dcrat | c94fe393a995fde11c3e7923320972f8000d18a40a597d886258784684ad4339

Analysis

max time kernel
119s
max time network
119s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
10-12-2024 17:20

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c94fe393a995fde11c3e7923320972f8000d18a40a597d886258784684ad4339N.exe
Size

1.7MB
MD5

6bcfacff2920b20d946173bf95750330
SHA1

7a6166a959e12742b8d01ffe953ca1bd63bc000f
SHA256

c94fe393a995fde11c3e7923320972f8000d18a40a597d886258784684ad4339
SHA512

896bac1f6043b3f1b863f120450f747154d3d116c4bdcd725bc0d6c63b59345e8ca4ada1e0a794561854db8468356dfd9e17dac296dfa8097621f2d3b90c584f
SSDEEP

49152:T+gYXZTD1VXUqzX7VwjvMoh1IFyuyigWnMzm6sDBKv:+THUxUoh1IF9gl2

Score

10^/10

dcrat execution infostealer rat

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat
Dcrat family
dcrat

Process spawned unexpected child process 15 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2740	2276	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2816	2276	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2684	2276	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	768	2276	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2140	2276	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2108	2276	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2620	2276	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2668	2276	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2352	2276	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2564	2276	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2608	2276	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2584	2276	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2104	2276	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2768	2276	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1324	2276	schtasks.exe	30

DCRat payload 9 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral1/memory/2336-1-0x00000000008A0000-0x0000000000A60000-memory.dmp	dcrat
behavioral1/files/0x0005000000019506-27.dat	dcrat
behavioral1/files/0x000900000001967f-66.dat	dcrat
behavioral1/files/0x0008000000019279-77.dat	dcrat
behavioral1/memory/2728-161-0x00000000011D0000-0x0000000001390000-memory.dmp	dcrat
behavioral1/memory/2920-173-0x0000000000010000-0x00000000001D0000-memory.dmp	dcrat
behavioral1/memory/2604-186-0x0000000000E70000-0x0000000001030000-memory.dmp	dcrat
behavioral1/memory/2476-209-0x00000000001B0000-0x0000000000370000-memory.dmp	dcrat
behavioral1/memory/1948-221-0x0000000000B40000-0x0000000000D00000-memory.dmp	dcrat

Command and Scripting Interpreter: PowerShell 1 TTPs 12 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
2912	powershell.exe
2952	powershell.exe
1612	powershell.exe
1808	powershell.exe
2264	powershell.exe
2384	powershell.exe
2628	powershell.exe
3048	powershell.exe
2928	powershell.exe
2252	powershell.exe
1896	powershell.exe
2260	powershell.exe

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\drivers\etc\hosts	c94fe393a995fde11c3e7923320972f8000d18a40a597d886258784684ad4339N.exe

Executes dropped EXE 7 IoCs

pid	Process
2728	OSPPSVC.exe
2920	OSPPSVC.exe
2604	OSPPSVC.exe
772	OSPPSVC.exe
2476	OSPPSVC.exe
1948	OSPPSVC.exe
2192	OSPPSVC.exe

