dcrat | 43364f9ca16420322a0acc57427148cb0cfa0df14884538f0ce8627dbc9ec983

Analysis

max time kernel
120s
max time network
120s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
05-12-2024 19:47

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

43364f9ca16420322a0acc57427148cb0cfa0df14884538f0ce8627dbc9ec983N.exe
Size

1.8MB
MD5

8691b8256074b5ec561c7ef05e4f1830
SHA1

6f1deb8e7057f3669b6d92b14de7086a4a0395eb
SHA256

43364f9ca16420322a0acc57427148cb0cfa0df14884538f0ce8627dbc9ec983
SHA512

e7fcaaf6e787f7eda8ff55ef8bc16d36f48c9b8ec1ebf7a7c7c5be84a05f3a0b1e6e898734cfd2c817922f3151efdfbc8ebe8916153ef6a67930df838036a29e
SSDEEP

49152:XWqKKPZ1snfJ+rqDPuQDLME5MT4rDQNpfh:pKKZ1sRD2Q3N5MT4r

Score

10^/10

dcrat discovery evasion execution infostealer rat spyware stealer trojan

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat
Dcrat family
dcrat

Process spawned unexpected child process 27 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1472	3976	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2696	3976	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4512	3976	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5028	3976	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2288	3976	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2352	3976	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	868	3976	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4648	3976	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2096	3976	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1320	3976	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3196	3976	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3504	3976	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1640	3976	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1664	3976	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2756	3976	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	544	3976	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2384	3976	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2388	3976	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2020	3976	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3108	3976	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1424	3976	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3156	3976	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3464	3976	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5048	3976	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3080	3976	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2160	3976	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5032	3976	schtasks.exe	82

UAC bypass 3 TTPs 6 IoCs

evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	System.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	System.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	43364f9ca16420322a0acc57427148cb0cfa0df14884538f0ce8627dbc9ec983N.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	43364f9ca16420322a0acc57427148cb0cfa0df14884538f0ce8627dbc9ec983N.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	43364f9ca16420322a0acc57427148cb0cfa0df14884538f0ce8627dbc9ec983N.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	System.exe

DCRat payload 8 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral2/memory/2780-1-0x00000000002A0000-0x000000000046C000-memory.dmp	dcrat
behavioral2/files/0x000a000000023b9f-32.dat	dcrat
behavioral2/files/0x000c000000023baf-55.dat	dcrat
behavioral2/files/0x000e000000023b33-66.dat	dcrat
behavioral2/files/0x000e000000023b93-100.dat	dcrat
behavioral2/files/0x000300000001e754-134.dat	dcrat
behavioral2/files/0x000b000000023ba7-146.dat	dcrat
behavioral2/memory/2608-302-0x00000000006D0000-0x000000000089C000-memory.dmp	dcrat

Command and Scripting Interpreter: PowerShell 1 TTPs 10 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
2536	powershell.exe
1932	powershell.exe
4440	powershell.exe
3228	powershell.exe
4236	powershell.exe
3288	powershell.exe
4528	powershell.exe
1416	powershell.exe
2576	powershell.exe
5104	powershell.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Control Panel\International\Geo\Nation	43364f9ca16420322a0acc57427148cb0cfa0df14884538f0ce8627dbc9ec983N.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Control Panel\International\Geo\Nation	System.exe

Executes dropped EXE 1 IoCs

pid	Process
2608	System.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Checks whether UAC is enabled 1 TTPs 4 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	43364f9ca16420322a0acc57427148cb0cfa0df14884538f0ce8627dbc9ec983N.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	43364f9ca16420322a0acc57427148cb0cfa0df14884538f0ce8627dbc9ec983N.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	System.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	System.exe

