2af29a5f99c8ab0654dbece76b2e046f66703a4ae8b4ffa9b4071f9aa74523d7

Resubmissions

10-10-2024 02:19

241010-crx4sazhnm 10

Analysis

max time kernel
119s
max time network
147s
platform
windows11-21h2_x64
resource
win11-20241007-en
resource tags

arch:x64arch:x86image:win11-20241007-enlocale:en-usos:windows11-21h2-x64system
submitted
10-10-2024 02:19

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Samples - 10-09-2024/4ac2ddb4fa2d1917ae491b5ac623e7ebf23e5e34667c63e5acd433cc6696c23d.exe
Size

3.3MB
MD5

3c9cf0b38226e2a7f0191a0130536859
SHA1

87d531257a15e18b50fa341bce9ac3c5a71ba80d
SHA256

4ac2ddb4fa2d1917ae491b5ac623e7ebf23e5e34667c63e5acd433cc6696c23d
SHA512

ad6bc0c26b6adbb7ead5db17fb4fd4285bcfd623531f41ad6ae31e97a1e760a59f36de05eab0e298e0892fea03d4a4c2ae389d90036c784edb44e61d7a8161d2
SSDEEP

49152:uGmcpg5vS+c8OorsMzNRK6v1hFXefh0iMB+0b+N/uyVbVihyXYuIS:t0vfxoEe6vHFXgh5cb+NhqlS

Score

10^/10

execution persistence spyware stealer

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 5 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Users\\Default User\\spoolsv.exe\", \"C:\\Recovery\\WindowsRE\\csrss.exe\", \"C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Setup Files\\smss.exe\", \"C:\\Users\\Default User\\wininit.exe\", \"C:\\Program Files (x86)\\Microsoft.NET\\Primary Interop Assemblies\\fontdrvhost.exe\""	4ac2ddb4fa2d1917ae491b5ac623e7ebf23e5e34667c63e5acd433cc6696c23d.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Users\\Default User\\spoolsv.exe\""	4ac2ddb4fa2d1917ae491b5ac623e7ebf23e5e34667c63e5acd433cc6696c23d.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Users\\Default User\\spoolsv.exe\", \"C:\\Recovery\\WindowsRE\\csrss.exe\""	4ac2ddb4fa2d1917ae491b5ac623e7ebf23e5e34667c63e5acd433cc6696c23d.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Users\\Default User\\spoolsv.exe\", \"C:\\Recovery\\WindowsRE\\csrss.exe\", \"C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Setup Files\\smss.exe\""	4ac2ddb4fa2d1917ae491b5ac623e7ebf23e5e34667c63e5acd433cc6696c23d.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Users\\Default User\\spoolsv.exe\", \"C:\\Recovery\\WindowsRE\\csrss.exe\", \"C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Setup Files\\smss.exe\", \"C:\\Users\\Default User\\wininit.exe\""	4ac2ddb4fa2d1917ae491b5ac623e7ebf23e5e34667c63e5acd433cc6696c23d.exe

Process spawned unexpected child process 15 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	396	240	schtasks.exe	78
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4304	240	schtasks.exe	78
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2408	240	schtasks.exe	78
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2392	240	schtasks.exe	78
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	404	240	schtasks.exe	78
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1940	240	schtasks.exe	78
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1576	240	schtasks.exe	78
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3632	240	schtasks.exe	78
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1016	240	schtasks.exe	78
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1040	240	schtasks.exe	78
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4308	240	schtasks.exe	78
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1960	240	schtasks.exe	78
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2196	240	schtasks.exe	78
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1976	240	schtasks.exe	78
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3024	240	schtasks.exe	78

Command and Scripting Interpreter: PowerShell 1 TTPs 5 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
1856	powershell.exe
3448	powershell.exe
1664	powershell.exe
3500	powershell.exe
4504	powershell.exe

