dcrat | e52790fad710c0c1b12fbd9ea860621073af0615c796cd4fbd08fb6fb48982ed

Analysis

max time kernel
149s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
06-12-2024 05:24

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6f8def1aecbdb57d595fdb2520dc7009.exe
Size

1.8MB
MD5

6f8def1aecbdb57d595fdb2520dc7009
SHA1

117dedc36c0146a0557e191ac78f22dc61c96b74
SHA256

e52790fad710c0c1b12fbd9ea860621073af0615c796cd4fbd08fb6fb48982ed
SHA512

a929f473cbd7a3c3e8d494ccb472ee75e0ca5915ff965bc95020b5b5df24205505601337dcaf0e5750ed441c5293e3b91b8bca4813e577d5ef350a9aaa7a28c7
SSDEEP

49152:5WqKKPZ1snfJ+rqDPuQDLME5MT4rDQNpfh:jKKZ1sRD2Q3N5MT4r

Score

10^/10

dcrat evasion execution infostealer rat trojan

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat
Dcrat family
dcrat

Process spawned unexpected child process 24 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4556	1144	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1996	1144	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2676	1144	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2144	1144	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1852	1144	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1564	1144	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	680	1144	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4908	1144	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3060	1144	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1676	1144	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4092	1144	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2448	1144	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1432	1144	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1380	1144	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	216	1144	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1428	1144	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2284	1144	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3768	1144	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1460	1144	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3908	1144	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5012	1144	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3820	1144	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3572	1144	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3900	1144	schtasks.exe	83

UAC bypass 3 TTPs 6 IoCs

evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	6f8def1aecbdb57d595fdb2520dc7009.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	6f8def1aecbdb57d595fdb2520dc7009.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	SppExtComObj.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	SppExtComObj.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	SppExtComObj.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	6f8def1aecbdb57d595fdb2520dc7009.exe

DCRat payload 7 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral2/memory/1276-1-0x00000000002A0000-0x000000000046C000-memory.dmp	dcrat
behavioral2/files/0x000a000000023b98-32.dat	dcrat
behavioral2/files/0x000c000000023ba9-77.dat	dcrat
behavioral2/files/0x000d000000023b90-100.dat	dcrat
behavioral2/files/0x000c000000023b98-111.dat	dcrat
behavioral2/files/0x000c000000023b9c-122.dat	dcrat
behavioral2/files/0x000c000000023ba0-133.dat	dcrat

Command and Scripting Interpreter: PowerShell 1 TTPs 9 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
752	powershell.exe
4920	powershell.exe
3048	powershell.exe
2616	powershell.exe
3260	powershell.exe
3028	powershell.exe
1344	powershell.exe
3888	powershell.exe
4508	powershell.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation	SppExtComObj.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation	6f8def1aecbdb57d595fdb2520dc7009.exe

Executes dropped EXE 1 IoCs

pid	Process
1784	SppExtComObj.exe

Checks whether UAC is enabled 1 TTPs 4 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	6f8def1aecbdb57d595fdb2520dc7009.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	6f8def1aecbdb57d595fdb2520dc7009.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	SppExtComObj.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	SppExtComObj.exe

