • Suspicious use of SetThreadContext
                                              • System Location Discovery: System Language Discovery
                                              • Suspicious use of WriteProcessMemory
                                              PID:4520
                                              • C:\Users\Admin\AppData\Local\Temp\tmpF01D.tmp.exe
                                                "C:\Users\Admin\AppData\Local\Temp\tmpF01D.tmp.exe"
                                                4⤵
                                                • Executes dropped EXE
                                                PID:4972
                                        • C:\Windows\system32\schtasks.exe
                                          schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 9 /tr "'C:\Users\Public\Documents\My Pictures\dllhost.exe'" /f
                                          1⤵
                                          • Process spawned unexpected child process
                                          • Scheduled Task/Job: Scheduled Task
                                          PID:3352
                                        • C:\Windows\system32\schtasks.exe
                                          schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Users\Public\Documents\My Pictures\dllhost.exe'" /rl HIGHEST /f
                                          1⤵
                                          • Process spawned unexpected child process
                                          • Scheduled Task/Job: Scheduled Task
                                          PID:3972
                                        • C:\Windows\system32\schtasks.exe
                                          schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 7 /tr "'C:\Users\Public\Documents\My Pictures\dllhost.exe'" /rl HIGHEST /f
                                          1⤵
                                          • Process spawned unexpected child process
                                          • Scheduled Task/Job: Scheduled Task
                                          PID:3964
                                        • C:\Windows\system32\schtasks.exe
                                          schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 7 /tr "'C:\Program Files\VideoLAN\VLC\lua\csrss.exe'" /f
                                          1⤵
                                          • Process spawned unexpected child process
                                          • Scheduled Task/Job: Scheduled Task
                                          PID:1620
                                        • C:\Windows\system32\schtasks.exe
                                          schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Program Files\VideoLAN\VLC\lua\csrss.exe'" /rl HIGHEST /f
                                          1⤵
                                          • Process spawned unexpected child process
                                          • Scheduled Task/Job: Scheduled Task
                                          PID:4816
                                        • C:\Windows\system32\schtasks.exe
                                          schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 13 /tr "'C:\Program Files\VideoLAN\VLC\lua\csrss.exe'" /rl HIGHEST /f
                                          1⤵
                                          • Process spawned unexpected child process
                                          • Scheduled Task/Job: Scheduled Task
                                          PID:1380
                                        • C:\Windows\system32\schtasks.exe
                                          schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 8 /tr "'C:\Recovery\WindowsRE\lsass.exe'" /f
                                          1⤵
                                          • Process spawned unexpected child process
                                          • Scheduled Task/Job: Scheduled Task
                                          PID:1100
                                        • C:\Windows\system32\schtasks.exe
                                          schtasks.exe /create /tn "lsass" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\lsass.exe'" /rl HIGHEST /f
                                          1⤵
                                          • Process spawned unexpected child process
                                          • Scheduled Task/Job: Scheduled Task
                                          PID:1728
                                        • C:\Windows\system32\schtasks.exe
                                          schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 10 /tr "'C:\Recovery\WindowsRE\lsass.exe'" /rl HIGHEST /f
                                          1⤵
                                          • Process spawned unexpected child process
                                          • Scheduled Task/Job: Scheduled Task
                                          PID:4024
                                        • C:\Windows\system32\schtasks.exe
                                          schtasks.exe /create /tn "b8a5a65f1c36e6e16080dfa07bbcb2296023b1092006dcdf5ea49c9b46be166eNb" /sc MINUTE /mo 10 /tr "'C:\Program Files\7-Zip\b8a5a65f1c36e6e16080dfa07bbcb2296023b1092006dcdf5ea49c9b46be166eN.exe'" /f
                                          1⤵
                                          • Process spawned unexpected child process
                                          • Scheduled Task/Job: Scheduled Task
                                          PID:32
                                        • C:\Windows\system32\schtasks.exe
                                          schtasks.exe /create /tn "b8a5a65f1c36e6e16080dfa07bbcb2296023b1092006dcdf5ea49c9b46be166eN" /sc ONLOGON /tr "'C:\Program Files\7-Zip\b8a5a65f1c36e6e16080dfa07bbcb2296023b1092006dcdf5ea49c9b46be166eN.exe'" /rl HIGHEST /f
                                          1⤵
                                          • Process spawned unexpected child process
                                          • Scheduled Task/Job: Scheduled Task
                                          PID:3628
                                        • C:\Windows\system32\schtasks.exe