Executes dropped EXE 1 IoCs

pid	Process
3288	wininit.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 10 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\smss = "\"C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Setup Files\\smss.exe\""	4ac2ddb4fa2d1917ae491b5ac623e7ebf23e5e34667c63e5acd433cc6696c23d.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\wininit = "\"C:\\Users\\Default User\\wininit.exe\""	4ac2ddb4fa2d1917ae491b5ac623e7ebf23e5e34667c63e5acd433cc6696c23d.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2584844841-1405471295-1760131749-1000\Software\Microsoft\Windows\CurrentVersion\Run\fontdrvhost = "\"C:\\Program Files (x86)\\Microsoft.NET\\Primary Interop Assemblies\\fontdrvhost.exe\""	4ac2ddb4fa2d1917ae491b5ac623e7ebf23e5e34667c63e5acd433cc6696c23d.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2584844841-1405471295-1760131749-1000\Software\Microsoft\Windows\CurrentVersion\Run\spoolsv = "\"C:\\Users\\Default User\\spoolsv.exe\""	4ac2ddb4fa2d1917ae491b5ac623e7ebf23e5e34667c63e5acd433cc6696c23d.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2584844841-1405471295-1760131749-1000\Software\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Recovery\\WindowsRE\\csrss.exe\""	4ac2ddb4fa2d1917ae491b5ac623e7ebf23e5e34667c63e5acd433cc6696c23d.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2584844841-1405471295-1760131749-1000\Software\Microsoft\Windows\CurrentVersion\Run\smss = "\"C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Setup Files\\smss.exe\""	4ac2ddb4fa2d1917ae491b5ac623e7ebf23e5e34667c63e5acd433cc6696c23d.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2584844841-1405471295-1760131749-1000\Software\Microsoft\Windows\CurrentVersion\Run\wininit = "\"C:\\Users\\Default User\\wininit.exe\""	4ac2ddb4fa2d1917ae491b5ac623e7ebf23e5e34667c63e5acd433cc6696c23d.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\fontdrvhost = "\"C:\\Program Files (x86)\\Microsoft.NET\\Primary Interop Assemblies\\fontdrvhost.exe\""	4ac2ddb4fa2d1917ae491b5ac623e7ebf23e5e34667c63e5acd433cc6696c23d.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\spoolsv = "\"C:\\Users\\Default User\\spoolsv.exe\""	4ac2ddb4fa2d1917ae491b5ac623e7ebf23e5e34667c63e5acd433cc6696c23d.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Recovery\\WindowsRE\\csrss.exe\""	4ac2ddb4fa2d1917ae491b5ac623e7ebf23e5e34667c63e5acd433cc6696c23d.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	\??\c:\Windows\System32\CSCFED99657FBEE4E9683585A3179A05437.TMP	csc.exe
File created	\??\c:\Windows\System32\dfm5rj.exe	csc.exe