Drops file in Program Files directory 20 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\logs\RCXBE45.tmp	6f8def1aecbdb57d595fdb2520dc7009.exe
File opened for modification	C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\RCXC2DD.tmp	6f8def1aecbdb57d595fdb2520dc7009.exe
File opened for modification	C:\Program Files\7-Zip\Lang\RCXC7F2.tmp	6f8def1aecbdb57d595fdb2520dc7009.exe
File opened for modification	C:\Program Files\7-Zip\Lang\Idle.exe	6f8def1aecbdb57d595fdb2520dc7009.exe
File opened for modification	C:\Program Files (x86)\Windows Portable Devices\Registry.exe	6f8def1aecbdb57d595fdb2520dc7009.exe
File created	C:\Program Files (x86)\Windows Portable Devices\Registry.exe	6f8def1aecbdb57d595fdb2520dc7009.exe
File created	C:\Program Files (x86)\Windows Portable Devices\ee2ad38f3d4382	6f8def1aecbdb57d595fdb2520dc7009.exe
File opened for modification	C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\RCXC34B.tmp	6f8def1aecbdb57d595fdb2520dc7009.exe
File opened for modification	C:\Program Files (x86)\Windows Portable Devices\RCXCAE3.tmp	6f8def1aecbdb57d595fdb2520dc7009.exe
File created	C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\aa97147c4c782d	6f8def1aecbdb57d595fdb2520dc7009.exe
File created	C:\Program Files\7-Zip\Lang\6ccacd8608530f	6f8def1aecbdb57d595fdb2520dc7009.exe
File created	C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\MusNotification.exe	6f8def1aecbdb57d595fdb2520dc7009.exe
File created	C:\Program Files\7-Zip\Lang\Idle.exe	6f8def1aecbdb57d595fdb2520dc7009.exe
File opened for modification	C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\MusNotification.exe	6f8def1aecbdb57d595fdb2520dc7009.exe
File opened for modification	C:\Program Files (x86)\Windows Portable Devices\RCXCA65.tmp	6f8def1aecbdb57d595fdb2520dc7009.exe
File created	C:\Program Files (x86)\Mozilla Maintenance Service\logs\csrss.exe	6f8def1aecbdb57d595fdb2520dc7009.exe
File created	C:\Program Files (x86)\Mozilla Maintenance Service\logs\886983d96e3d3e	6f8def1aecbdb57d595fdb2520dc7009.exe
File opened for modification	C:\Program Files\7-Zip\Lang\RCXC860.tmp	6f8def1aecbdb57d595fdb2520dc7009.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\logs\RCXBEC3.tmp	6f8def1aecbdb57d595fdb2520dc7009.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\logs\csrss.exe	6f8def1aecbdb57d595fdb2520dc7009.exe