                                          schtasks.exe /create /tn "b8a5a65f1c36e6e16080dfa07bbcb2296023b1092006dcdf5ea49c9b46be166eNb" /sc MINUTE /mo 6 /tr "'C:\Program Files\7-Zip\b8a5a65f1c36e6e16080dfa07bbcb2296023b1092006dcdf5ea49c9b46be166eN.exe'" /rl HIGHEST /f
                                          1⤵
                                          • Process spawned unexpected child process
                                          • Scheduled Task/Job: Scheduled Task
                                          PID:2200
                                        • C:\Windows\system32\schtasks.exe
                                          schtasks.exe /create /tn "servicess" /sc MINUTE /mo 12 /tr "'C:\Program Files\Java\jre-1.8\services.exe'" /f
                                          1⤵
                                          • Process spawned unexpected child process
                                          • Scheduled Task/Job: Scheduled Task
                                          PID:876
                                        • C:\Windows\system32\schtasks.exe
                                          schtasks.exe /create /tn "services" /sc ONLOGON /tr "'C:\Program Files\Java\jre-1.8\services.exe'" /rl HIGHEST /f
                                          1⤵
                                          • Process spawned unexpected child process
                                          • Scheduled Task/Job: Scheduled Task
                                          PID:4852
                                        • C:\Windows\system32\schtasks.exe
                                          schtasks.exe /create /tn "servicess" /sc MINUTE /mo 14 /tr "'C:\Program Files\Java\jre-1.8\services.exe'" /rl HIGHEST /f
                                          1⤵
                                          • Process spawned unexpected child process
                                          • Scheduled Task/Job: Scheduled Task
                                          PID:4260
                                        • C:\Windows\system32\schtasks.exe
                                          schtasks.exe /create /tn "unsecappu" /sc MINUTE /mo 11 /tr "'C:\Recovery\WindowsRE\unsecapp.exe'" /f
                                          1⤵
                                          • Process spawned unexpected child process
                                          • Scheduled Task/Job: Scheduled Task
                                          PID:3504
                                        • C:\Windows\system32\schtasks.exe
                                          schtasks.exe /create /tn "unsecapp" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\unsecapp.exe'" /rl HIGHEST /f
                                          1⤵
                                          • Process spawned unexpected child process
                                          • Scheduled Task/Job: Scheduled Task
                                          PID:1424
                                        • C:\Windows\system32\schtasks.exe
                                          schtasks.exe /create /tn "unsecappu" /sc MINUTE /mo 11 /tr "'C:\Recovery\WindowsRE\unsecapp.exe'" /rl HIGHEST /f
                                          1⤵
                                          • Process spawned unexpected child process
                                          • Scheduled Task/Job: Scheduled Task
                                          PID:1792
                                        • C:\Windows\system32\schtasks.exe
                                          schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 12 /tr "'C:\Program Files\Google\Chrome\Application\123.0.6312.123\csrss.exe'" /f
                                          1⤵
                                          • Process spawned unexpected child process
                                          • Scheduled Task/Job: Scheduled Task
                                          PID:2192
                                        • C:\Windows\system32\schtasks.exe
                                          schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Program Files\Google\Chrome\Application\123.0.6312.123\csrss.exe'" /rl HIGHEST /f
                                          1⤵
                                          • Process spawned unexpected child process
                                          • Scheduled Task/Job: Scheduled Task
                                          PID:2280
                                        • C:\Windows\system32\schtasks.exe
                                          schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 13 /tr "'C:\Program Files\Google\Chrome\Application\123.0.6312.123\csrss.exe'" /rl HIGHEST /f
                                          1⤵
                                          • Process spawned unexpected child process
                                          • Scheduled Task/Job: Scheduled Task
                                          PID:5008
                                        • C:\Windows\system32\schtasks.exe
                                          schtasks.exe /create /tn "servicess" /sc MINUTE /mo 5 /tr "'C:\Program Files\Google\Chrome\Application\SetupMetrics\services.exe'" /f
                                          1⤵
                                          • Process spawned unexpected child process
                                          • Scheduled Task/Job: Scheduled Task
                                          PID:4984
                                        • C:\Windows\system32\schtasks.exe
                                          schtasks.exe /create /tn "services" /sc ONLOGON /tr "'C:\Program Files\Google\Chrome\Application\SetupMetrics\services.exe'" /rl HIGHEST /f
                                          1⤵
                                          • Process spawned unexpected child process
                                          • Scheduled Task/Job: Scheduled Task
                                          PID:3104
                                        • C:\Windows\system32\schtasks.exe
                                          schtasks.exe /create /tn "servicess" /sc MINUTE /mo 11 /tr "'C:\Program Files\Google\Chrome\Application\SetupMetrics\services.exe'" /rl HIGHEST /f
                                          1⤵
                                          • Process spawned unexpected child process
                                          • Scheduled Task/Job: Scheduled Task
                                          PID:2492