Drops file in Program Files directory 4 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Setup Files\smss.exe	4ac2ddb4fa2d1917ae491b5ac623e7ebf23e5e34667c63e5acd433cc6696c23d.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Setup Files\69ddcba757bf72	4ac2ddb4fa2d1917ae491b5ac623e7ebf23e5e34667c63e5acd433cc6696c23d.exe
File created	C:\Program Files (x86)\Microsoft.NET\Primary Interop Assemblies\fontdrvhost.exe	4ac2ddb4fa2d1917ae491b5ac623e7ebf23e5e34667c63e5acd433cc6696c23d.exe
File created	C:\Program Files (x86)\Microsoft.NET\Primary Interop Assemblies\5b884080fd4f94	4ac2ddb4fa2d1917ae491b5ac623e7ebf23e5e34667c63e5acd433cc6696c23d.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2584844841-1405471295-1760131749-1000_Classes\Local Settings	4ac2ddb4fa2d1917ae491b5ac623e7ebf23e5e34667c63e5acd433cc6696c23d.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 15 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
1576	schtasks.exe
1016	schtasks.exe
2196	schtasks.exe
396	schtasks.exe
4308	schtasks.exe
1976	schtasks.exe
4304	schtasks.exe
404	schtasks.exe
2408	schtasks.exe
2392	schtasks.exe
1940	schtasks.exe
3632	schtasks.exe
1040	schtasks.exe
1960	schtasks.exe
3024	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1216	4ac2ddb4fa2d1917ae491b5ac623e7ebf23e5e34667c63e5acd433cc6696c23d.exe
1216	4ac2ddb4fa2d1917ae491b5ac623e7ebf23e5e34667c63e5acd433cc6696c23d.exe
1216	4ac2ddb4fa2d1917ae491b5ac623e7ebf23e5e34667c63e5acd433cc6696c23d.exe
1216	4ac2ddb4fa2d1917ae491b5ac623e7ebf23e5e34667c63e5acd433cc6696c23d.exe
1216	4ac2ddb4fa2d1917ae491b5ac623e7ebf23e5e34667c63e5acd433cc6696c23d.exe
1216	4ac2ddb4fa2d1917ae491b5ac623e7ebf23e5e34667c63e5acd433cc6696c23d.exe
1216	4ac2ddb4fa2d1917ae491b5ac623e7ebf23e5e34667c63e5acd433cc6696c23d.exe
1216	4ac2ddb4fa2d1917ae491b5ac623e7ebf23e5e34667c63e5acd433cc6696c23d.exe
1216	4ac2ddb4fa2d1917ae491b5ac623e7ebf23e5e34667c63e5acd433cc6696c23d.exe
1216	4ac2ddb4fa2d1917ae491b5ac623e7ebf23e5e34667c63e5acd433cc6696c23d.exe
1216	4ac2ddb4fa2d1917ae491b5ac623e7ebf23e5e34667c63e5acd433cc6696c23d.exe
1216	4ac2ddb4fa2d1917ae491b5ac623e7ebf23e5e34667c63e5acd433cc6696c23d.exe
1216	4ac2ddb4fa2d1917ae491b5ac623e7ebf23e5e34667c63e5acd433cc6696c23d.exe
1216	4ac2ddb4fa2d1917ae491b5ac623e7ebf23e5e34667c63e5acd433cc6696c23d.exe
1216	4ac2ddb4fa2d1917ae491b5ac623e7ebf23e5e34667c63e5acd433cc6696c23d.exe
1216	4ac2ddb4fa2d1917ae491b5ac623e7ebf23e5e34667c63e5acd433cc6696c23d.exe
1216	4ac2ddb4fa2d1917ae491b5ac623e7ebf23e5e34667c63e5acd433cc6696c23d.exe
1216	4ac2ddb4fa2d1917ae491b5ac623e7ebf23e5e34667c63e5acd433cc6696c23d.exe
1216	4ac2ddb4fa2d1917ae491b5ac623e7ebf23e5e34667c63e5acd433cc6696c23d.exe
1216	4ac2ddb4fa2d1917ae491b5ac623e7ebf23e5e34667c63e5acd433cc6696c23d.exe
1216	4ac2ddb4fa2d1917ae491b5ac623e7ebf23e5e34667c63e5acd433cc6696c23d.exe
1216	4ac2ddb4fa2d1917ae491b5ac623e7ebf23e5e34667c63e5acd433cc6696c23d.exe
1216	4ac2ddb4fa2d1917ae491b5ac623e7ebf23e5e34667c63e5acd433cc6696c23d.exe
1216	4ac2ddb4fa2d1917ae491b5ac623e7ebf23e5e34667c63e5acd433cc6696c23d.exe