Drops file in Windows directory 10 IoCs

description	ioc	Process
File opened for modification	C:\Windows\ImmersiveControlPanel\pris\explorer.exe	6f8def1aecbdb57d595fdb2520dc7009.exe
File created	C:\Windows\ImmersiveControlPanel\pris\7a0fd90576e088	6f8def1aecbdb57d595fdb2520dc7009.exe
File created	C:\Windows\Globalization\ELS\backgroundTaskHost.exe	6f8def1aecbdb57d595fdb2520dc7009.exe
File created	C:\Windows\Globalization\ELS\eddb19405b7ce1	6f8def1aecbdb57d595fdb2520dc7009.exe
File opened for modification	C:\Windows\ImmersiveControlPanel\pris\RCXBA1B.tmp	6f8def1aecbdb57d595fdb2520dc7009.exe
File created	C:\Windows\ImmersiveControlPanel\pris\explorer.exe	6f8def1aecbdb57d595fdb2520dc7009.exe
File opened for modification	C:\Windows\ImmersiveControlPanel\pris\RCXBA1A.tmp	6f8def1aecbdb57d595fdb2520dc7009.exe
File opened for modification	C:\Windows\Globalization\ELS\RCXBC30.tmp	6f8def1aecbdb57d595fdb2520dc7009.exe
File opened for modification	C:\Windows\Globalization\ELS\RCXBC31.tmp	6f8def1aecbdb57d595fdb2520dc7009.exe
File opened for modification	C:\Windows\Globalization\ELS\backgroundTaskHost.exe	6f8def1aecbdb57d595fdb2520dc7009.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	6f8def1aecbdb57d595fdb2520dc7009.exe
Key created	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000_Classes\Local Settings	SppExtComObj.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 24 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2676	schtasks.exe
1852	schtasks.exe
1564	schtasks.exe
2284	schtasks.exe
1996	schtasks.exe
3060	schtasks.exe
1432	schtasks.exe
1380	schtasks.exe
3908	schtasks.exe
5012	schtasks.exe
3820	schtasks.exe
3900	schtasks.exe
2144	schtasks.exe
1676	schtasks.exe
4092	schtasks.exe
2448	schtasks.exe
1428	schtasks.exe
3768	schtasks.exe
4556	schtasks.exe
680	schtasks.exe
4908	schtasks.exe
216	schtasks.exe
1460	schtasks.exe
3572	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1276	6f8def1aecbdb57d595fdb2520dc7009.exe
1276	6f8def1aecbdb57d595fdb2520dc7009.exe
1276	6f8def1aecbdb57d595fdb2520dc7009.exe
1276	6f8def1aecbdb57d595fdb2520dc7009.exe
1276	6f8def1aecbdb57d595fdb2520dc7009.exe
1276	6f8def1aecbdb57d595fdb2520dc7009.exe
1276	6f8def1aecbdb57d595fdb2520dc7009.exe
1276	6f8def1aecbdb57d595fdb2520dc7009.exe
1276	6f8def1aecbdb57d595fdb2520dc7009.exe
1276	6f8def1aecbdb57d595fdb2520dc7009.exe
1276	6f8def1aecbdb57d595fdb2520dc7009.exe
1276	6f8def1aecbdb57d595fdb2520dc7009.exe
1276	6f8def1aecbdb57d595fdb2520dc7009.exe
1276	6f8def1aecbdb57d595fdb2520dc7009.exe
1276	6f8def1aecbdb57d595fdb2520dc7009.exe
1276	6f8def1aecbdb57d595fdb2520dc7009.exe
1276	6f8def1aecbdb57d595fdb2520dc7009.exe
1276	6f8def1aecbdb57d595fdb2520dc7009.exe
1276	6f8def1aecbdb57d595fdb2520dc7009.exe
1276	6f8def1aecbdb57d595fdb2520dc7009.exe
1276	6f8def1aecbdb57d595fdb2520dc7009.exe
1276	6f8def1aecbdb57d595fdb2520dc7009.exe
1276	6f8def1aecbdb57d595fdb2520dc7009.exe
1276	6f8def1aecbdb57d595fdb2520dc7009.exe
1276	6f8def1aecbdb57d595fdb2520dc7009.exe
1276	6f8def1aecbdb57d595fdb2520dc7009.exe
1276	6f8def1aecbdb57d595fdb2520dc7009.exe
1276	6f8def1aecbdb57d595fdb2520dc7009.exe
1276	6f8def1aecbdb57d595fdb2520dc7009.exe
1276	6f8def1aecbdb57d595fdb2520dc7009.exe
1276	6f8def1aecbdb57d595fdb2520dc7009.exe
1276	6f8def1aecbdb57d595fdb2520dc7009.exe
1276	6f8def1aecbdb57d595fdb2520dc7009.exe
1276	6f8def1aecbdb57d595fdb2520dc7009.exe
1276	6f8def1aecbdb57d595fdb2520dc7009.exe
1276	6f8def1aecbdb57d595fdb2520dc7009.exe
1276	6f8def1aecbdb57d595fdb2520dc7009.exe
1276	6f8def1aecbdb57d595fdb2520dc7009.exe
1276	6f8def1aecbdb57d595fdb2520dc7009.exe
1276	6f8def1aecbdb57d595fdb2520dc7009.exe
1276	6f8def1aecbdb57d595fdb2520dc7009.exe
3260	powershell.exe
1344	powershell.exe
1344	powershell.exe
3888	powershell.exe
3028	powershell.exe
3888	powershell.exe
3028	powershell.exe
2616	powershell.exe
2616	powershell.exe
3048	powershell.exe
3048	powershell.exe
4920	powershell.exe
4920	powershell.exe
1276	6f8def1aecbdb57d595fdb2520dc7009.exe
1276	6f8def1aecbdb57d595fdb2520dc7009.exe
752	powershell.exe
752	powershell.exe
4508	powershell.exe
4508	powershell.exe
1276	6f8def1aecbdb57d595fdb2520dc7009.exe
3028	powershell.exe
2616	powershell.exe
3260	powershell.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1784	SppExtComObj.exe

Suspicious use of AdjustPrivilegeToken 14 IoCs

description	pid	Process
Token: SeDebugPrivilege	1276	6f8def1aecbdb57d595fdb2520dc7009.exe
Token: SeDebugPrivilege	3260	powershell.exe
Token: SeDebugPrivilege	1344	powershell.exe
Token: SeDebugPrivilege	752	powershell.exe
Token: SeDebugPrivilege	3028	powershell.exe
Token: SeDebugPrivilege	3888	powershell.exe
Token: SeDebugPrivilege	2616	powershell.exe
Token: SeDebugPrivilege	4920	powershell.exe
Token: SeDebugPrivilege	3048	powershell.exe
Token: SeDebugPrivilege	4508	powershell.exe
Token: SeDebugPrivilege	1784	SppExtComObj.exe
Token: SeBackupPrivilege	5032	vssvc.exe
Token: SeRestorePrivilege	5032	vssvc.exe
Token: SeAuditPrivilege	5032	vssvc.exe