                                        Network

                                        MITRE ATT&CK Enterprise v15

                                        Replay Monitor

                                        Loading Replay Monitor...

                                        Downloads

                                        • C:\Program Files\Java\jre-1.8\services.exe
                                          Filesize

                                          4.9MB

                                          MD5

                                          c31fedba9ce9222a356e7715a3c34920

                                          SHA1

                                          0461a57e40a68464e8bd0c1a8450013da3b343d7

                                          SHA256

                                          b8a5a65f1c36e6e16080dfa07bbcb2296023b1092006dcdf5ea49c9b46be166e

                                          SHA512

                                          86a6e7190b99a8f204871f28b6614e7c44d9fb6bbf9118afdcc1d81094aa2de72b5ca0e415bf408b84fcfc3fd715482139f69f11e64189f60c1bc647bffc0632

                                          Download Submit

                                        • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\lsass.exe.log
                                          Filesize

                                          1KB

                                          MD5

                                          4a667f150a4d1d02f53a9f24d89d53d1

                                          SHA1

                                          306e125c9edce66f28fdb63e6c4ca5c9ad6e8c97

                                          SHA256

                                          414659decfd237dde09625a49811e03b5b30ee06ee2ee97ea8bcfac394d281fd

                                          SHA512

                                          4edd8e73ce03488a6d92750a782cd4042fbb54a5b3f8d8ba3ea227fda0653c2cd84f0c5d64976c7cdc1f518a2fdc8ff10e2a015ec7acf3cd01b0d62bc98542d8

                                          Download Submit

                                        • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
                                          Filesize

                                          2KB

                                          MD5

                                          d85ba6ff808d9e5444a4b369f5bc2730

                                          SHA1

                                          31aa9d96590fff6981b315e0b391b575e4c0804a

                                          SHA256

                                          84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

                                          SHA512

                                          8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

                                          Download Submit

                                        • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                          Filesize

                                          944B

                                          MD5

                                          cadef9abd087803c630df65264a6c81c

                                          SHA1

                                          babbf3636c347c8727c35f3eef2ee643dbcc4bd2

                                          SHA256

                                          cce65b73cdfe9304bcd5207913e8b60fb69faa20cd3b684f2b0343b755b99438

                                          SHA512

                                          7278aa87124abb382d9024a645e881e7b7cf1b84e8894943b36e018dbf0399e6858392f77980b599fa5488e2e21bf757a0702fe6419417edac93b68e0c2ec085

                                          Download Submit

                                        • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                          Filesize