Drops file in Program Files directory 20 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Adobe\Reader 9.0\Esl\f3b6ecef712a24	c94fe393a995fde11c3e7923320972f8000d18a40a597d886258784684ad4339N.exe
File opened for modification	C:\Program Files\Windows Media Player\RCXB81C.tmp	c94fe393a995fde11c3e7923320972f8000d18a40a597d886258784684ad4339N.exe
File opened for modification	C:\Program Files (x86)\Microsoft Synchronization Services\ADO.NET\v1.0\OSPPSVC.exe	c94fe393a995fde11c3e7923320972f8000d18a40a597d886258784684ad4339N.exe
File opened for modification	C:\Program Files (x86)\Google\Temp\RCXBE96.tmp	c94fe393a995fde11c3e7923320972f8000d18a40a597d886258784684ad4339N.exe
File opened for modification	C:\Program Files\Windows Media Player\winlogon.exe	c94fe393a995fde11c3e7923320972f8000d18a40a597d886258784684ad4339N.exe
File created	C:\Program Files (x86)\Microsoft Synchronization Services\ADO.NET\v1.0\1610b97d3ab4a7	c94fe393a995fde11c3e7923320972f8000d18a40a597d886258784684ad4339N.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Esl\RCXBA1F.tmp	c94fe393a995fde11c3e7923320972f8000d18a40a597d886258784684ad4339N.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Esl\RCXBA20.tmp	c94fe393a995fde11c3e7923320972f8000d18a40a597d886258784684ad4339N.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Esl\spoolsv.exe	c94fe393a995fde11c3e7923320972f8000d18a40a597d886258784684ad4339N.exe
File created	C:\Program Files\Windows Media Player\cc11b995f2a76d	c94fe393a995fde11c3e7923320972f8000d18a40a597d886258784684ad4339N.exe
File created	C:\Program Files (x86)\Microsoft Synchronization Services\ADO.NET\v1.0\OSPPSVC.exe	c94fe393a995fde11c3e7923320972f8000d18a40a597d886258784684ad4339N.exe
File created	C:\Program Files (x86)\Google\Temp\27d1bcfc3c54e0	c94fe393a995fde11c3e7923320972f8000d18a40a597d886258784684ad4339N.exe
File opened for modification	C:\Program Files (x86)\Google\Temp\System.exe	c94fe393a995fde11c3e7923320972f8000d18a40a597d886258784684ad4339N.exe
File created	C:\Program Files (x86)\Adobe\Reader 9.0\Esl\spoolsv.exe	c94fe393a995fde11c3e7923320972f8000d18a40a597d886258784684ad4339N.exe
File created	C:\Program Files (x86)\Google\Temp\System.exe	c94fe393a995fde11c3e7923320972f8000d18a40a597d886258784684ad4339N.exe
File opened for modification	C:\Program Files\Windows Media Player\RCXB80B.tmp	c94fe393a995fde11c3e7923320972f8000d18a40a597d886258784684ad4339N.exe
File opened for modification	C:\Program Files (x86)\Microsoft Synchronization Services\ADO.NET\v1.0\RCXBC24.tmp	c94fe393a995fde11c3e7923320972f8000d18a40a597d886258784684ad4339N.exe
File opened for modification	C:\Program Files (x86)\Microsoft Synchronization Services\ADO.NET\v1.0\RCXBC92.tmp	c94fe393a995fde11c3e7923320972f8000d18a40a597d886258784684ad4339N.exe
File opened for modification	C:\Program Files (x86)\Google\Temp\RCXBF04.tmp	c94fe393a995fde11c3e7923320972f8000d18a40a597d886258784684ad4339N.exe
File created	C:\Program Files\Windows Media Player\winlogon.exe	c94fe393a995fde11c3e7923320972f8000d18a40a597d886258784684ad4339N.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Scheduled Task/Job: Scheduled Task 1 TTPs 15 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2740	schtasks.exe
2816	schtasks.exe
2108	schtasks.exe
2620	schtasks.exe
2608	schtasks.exe
2768	schtasks.exe
1324	schtasks.exe
768	schtasks.exe
2668	schtasks.exe
2584	schtasks.exe
2684	schtasks.exe
2140	schtasks.exe
2352	schtasks.exe
2564	schtasks.exe
2104	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2336	c94fe393a995fde11c3e7923320972f8000d18a40a597d886258784684ad4339N.exe
2336	c94fe393a995fde11c3e7923320972f8000d18a40a597d886258784684ad4339N.exe
2336	c94fe393a995fde11c3e7923320972f8000d18a40a597d886258784684ad4339N.exe
2336	c94fe393a995fde11c3e7923320972f8000d18a40a597d886258784684ad4339N.exe
2336	c94fe393a995fde11c3e7923320972f8000d18a40a597d886258784684ad4339N.exe
2336	c94fe393a995fde11c3e7923320972f8000d18a40a597d886258784684ad4339N.exe
2336	c94fe393a995fde11c3e7923320972f8000d18a40a597d886258784684ad4339N.exe
2336	c94fe393a995fde11c3e7923320972f8000d18a40a597d886258784684ad4339N.exe
2336	c94fe393a995fde11c3e7923320972f8000d18a40a597d886258784684ad4339N.exe
2336	c94fe393a995fde11c3e7923320972f8000d18a40a597d886258784684ad4339N.exe
2336	c94fe393a995fde11c3e7923320972f8000d18a40a597d886258784684ad4339N.exe
2336	c94fe393a995fde11c3e7923320972f8000d18a40a597d886258784684ad4339N.exe
2336	c94fe393a995fde11c3e7923320972f8000d18a40a597d886258784684ad4339N.exe
2336	c94fe393a995fde11c3e7923320972f8000d18a40a597d886258784684ad4339N.exe
2336	c94fe393a995fde11c3e7923320972f8000d18a40a597d886258784684ad4339N.exe
2336	c94fe393a995fde11c3e7923320972f8000d18a40a597d886258784684ad4339N.exe
2336	c94fe393a995fde11c3e7923320972f8000d18a40a597d886258784684ad4339N.exe
2260	powershell.exe
1896	powershell.exe
2952	powershell.exe
2336	c94fe393a995fde11c3e7923320972f8000d18a40a597d886258784684ad4339N.exe
2336	c94fe393a995fde11c3e7923320972f8000d18a40a597d886258784684ad4339N.exe
1808	powershell.exe
2252	powershell.exe
2928	powershell.exe
2628	powershell.exe
1612	powershell.exe
2912	powershell.exe
2264	powershell.exe
3048	powershell.exe
2384	powershell.exe
2336	c94fe393a995fde11c3e7923320972f8000d18a40a597d886258784684ad4339N.exe
2336	c94fe393a995fde11c3e7923320972f8000d18a40a597d886258784684ad4339N.exe
2728	OSPPSVC.exe
2728	OSPPSVC.exe
2728	OSPPSVC.exe
2728	OSPPSVC.exe
2728	OSPPSVC.exe
2728	OSPPSVC.exe
2728	OSPPSVC.exe
2728	OSPPSVC.exe
2728	OSPPSVC.exe
2728	OSPPSVC.exe
2728	OSPPSVC.exe
2728	OSPPSVC.exe
2728	OSPPSVC.exe
2728	OSPPSVC.exe
2728	OSPPSVC.exe
2728	OSPPSVC.exe
2728	OSPPSVC.exe
2728	OSPPSVC.exe
2728	OSPPSVC.exe
2728	OSPPSVC.exe
2728	OSPPSVC.exe
2728	OSPPSVC.exe
2728	OSPPSVC.exe
2728	OSPPSVC.exe
2728	OSPPSVC.exe
2728	OSPPSVC.exe
2728	OSPPSVC.exe
2728	OSPPSVC.exe
2728	OSPPSVC.exe
2728	OSPPSVC.exe
2728	OSPPSVC.exe