Suspicious use of WriteProcessMemory 24 IoCs

description	pid	Process	procid_target
PID 1276 wrote to memory of 4920	1276	6f8def1aecbdb57d595fdb2520dc7009.exe	109
PID 1276 wrote to memory of 4920	1276	6f8def1aecbdb57d595fdb2520dc7009.exe	109
PID 1276 wrote to memory of 4508	1276	6f8def1aecbdb57d595fdb2520dc7009.exe	110
PID 1276 wrote to memory of 4508	1276	6f8def1aecbdb57d595fdb2520dc7009.exe	110
PID 1276 wrote to memory of 3028	1276	6f8def1aecbdb57d595fdb2520dc7009.exe	111
PID 1276 wrote to memory of 3028	1276	6f8def1aecbdb57d595fdb2520dc7009.exe	111
PID 1276 wrote to memory of 3888	1276	6f8def1aecbdb57d595fdb2520dc7009.exe	112
PID 1276 wrote to memory of 3888	1276	6f8def1aecbdb57d595fdb2520dc7009.exe	112
PID 1276 wrote to memory of 1344	1276	6f8def1aecbdb57d595fdb2520dc7009.exe	113
PID 1276 wrote to memory of 1344	1276	6f8def1aecbdb57d595fdb2520dc7009.exe	113
PID 1276 wrote to memory of 3260	1276	6f8def1aecbdb57d595fdb2520dc7009.exe	114
PID 1276 wrote to memory of 3260	1276	6f8def1aecbdb57d595fdb2520dc7009.exe	114
PID 1276 wrote to memory of 3048	1276	6f8def1aecbdb57d595fdb2520dc7009.exe	115
PID 1276 wrote to memory of 3048	1276	6f8def1aecbdb57d595fdb2520dc7009.exe	115
PID 1276 wrote to memory of 2616	1276	6f8def1aecbdb57d595fdb2520dc7009.exe	116
PID 1276 wrote to memory of 2616	1276	6f8def1aecbdb57d595fdb2520dc7009.exe	116
PID 1276 wrote to memory of 752	1276	6f8def1aecbdb57d595fdb2520dc7009.exe	117
PID 1276 wrote to memory of 752	1276	6f8def1aecbdb57d595fdb2520dc7009.exe	117
PID 1276 wrote to memory of 1784	1276	6f8def1aecbdb57d595fdb2520dc7009.exe	127
PID 1276 wrote to memory of 1784	1276	6f8def1aecbdb57d595fdb2520dc7009.exe	127
PID 1784 wrote to memory of 4468	1784	SppExtComObj.exe	129
PID 1784 wrote to memory of 4468	1784	SppExtComObj.exe	129
PID 1784 wrote to memory of 4092	1784	SppExtComObj.exe	130
PID 1784 wrote to memory of 4092	1784	SppExtComObj.exe	130

System policy modification 1 TTPs 6 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	6f8def1aecbdb57d595fdb2520dc7009.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	6f8def1aecbdb57d595fdb2520dc7009.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	6f8def1aecbdb57d595fdb2520dc7009.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	SppExtComObj.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	SppExtComObj.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	SppExtComObj.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\6f8def1aecbdb57d595fdb2520dc7009.exe
"C:\Users\Admin\AppData\Local\Temp\6f8def1aecbdb57d595fdb2520dc7009.exe"
1⤵
- UAC bypass
- Checks computer location settings
- Checks whether UAC is enabled
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1276
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\6f8def1aecbdb57d595fdb2520dc7009.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4920
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\ImmersiveControlPanel\pris\explorer.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4508
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\Globalization\ELS\backgroundTaskHost.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3028
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Mozilla Maintenance Service\logs\csrss.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3888
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\All Users\Oracle\SppExtComObj.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1344
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\MusNotification.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3260
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\WindowsRE\csrss.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3048
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\7-Zip\Lang\Idle.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2616
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Windows Portable Devices\Registry.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:752
- C:\Users\All Users\Oracle\SppExtComObj.exe
  "C:\Users\All Users\Oracle\SppExtComObj.exe"
  2⤵
  - UAC bypass
  - Checks computer location settings
  - Executes dropped EXE
  - Checks whether UAC is enabled
  - Modifies registry class
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  - System policy modification
  PID:1784
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\0f05e227-9b9f-4cb1-a14a-ee25ef28b0eb.vbs"
    3⤵
    PID:4468
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\302af0de-c2e1-49fd-952b-0997b01baac5.vbs"
    3⤵
    PID:4092