1216	4ac2ddb4fa2d1917ae491b5ac623e7ebf23e5e34667c63e5acd433cc6696c23d.exe
1216	4ac2ddb4fa2d1917ae491b5ac623e7ebf23e5e34667c63e5acd433cc6696c23d.exe
1216	4ac2ddb4fa2d1917ae491b5ac623e7ebf23e5e34667c63e5acd433cc6696c23d.exe
1216	4ac2ddb4fa2d1917ae491b5ac623e7ebf23e5e34667c63e5acd433cc6696c23d.exe
1216	4ac2ddb4fa2d1917ae491b5ac623e7ebf23e5e34667c63e5acd433cc6696c23d.exe
1216	4ac2ddb4fa2d1917ae491b5ac623e7ebf23e5e34667c63e5acd433cc6696c23d.exe
1216	4ac2ddb4fa2d1917ae491b5ac623e7ebf23e5e34667c63e5acd433cc6696c23d.exe
1216	4ac2ddb4fa2d1917ae491b5ac623e7ebf23e5e34667c63e5acd433cc6696c23d.exe
1216	4ac2ddb4fa2d1917ae491b5ac623e7ebf23e5e34667c63e5acd433cc6696c23d.exe
1216	4ac2ddb4fa2d1917ae491b5ac623e7ebf23e5e34667c63e5acd433cc6696c23d.exe
1216	4ac2ddb4fa2d1917ae491b5ac623e7ebf23e5e34667c63e5acd433cc6696c23d.exe
1216	4ac2ddb4fa2d1917ae491b5ac623e7ebf23e5e34667c63e5acd433cc6696c23d.exe
1216	4ac2ddb4fa2d1917ae491b5ac623e7ebf23e5e34667c63e5acd433cc6696c23d.exe
1216	4ac2ddb4fa2d1917ae491b5ac623e7ebf23e5e34667c63e5acd433cc6696c23d.exe
1216	4ac2ddb4fa2d1917ae491b5ac623e7ebf23e5e34667c63e5acd433cc6696c23d.exe
1216	4ac2ddb4fa2d1917ae491b5ac623e7ebf23e5e34667c63e5acd433cc6696c23d.exe
1216	4ac2ddb4fa2d1917ae491b5ac623e7ebf23e5e34667c63e5acd433cc6696c23d.exe
1216	4ac2ddb4fa2d1917ae491b5ac623e7ebf23e5e34667c63e5acd433cc6696c23d.exe
1216	4ac2ddb4fa2d1917ae491b5ac623e7ebf23e5e34667c63e5acd433cc6696c23d.exe
1216	4ac2ddb4fa2d1917ae491b5ac623e7ebf23e5e34667c63e5acd433cc6696c23d.exe
1216	4ac2ddb4fa2d1917ae491b5ac623e7ebf23e5e34667c63e5acd433cc6696c23d.exe
1216	4ac2ddb4fa2d1917ae491b5ac623e7ebf23e5e34667c63e5acd433cc6696c23d.exe
1216	4ac2ddb4fa2d1917ae491b5ac623e7ebf23e5e34667c63e5acd433cc6696c23d.exe
1216	4ac2ddb4fa2d1917ae491b5ac623e7ebf23e5e34667c63e5acd433cc6696c23d.exe
1216	4ac2ddb4fa2d1917ae491b5ac623e7ebf23e5e34667c63e5acd433cc6696c23d.exe
1216	4ac2ddb4fa2d1917ae491b5ac623e7ebf23e5e34667c63e5acd433cc6696c23d.exe
1216	4ac2ddb4fa2d1917ae491b5ac623e7ebf23e5e34667c63e5acd433cc6696c23d.exe
1216	4ac2ddb4fa2d1917ae491b5ac623e7ebf23e5e34667c63e5acd433cc6696c23d.exe
1216	4ac2ddb4fa2d1917ae491b5ac623e7ebf23e5e34667c63e5acd433cc6696c23d.exe
1216	4ac2ddb4fa2d1917ae491b5ac623e7ebf23e5e34667c63e5acd433cc6696c23d.exe
1216	4ac2ddb4fa2d1917ae491b5ac623e7ebf23e5e34667c63e5acd433cc6696c23d.exe
1216	4ac2ddb4fa2d1917ae491b5ac623e7ebf23e5e34667c63e5acd433cc6696c23d.exe
1216	4ac2ddb4fa2d1917ae491b5ac623e7ebf23e5e34667c63e5acd433cc6696c23d.exe
1216	4ac2ddb4fa2d1917ae491b5ac623e7ebf23e5e34667c63e5acd433cc6696c23d.exe
1216	4ac2ddb4fa2d1917ae491b5ac623e7ebf23e5e34667c63e5acd433cc6696c23d.exe
1216	4ac2ddb4fa2d1917ae491b5ac623e7ebf23e5e34667c63e5acd433cc6696c23d.exe
1216	4ac2ddb4fa2d1917ae491b5ac623e7ebf23e5e34667c63e5acd433cc6696c23d.exe
1216	4ac2ddb4fa2d1917ae491b5ac623e7ebf23e5e34667c63e5acd433cc6696c23d.exe
1216	4ac2ddb4fa2d1917ae491b5ac623e7ebf23e5e34667c63e5acd433cc6696c23d.exe
1216	4ac2ddb4fa2d1917ae491b5ac623e7ebf23e5e34667c63e5acd433cc6696c23d.exe