Suspicious use of AdjustPrivilegeToken 19 IoCs

description	pid	Process
Token: SeDebugPrivilege	2336	c94fe393a995fde11c3e7923320972f8000d18a40a597d886258784684ad4339N.exe
Token: SeDebugPrivilege	2260	powershell.exe
Token: SeDebugPrivilege	1896	powershell.exe
Token: SeDebugPrivilege	2952	powershell.exe
Token: SeDebugPrivilege	1808	powershell.exe
Token: SeDebugPrivilege	2252	powershell.exe
Token: SeDebugPrivilege	2928	powershell.exe
Token: SeDebugPrivilege	2628	powershell.exe
Token: SeDebugPrivilege	1612	powershell.exe
Token: SeDebugPrivilege	2912	powershell.exe
Token: SeDebugPrivilege	2264	powershell.exe
Token: SeDebugPrivilege	3048	powershell.exe
Token: SeDebugPrivilege	2384	powershell.exe
Token: SeDebugPrivilege	2728	OSPPSVC.exe
Token: SeDebugPrivilege	2920	OSPPSVC.exe
Token: SeDebugPrivilege	2604	OSPPSVC.exe
Token: SeDebugPrivilege	772	OSPPSVC.exe
Token: SeDebugPrivilege	2476	OSPPSVC.exe
Token: SeDebugPrivilege	1948	OSPPSVC.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2336 wrote to memory of 2952	2336	c94fe393a995fde11c3e7923320972f8000d18a40a597d886258784684ad4339N.exe	46
PID 2336 wrote to memory of 2952	2336	c94fe393a995fde11c3e7923320972f8000d18a40a597d886258784684ad4339N.exe	46
PID 2336 wrote to memory of 2952	2336	c94fe393a995fde11c3e7923320972f8000d18a40a597d886258784684ad4339N.exe	46
PID 2336 wrote to memory of 2928	2336	c94fe393a995fde11c3e7923320972f8000d18a40a597d886258784684ad4339N.exe	47
PID 2336 wrote to memory of 2928	2336	c94fe393a995fde11c3e7923320972f8000d18a40a597d886258784684ad4339N.exe	47
PID 2336 wrote to memory of 2928	2336	c94fe393a995fde11c3e7923320972f8000d18a40a597d886258784684ad4339N.exe	47
PID 2336 wrote to memory of 2912	2336	c94fe393a995fde11c3e7923320972f8000d18a40a597d886258784684ad4339N.exe	48
PID 2336 wrote to memory of 2912	2336	c94fe393a995fde11c3e7923320972f8000d18a40a597d886258784684ad4339N.exe	48
PID 2336 wrote to memory of 2912	2336	c94fe393a995fde11c3e7923320972f8000d18a40a597d886258784684ad4339N.exe	48
PID 2336 wrote to memory of 3048	2336	c94fe393a995fde11c3e7923320972f8000d18a40a597d886258784684ad4339N.exe	50
PID 2336 wrote to memory of 3048	2336	c94fe393a995fde11c3e7923320972f8000d18a40a597d886258784684ad4339N.exe	50
PID 2336 wrote to memory of 3048	2336	c94fe393a995fde11c3e7923320972f8000d18a40a597d886258784684ad4339N.exe	50
PID 2336 wrote to memory of 2260	2336	c94fe393a995fde11c3e7923320972f8000d18a40a597d886258784684ad4339N.exe	51
PID 2336 wrote to memory of 2260	2336	c94fe393a995fde11c3e7923320972f8000d18a40a597d886258784684ad4339N.exe	51
PID 2336 wrote to memory of 2260	2336	c94fe393a995fde11c3e7923320972f8000d18a40a597d886258784684ad4339N.exe	51
PID 2336 wrote to memory of 1612	2336	c94fe393a995fde11c3e7923320972f8000d18a40a597d886258784684ad4339N.exe	52
PID 2336 wrote to memory of 1612	2336	c94fe393a995fde11c3e7923320972f8000d18a40a597d886258784684ad4339N.exe	52
PID 2336 wrote to memory of 1612	2336	c94fe393a995fde11c3e7923320972f8000d18a40a597d886258784684ad4339N.exe	52
PID 2336 wrote to memory of 1896	2336	c94fe393a995fde11c3e7923320972f8000d18a40a597d886258784684ad4339N.exe	54
PID 2336 wrote to memory of 1896	2336	c94fe393a995fde11c3e7923320972f8000d18a40a597d886258784684ad4339N.exe	54
PID 2336 wrote to memory of 1896	2336	c94fe393a995fde11c3e7923320972f8000d18a40a597d886258784684ad4339N.exe	54