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 5 /tr "'C:\Windows\ImmersiveControlPanel\pris\explorer.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4556

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorer" /sc ONLOGON /tr "'C:\Windows\ImmersiveControlPanel\pris\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1996

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 12 /tr "'C:\Windows\ImmersiveControlPanel\pris\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2676

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "backgroundTaskHostb" /sc MINUTE /mo 6 /tr "'C:\Windows\Globalization\ELS\backgroundTaskHost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2144

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "backgroundTaskHost" /sc ONLOGON /tr "'C:\Windows\Globalization\ELS\backgroundTaskHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1852

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "backgroundTaskHostb" /sc MINUTE /mo 12 /tr "'C:\Windows\Globalization\ELS\backgroundTaskHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1564

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 11 /tr "'C:\Program Files (x86)\Mozilla Maintenance Service\logs\csrss.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:680

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Program Files (x86)\Mozilla Maintenance Service\logs\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4908

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 12 /tr "'C:\Program Files (x86)\Mozilla Maintenance Service\logs\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3060

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SppExtComObjS" /sc MINUTE /mo 9 /tr "'C:\Users\All Users\Oracle\SppExtComObj.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1676

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SppExtComObj" /sc ONLOGON /tr "'C:\Users\All Users\Oracle\SppExtComObj.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4092

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SppExtComObjS" /sc MINUTE /mo 13 /tr "'C:\Users\All Users\Oracle\SppExtComObj.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2448

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "MusNotificationM" /sc MINUTE /mo 11 /tr "'C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\MusNotification.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1432

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "MusNotification" /sc ONLOGON /tr "'C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\MusNotification.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1380

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "MusNotificationM" /sc MINUTE /mo 8 /tr "'C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\MusNotification.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:216

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 7 /tr "'C:\Recovery\WindowsRE\csrss.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1428

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2284

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 13 /tr "'C:\Recovery\WindowsRE\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3768

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 11 /tr "'C:\Program Files\7-Zip\Lang\Idle.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1460

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Idle" /sc ONLOGON /tr "'C:\Program Files\7-Zip\Lang\Idle.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3908

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 7 /tr "'C:\Program Files\7-Zip\Lang\Idle.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5012

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RegistryR" /sc MINUTE /mo 10 /tr "'C:\Program Files (x86)\Windows Portable Devices\Registry.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3572

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Registry" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Portable Devices\Registry.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3820

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RegistryR" /sc MINUTE /mo 6 /tr "'C:\Program Files (x86)\Windows Portable Devices\Registry.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3900

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:5032

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
PID:4624

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Mozilla Maintenance Service\logs\csrss.exe

Filesize
1.8MB

MD5
e98d5b55374fdd060bb42ad45d7aab72

SHA1
20209260b696f3bd3ddb0cdb994653a8c2f5f866

SHA256
618652e8bbf30b5644c73d97b1801567d7cbbf7a408b8b1d5cdfb9105d558ffe

SHA512
a18120e5e70ad4ab8a3ff8cf18137592a29fed73943bca4746b4deafe3b2913373c659a67f3ed214ff745e5a9e4c4cb920e2d7abb9dd677c15d4bc2b7db27380

Download Submit
C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\MusNotification.exe

Filesize
1.8MB

MD5
6f8def1aecbdb57d595fdb2520dc7009

SHA1
117dedc36c0146a0557e191ac78f22dc61c96b74

SHA256
e52790fad710c0c1b12fbd9ea860621073af0615c796cd4fbd08fb6fb48982ed

SHA512
a929f473cbd7a3c3e8d494ccb472ee75e0ca5915ff965bc95020b5b5df24205505601337dcaf0e5750ed441c5293e3b91b8bca4813e577d5ef350a9aaa7a28c7

Download Submit
C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\MusNotification.exe

Filesize
1.8MB

MD5
cddc57be789af3c064eb6305c11ab5f7

SHA1
a22325fb41164f27ceae67932718eebfa93de1e4

SHA256
8badf7d7c959f0dac5f6193745f0d8b2cb3d66f5c60818ee675d3d290448dcca

SHA512
ff423c3ddc8fa71f1480af0418377cf74675ccb7d889567e27f7544f4c05e8dff499789569e465a55c188adb90ded1c2f64b60e3d00b912c684fc2b70e534112