Drops file in Program Files directory 20 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Windows Media Player\en-US\RCXAD04.tmp	43364f9ca16420322a0acc57427148cb0cfa0df14884538f0ce8627dbc9ec983N.exe
File opened for modification	C:\Program Files (x86)\Windows Multimedia Platform\RCXB13D.tmp	43364f9ca16420322a0acc57427148cb0cfa0df14884538f0ce8627dbc9ec983N.exe
File opened for modification	C:\Program Files (x86)\Windows Multimedia Platform\wininit.exe	43364f9ca16420322a0acc57427148cb0cfa0df14884538f0ce8627dbc9ec983N.exe
File opened for modification	C:\Program Files (x86)\Windows Mail\sppsvc.exe	43364f9ca16420322a0acc57427148cb0cfa0df14884538f0ce8627dbc9ec983N.exe
File created	C:\Program Files (x86)\Windows Media Player\en-US\wininit.exe	43364f9ca16420322a0acc57427148cb0cfa0df14884538f0ce8627dbc9ec983N.exe
File created	C:\Program Files (x86)\Windows Multimedia Platform\56085415360792	43364f9ca16420322a0acc57427148cb0cfa0df14884538f0ce8627dbc9ec983N.exe
File created	C:\Program Files (x86)\Windows Mail\sppsvc.exe	43364f9ca16420322a0acc57427148cb0cfa0df14884538f0ce8627dbc9ec983N.exe
File opened for modification	C:\Program Files (x86)\Windows Media Player\en-US\RCXAC96.tmp	43364f9ca16420322a0acc57427148cb0cfa0df14884538f0ce8627dbc9ec983N.exe
File opened for modification	C:\Program Files\VideoLAN\RCXAF28.tmp	43364f9ca16420322a0acc57427148cb0cfa0df14884538f0ce8627dbc9ec983N.exe
File opened for modification	C:\Program Files\VideoLAN\RCXAF29.tmp	43364f9ca16420322a0acc57427148cb0cfa0df14884538f0ce8627dbc9ec983N.exe
File opened for modification	C:\Program Files\VideoLAN\OfficeClickToRun.exe	43364f9ca16420322a0acc57427148cb0cfa0df14884538f0ce8627dbc9ec983N.exe
File created	C:\Program Files (x86)\Windows Media Player\en-US\56085415360792	43364f9ca16420322a0acc57427148cb0cfa0df14884538f0ce8627dbc9ec983N.exe
File created	C:\Program Files\VideoLAN\OfficeClickToRun.exe	43364f9ca16420322a0acc57427148cb0cfa0df14884538f0ce8627dbc9ec983N.exe
File created	C:\Program Files (x86)\Windows Multimedia Platform\wininit.exe	43364f9ca16420322a0acc57427148cb0cfa0df14884538f0ce8627dbc9ec983N.exe
File opened for modification	C:\Program Files (x86)\Windows Media Player\en-US\wininit.exe	43364f9ca16420322a0acc57427148cb0cfa0df14884538f0ce8627dbc9ec983N.exe
File created	C:\Program Files (x86)\Windows Mail\0a1fd5f707cd16	43364f9ca16420322a0acc57427148cb0cfa0df14884538f0ce8627dbc9ec983N.exe
File opened for modification	C:\Program Files (x86)\Windows Multimedia Platform\RCXB13E.tmp	43364f9ca16420322a0acc57427148cb0cfa0df14884538f0ce8627dbc9ec983N.exe
File opened for modification	C:\Program Files (x86)\Windows Mail\RCXB43E.tmp	43364f9ca16420322a0acc57427148cb0cfa0df14884538f0ce8627dbc9ec983N.exe
File created	C:\Program Files\VideoLAN\e6c9b481da804f	43364f9ca16420322a0acc57427148cb0cfa0df14884538f0ce8627dbc9ec983N.exe
File opened for modification	C:\Program Files (x86)\Windows Mail\RCXB3C0.tmp	43364f9ca16420322a0acc57427148cb0cfa0df14884538f0ce8627dbc9ec983N.exe