Suspicious use of AdjustPrivilegeToken 7 IoCs

description	pid	Process
Token: SeDebugPrivilege	1216	4ac2ddb4fa2d1917ae491b5ac623e7ebf23e5e34667c63e5acd433cc6696c23d.exe
Token: SeDebugPrivilege	3448	powershell.exe
Token: SeDebugPrivilege	3500	powershell.exe
Token: SeDebugPrivilege	1856	powershell.exe
Token: SeDebugPrivilege	1664	powershell.exe
Token: SeDebugPrivilege	4504	powershell.exe
Token: SeDebugPrivilege	3288	wininit.exe

Suspicious use of WriteProcessMemory 22 IoCs

description	pid	Process	procid_target
PID 1216 wrote to memory of 1764	1216	4ac2ddb4fa2d1917ae491b5ac623e7ebf23e5e34667c63e5acd433cc6696c23d.exe	82
PID 1216 wrote to memory of 1764	1216	4ac2ddb4fa2d1917ae491b5ac623e7ebf23e5e34667c63e5acd433cc6696c23d.exe	82
PID 1764 wrote to memory of 2540	1764	csc.exe	84
PID 1764 wrote to memory of 2540	1764	csc.exe	84
PID 1216 wrote to memory of 3500	1216	4ac2ddb4fa2d1917ae491b5ac623e7ebf23e5e34667c63e5acd433cc6696c23d.exe	97
PID 1216 wrote to memory of 3500	1216	4ac2ddb4fa2d1917ae491b5ac623e7ebf23e5e34667c63e5acd433cc6696c23d.exe	97
PID 1216 wrote to memory of 1664	1216	4ac2ddb4fa2d1917ae491b5ac623e7ebf23e5e34667c63e5acd433cc6696c23d.exe	98
PID 1216 wrote to memory of 1664	1216	4ac2ddb4fa2d1917ae491b5ac623e7ebf23e5e34667c63e5acd433cc6696c23d.exe	98
PID 1216 wrote to memory of 3448	1216	4ac2ddb4fa2d1917ae491b5ac623e7ebf23e5e34667c63e5acd433cc6696c23d.exe	99
PID 1216 wrote to memory of 3448	1216	4ac2ddb4fa2d1917ae491b5ac623e7ebf23e5e34667c63e5acd433cc6696c23d.exe	99
PID 1216 wrote to memory of 1856	1216	4ac2ddb4fa2d1917ae491b5ac623e7ebf23e5e34667c63e5acd433cc6696c23d.exe	100
PID 1216 wrote to memory of 1856	1216	4ac2ddb4fa2d1917ae491b5ac623e7ebf23e5e34667c63e5acd433cc6696c23d.exe	100
PID 1216 wrote to memory of 4504	1216	4ac2ddb4fa2d1917ae491b5ac623e7ebf23e5e34667c63e5acd433cc6696c23d.exe	101
PID 1216 wrote to memory of 4504	1216	4ac2ddb4fa2d1917ae491b5ac623e7ebf23e5e34667c63e5acd433cc6696c23d.exe	101
PID 1216 wrote to memory of 4380	1216	4ac2ddb4fa2d1917ae491b5ac623e7ebf23e5e34667c63e5acd433cc6696c23d.exe	107
PID 1216 wrote to memory of 4380	1216	4ac2ddb4fa2d1917ae491b5ac623e7ebf23e5e34667c63e5acd433cc6696c23d.exe	107
PID 4380 wrote to memory of 4860	4380	cmd.exe	109
PID 4380 wrote to memory of 4860	4380	cmd.exe	109
PID 4380 wrote to memory of 3076	4380	cmd.exe	110
PID 4380 wrote to memory of 3076	4380	cmd.exe	110
PID 4380 wrote to memory of 3288	4380	cmd.exe	111
PID 4380 wrote to memory of 3288	4380	cmd.exe	111