PID 2336 wrote to memory of 2628	2336	c94fe393a995fde11c3e7923320972f8000d18a40a597d886258784684ad4339N.exe	55
PID 2336 wrote to memory of 2628	2336	c94fe393a995fde11c3e7923320972f8000d18a40a597d886258784684ad4339N.exe	55
PID 2336 wrote to memory of 2628	2336	c94fe393a995fde11c3e7923320972f8000d18a40a597d886258784684ad4339N.exe	55
PID 2336 wrote to memory of 2384	2336	c94fe393a995fde11c3e7923320972f8000d18a40a597d886258784684ad4339N.exe	56
PID 2336 wrote to memory of 2384	2336	c94fe393a995fde11c3e7923320972f8000d18a40a597d886258784684ad4339N.exe	56
PID 2336 wrote to memory of 2384	2336	c94fe393a995fde11c3e7923320972f8000d18a40a597d886258784684ad4339N.exe	56
PID 2336 wrote to memory of 2264	2336	c94fe393a995fde11c3e7923320972f8000d18a40a597d886258784684ad4339N.exe	58
PID 2336 wrote to memory of 2264	2336	c94fe393a995fde11c3e7923320972f8000d18a40a597d886258784684ad4339N.exe	58
PID 2336 wrote to memory of 2264	2336	c94fe393a995fde11c3e7923320972f8000d18a40a597d886258784684ad4339N.exe	58
PID 2336 wrote to memory of 2252	2336	c94fe393a995fde11c3e7923320972f8000d18a40a597d886258784684ad4339N.exe	59
PID 2336 wrote to memory of 2252	2336	c94fe393a995fde11c3e7923320972f8000d18a40a597d886258784684ad4339N.exe	59
PID 2336 wrote to memory of 2252	2336	c94fe393a995fde11c3e7923320972f8000d18a40a597d886258784684ad4339N.exe	59
PID 2336 wrote to memory of 1808	2336	c94fe393a995fde11c3e7923320972f8000d18a40a597d886258784684ad4339N.exe	60
PID 2336 wrote to memory of 1808	2336	c94fe393a995fde11c3e7923320972f8000d18a40a597d886258784684ad4339N.exe	60
PID 2336 wrote to memory of 1808	2336	c94fe393a995fde11c3e7923320972f8000d18a40a597d886258784684ad4339N.exe	60
PID 2336 wrote to memory of 2728	2336	c94fe393a995fde11c3e7923320972f8000d18a40a597d886258784684ad4339N.exe	70
PID 2336 wrote to memory of 2728	2336	c94fe393a995fde11c3e7923320972f8000d18a40a597d886258784684ad4339N.exe	70
PID 2336 wrote to memory of 2728	2336	c94fe393a995fde11c3e7923320972f8000d18a40a597d886258784684ad4339N.exe	70
PID 2728 wrote to memory of 2792	2728	OSPPSVC.exe	72
PID 2728 wrote to memory of 2792	2728	OSPPSVC.exe	72
PID 2728 wrote to memory of 2792	2728	OSPPSVC.exe	72
PID 2728 wrote to memory of 2756	2728	OSPPSVC.exe	73
PID 2728 wrote to memory of 2756	2728	OSPPSVC.exe	73
PID 2728 wrote to memory of 2756	2728	OSPPSVC.exe	73
PID 2792 wrote to memory of 2920	2792	WScript.exe	74
PID 2792 wrote to memory of 2920	2792	WScript.exe	74
PID 2792 wrote to memory of 2920	2792	WScript.exe	74
PID 2920 wrote to memory of 900	2920	OSPPSVC.exe	75
PID 2920 wrote to memory of 900	2920	OSPPSVC.exe	75
PID 2920 wrote to memory of 900	2920	OSPPSVC.exe	75
PID 2920 wrote to memory of 2976	2920	OSPPSVC.exe	76
PID 2920 wrote to memory of 2976	2920	OSPPSVC.exe	76
PID 2920 wrote to memory of 2976	2920	OSPPSVC.exe	76
PID 900 wrote to memory of 2604	900	WScript.exe	77
PID 900 wrote to memory of 2604	900	WScript.exe	77
PID 900 wrote to memory of 2604	900	WScript.exe	77
PID 2604 wrote to memory of 1656	2604	OSPPSVC.exe	78
PID 2604 wrote to memory of 1656	2604	OSPPSVC.exe	78
PID 2604 wrote to memory of 1656	2604	OSPPSVC.exe	78
PID 2604 wrote to memory of 1664	2604	OSPPSVC.exe	79
PID 2604 wrote to memory of 1664	2604	OSPPSVC.exe	79
PID 2604 wrote to memory of 1664	2604	OSPPSVC.exe	79
PID 1656 wrote to memory of 772	1656	WScript.exe	80