Drops file in Windows directory 10 IoCs

description	ioc	Process
File opened for modification	C:\Windows\ImmersiveControlPanel\System.exe	43364f9ca16420322a0acc57427148cb0cfa0df14884538f0ce8627dbc9ec983N.exe
File created	C:\Windows\IME\fr-FR\38384e6a620884	43364f9ca16420322a0acc57427148cb0cfa0df14884538f0ce8627dbc9ec983N.exe
File opened for modification	C:\Windows\ImmersiveControlPanel\RCXA348.tmp	43364f9ca16420322a0acc57427148cb0cfa0df14884538f0ce8627dbc9ec983N.exe
File opened for modification	C:\Windows\IME\fr-FR\RCXAA13.tmp	43364f9ca16420322a0acc57427148cb0cfa0df14884538f0ce8627dbc9ec983N.exe
File created	C:\Windows\ImmersiveControlPanel\System.exe	43364f9ca16420322a0acc57427148cb0cfa0df14884538f0ce8627dbc9ec983N.exe
File created	C:\Windows\ImmersiveControlPanel\27d1bcfc3c54e0	43364f9ca16420322a0acc57427148cb0cfa0df14884538f0ce8627dbc9ec983N.exe
File created	C:\Windows\IME\fr-FR\SearchApp.exe	43364f9ca16420322a0acc57427148cb0cfa0df14884538f0ce8627dbc9ec983N.exe
File opened for modification	C:\Windows\ImmersiveControlPanel\RCXA2AA.tmp	43364f9ca16420322a0acc57427148cb0cfa0df14884538f0ce8627dbc9ec983N.exe
File opened for modification	C:\Windows\IME\fr-FR\RCXAA14.tmp	43364f9ca16420322a0acc57427148cb0cfa0df14884538f0ce8627dbc9ec983N.exe
File opened for modification	C:\Windows\IME\fr-FR\SearchApp.exe	43364f9ca16420322a0acc57427148cb0cfa0df14884538f0ce8627dbc9ec983N.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	43364f9ca16420322a0acc57427148cb0cfa0df14884538f0ce8627dbc9ec983N.exe
Key created	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000_Classes\Local Settings	System.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 27 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
5028	schtasks.exe
3196	schtasks.exe
3504	schtasks.exe
2756	schtasks.exe
544	schtasks.exe
2696	schtasks.exe
4648	schtasks.exe
2384	schtasks.exe
2020	schtasks.exe
3156	schtasks.exe
1320	schtasks.exe
1640	schtasks.exe
2388	schtasks.exe
3108	schtasks.exe
5048	schtasks.exe
3080	schtasks.exe
5032	schtasks.exe
2288	schtasks.exe
2352	schtasks.exe
2096	schtasks.exe
1472	schtasks.exe
3464	schtasks.exe
868	schtasks.exe
1424	schtasks.exe
2160	schtasks.exe
4512	schtasks.exe
1664	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2780	43364f9ca16420322a0acc57427148cb0cfa0df14884538f0ce8627dbc9ec983N.exe
2780	43364f9ca16420322a0acc57427148cb0cfa0df14884538f0ce8627dbc9ec983N.exe
2780	43364f9ca16420322a0acc57427148cb0cfa0df14884538f0ce8627dbc9ec983N.exe
2780	43364f9ca16420322a0acc57427148cb0cfa0df14884538f0ce8627dbc9ec983N.exe
2780	43364f9ca16420322a0acc57427148cb0cfa0df14884538f0ce8627dbc9ec983N.exe
2780	43364f9ca16420322a0acc57427148cb0cfa0df14884538f0ce8627dbc9ec983N.exe
2780	43364f9ca16420322a0acc57427148cb0cfa0df14884538f0ce8627dbc9ec983N.exe
2780	43364f9ca16420322a0acc57427148cb0cfa0df14884538f0ce8627dbc9ec983N.exe
2780	43364f9ca16420322a0acc57427148cb0cfa0df14884538f0ce8627dbc9ec983N.exe
2780	43364f9ca16420322a0acc57427148cb0cfa0df14884538f0ce8627dbc9ec983N.exe
2780	43364f9ca16420322a0acc57427148cb0cfa0df14884538f0ce8627dbc9ec983N.exe
2780	43364f9ca16420322a0acc57427148cb0cfa0df14884538f0ce8627dbc9ec983N.exe
2780	43364f9ca16420322a0acc57427148cb0cfa0df14884538f0ce8627dbc9ec983N.exe
2780	43364f9ca16420322a0acc57427148cb0cfa0df14884538f0ce8627dbc9ec983N.exe
2780	43364f9ca16420322a0acc57427148cb0cfa0df14884538f0ce8627dbc9ec983N.exe
2780	43364f9ca16420322a0acc57427148cb0cfa0df14884538f0ce8627dbc9ec983N.exe
2780	43364f9ca16420322a0acc57427148cb0cfa0df14884538f0ce8627dbc9ec983N.exe
2780	43364f9ca16420322a0acc57427148cb0cfa0df14884538f0ce8627dbc9ec983N.exe
2780	43364f9ca16420322a0acc57427148cb0cfa0df14884538f0ce8627dbc9ec983N.exe
2780	43364f9ca16420322a0acc57427148cb0cfa0df14884538f0ce8627dbc9ec983N.exe
2780	43364f9ca16420322a0acc57427148cb0cfa0df14884538f0ce8627dbc9ec983N.exe
2780	43364f9ca16420322a0acc57427148cb0cfa0df14884538f0ce8627dbc9ec983N.exe
2780	43364f9ca16420322a0acc57427148cb0cfa0df14884538f0ce8627dbc9ec983N.exe
2780	43364f9ca16420322a0acc57427148cb0cfa0df14884538f0ce8627dbc9ec983N.exe
2780	43364f9ca16420322a0acc57427148cb0cfa0df14884538f0ce8627dbc9ec983N.exe
2780	43364f9ca16420322a0acc57427148cb0cfa0df14884538f0ce8627dbc9ec983N.exe
2780	43364f9ca16420322a0acc57427148cb0cfa0df14884538f0ce8627dbc9ec983N.exe
2780	43364f9ca16420322a0acc57427148cb0cfa0df14884538f0ce8627dbc9ec983N.exe
2780	43364f9ca16420322a0acc57427148cb0cfa0df14884538f0ce8627dbc9ec983N.exe
2780	43364f9ca16420322a0acc57427148cb0cfa0df14884538f0ce8627dbc9ec983N.exe
2780	43364f9ca16420322a0acc57427148cb0cfa0df14884538f0ce8627dbc9ec983N.exe
2780	43364f9ca16420322a0acc57427148cb0cfa0df14884538f0ce8627dbc9ec983N.exe
2780	43364f9ca16420322a0acc57427148cb0cfa0df14884538f0ce8627dbc9ec983N.exe
2780	43364f9ca16420322a0acc57427148cb0cfa0df14884538f0ce8627dbc9ec983N.exe
5104	powershell.exe
5104	powershell.exe
3288	powershell.exe
3288	powershell.exe
1932	powershell.exe
1932	powershell.exe
2576	powershell.exe
2576	powershell.exe
4440	powershell.exe
4440	powershell.exe
4528	powershell.exe
4528	powershell.exe
2536	powershell.exe
2536	powershell.exe
4236	powershell.exe
4236	powershell.exe
2780	43364f9ca16420322a0acc57427148cb0cfa0df14884538f0ce8627dbc9ec983N.exe
2780	43364f9ca16420322a0acc57427148cb0cfa0df14884538f0ce8627dbc9ec983N.exe
1416	powershell.exe
1416	powershell.exe
3228	powershell.exe
3228	powershell.exe
1416	powershell.exe
2780	43364f9ca16420322a0acc57427148cb0cfa0df14884538f0ce8627dbc9ec983N.exe
2536	powershell.exe
4236	powershell.exe
5104	powershell.exe
1932	powershell.exe
3288	powershell.exe
2576	powershell.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe