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\Samples - 10-09-2024\4ac2ddb4fa2d1917ae491b5ac623e7ebf23e5e34667c63e5acd433cc6696c23d.exe
"C:\Users\Admin\AppData\Local\Temp\Samples - 10-09-2024\4ac2ddb4fa2d1917ae491b5ac623e7ebf23e5e34667c63e5acd433cc6696c23d.exe"
1⤵
- Modifies WinLogon for persistence
- Adds Run key to start application
- Drops file in Program Files directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1216
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\fws2z52w\fws2z52w.cmdline"
  2⤵
  - Drops file in System32 directory
  - Suspicious use of WriteProcessMemory
  PID:1764
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES5946.tmp" "c:\Windows\System32\CSCFED99657FBEE4E9683585A3179A05437.TMP"
    3⤵
    PID:2540
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Default User\spoolsv.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of AdjustPrivilegeToken
  PID:3500
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\WindowsRE\csrss.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of AdjustPrivilegeToken
  PID:1664
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Adobe\Acrobat Reader DC\Setup Files\smss.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of AdjustPrivilegeToken
  PID:3448
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Default User\wininit.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of AdjustPrivilegeToken
  PID:1856
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Microsoft.NET\Primary Interop Assemblies\fontdrvhost.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of AdjustPrivilegeToken
  PID:4504
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\kDSUZmuH6d.bat"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4380
- - C:\Windows\system32\chcp.com
    chcp 65001
    3⤵
    PID:4860
- - C:\Windows\system32\w32tm.exe
    w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
    3⤵
    PID:3076
- - C:\Users\Default User\wininit.exe
    "C:\Users\Default User\wininit.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of AdjustPrivilegeToken
    PID:3288

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 11 /tr "'C:\Users\Default User\spoolsv.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:396

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsv" /sc ONLOGON /tr "'C:\Users\Default User\spoolsv.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4304

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 8 /tr "'C:\Users\Default User\spoolsv.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2408

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 7 /tr "'C:\Recovery\WindowsRE\csrss.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2392

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1940

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 13 /tr "'C:\Recovery\WindowsRE\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:404

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 11 /tr "'C:\Program Files (x86)\Adobe\Acrobat Reader DC\Setup Files\smss.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1576

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smss" /sc ONLOGON /tr "'C:\Program Files (x86)\Adobe\Acrobat Reader DC\Setup Files\smss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3632

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 5 /tr "'C:\Program Files (x86)\Adobe\Acrobat Reader DC\Setup Files\smss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1016

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 10 /tr "'C:\Users\Default User\wininit.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1040

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininit" /sc ONLOGON /tr "'C:\Users\Default User\wininit.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4308

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 9 /tr "'C:\Users\Default User\wininit.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1960

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 8 /tr "'C:\Program Files (x86)\Microsoft.NET\Primary Interop Assemblies\fontdrvhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2196

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\Program Files (x86)\Microsoft.NET\Primary Interop Assemblies\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1976

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 8 /tr "'C:\Program Files (x86)\Microsoft.NET\Primary Interop Assemblies\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3024

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Microsoft.NET\Primary Interop Assemblies\fontdrvhost.exe

Filesize
3.3MB

MD5
3c9cf0b38226e2a7f0191a0130536859

SHA1
87d531257a15e18b50fa341bce9ac3c5a71ba80d

SHA256
4ac2ddb4fa2d1917ae491b5ac623e7ebf23e5e34667c63e5acd433cc6696c23d

SHA512
ad6bc0c26b6adbb7ead5db17fb4fd4285bcfd623531f41ad6ae31e97a1e760a59f36de05eab0e298e0892fea03d4a4c2ae389d90036c784edb44e61d7a8161d2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
627073ee3ca9676911bee35548eff2b8