Download Submit
C:\Program Files (x86)\Windows Portable Devices\Registry.exe

Filesize
1.8MB

MD5
9db7e37cdcac9dcb92ce095ca88a6f19

SHA1
a90bdf07cb53d452d574b556ab72e7aaf89c569f

SHA256
b4b39066fba79ace13acdf8a03e41d41a82326fffc58dfdabbcbde75c905200f

SHA512
22f57471c44db8bb1356c22956f26e3952d8d22fb4573c7722a9cc99197658f345c23eafa546066c4b8e55dd1f77941cde259564d1cdcb8f74585010d5b4f7f3

Download Submit
C:\Program Files\7-Zip\Lang\Idle.exe

Filesize
1.8MB

MD5
e24817b4d63e1d74a127730678e98358

SHA1
91af5ee06a40a075e8224adf29d5bf725391f533

SHA256
7d28de1b0d25be825bb805c7f285bfa7bb12039ba1616d167fa0769139811821

SHA512
2e7bd8a7e7dbc38880f04503354f0a656be68c959a51ad0c3c93cc98945484c7ef1bcf50deeb4934ad33879060bb18581ed06affc9187372245c512083b35217

Download Submit
C:\Recovery\WindowsRE\csrss.exe

Filesize
1.8MB

MD5
38743b0bd1b1fea9656b7a931040b6fa

SHA1
df44899c56e8762f23c5590cb47a6874e6980103

SHA256
f98d09c3560b728148c24a5f49bd56df7dbd03e2e2630cc48d21ed06b4a54367

SHA512
d67094dded5e7f9e4b1b1fe8c694c7390093490cef5f43fa1a9d18af29e211ab0e51941716413ae4663e2b0cb357a937000533c248bc4bd18103eb29ba9701f4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
d85ba6ff808d9e5444a4b369f5bc2730

SHA1
31aa9d96590fff6981b315e0b391b575e4c0804a

SHA256
84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

SHA512
8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
62623d22bd9e037191765d5083ce16a3

SHA1
4a07da6872672f715a4780513d95ed8ddeefd259

SHA256
95d79fd575bbd21540e378fcbc1cd00d16f51af62ce15bae7080bb72c24e2010

SHA512
9a448b7a0d867466c2ea04ab84d2a9485d5fd20ab53b2b854f491831ee3f1d781b94d2635f7b0b35cb9f2d373cd52c67570879a56a42ed66bc9db06962ed4992

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
77d622bb1a5b250869a3238b9bc1402b

SHA1
d47f4003c2554b9dfc4c16f22460b331886b191b

SHA256
f97ff12a8abf4bf88bb6497bd2ac2da12628c8847a8ba5a9026bdbb76507cdfb

SHA512
d6789b5499f23c9035375a102271e17a8a82e57d6f5312fa24242e08a83efdeb8becb7622f55c4cf1b89c7d864b445df11f4d994cf7e2f87a900535bcca12fd9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
d28a889fd956d5cb3accfbaf1143eb6f

SHA1
157ba54b365341f8ff06707d996b3635da8446f7

SHA256
21e5d7ccf80a293e6ba30ed728846ca19c929c52b96e2c8d34e27cd2234f1d45

SHA512
0b6d88deb9be85722e6a78d5886d49f2caf407a59e128d2b4ed74c1356f9928c40048a62731959f2460e9ff9d9feee311043d2a37abe3bb92c2b76a44281478c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
59d97011e091004eaffb9816aa0b9abd

SHA1
1602a56b01dd4b7c577ca27d3117e4bcc1aa657b

SHA256
18f381e0db020a763b8c515c346ef58679ab9c403267eacfef5359e272f7e71d

SHA512
d9ca49c1a17580981e2c1a50d73c0eecaa7a62f8514741512172e395af2a3d80aeb0f71c58bc7f52c18246d57ba67af09b6bff4776877d6cc6f0245c30e092d6

Download Submit
C:\Users\Admin\AppData\Local\Temp\0f05e227-9b9f-4cb1-a14a-ee25ef28b0eb.vbs