Suspicious use of AdjustPrivilegeToken 15 IoCs

description	pid	Process
Token: SeDebugPrivilege	2780	43364f9ca16420322a0acc57427148cb0cfa0df14884538f0ce8627dbc9ec983N.exe
Token: SeDebugPrivilege	4236	powershell.exe
Token: SeDebugPrivilege	5104	powershell.exe
Token: SeDebugPrivilege	3288	powershell.exe
Token: SeDebugPrivilege	2536	powershell.exe
Token: SeDebugPrivilege	2576	powershell.exe
Token: SeDebugPrivilege	1932	powershell.exe
Token: SeDebugPrivilege	4440	powershell.exe
Token: SeDebugPrivilege	4528	powershell.exe
Token: SeDebugPrivilege	1416	powershell.exe
Token: SeDebugPrivilege	3228	powershell.exe
Token: SeDebugPrivilege	2608	System.exe
Token: SeBackupPrivilege	2620	vssvc.exe
Token: SeRestorePrivilege	2620	vssvc.exe
Token: SeAuditPrivilege	2620	vssvc.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2780 wrote to memory of 3228	2780	43364f9ca16420322a0acc57427148cb0cfa0df14884538f0ce8627dbc9ec983N.exe	110
PID 2780 wrote to memory of 3228	2780	43364f9ca16420322a0acc57427148cb0cfa0df14884538f0ce8627dbc9ec983N.exe	110
PID 2780 wrote to memory of 4440	2780	43364f9ca16420322a0acc57427148cb0cfa0df14884538f0ce8627dbc9ec983N.exe	111
PID 2780 wrote to memory of 4440	2780	43364f9ca16420322a0acc57427148cb0cfa0df14884538f0ce8627dbc9ec983N.exe	111
PID 2780 wrote to memory of 5104	2780	43364f9ca16420322a0acc57427148cb0cfa0df14884538f0ce8627dbc9ec983N.exe	112
PID 2780 wrote to memory of 5104	2780	43364f9ca16420322a0acc57427148cb0cfa0df14884538f0ce8627dbc9ec983N.exe	112
PID 2780 wrote to memory of 2576	2780	43364f9ca16420322a0acc57427148cb0cfa0df14884538f0ce8627dbc9ec983N.exe	113
PID 2780 wrote to memory of 2576	2780	43364f9ca16420322a0acc57427148cb0cfa0df14884538f0ce8627dbc9ec983N.exe	113
PID 2780 wrote to memory of 1416	2780	43364f9ca16420322a0acc57427148cb0cfa0df14884538f0ce8627dbc9ec983N.exe	114
PID 2780 wrote to memory of 1416	2780	43364f9ca16420322a0acc57427148cb0cfa0df14884538f0ce8627dbc9ec983N.exe	114
PID 2780 wrote to memory of 1932	2780	43364f9ca16420322a0acc57427148cb0cfa0df14884538f0ce8627dbc9ec983N.exe	115
PID 2780 wrote to memory of 1932	2780	43364f9ca16420322a0acc57427148cb0cfa0df14884538f0ce8627dbc9ec983N.exe	115
PID 2780 wrote to memory of 4528	2780	43364f9ca16420322a0acc57427148cb0cfa0df14884538f0ce8627dbc9ec983N.exe	116
PID 2780 wrote to memory of 4528	2780	43364f9ca16420322a0acc57427148cb0cfa0df14884538f0ce8627dbc9ec983N.exe	116
PID 2780 wrote to memory of 2536	2780	43364f9ca16420322a0acc57427148cb0cfa0df14884538f0ce8627dbc9ec983N.exe	117
PID 2780 wrote to memory of 2536	2780	43364f9ca16420322a0acc57427148cb0cfa0df14884538f0ce8627dbc9ec983N.exe	117
PID 2780 wrote to memory of 3288	2780	43364f9ca16420322a0acc57427148cb0cfa0df14884538f0ce8627dbc9ec983N.exe	118
PID 2780 wrote to memory of 3288	2780	43364f9ca16420322a0acc57427148cb0cfa0df14884538f0ce8627dbc9ec983N.exe	118
PID 2780 wrote to memory of 4236	2780	43364f9ca16420322a0acc57427148cb0cfa0df14884538f0ce8627dbc9ec983N.exe	119
PID 2780 wrote to memory of 4236	2780	43364f9ca16420322a0acc57427148cb0cfa0df14884538f0ce8627dbc9ec983N.exe	119
PID 2780 wrote to memory of 2608	2780	43364f9ca16420322a0acc57427148cb0cfa0df14884538f0ce8627dbc9ec983N.exe	130
PID 2780 wrote to memory of 2608	2780	43364f9ca16420322a0acc57427148cb0cfa0df14884538f0ce8627dbc9ec983N.exe	130
PID 2608 wrote to memory of 4376	2608	System.exe	133
PID 2608 wrote to memory of 4376	2608	System.exe	133
PID 2608 wrote to memory of 2704	2608	System.exe	134
PID 2608 wrote to memory of 2704	2608	System.exe	134
PID 2608 wrote to memory of 2552	2608	System.exe	141
PID 2608 wrote to memory of 2552	2608	System.exe	141
PID 2552 wrote to memory of 4664	2552	msedge.exe	142
PID 2552 wrote to memory of 4664	2552	msedge.exe	142
PID 2552 wrote to memory of 776	2552	msedge.exe	143
PID 2552 wrote to memory of 776	2552	msedge.exe	143
PID 2552 wrote to memory of 776	2552	msedge.exe	143
PID 2552 wrote to memory of 776	2552	msedge.exe	143
PID 2552 wrote to memory of 776	2552	msedge.exe	143
PID 2552 wrote to memory of 776	2552	msedge.exe	143
PID 2552 wrote to memory of 776	2552	msedge.exe	143
PID 2552 wrote to memory of 776	2552	msedge.exe	143
PID 2552 wrote to memory of 776	2552	msedge.exe	143
PID 2552 wrote to memory of 776	2552	msedge.exe	143
PID 2552 wrote to memory of 776	2552	msedge.exe	143
PID 2552 wrote to memory of 776	2552	msedge.exe	143
PID 2552 wrote to memory of 776	2552	msedge.exe	143
PID 2552 wrote to memory of 776	2552	msedge.exe	143
PID 2552 wrote to memory of 776	2552	msedge.exe	143
PID 2552 wrote to memory of 776	2552	msedge.exe	143
PID 2552 wrote to memory of 776	2552	msedge.exe	143
PID 2552 wrote to memory of 776	2552	msedge.exe	143
PID 2552 wrote to memory of 776	2552	msedge.exe	143
PID 2552 wrote to memory of 776	2552	msedge.exe	143
PID 2552 wrote to memory of 776	2552	msedge.exe	143
PID 2552 wrote to memory of 776	2552	msedge.exe	143
PID 2552 wrote to memory of 776	2552	msedge.exe	143
PID 2552 wrote to memory of 776	2552	msedge.exe	143
PID 2552 wrote to memory of 776	2552	msedge.exe	143
PID 2552 wrote to memory of 776	2552	msedge.exe	143
PID 2552 wrote to memory of 776	2552	msedge.exe	143
PID 2552 wrote to memory of 776	2552	msedge.exe	143
PID 2552 wrote to memory of 776	2552	msedge.exe	143
PID 2552 wrote to memory of 776	2552	msedge.exe	143
PID 2552 wrote to memory of 776	2552	msedge.exe	143
PID 2552 wrote to memory of 776	2552	msedge.exe	143
PID 2552 wrote to memory of 776	2552	msedge.exe	143
PID 2552 wrote to memory of 776	2552	msedge.exe	143