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\c94fe393a995fde11c3e7923320972f8000d18a40a597d886258784684ad4339N.exe
"C:\Users\Admin\AppData\Local\Temp\c94fe393a995fde11c3e7923320972f8000d18a40a597d886258784684ad4339N.exe"
1⤵
- Drops file in Drivers directory
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2336
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2952
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/$Recycle.Bin/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2928
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Documents and Settings/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2912
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/MSOCache/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3048
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/PerfLogs/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2260
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1612
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files (x86)/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1896
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/ProgramData/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2628
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Recovery/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2384
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/System Volume Information/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2264
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Users/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2252
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Windows/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1808
- C:\Program Files (x86)\Microsoft Synchronization Services\ADO.NET\v1.0\OSPPSVC.exe
  "C:\Program Files (x86)\Microsoft Synchronization Services\ADO.NET\v1.0\OSPPSVC.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2728
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\5514232e-e2a4-418b-8943-21a4514b74ac.vbs"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2792
  - - C:\Program Files (x86)\Microsoft Synchronization Services\ADO.NET\v1.0\OSPPSVC.exe
      "C:\Program Files (x86)\Microsoft Synchronization Services\ADO.NET\v1.0\OSPPSVC.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:2920
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\0f1448c2-978f-4de4-b3d4-56235289a6aa.vbs"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:900
      - C:\Program Files (x86)\Microsoft Synchronization Services\ADO.NET\v1.0\OSPPSVC.exe
        
        "C:\Program Files (x86)\Microsoft Synchronization Services\ADO.NET\v1.0\OSPPSVC.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2604
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\b5956f9d-132f-4227-bdaf-51db23c77058.vbs"
        7⤵
        Suspicious use of WriteProcessMemory
        
        PID:1656
        
        C:\Program Files (x86)\Microsoft Synchronization Services\ADO.NET\v1.0\OSPPSVC.exe
        
        "C:\Program Files (x86)\Microsoft Synchronization Services\ADO.NET\v1.0\OSPPSVC.exe"
        8⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:772
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\85aa41f1-f720-4774-b31c-2d009abbc03f.vbs"
        9⤵
        
        PID:1884
        
        C:\Program Files (x86)\Microsoft Synchronization Services\ADO.NET\v1.0\OSPPSVC.exe
        
        "C:\Program Files (x86)\Microsoft Synchronization Services\ADO.NET\v1.0\OSPPSVC.exe"
        10⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:2476
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\d2cb9215-b7d3-485e-a066-773907b71ffa.vbs"
        11⤵
        
        PID:1724
        
        C:\Program Files (x86)\Microsoft Synchronization Services\ADO.NET\v1.0\OSPPSVC.exe
        