SHA1
4c4b68c65e2cab9864b51167d710aa29ebdcff2e

SHA256
85b280a39fc31ba1e15fb06102a05b8405ff3b82feb181d4170f04e466dd647c

SHA512
3c5f6c03e253b83c57e8d6f0334187dbdcdf4fa549eecd36cbc1322dca6d3ca891dc6a019c49ec2eafb88f82d0434299c31e4dfaab123acb42e0546218f311fb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
1a9fa92a4f2e2ec9e244d43a6a4f8fb9

SHA1
9910190edfaccece1dfcc1d92e357772f5dae8f7

SHA256
0ee052d5333fd5fd86bc84856fec98e045f077a7ac8051651bf7c521b9706888

SHA512
5d2361476fa22200e6f83883efe7dcb8c3fe7dae8d56e04e28a36e9ae1270c327b6aa161d92b239593da7661289d002c574446ecfd6bd19928209aae25e3ef64

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
45f53352160cf0903c729c35c8edfdce

SHA1
b35a4d4fbaf2a3cc61e540fc03516dd70f3c34ab

SHA256
9cf18d157a858fc143a6de5c2dd3f618516a527b34478ac478d8c94ff027b0d2

SHA512
e3fa27a80a1df58acb49106c306dab22e5ed582f6b0cd7d9c3ef0a85e9f5919333257e88aa44f42a0e095fd577c9e12a02957a7845c0d109f821f32d8d3343f3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
aa4f31835d07347297d35862c9045f4a

SHA1
83e728008935d30f98e5480fba4fbccf10cefb05

SHA256
99c83bc5c531e49d4240700142f3425aba74e18ebcc23556be32238ffde9cce0

SHA512
ec3a4bee8335007b8753ae8ac42287f2b3bcbb258f7fc3fb15c9f8d3e611cb9bf6ae2d3034953286a34f753e9ec33f7495e064bab0e8c7fcedd75d6e5eb66629

Download Submit
C:\Users\Admin\AppData\Local\Temp\RES5946.tmp

Filesize
1KB

MD5
5f516b4ae1bd0892f59a6554955cb549

SHA1
36759ce6f6f6a366731edb75354eef0b10b9e510

SHA256
cb974aeb2ed4ae5bc12fb76bf8917fd57621f4d3fccdf5c575dc1c9ff1166a0a

SHA512
c07e3dd27c86207ad775c2de98c471a10c0b78946671aa40b27140587c50cf8ce4603affdc84cf10812e3d9936528b45d712dc314d1a39da6e7e38077c652e89

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_v4bxmx2j.24z.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\kDSUZmuH6d.bat

Filesize
209B

MD5
449fc50a59530775ddcd421cfd6fcd77

SHA1
146e2c8976cf28fcdd5e27d1b95ddc8f049ae948

SHA256
206aef375bb408a1790795479b96b3abdc162496f87c51a976a21284345b6e50

SHA512
7afd0067b1d1f53ec9bed761fc650a43ac34ca1af740ab1e8daa0c51834dbe05d64c97e9b6846f3a8817ca2797d18d9a355e0634adf79db157ea7d08c30b7a4a

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\fws2z52w\fws2z52w.0.cs

Filesize
365B

MD5
2ca0f046cc378e8ccaa2ea77ecb5f4b2

SHA1
4e2e1b1c3675568cdf435c2fa99c78c21e46c57f

SHA256
56a3e5a8dc21ba87657762c79e5a6850897912e47eac5011307acff0d8318473

SHA512
7596478da1b4ca0d0b0eb5f973db4d314644abaaa500fc6b5eef2e2b945a60c3aaeeb1b75e54dfd2947903b9a97608109d808034aafef3b08f7905e721556229

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\fws2z52w\fws2z52w.cmdline

Filesize
235B

MD5
abd7055e334f8cda89e16fe080bac37d

SHA1
8eb953d8b8ec9e5d51938c8f11d2561734e237fb

SHA256
cca976d27cb9ff92dfa0b92d30a791f935e6d630e64682c707070a70e5943282

SHA512
fa9185f749afbc8db4c7c74ebaef6fe8cb95dc78847d1f021626930df60a02a11dcc7aa47f433447f71169663d280a681f79d129d50ae766c2a0f063a9a0df5d

Download Submit
\??\c:\Windows\System32\CSCFED99657FBEE4E9683585A3179A05437.TMP

Filesize
1KB

MD5
d89c8eda5ccd9b9600f2962d9a95e453

SHA1
e5d9f7603b9bc8339c9bc451e8ad7c67b1916d95

SHA256
9b274ee8615f4208df254a0fc6abb2b0d8be71defecba04292fcc69cef64387b

SHA512
9c4f365e362069a6256c8d7691f217e1ae01a3af2218cdc400f77d7dc9af9d3634b234338b9cc562fd146ebcc8034dfd313cd9d3aa2df2e20876e6641c6d9055