System policy modification 1 TTPs 6 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	43364f9ca16420322a0acc57427148cb0cfa0df14884538f0ce8627dbc9ec983N.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	System.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	System.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	System.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	43364f9ca16420322a0acc57427148cb0cfa0df14884538f0ce8627dbc9ec983N.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	43364f9ca16420322a0acc57427148cb0cfa0df14884538f0ce8627dbc9ec983N.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\43364f9ca16420322a0acc57427148cb0cfa0df14884538f0ce8627dbc9ec983N.exe
"C:\Users\Admin\AppData\Local\Temp\43364f9ca16420322a0acc57427148cb0cfa0df14884538f0ce8627dbc9ec983N.exe"
1⤵
- UAC bypass
- Checks computer location settings
- Checks whether UAC is enabled
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2780
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\43364f9ca16420322a0acc57427148cb0cfa0df14884538f0ce8627dbc9ec983N.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3228
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\ImmersiveControlPanel\System.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4440
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\WindowsRE\wininit.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5104
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Default\SendTo\fontdrvhost.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2576
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\IME\fr-FR\SearchApp.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1416
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Windows Media Player\en-US\wininit.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1932
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\VideoLAN\OfficeClickToRun.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4528
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Windows Multimedia Platform\wininit.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2536
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Windows Mail\sppsvc.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3288
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\All Users\Microsoft\Provisioning\AssetCache\spoolsv.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4236
- C:\Windows\ImmersiveControlPanel\System.exe
  "C:\Windows\ImmersiveControlPanel\System.exe"
  2⤵
  - UAC bypass
  - Checks computer location settings
  - Executes dropped EXE
  - Checks whether UAC is enabled
  - Modifies registry class
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  - System policy modification
  PID:2608
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\2b50b3aa-57b3-449f-9b41-13077d5abaa9.vbs"
    3⤵
    PID:4376
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\3a59c600-09a3-4154-9b01-1d087105fc56.vbs"
    3⤵
    PID:2704
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://localhost:13954/
    3⤵
    - Enumerates system info in registry
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    - Suspicious use of WriteProcessMemory
    PID:2552
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa83b846f8,0x7ffa83b84708,0x7ffa83b84718
      4⤵
      PID:4664
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2172,10388079977735363204,4470501215820030164,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2184 /prefetch:2
      4⤵
      PID:776
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2172,10388079977735363204,4470501215820030164,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2236 /prefetch:3
      4⤵
      PID:4400
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2172,10388079977735363204,4470501215820030164,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2692 /prefetch:8
      4⤵
      PID:1376
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,10388079977735363204,4470501215820030164,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3356 /prefetch:1
      4⤵
      PID:3320
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,10388079977735363204,4470501215820030164,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3364 /prefetch:1
      4⤵
      PID:3744
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,10388079977735363204,4470501215820030164,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4144 /prefetch:1
      4⤵
      PID:4188
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,10388079977735363204,4470501215820030164,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2324 /prefetch:1
      4⤵
      PID:4948
  - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2172,10388079977735363204,4470501215820030164,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4752 /prefetch:8
      4⤵
      PID:3472
  - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2172,10388079977735363204,4470501215820030164,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4752 /prefetch:8
      4⤵
      PID:1256
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,10388079977735363204,4470501215820030164,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3044 /prefetch:1
      4⤵
      PID:1504
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,10388079977735363204,4470501215820030164,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3556 /prefetch:1
      4⤵
      PID:3200
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,10388079977735363204,4470501215820030164,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5164 /prefetch:1
      4⤵
      PID:5204
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,10388079977735363204,4470501215820030164,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4052 /prefetch:1
      4⤵
      PID:5324
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,10388079977735363204,4470501215820030164,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2044 /prefetch:1
      4⤵
      PID:5704