                                          944B

                                          MD5

                                          e448fe0d240184c6597a31d3be2ced58

                                          SHA1

                                          372b8d8c19246d3e38cd3ba123cc0f56070f03cd

                                          SHA256

                                          c660f0db85a1e7f0f68db19868979bf50bd541531babf77a701e1b1ce5e6a391

                                          SHA512

                                          0b7f7eae7700d32b18eee3677cb7f89b46ace717fa7e6b501d6c47d54f15dff7e12b49f5a7d36a6ffe4c16165c7d55162db4f3621db545b6af638035752beab4

                                          Download Submit

                                        • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                          Filesize

                                          944B

                                          MD5

                                          e243a38635ff9a06c87c2a61a2200656

                                          SHA1

                                          ecd95ed5bf1a9fbe96a8448fc2814a0210fa2afc

                                          SHA256

                                          af5782703f3f2d5a29fb313dae6680a64134db26064d4a321a3f23b75f6ca00f

                                          SHA512

                                          4418957a1b10eee44cf270c81816ae707352411c4f5ac14b6b61ab537c91480e24e0a0a2c276a6291081b4984c123cf673a45dcedb0ceeef682054ba0fc19cb4

                                          Download Submit

                                        • C:\Users\Admin\AppData\Local\Temp\086d9cee-336c-4b9f-9fde-acddfc0f99cb.vbs
                                          Filesize

                                          483B

                                          MD5

                                          8b8101989bf33318a440ac63a2c3e7ce

                                          SHA1

                                          31eed4053c36a4d9d56ef57763ffec0ffa9912d9

                                          SHA256

                                          9ab825f1e519d852649f398e8ebdeade412fe97c30966c1c9ecc34be388214a5

                                          SHA512

                                          0ef3e6748501ca7094c62c3d7241eedcebebb29f0bba8d38924300738dc91ea7bdba5f01d5e9c7111c323d0d0714ed224468bf50ec57584ca9a350544a05c533

                                          Download Submit

                                        • C:\Users\Admin\AppData\Local\Temp\9252cbac-2212-49c9-80dc-192084cc267c.vbs
                                          Filesize

                                          707B

                                          MD5

                                          017c35deb7e7cd136cab9174861650b0

                                          SHA1

                                          efacc94246fdf9007e66ef5cdba9052fb3c81153

                                          SHA256

                                          d2d9b3e6219ab0dacc270087cd867a319739816bef2ed5cce926e087fd560a8d

                                          SHA512

                                          f5484f5aed64c9148af626509d8068512cb26c4fe4ef43722ab094ae97ed30a78db2bf7931bb84a6205e1182d20411414f464de610e0ce41462f1d96188f04e4

                                          Download Submit

                                        • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_z10w1ac5.ezs.ps1
                                          Filesize

                                          60B

                                          MD5

                                          d17fe0a3f47be24a6453e9ef58c94641

                                          SHA1

                                          6ab83620379fc69f80c0242105ddffd7d98d5d9d

                                          SHA256

                                          96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

                                          SHA512

                                          5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

                                          Download Submit

                                        • C:\Users\Admin\AppData\Local\Temp\aeace238-c64e-4b8e-a9b8-49da7cb0cc3d.vbs
                                          Filesize

                                          707B

                                          MD5

                                          fab82fd85a3aac5aa3af166455908d3c

                                          SHA1

                                          79f710c188057413d3acdfd120a7b93f02bd9e14

                                          SHA256

                                          b7b7a402eeeedf42bc4794d78dd04ac01202619e5e9d56dff48c68ade0de70f0

                                          SHA512

                                          883ca3cbebc165925848608217f58926cfa80a4b9be477779cbfeb4878ec2e9434e01ee85036cd24c7f62a906a212dc72bd5a30329eb79fbbde4caccbc67599c

                                          Download Submit

                                        • C:\Users\Admin\AppData\Local\Temp\aed15a0d-69e6-4e2c-905e-e89610dff3eb.vbs
                                          Filesize