Filesize
718B

MD5
cff37ea76a088b3e7dcc5e5b5f383164

SHA1
434e1dbdb86f472aa721013b1c20bc1228779d5b

SHA256
d5cdc7ecc672342cd92c7f1a142b81fd8c604bc03daa246e6a1df9af368f3f31

SHA512
dbf83aa7b666faaf4cf81595103cef23174bde6703c87f7268690c58b79d442ed412489ee85149f1b907cf5f0f78b032e07b92e47629504d16826f5c7f70f36c

Download Submit
C:\Users\Admin\AppData\Local\Temp\302af0de-c2e1-49fd-952b-0997b01baac5.vbs

Filesize
494B

MD5
48c4af2734db79076fa1ed5c34a7aca5

SHA1
baf16cd81ba01c2b8db77dcb62f45f92382d05f1

SHA256
559c1a853605c10f55335100a7322cfd051980f80087ad1f5f86bb1d54bb1ed3

SHA512
4f1f7f642e81d889695907368835ff9badf9fa22bea8154d3820c66b14b5bff6af9173057734e94cce45943fdcb11c75084038b408d0c430b4f8f3f10b53fd8c

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_agvpmbfw.4az.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
memory/1276-25-0x00007FFA03C40000-0x00007FFA04701000-memory.dmp

Filesize
10.8MB

Download
memory/1276-11-0x000000001B150000-0x000000001B15C000-memory.dmp

Filesize
48KB

Download
memory/1276-16-0x000000001B9B0000-0x000000001B9BC000-memory.dmp

Filesize
48KB

Download
memory/1276-20-0x000000001B9F0000-0x000000001B9FC000-memory.dmp

Filesize
48KB

Download
memory/1276-21-0x000000001BA40000-0x000000001BA4C000-memory.dmp

Filesize
48KB

Download
memory/1276-19-0x000000001B9E0000-0x000000001B9E8000-memory.dmp

Filesize
32KB

Download
memory/1276-0-0x00007FFA03C43000-0x00007FFA03C45000-memory.dmp

Filesize
8KB

Download
memory/1276-22-0x00007FFA03C40000-0x00007FFA04701000-memory.dmp

Filesize
10.8MB

Download
memory/1276-18-0x000000001B9D0000-0x000000001B9DE000-memory.dmp

Filesize
56KB

Download
memory/1276-17-0x000000001B9C0000-0x000000001B9CA000-memory.dmp

Filesize
40KB

Download
memory/1276-14-0x000000001B790000-0x000000001B79C000-memory.dmp

Filesize
48KB

Download
memory/1276-13-0x000000001B780000-0x000000001B78C000-memory.dmp

Filesize
48KB

Download
memory/1276-12-0x000000001B160000-0x000000001B16C000-memory.dmp

Filesize
48KB

Download
memory/1276-15-0x000000001B9A0000-0x000000001B9A8000-memory.dmp

Filesize
32KB

Download
memory/1276-10-0x000000001B0F0000-0x000000001B0FC000-memory.dmp

Filesize
48KB

Download
memory/1276-9-0x000000001B0E0000-0x000000001B0EA000-memory.dmp

Filesize
40KB

Download
memory/1276-1-0x00000000002A0000-0x000000000046C000-memory.dmp

Filesize
1.8MB

Download
memory/1276-4-0x000000001B100000-0x000000001B150000-memory.dmp

Filesize
320KB

Download
memory/1276-267-0x00007FFA03C43000-0x00007FFA03C45000-memory.dmp

Filesize
8KB

Download
memory/1276-279-0x00007FFA03C40000-0x00007FFA04701000-memory.dmp

Filesize
10.8MB

Download
memory/1276-5-0x0000000002580000-0x0000000002588000-memory.dmp

Filesize
32KB

Download
memory/1276-7-0x000000001B0B0000-0x000000001B0C6000-memory.dmp

Filesize
88KB

Download
memory/1276-8-0x000000001B0D0000-0x000000001B0D8000-memory.dmp

Filesize
32KB

Download
memory/1276-6-0x00000000025A0000-0x00000000025B0000-memory.dmp

Filesize
64KB

Download
memory/1276-3-0x000000001B090000-0x000000001B0AC000-memory.dmp

Filesize
112KB

Download
memory/1276-2-0x00007FFA03C40000-0x00007FFA04701000-memory.dmp

Filesize
10.8MB

Download
memory/3260-190-0x0000018928AB0000-0x0000018928AD2000-memory.dmp

Filesize
136KB

Download