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 12 /tr "'C:\Windows\ImmersiveControlPanel\System.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1472

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "System" /sc ONLOGON /tr "'C:\Windows\ImmersiveControlPanel\System.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2696

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 6 /tr "'C:\Windows\ImmersiveControlPanel\System.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4512

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 14 /tr "'C:\Recovery\WindowsRE\wininit.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5028

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininit" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\wininit.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2288

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 7 /tr "'C:\Recovery\WindowsRE\wininit.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2352

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 10 /tr "'C:\Users\Default\SendTo\fontdrvhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:868

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\Users\Default\SendTo\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4648

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 7 /tr "'C:\Users\Default\SendTo\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2096

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SearchAppS" /sc MINUTE /mo 6 /tr "'C:\Windows\IME\fr-FR\SearchApp.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1320

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SearchApp" /sc ONLOGON /tr "'C:\Windows\IME\fr-FR\SearchApp.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3196

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SearchAppS" /sc MINUTE /mo 7 /tr "'C:\Windows\IME\fr-FR\SearchApp.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3504

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 13 /tr "'C:\Program Files (x86)\Windows Media Player\en-US\wininit.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1640

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininit" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Media Player\en-US\wininit.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1664

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 9 /tr "'C:\Program Files (x86)\Windows Media Player\en-US\wininit.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2756

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OfficeClickToRunO" /sc MINUTE /mo 7 /tr "'C:\Program Files\VideoLAN\OfficeClickToRun.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:544

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OfficeClickToRun" /sc ONLOGON /tr "'C:\Program Files\VideoLAN\OfficeClickToRun.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2384

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OfficeClickToRunO" /sc MINUTE /mo 7 /tr "'C:\Program Files\VideoLAN\OfficeClickToRun.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2388

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 14 /tr "'C:\Program Files (x86)\Windows Multimedia Platform\wininit.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2020

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininit" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Multimedia Platform\wininit.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3108

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 6 /tr "'C:\Program Files (x86)\Windows Multimedia Platform\wininit.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1424

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 10 /tr "'C:\Program Files (x86)\Windows Mail\sppsvc.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3156

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvc" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Mail\sppsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3464

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 5 /tr "'C:\Program Files (x86)\Windows Mail\sppsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5048

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 11 /tr "'C:\Users\All Users\Microsoft\Provisioning\AssetCache\spoolsv.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3080

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsv" /sc ONLOGON /tr "'C:\Users\All Users\Microsoft\Provisioning\AssetCache\spoolsv.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2160

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 13 /tr "'C:\Users\All Users\Microsoft\Provisioning\AssetCache\spoolsv.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5032

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2620

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4428

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4528

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
PID:4080

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Windows Mail\sppsvc.exe

Filesize
1.8MB

MD5
073ba7846142173c5a2afcdefd64b8af

SHA1
241962d2c83e1ed44a3519e2cfe14d97a339f13b

SHA256
a1ee213c89957c65559975ab0a160459ba5630e323c2d2173d23fbb50b27d85a

SHA512
4a5cad0789d1d42c0c8076639a385d3e4bd70877273240854b9aa7b3549f0e83ff4a3203a539b4ed3981da0effa6108c89d4de43f0ea6b40f388ebf9f9482640

Download Submit
C:\Program Files (x86)\Windows Media Player\en-US\wininit.exe

Filesize
1.8MB

MD5
8691b8256074b5ec561c7ef05e4f1830

SHA1
6f1deb8e7057f3669b6d92b14de7086a4a0395eb

SHA256
43364f9ca16420322a0acc57427148cb0cfa0df14884538f0ce8627dbc9ec983

SHA512
e7fcaaf6e787f7eda8ff55ef8bc16d36f48c9b8ec1ebf7a7c7c5be84a05f3a0b1e6e898734cfd2c817922f3151efdfbc8ebe8916153ef6a67930df838036a29e

Download Submit
C:\Program Files (x86)\Windows Media Player\en-US\wininit.exe

Filesize
1.8MB

MD5
89e1d1b652ba6df20dda77c41cf59f95

SHA1
885b869e9b8b4f5d790ab0d282046e42a15857e7

SHA256
6362ca1abc4924b356c3c340d25835ee15e6f14c1199d47fba5f4d0f2fdccce1

SHA512
a8c4d60ee4fdd509c43b18c63139a9024284daa21a541bac264a91470b551bd37e43bc30851748dc927c3beecd0004c2076be153157ba11133c1387867aaeeb9

Download Submit
C:\ProgramData\Microsoft\Provisioning\AssetCache\spoolsv.exe

Filesize
1.8MB

MD5
7dbb406fe86878f790816cc1f3bb3204

SHA1
31bfad6ef0638b200cfbc4df581d56eef6cc49c2

SHA256
4caca56d974a94a7a6a86b39405c61414ece1a5a6d4213141dcc8aec4056105a

SHA512
9e96a2584839d5c53b7d4473b4aebc112900bf71f9760e242844ab0463b2065ddbac0b6713ae319a74a6001edb0eebde1c1a966337216f34dde5d9965f748176

