dcrat | 510a32139a79df7c7f5fb36bc540e5d1c8ad46e3baf9df5e3e1d4f7e38255b83

Analysis

max time kernel
146s
max time network
150s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
21-12-2024 17:56

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

510a32139a79df7c7f5fb36bc540e5d1c8ad46e3baf9df5e3e1d4f7e38255b83.exe
Size

1.3MB
MD5

855fb25af1fc13afe4a0fa50d9fd2cab
SHA1

49c2af43b4ae1720e2643799d37ab9210b1c7c1f
SHA256

510a32139a79df7c7f5fb36bc540e5d1c8ad46e3baf9df5e3e1d4f7e38255b83
SHA512

7d9867210c7a1a02acd0606365d7bca752b6bc81b4fc7a9be8d4dd3588c988f4cc3d74303292f700288f5b7ad9f60557d628c304c916222258db4d1d6d446dcb
SSDEEP

24576:U2G/nvxW3Ww0t6TnzGmVBDh4+aknuRRZJND0gFJ4rD/IjC:UbA30GnzV/q+DnsXg

Score

10^/10

dcrat discovery execution infostealer rat

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat
Dcrat family
dcrat

Process spawned unexpected child process 18 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2804	2936	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2168	2936	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1668	2936	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2716	2936	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	884	2936	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2184	2936	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2260	2936	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2360	2936	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	588	2936	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1816	2936	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1252	2936	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1564	2936	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1624	2936	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1500	2936	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1424	2936	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1344	2936	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2304	2936	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1768	2936	schtasks.exe	34

DCRat payload 7 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral1/files/0x0008000000016d69-9.dat	dcrat
behavioral1/memory/2740-13-0x00000000002D0000-0x00000000003E0000-memory.dmp	dcrat
behavioral1/memory/2664-73-0x0000000000150000-0x0000000000260000-memory.dmp	dcrat
behavioral1/memory/2920-133-0x0000000000390000-0x00000000004A0000-memory.dmp	dcrat
behavioral1/memory/2592-193-0x00000000011C0000-0x00000000012D0000-memory.dmp	dcrat
behavioral1/memory/1924-490-0x00000000001A0000-0x00000000002B0000-memory.dmp	dcrat
behavioral1/memory/696-550-0x0000000000B50000-0x0000000000C60000-memory.dmp	dcrat

Command and Scripting Interpreter: PowerShell 1 TTPs 7 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
3068	powershell.exe
1056	powershell.exe
1244	powershell.exe
2036	powershell.exe
1752	powershell.exe
2568	powershell.exe
1896	powershell.exe

Executes dropped EXE 10 IoCs

pid	Process
2740	DllCommonsvc.exe
2664	wininit.exe
2920	wininit.exe
2592	wininit.exe
1096	wininit.exe
2376	wininit.exe
1128	wininit.exe
1636	wininit.exe
1924	wininit.exe
696	wininit.exe

Loads dropped DLL 2 IoCs

pid	Process
3056	cmd.exe
3056	cmd.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 10 IoCs

Web Service

T1102

flow	ioc
16	raw.githubusercontent.com
19	raw.githubusercontent.com
22	raw.githubusercontent.com
30	raw.githubusercontent.com
9	raw.githubusercontent.com
5	raw.githubusercontent.com
13	raw.githubusercontent.com
26	raw.githubusercontent.com
33	raw.githubusercontent.com
4	raw.githubusercontent.com

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	510a32139a79df7c7f5fb36bc540e5d1c8ad46e3baf9df5e3e1d4f7e38255b83.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe

Modifies registry class 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000_CLASSES\Local Settings\MuiCache	wininit.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000_CLASSES\Local Settings\MuiCache	wininit.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000_CLASSES\Local Settings\MuiCache	wininit.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000_CLASSES\Local Settings\MuiCache	wininit.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000_CLASSES\Local Settings\MuiCache	wininit.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000_CLASSES\Local Settings\MuiCache	wininit.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000_CLASSES\Local Settings\MuiCache	wininit.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000_CLASSES\Local Settings\MuiCache	wininit.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000_CLASSES\Local Settings\MuiCache	wininit.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 18 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2716	schtasks.exe
1344	schtasks.exe
2304	schtasks.exe
884	schtasks.exe
2260	schtasks.exe
1816	schtasks.exe
1500	schtasks.exe
2804	schtasks.exe
2168	schtasks.exe
2184	schtasks.exe
588	schtasks.exe
1624	schtasks.exe
1424	schtasks.exe
1768	schtasks.exe
1668	schtasks.exe
2360	schtasks.exe
1252	schtasks.exe
1564	schtasks.exe