Download Submit
memory/1216-3562-0x00007FFEF38D0000-0x00007FFEF4392000-memory.dmp

Filesize
10.8MB

Download
memory/1216-3573-0x0000000001480000-0x0000000001490000-memory.dmp

Filesize
64KB

Download
memory/1216-5-0x000000001B760000-0x000000001BB0F000-memory.dmp

Filesize
3.7MB

Download
memory/1216-17-0x000000001B760000-0x000000001BB0F000-memory.dmp

Filesize
3.7MB

Download
memory/1216-19-0x000000001B760000-0x000000001BB0F000-memory.dmp

Filesize
3.7MB

Download
memory/1216-26-0x000000001B760000-0x000000001BB0F000-memory.dmp

Filesize
3.7MB

Download
memory/1216-27-0x000000001B760000-0x000000001BB0F000-memory.dmp

Filesize
3.7MB

Download
memory/1216-37-0x000000001B760000-0x000000001BB0F000-memory.dmp

Filesize
3.7MB

Download
memory/1216-36-0x000000001B760000-0x000000001BB0F000-memory.dmp

Filesize
3.7MB

Download
memory/1216-41-0x000000001B760000-0x000000001BB0F000-memory.dmp

Filesize
3.7MB

Download
memory/1216-39-0x000000001B760000-0x000000001BB0F000-memory.dmp

Filesize
3.7MB

Download
memory/1216-51-0x000000001B760000-0x000000001BB0F000-memory.dmp

Filesize
3.7MB

Download
memory/1216-49-0x000000001B760000-0x000000001BB0F000-memory.dmp

Filesize
3.7MB

Download
memory/1216-53-0x000000001B760000-0x000000001BB0F000-memory.dmp

Filesize
3.7MB

Download
memory/1216-55-0x000000001B760000-0x000000001BB0F000-memory.dmp

Filesize
3.7MB

Download
memory/1216-47-0x000000001B760000-0x000000001BB0F000-memory.dmp

Filesize
3.7MB

Download
memory/1216-45-0x000000001B760000-0x000000001BB0F000-memory.dmp

Filesize
3.7MB

Download
memory/1216-43-0x000000001B760000-0x000000001BB0F000-memory.dmp

Filesize
3.7MB

Download
memory/1216-33-0x000000001B760000-0x000000001BB0F000-memory.dmp

Filesize
3.7MB

Download
memory/1216-31-0x000000001B760000-0x000000001BB0F000-memory.dmp

Filesize
3.7MB

Download
memory/1216-29-0x000000001B760000-0x000000001BB0F000-memory.dmp

Filesize
3.7MB

Download
memory/1216-23-0x000000001B760000-0x000000001BB0F000-memory.dmp

Filesize
3.7MB

Download
memory/1216-15-0x000000001B760000-0x000000001BB0F000-memory.dmp

Filesize
3.7MB

Download
memory/1216-21-0x000000001B760000-0x000000001BB0F000-memory.dmp

Filesize
3.7MB

Download
memory/1216-14-0x00007FFEF38D0000-0x00007FFEF4392000-memory.dmp

Filesize
10.8MB

Download
memory/1216-61-0x000000001B760000-0x000000001BB0F000-memory.dmp

Filesize
3.7MB

Download
memory/1216-64-0x000000001B760000-0x000000001BB0F000-memory.dmp

Filesize
3.7MB

Download
memory/1216-67-0x000000001B760000-0x000000001BB0F000-memory.dmp

Filesize
3.7MB

Download
memory/1216-65-0x000000001B760000-0x000000001BB0F000-memory.dmp

Filesize
3.7MB

Download
memory/1216-58-0x000000001B760000-0x000000001BB0F000-memory.dmp

Filesize
3.7MB

Download
memory/1216-59-0x000000001B760000-0x000000001BB0F000-memory.dmp

Filesize
3.7MB

Download
memory/1216-1698-0x00007FFEF38D3000-0x00007FFEF38D5000-memory.dmp

Filesize
8KB

Download
memory/1216-1993-0x00007FFEF38D0000-0x00007FFEF4392000-memory.dmp

Filesize
10.8MB

Download
memory/1216-12-0x000000001B760000-0x000000001BB0F000-memory.dmp

Filesize
3.7MB

Download
memory/1216-3563-0x00007FFEF38D0000-0x00007FFEF4392000-memory.dmp

Filesize
10.8MB

Download
memory/1216-3565-0x0000000002CD0000-0x0000000002CF6000-memory.dmp

Filesize
152KB

Download
memory/1216-3566-0x00007FFEF38D0000-0x00007FFEF4392000-memory.dmp

Filesize
10.8MB

Download
memory/1216-3568-0x0000000001470000-0x000000000147E000-memory.dmp

Filesize
56KB

Download
memory/1216-3570-0x0000000002E40000-0x0000000002E5C000-memory.dmp

Filesize
112KB

Download
memory/1216-6-0x000000001B760000-0x000000001BB0F000-memory.dmp

Filesize
3.7MB

Download
memory/1216-3571-0x000000001C190000-0x000000001C1E0000-memory.dmp

Filesize
320KB

Download
memory/1216-3576-0x0000000002E60000-0x0000000002E78000-memory.dmp

Filesize
96KB

Download
memory/1216-3578-0x0000000002D00000-0x0000000002D10000-memory.dmp

Filesize
64KB

Download
memory/1216-3583-0x0000000002D20000-0x0000000002D2E000-memory.dmp

Filesize
56KB

Download
memory/1216-3591-0x000000001C170000-0x000000001C182000-memory.dmp

Filesize
72KB

Download
memory/1216-3589-0x000000001C140000-0x000000001C14E000-memory.dmp

Filesize
56KB

Download
memory/1216-3593-0x000000001C150000-0x000000001C160000-memory.dmp

Filesize
64KB

Download
memory/1216-3587-0x000000001BC20000-0x000000001BC2C000-memory.dmp

Filesize
48KB

Download
memory/1216-3595-0x000000001C200000-0x000000001C216000-memory.dmp

Filesize
88KB

Download
memory/1216-3596-0x00007FFEF38D0000-0x00007FFEF4392000-memory.dmp

Filesize
10.8MB

Download
memory/1216-3598-0x000000001C220000-0x000000001C232000-memory.dmp

Filesize
72KB

Download
memory/1216-3585-0x000000001BC10000-0x000000001BC1E000-memory.dmp

Filesize
56KB

Download
memory/1216-3581-0x00007FFEF38D0000-0x00007FFEF4392000-memory.dmp

Filesize
10.8MB

Download
memory/1216-3580-0x0000000002D10000-0x0000000002D20000-memory.dmp

Filesize
64KB

Download
memory/1216-3574-0x00007FFEF38D0000-0x00007FFEF4392000-memory.dmp

Filesize
10.8MB

Download
memory/1216-3600-0x00007FFEF38D0000-0x00007FFEF4392000-memory.dmp

Filesize
10.8MB

Download
memory/1216-3599-0x000000001C770000-0x000000001CC98000-memory.dmp

Filesize
5.2MB

Download
memory/1216-3602-0x000000001C160000-0x000000001C16E000-memory.dmp

Filesize
56KB

Download
memory/1216-3604-0x000000001C1E0000-0x000000001C1EC000-memory.dmp

Filesize
48KB

Download
memory/1216-3606-0x000000001C1F0000-0x000000001C200000-memory.dmp

Filesize
64KB

Download
memory/1216-3608-0x000000001C240000-0x000000001C250000-memory.dmp

Filesize
64KB

Download
memory/1216-3610-0x000000001C2B0000-0x000000001C30A000-memory.dmp

Filesize
360KB

Download
memory/1216-3611-0x00007FFEF38D0000-0x00007FFEF4392000-memory.dmp

Filesize
10.8MB

Download
memory/1216-3615-0x000000001C260000-0x000000001C270000-memory.dmp

Filesize
64KB

Download
memory/1216-3618-0x00007FFEF38D0000-0x00007FFEF4392000-memory.dmp

Filesize
10.8MB

Download
memory/1216-8-0x000000001B760000-0x000000001BB0F000-memory.dmp

Filesize
3.7MB

Download
memory/1216-3617-0x000000001C270000-0x000000001C27E000-memory.dmp

Filesize
56KB

Download
memory/1216-3613-0x000000001C250000-0x000000001C25E000-memory.dmp

Filesize
56KB

Download
memory/1216-3620-0x000000001C510000-0x000000001C528000-memory.dmp

Filesize
96KB

Download
memory/1216-3622-0x000000001C280000-0x000000001C28C000-memory.dmp

Filesize
48KB

Download
memory/1216-3624-0x000000001C580000-0x000000001C5CE000-memory.dmp

Filesize
312KB

Download
memory/1216-0-0x00007FFEF38D3000-0x00007FFEF38D5000-memory.dmp

Filesize
8KB

Download
memory/1216-3678-0x00007FFEF38D0000-0x00007FFEF4392000-memory.dmp

Filesize
10.8MB

Download
memory/1216-10-0x000000001B760000-0x000000001BB0F000-memory.dmp

Filesize
3.7MB

Download
memory/1216-3-0x000000001B760000-0x000000001BB0F000-memory.dmp

Filesize
3.7MB

Download
memory/1216-2-0x000000001B760000-0x000000001BB16000-memory.dmp

Filesize
3.7MB

Download
memory/1216-1-0x0000000000B30000-0x0000000000B38000-memory.dmp

Filesize
32KB

Download
memory/1856-3677-0x0000022EE9AC0000-0x0000022EE9AE2000-memory.dmp

Filesize
136KB

Download