Download Submit
C:\Recovery\WindowsRE\wininit.exe

Filesize
1.8MB

MD5
e2c4d414c87a93c2f5c3e6ccf2f246a7

SHA1
4414a06bb1f34771e78f69166869e2a41a2b8696

SHA256
d6ec2cdb7cb876fffcf17f960749c75be9ac4c0a0936b978932da09409bd1340

SHA512
a7cd0d5818d97acd7064a9511259c04c882a760ae350e09e5f966b90be8c68059c85c5f9cf4244bde526adfe038aeb9c01dff932d20282b7df7f769858fdfd02

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
d85ba6ff808d9e5444a4b369f5bc2730

SHA1
31aa9d96590fff6981b315e0b391b575e4c0804a

SHA256
84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

SHA512
8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ba6ef346187b40694d493da98d5da979

SHA1
643c15bec043f8673943885199bb06cd1652ee37

SHA256
d86eec91f295dfda8ed1c5fa99de426f2fe359282c7ebf67e3a40be739475d73

SHA512
2e6cc97330be8868d4b9c53be7e12c558f6eb1ac2c4080a611ba6c43561d0c5bb4791b8a11a8c2371599f0ba73ed1d9a7a2ea6dee2ae6a080f1912e0cb1f656c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
b8880802fc2bb880a7a869faa01315b0

SHA1
51d1a3fa2c272f094515675d82150bfce08ee8d3

SHA256
467b8cd4aacac66557712f9843023dcedefcc26efc746f3e44157bc8dac73812

SHA512
e1c6dba2579357ba70de58968b167d2c529534d24bff70568144270c48ac18a48ee2af2d58d78ae741e5a36958fa78a57955bd2456f1df00b781fc1002e123d2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\2f4e92cf-de6b-4ef2-a7ba-6dfb129ef7c7.tmp

Filesize
5KB

MD5
b887ea0dc7ebb1c4053dad384a242751

SHA1
a28fa576688fa7ebaadcf92e418734245437c750

SHA256
6a07718a7d89180b2590c8612b95b9b431264839490b2bb2ff80ca3c92d8222c

SHA512
23cf06a584c9d72ff9ee8c8d06904518d3a6aa4db574a6ed5eff49b1c264d60bcb6ef651ef5abb869f98f21bc723f59b6a7133b5afb3b74f6685300e73af2b2f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
d1b6f8f01100e213640d8dad04b3414b

SHA1
57b0429ff4e44a25c3ad3c8ce12bf842b5e2a8af

SHA256
e5f35b9c18f30c0f55f2176cd4dcc07df035cc9a63f8d763406401bf5826de5e

SHA512
00370a40bbfc0565174976083f947aab0176fae660fdeeb7c229681f630ac04ee1c4c142645aa09f912a87c8f698e15a0f33a51baf92713f16f624207c0cfa8f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
06245a9f2e0a462855fcf3b94a83fd6f

SHA1
9dae2738ea4bbeb6de4c7739cf03be238c43ba29

SHA256
7f563185d8fb8d441058453b74f4a8dcf175e96411d22f87453225c0cbd1096a

SHA512
deb3b385978512dc9b15fb8674c4a45c29420f7c7ac85e69c1f486136fb0210ea19e2751ff6c436c10e36d04614cde063e407c68d1f3bf3f0af7008c6d30b2e1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
130ad4b0dffdd717923389a90fee1d2a

SHA1
36f5aa4fc6d9829f28279db48a9079ed8e88bf93

SHA256
c4576170d53f74ec29591159573211ebeb17c2405100b67e6819494e27cbab55

SHA512
af6adbb9225276bd2fbabcbaf1d0540da981d64cd4d8bf3426549e65dc5d292eef360e29e89867daeb8911dd25c82ad580007ddd7ff00188599e33dc4b224226

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
bd5940f08d0be56e65e5f2aaf47c538e

SHA1
d7e31b87866e5e383ab5499da64aba50f03e8443

SHA256
2d2f364c75bd2897504249f42cdf1d19374f5230aad68fa9154ea3d03e3031a6

SHA512
c34d10c7e07da44a180fae9889b61f08903aa84e8ddfa80c31c272b1ef9d491b8cec6b8a4c836c3cb1583fe8f4955c6a8db872515de3a9e10eae09610c959406

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
59d97011e091004eaffb9816aa0b9abd

SHA1
1602a56b01dd4b7c577ca27d3117e4bcc1aa657b

SHA256
18f381e0db020a763b8c515c346ef58679ab9c403267eacfef5359e272f7e71d

SHA512
d9ca49c1a17580981e2c1a50d73c0eecaa7a62f8514741512172e395af2a3d80aeb0f71c58bc7f52c18246d57ba67af09b6bff4776877d6cc6f0245c30e092d6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
cadef9abd087803c630df65264a6c81c

SHA1
babbf3636c347c8727c35f3eef2ee643dbcc4bd2

SHA256
cce65b73cdfe9304bcd5207913e8b60fb69faa20cd3b684f2b0343b755b99438

SHA512
7278aa87124abb382d9024a645e881e7b7cf1b84e8894943b36e018dbf0399e6858392f77980b599fa5488e2e21bf757a0702fe6419417edac93b68e0c2ec085

Download Submit
C:\Users\Admin\AppData\Local\Temp\2b50b3aa-57b3-449f-9b41-13077d5abaa9.vbs