                                          707B

                                          MD5

                                          2a704f275d61372af92f00c49bca173f

                                          SHA1

                                          81c05e0e20132161cf62d400dd2504489b4ffe21

                                          SHA256

                                          4c0c04f4b40bf2ada22454e9d26b3967d09a3ef8ef384f802c43661bb99ee7ec

                                          SHA512

                                          35801f7d6b268cc76332fb7b91979b2f48ed725c66a924c88b17acaa919d2cceaf99927d9f62cff43a8757544366cf72b9afce67c52cc764890d4aee1c055965

                                          Download Submit

                                        • C:\Users\Admin\AppData\Local\Temp\d0db82cd-a824-489e-afe4-2109503284e5.vbs
                                          Filesize

                                          706B

                                          MD5

                                          c79a6d6e4c808b6c8de1c3319be9ff78

                                          SHA1

                                          b5c764b8aaee9a67311d0da8d0f793a28800223c

                                          SHA256

                                          938d6dbf59c98471bf5a2cf9f9f543f88f7b19b0aff5a0590c31bf0129697205

                                          SHA512

                                          84468b494ad9c37f6c5f9e81e50892c8313724dd3bb244c6da60dd1c8021a56e7ddb108388666c1671a60b64bafe3fe59cf491ede192814318d14b761baa4895

                                          Download Submit

                                        • C:\Users\Admin\AppData\Local\Temp\efc5a4dc-483f-4081-9f5b-0b1adbc6a434.vbs
                                          Filesize

                                          707B

                                          MD5

                                          9acd40c08755bf26d5ce159ed90ea077

                                          SHA1

                                          cb0da64a3710d359ed6303d17463c330f8998b41

                                          SHA256

                                          d4c0eb32d0a796d748445c5594857f53c46aae438242c7bfe9bc3608bd131e5b

                                          SHA512

                                          2838d208e9e21cc02e9c1de348118db1f850a9b075bb708d99aa2b4ce68c89f72c7334f2d9d39e00ee76d5749d283984c772a4cad0a73a448c89df9c30e096be

                                          Download Submit

                                        • C:\Users\Admin\AppData\Local\Temp\f7a4c93c-747c-4f90-b4f5-5c7bd717bf65.vbs
                                          Filesize

                                          707B

                                          MD5

                                          d4525d2efe3abc1ebba60004311d6cb9

                                          SHA1

                                          590ab5c01f790bf5c5252fc6eb32faa67d58909a

                                          SHA256

                                          70db043ca2f96c48da8b89a77234bf5272d399d6a050d60d96adf081553e4d3c

                                          SHA512

                                          a31ebb5d8fec5d1bd9e2d886613a3210a4b2967b43a7befe6dae7caec800d9caeeeab604f6d56729a2bad4c43b084fb6452251a3d97fc7afdd6a704400284677

                                          Download Submit

                                        • C:\Users\Admin\AppData\Local\Temp\fecad07b-38a8-42c0-8849-6f4582ce073e.vbs
                                          Filesize

                                          707B

                                          MD5

                                          7dfd0e78ad87257a7fa70412ba604c63

                                          SHA1

                                          3fb7e634e88b1f14d115ef63df6696178834de2b

                                          SHA256

                                          4485b2500af763068248c0a0ec7b17c4ccaa1d26900f64fe4ef07a1dc21a1d62

                                          SHA512

                                          6b788a6cab3ea9724e6010b59e25c832dd51fca39e16d2e9005441622aece27baecca6a68f1b2b46e125448867bb46d3df69730709cfc2c3740f8e44a19d8794

                                          Download Submit

                                        • C:\Users\Admin\AppData\Local\Temp\tmpD323.tmp.exe
                                          Filesize