        "C:\Program Files (x86)\Microsoft Synchronization Services\ADO.NET\v1.0\OSPPSVC.exe"
        12⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:1948
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\a50a93c1-2b72-48af-9aab-408aa4957258.vbs"
        13⤵
        
        PID:1672
        
        C:\Program Files (x86)\Microsoft Synchronization Services\ADO.NET\v1.0\OSPPSVC.exe
        
        "C:\Program Files (x86)\Microsoft Synchronization Services\ADO.NET\v1.0\OSPPSVC.exe"
        14⤵
        Executes dropped EXE
        
        PID:2192
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\c219f54c-536b-4566-8a8d-bb7e47f23593.vbs"
        15⤵
        
        PID:1804
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\1ee18b8d-452e-48f3-ac7c-daac506cd6c2.vbs"
        15⤵
        
        PID:2220
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\ac36a71d-96cd-48a2-9c96-60bd9dddff96.vbs"
        13⤵
        
        PID:2420
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\046de2ad-2f46-4890-9ef1-5e44ecf3c5fc.vbs"
        11⤵
        
        PID:1940
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\e3dff093-aee1-48a6-b3b1-8444a66530aa.vbs"
        9⤵
        
        PID:2540
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\09cb0006-aae7-416e-aaa3-567b6c3531ce.vbs"
        7⤵
        
        PID:1664
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\f07290e7-ae29-4f22-a305-b151825dd310.vbs"
        5⤵
        
        PID:2976
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\4f45d5fa-6e25-4a18-9602-3f93c532c71f.vbs"
    3⤵
    PID:2756

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 14 /tr "'C:\Program Files\Windows Media Player\winlogon.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2740

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogon" /sc ONLOGON /tr "'C:\Program Files\Windows Media Player\winlogon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2816

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 11 /tr "'C:\Program Files\Windows Media Player\winlogon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2684

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 8 /tr "'C:\Program Files (x86)\Adobe\Reader 9.0\Esl\spoolsv.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:768

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsv" /sc ONLOGON /tr "'C:\Program Files (x86)\Adobe\Reader 9.0\Esl\spoolsv.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2140

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 6 /tr "'C:\Program Files (x86)\Adobe\Reader 9.0\Esl\spoolsv.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2108

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OSPPSVCO" /sc MINUTE /mo 8 /tr "'C:\Program Files (x86)\Microsoft Synchronization Services\ADO.NET\v1.0\OSPPSVC.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2620

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OSPPSVC" /sc ONLOGON /tr "'C:\Program Files (x86)\Microsoft Synchronization Services\ADO.NET\v1.0\OSPPSVC.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2668

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OSPPSVCO" /sc MINUTE /mo 11 /tr "'C:\Program Files (x86)\Microsoft Synchronization Services\ADO.NET\v1.0\OSPPSVC.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2352

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 14 /tr "'C:\Program Files (x86)\Google\Temp\System.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2564

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "System" /sc ONLOGON /tr "'C:\Program Files (x86)\Google\Temp\System.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2608

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 9 /tr "'C:\Program Files (x86)\Google\Temp\System.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2584

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 9 /tr "'C:\MSOCache\All Users\{90140000-001A-0409-0000-0000000FF1CE}-C\services.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2104

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "services" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-001A-0409-0000-0000000FF1CE}-C\services.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2768

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 13 /tr "'C:\MSOCache\All Users\{90140000-001A-0409-0000-0000000FF1CE}-C\services.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1324

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\MSOCache\All Users\{90140000-001A-0409-0000-0000000FF1CE}-C\services.exe

Filesize
1.7MB

MD5
6bcfacff2920b20d946173bf95750330

SHA1
7a6166a959e12742b8d01ffe953ca1bd63bc000f

SHA256
c94fe393a995fde11c3e7923320972f8000d18a40a597d886258784684ad4339

SHA512
896bac1f6043b3f1b863f120450f747154d3d116c4bdcd725bc0d6c63b59345e8ca4ada1e0a794561854db8468356dfd9e17dac296dfa8097621f2d3b90c584f

Download Submit
C:\Program Files (x86)\Google\Temp\System.exe

Filesize
1.7MB

MD5
5eced9e7d0b7b40ac73fe0f8acab8391

SHA1
ddcca033c5e85f03da78d216b8b17d90e1375a46

SHA256
61679ae80b041e1109cd29500664650ac6c1bd41fb476e2432b3211ca1b45a98

SHA512
30de3e7aeeac0d40c05a4bc428719d8dcf49568f320c8324da53662451a42a1961236fa7ab0efc3d3e833cba93ae007203d069a16d67190638b4ae2ceaced30d