Filesize
719B

MD5
f3e5ca49a21813b711d9ad0c47062065

SHA1
0a3fe5ac39e701fd5e215e59c8f2af648d2407f4

SHA256
84a0e3c94154d1e56ec2db79be815c365b36c8ac9e9e45a3dbba3497ee04b26e

SHA512
071051c49b814fd4d7668538de5370a702d7efd1a22971f3d8f7fd4b689dd15ce1cb40a2ee29df5fb420b91d3b291201f69c553c11e268a826a46f2bf881c955

Download Submit
C:\Users\Admin\AppData\Local\Temp\3a59c600-09a3-4154-9b01-1d087105fc56.vbs

Filesize
495B

MD5
c28466e448f1b096d56edb5300441087

SHA1
56deb84243f4f4f233117d1597282c36c390501e

SHA256
0e703bd79c27a2b7caeeddddd514fd0f08ccdca3dd488a83d534f645770c06ea

SHA512
664ff0bc8f84d7fec4cf026a2c1074cf468e410eb3f7125cea67b5c15131f98b7b858cdf6be4d76a5d78b4a42ece0dc4368d3cc0a167ca2ba0fed5077b983a63

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_eg5ossws.ued.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Windows\ImmersiveControlPanel\System.exe

Filesize
1.8MB

MD5
db5ad52ca080a10f437629e02a64b199

SHA1
385fa043666f047daa9d5ac5c475ed23e44c008d

SHA256
76c2ead63ee33c06328c3bc5f93b7e46bfdafb13cf31a4d50fbf77d5a9e32f6d

SHA512
b8e4b7f97c8a4cd9d06da3e4ce06a8082145a4a10b47189c57043f1594c658834f866ec1d55e4d2102d53466fded9603e8c0332f79cea40da24742a38d878186

Download Submit
memory/2608-302-0x00000000006D0000-0x000000000089C000-memory.dmp

Filesize
1.8MB

Download
memory/2780-25-0x00007FFA8A940000-0x00007FFA8B401000-memory.dmp

Filesize
10.8MB

Download
memory/2780-304-0x00007FFA8A940000-0x00007FFA8B401000-memory.dmp

Filesize
10.8MB

Download
memory/2780-13-0x000000001B120000-0x000000001B12C000-memory.dmp

Filesize
48KB

Download
memory/2780-24-0x00007FFA8A940000-0x00007FFA8B401000-memory.dmp

Filesize
10.8MB

Download
memory/2780-12-0x000000001B110000-0x000000001B11C000-memory.dmp

Filesize
48KB

Download
memory/2780-11-0x000000001B100000-0x000000001B10C000-memory.dmp

Filesize
48KB

Download
memory/2780-10-0x000000001B0D0000-0x000000001B0DC000-memory.dmp

Filesize
48KB

Download
memory/2780-137-0x00007FFA8A943000-0x00007FFA8A945000-memory.dmp

Filesize
8KB

Download
memory/2780-7-0x000000001B0A0000-0x000000001B0B6000-memory.dmp

Filesize
88KB

Download
memory/2780-149-0x00007FFA8A940000-0x00007FFA8B401000-memory.dmp

Filesize
10.8MB

Download
memory/2780-150-0x00007FFA8A940000-0x00007FFA8B401000-memory.dmp

Filesize
10.8MB

Download
memory/2780-17-0x000000001B9C0000-0x000000001B9CA000-memory.dmp

Filesize
40KB

Download
memory/2780-1-0x00000000002A0000-0x000000000046C000-memory.dmp

Filesize
1.8MB

Download
memory/2780-18-0x000000001BA10000-0x000000001BA1E000-memory.dmp

Filesize
56KB

Download
memory/2780-303-0x00007FFA8A940000-0x00007FFA8B401000-memory.dmp

Filesize
10.8MB

Download
memory/2780-14-0x000000001B790000-0x000000001B79C000-memory.dmp

Filesize
48KB

Download
memory/2780-9-0x000000001B0F0000-0x000000001B0FA000-memory.dmp

Filesize
40KB

Download
memory/2780-0-0x00007FFA8A943000-0x00007FFA8A945000-memory.dmp

Filesize
8KB

Download
memory/2780-19-0x000000001BA20000-0x000000001BA28000-memory.dmp

Filesize
32KB

Download
memory/2780-21-0x000000001BA40000-0x000000001BA4C000-memory.dmp

Filesize
48KB

Download
memory/2780-20-0x000000001BA30000-0x000000001BA3C000-memory.dmp

Filesize
48KB

Download
memory/2780-16-0x000000001B9B0000-0x000000001B9BC000-memory.dmp

Filesize
48KB

Download
memory/2780-8-0x000000001B0C0000-0x000000001B0C8000-memory.dmp

Filesize
32KB

Download
memory/2780-15-0x000000001B9A0000-0x000000001B9A8000-memory.dmp

Filesize
32KB

Download
memory/2780-4-0x000000001B740000-0x000000001B790000-memory.dmp

Filesize
320KB

Download
memory/2780-5-0x0000000002660000-0x0000000002668000-memory.dmp

Filesize
32KB

Download
memory/2780-6-0x000000001B090000-0x000000001B0A0000-memory.dmp

Filesize
64KB

Download
memory/2780-3-0x0000000002640000-0x000000000265C000-memory.dmp

Filesize
112KB

Download
memory/2780-2-0x00007FFA8A940000-0x00007FFA8B401000-memory.dmp

Filesize
10.8MB

Download
memory/3288-218-0x000001F653FD0000-0x000001F653FF2000-memory.dmp

Filesize
136KB

Download