                                          75KB

                                          MD5

                                          e0a68b98992c1699876f818a22b5b907

                                          SHA1

                                          d41e8ad8ba51217eb0340f8f69629ccb474484d0

                                          SHA256

                                          2b00d8c2bcc6b48e90524cdd41a07735dc94548ed41925baff86e43a61a4c37f

                                          SHA512

                                          856854f5fd89ae1669e4b2db10b73b4a78496bf80117003244c83e781f75e533e2e2bea9aa6c1b3aba3db1ed92ea0ed9755fbfd78cd6c86ba95867d07fc0ece2

                                          Download Submit

                                        • memory/2032-67-0x0000000000400000-0x0000000000407000-memory.dmp

                                          Filesize

                                          28KB

                                          Download

                                        • memory/3504-312-0x000000001DBF0000-0x000000001DC02000-memory.dmp

                                          Filesize

                                          72KB

                                          Download

                                        • memory/3840-8-0x000000001B660000-0x000000001B676000-memory.dmp

                                          Filesize

                                          88KB

                                          Download

                                        • memory/3840-10-0x000000001B680000-0x000000001B68A000-memory.dmp

                                          Filesize

                                          40KB

                                          Download

                                        • memory/3840-17-0x000000001BE70000-0x000000001BE78000-memory.dmp

                                          Filesize

                                          32KB

                                          Download

                                        • memory/3840-18-0x000000001BE80000-0x000000001BE8C000-memory.dmp

                                          Filesize

                                          48KB

                                          Download

                                        • memory/3840-13-0x000000001BDE0000-0x000000001BDEA000-memory.dmp

                                          Filesize

                                          40KB

                                          Download

                                        • memory/3840-1-0x00000000003E0000-0x00000000008D4000-memory.dmp

                                          Filesize

                                          5.0MB

                                          Download

                                        • memory/3840-264-0x00007FFAAD1A0000-0x00007FFAADC61000-memory.dmp

                                          Filesize

                                          10.8MB

                                          Download

                                        • memory/3840-15-0x000000001BE00000-0x000000001BE0E000-memory.dmp

                                          Filesize

                                          56KB

                                          Download

                                        • memory/3840-14-0x000000001BDF0000-0x000000001BDFE000-memory.dmp

                                          Filesize

                                          56KB

                                          Download

                                        • memory/3840-12-0x000000001C3A0000-0x000000001C8C8000-memory.dmp

                                          Filesize

                                          5.2MB

                                          Download

                                        • memory/3840-11-0x000000001BDD0000-0x000000001BDE2000-memory.dmp

                                          Filesize

                                          72KB

                                          Download

                                        • memory/3840-16-0x000000001BE10000-0x000000001BE18000-memory.dmp

                                          Filesize

                                          32KB

                                          Download

                                        • memory/3840-0-0x00007FFAAD1A3000-0x00007FFAAD1A5000-memory.dmp

                                          Filesize

                                          8KB

                                          Download

                                        • memory/3840-9-0x0000000002AE0000-0x0000000002AF0000-memory.dmp

                                          Filesize

                                          64KB

                                          Download

                                        • memory/3840-5-0x000000001BE20000-0x000000001BE70000-memory.dmp

                                          Filesize

                                          320KB

                                          Download

                                        • memory/3840-6-0x0000000001110000-0x0000000001118000-memory.dmp

                                          Filesize

                                          32KB

                                          Download

                                        • memory/3840-7-0x0000000001120000-0x0000000001130000-memory.dmp

                                          Filesize

                                          64KB

                                          Download

                                        • memory/3840-4-0x00000000010E0000-0x00000000010FC000-memory.dmp

                                          Filesize

                                          112KB

                                          Download

                                        • memory/3840-3-0x000000001B6A0000-0x000000001B7CE000-memory.dmp

                                          Filesize

                                          1.2MB

                                          Download

                                        • memory/3840-2-0x00007FFAAD1A0000-0x00007FFAADC61000-memory.dmp

                                          Filesize

                                          10.8MB

                                          Download

                                        • memory/4176-167-0x00000247747C0000-0x00000247747E2000-memory.dmp

                                          Filesize

                                          136KB

                                          Download