Download Submit
C:\Program Files (x86)\Microsoft Synchronization Services\ADO.NET\v1.0\OSPPSVC.exe

Filesize
1.7MB

MD5
95dddb7e5880af7468403af9a87b2d8d

SHA1
e575e09ebd27f0cdc534003d668fb0609caef252

SHA256
160b84c5c3ca4993046eb0904e1317fa9933b58d458856a3125aa32cab4c8f00

SHA512
880f095ff55e54e6fddb531f94b16e5524bfa1b1f76ab4a68f6db7d916c5cbb209ca5378bd11df46231860668d3dd60840a1935dfe532db9244af32dd472808e

Download Submit
C:\Users\Admin\AppData\Local\Temp\0f1448c2-978f-4de4-b3d4-56235289a6aa.vbs

Filesize
758B

MD5
97b0f732ce371c5fb53d5b2cf3fb047c

SHA1
ffa65138bca6bad61c0f7582e6c37ea7a01aa7d7

SHA256
5848efec9d2c39df9d9492e3decc63fda8bca9eb7acf50d323a6f069f8e930fa

SHA512
cfc7da3347b3f934da85d470f27d028dd4917b78e9c9361e4a4af2915fb7c4a96dbf37189ffa13564aa98d844d086626b402fd022e9abf04032000cb34497ef5

Download Submit
C:\Users\Admin\AppData\Local\Temp\4f45d5fa-6e25-4a18-9602-3f93c532c71f.vbs

Filesize
534B

MD5
933b735d16f9b7487248c046e6fd7326

SHA1
56a4576388bd45ead170dcb70e9a9dd8a8b9df86

SHA256
008fb77080901dcc91c889bfdfee68de6596d5a64fb0359fc8ea9bd6ebbca69d

SHA512
2830c583eb1641963d39355b7d8db63beefd324046def7a65142fd109e61c84db723ea9295399c46bee78c7eaa4544b7dcc2cf9a9b49bcbd90deca78d4a04c52

Download Submit
C:\Users\Admin\AppData\Local\Temp\5514232e-e2a4-418b-8943-21a4514b74ac.vbs

Filesize
758B

MD5
adfde80d873bcc99b7616fa653d1ad19

SHA1
949f3f49d65f368937d42891bd1e92bfc0c8d9c4

SHA256
1e0dbf8c5a3af3631ef0d0e4a6fe6544ca2c00330c9d7fb73c4885dfe4c0c126

SHA512
a3cefda3cec064324c2464cc35dd8c0e25606a4a3f5654b0b37a60cc3c184b6cceb348b9229acdee7d485a727d66c75a0a5e8ff00f7bcbd60904127658575cbb

Download Submit
C:\Users\Admin\AppData\Local\Temp\85aa41f1-f720-4774-b31c-2d009abbc03f.vbs

Filesize
757B

MD5
a48296d16918c580963eaa735cb0d1b4

SHA1
79d1300869e1b99febeba4b2d53caaaa1893cb02

SHA256
ec72c6ddf2a1a32be230801146025aee166009a79dc8c5a222845a9a521888e4

SHA512
df232d7ae91744db7c3535f00fa3d0fe596997eccf32653037da456b1fdbde45280bdec98035010e227325ecde6293d6f702fde7df104ade1f3d46ac0a9de0d0

Download Submit
C:\Users\Admin\AppData\Local\Temp\a50a93c1-2b72-48af-9aab-408aa4957258.vbs

Filesize
758B

MD5
12a23aea1721a10715970e11d1b99684

SHA1
f6c519233f878d0fedd4a30de91dcc7ddcb46fee

SHA256
455d8fb2f5c0ef165b0c889876b34c1c9b0ec8ee63395e69fbf384b801092085

SHA512
7ea572dc1228d71861009937abb6289e1d3b83039d642a1d4068807a5e669946e0dfeba67825851ac3dc6cb2be7a4bea9cc73a0ae7461d59884f559869f0a9d2

Download Submit
C:\Users\Admin\AppData\Local\Temp\b5956f9d-132f-4227-bdaf-51db23c77058.vbs

Filesize
758B

MD5
4b61159b906515164ea610135f2a8bb0

SHA1
39e9e53d881f1792c5e0b4e60dbeb96ba91f1edd

SHA256
6578031a0f59621493884fc254d5d07c86cb38ab278a54ed9e4da7be5f3ee05e

SHA512
11d768176673bcd7b8cab17ae0a1e15472e3a32def0fa280fa9b114bc273f2ce9dbd80a9410a159fd16d876994f374f944b0088996caca361e8a2c4a11eec76c

Download Submit
C:\Users\Admin\AppData\Local\Temp\d2cb9215-b7d3-485e-a066-773907b71ffa.vbs

Filesize
758B

MD5
d1402036809e4781b6c3d302ade86995

SHA1
8d73c63087676ab921b5b09b551d0917ccb5b417

SHA256
a81c0820d1d54d8cf983213180826d3d336bab9c29d791cdcc93c12e2984752f

SHA512
8c7f5fd7fb7998d49bd26f527785db0cf39aa14a5e99574a2c0a97771e603f4f28df3b838b7ee50be4a295008f6f7c0789eea7b0ea31a6b8fe0e8d95c19b0dc2

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
7KB

MD5
652c3beca9b0f36241c8c3bb3f9eda90

SHA1
990ff8316cc5f65d3f797815a126699693f25240

SHA256
258e297a8cdb68ed9a988e76761a0a2f60ac74ce6c6e84eee9b405ec926df9c7

SHA512
e6e0ec25e2314fb14e3b98f97aee6c2e43ea52af55fd23e6d4bae275f6a1abf31e8a3663f02cbeba96218d4c1f39e0819e9269245ca0bece3de48c40212fb1c8

Download Submit
memory/1948-221-0x0000000000B40000-0x0000000000D00000-memory.dmp

Filesize
1.8MB

Download
memory/2260-109-0x0000000002070000-0x0000000002078000-memory.dmp

Filesize
32KB

Download
memory/2260-107-0x000000001B620000-0x000000001B902000-memory.dmp

Filesize
2.9MB

Download
memory/2336-16-0x0000000000540000-0x000000000054C000-memory.dmp

Filesize
48KB

Download
memory/2336-0-0x000007FEF6083000-0x000007FEF6084000-memory.dmp

Filesize
4KB

Download
memory/2336-17-0x00000000006D0000-0x00000000006DC000-memory.dmp

Filesize
48KB

Download
memory/2336-20-0x000007FEF6080000-0x000007FEF6A6C000-memory.dmp

Filesize
9.9MB

Download
memory/2336-5-0x0000000000170000-0x0000000000180000-memory.dmp

Filesize
64KB

Download
memory/2336-4-0x0000000000160000-0x0000000000168000-memory.dmp

Filesize
32KB

Download
memory/2336-3-0x0000000000140000-0x000000000015C000-memory.dmp

Filesize
112KB

Download
memory/2336-6-0x0000000000390000-0x00000000003A6000-memory.dmp

Filesize
88KB

Download
memory/2336-14-0x0000000000520000-0x000000000052E000-memory.dmp

Filesize
56KB

Download
memory/2336-13-0x0000000000510000-0x000000000051A000-memory.dmp

Filesize
40KB

Download
memory/2336-7-0x0000000000180000-0x0000000000190000-memory.dmp

Filesize
64KB

Download
memory/2336-160-0x000007FEF6080000-0x000007FEF6A6C000-memory.dmp

Filesize
9.9MB

Download
memory/2336-8-0x0000000000430000-0x000000000043C000-memory.dmp

Filesize
48KB

Download
memory/2336-15-0x0000000000530000-0x0000000000538000-memory.dmp

Filesize
32KB

Download
memory/2336-2-0x000007FEF6080000-0x000007FEF6A6C000-memory.dmp

Filesize
9.9MB

Download
memory/2336-9-0x0000000000440000-0x0000000000448000-memory.dmp

Filesize
32KB

Download
memory/2336-11-0x0000000000450000-0x0000000000462000-memory.dmp

Filesize
72KB

Download
memory/2336-1-0x00000000008A0000-0x0000000000A60000-memory.dmp

Filesize
1.8MB

Download
memory/2336-12-0x0000000000500000-0x000000000050C000-memory.dmp

Filesize
48KB

Download
memory/2476-209-0x00000000001B0000-0x0000000000370000-memory.dmp

Filesize
1.8MB

Download
memory/2604-186-0x0000000000E70000-0x0000000001030000-memory.dmp

Filesize
1.8MB

Download
memory/2728-162-0x00000000004D0000-0x00000000004E2000-memory.dmp

Filesize
72KB

Download
memory/2728-161-0x00000000011D0000-0x0000000001390000-memory.dmp

Filesize
1.8MB

Download
memory/2920-174-0x0000000000790000-0x00000000007A2000-memory.dmp

Filesize
72KB

Download
memory/2920-173-0x0000000000010000-0x00000000001D0000-memory.dmp

Filesize
1.8MB

Download