Suspicious behavior: EnumeratesProcesses 19 IoCs

pid	Process
2740	DllCommonsvc.exe
2740	DllCommonsvc.exe
2740	DllCommonsvc.exe
1056	powershell.exe
3068	powershell.exe
2036	powershell.exe
1752	powershell.exe
2568	powershell.exe
1896	powershell.exe
1244	powershell.exe
2664	wininit.exe
2920	wininit.exe
2592	wininit.exe
1096	wininit.exe
2376	wininit.exe
1128	wininit.exe
1636	wininit.exe
1924	wininit.exe
696	wininit.exe

Suspicious use of AdjustPrivilegeToken 17 IoCs

description	pid	Process
Token: SeDebugPrivilege	2740	DllCommonsvc.exe
Token: SeDebugPrivilege	3068	powershell.exe
Token: SeDebugPrivilege	1056	powershell.exe
Token: SeDebugPrivilege	2036	powershell.exe
Token: SeDebugPrivilege	1752	powershell.exe
Token: SeDebugPrivilege	2568	powershell.exe
Token: SeDebugPrivilege	1896	powershell.exe
Token: SeDebugPrivilege	1244	powershell.exe
Token: SeDebugPrivilege	2664	wininit.exe
Token: SeDebugPrivilege	2920	wininit.exe
Token: SeDebugPrivilege	2592	wininit.exe
Token: SeDebugPrivilege	1096	wininit.exe
Token: SeDebugPrivilege	2376	wininit.exe
Token: SeDebugPrivilege	1128	wininit.exe
Token: SeDebugPrivilege	1636	wininit.exe
Token: SeDebugPrivilege	1924	wininit.exe
Token: SeDebugPrivilege	696	wininit.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2476 wrote to memory of 2140	2476	510a32139a79df7c7f5fb36bc540e5d1c8ad46e3baf9df5e3e1d4f7e38255b83.exe	30
PID 2476 wrote to memory of 2140	2476	510a32139a79df7c7f5fb36bc540e5d1c8ad46e3baf9df5e3e1d4f7e38255b83.exe	30
PID 2476 wrote to memory of 2140	2476	510a32139a79df7c7f5fb36bc540e5d1c8ad46e3baf9df5e3e1d4f7e38255b83.exe	30
PID 2476 wrote to memory of 2140	2476	510a32139a79df7c7f5fb36bc540e5d1c8ad46e3baf9df5e3e1d4f7e38255b83.exe	30
PID 2140 wrote to memory of 3056	2140	WScript.exe	31
PID 2140 wrote to memory of 3056	2140	WScript.exe	31
PID 2140 wrote to memory of 3056	2140	WScript.exe	31
PID 2140 wrote to memory of 3056	2140	WScript.exe	31
PID 3056 wrote to memory of 2740	3056	cmd.exe	33
PID 3056 wrote to memory of 2740	3056	cmd.exe	33
PID 3056 wrote to memory of 2740	3056	cmd.exe	33
PID 3056 wrote to memory of 2740	3056	cmd.exe	33
PID 2740 wrote to memory of 1896	2740	DllCommonsvc.exe	53
PID 2740 wrote to memory of 1896	2740	DllCommonsvc.exe	53
PID 2740 wrote to memory of 1896	2740	DllCommonsvc.exe	53
PID 2740 wrote to memory of 3068	2740	DllCommonsvc.exe	54
PID 2740 wrote to memory of 3068	2740	DllCommonsvc.exe	54
PID 2740 wrote to memory of 3068	2740	DllCommonsvc.exe	54
PID 2740 wrote to memory of 1056	2740	DllCommonsvc.exe	55
PID 2740 wrote to memory of 1056	2740	DllCommonsvc.exe	55
PID 2740 wrote to memory of 1056	2740	DllCommonsvc.exe	55
PID 2740 wrote to memory of 1244	2740	DllCommonsvc.exe	56
PID 2740 wrote to memory of 1244	2740	DllCommonsvc.exe	56
PID 2740 wrote to memory of 1244	2740	DllCommonsvc.exe	56
PID 2740 wrote to memory of 2036	2740	DllCommonsvc.exe	57
PID 2740 wrote to memory of 2036	2740	DllCommonsvc.exe	57
PID 2740 wrote to memory of 2036	2740	DllCommonsvc.exe	57
PID 2740 wrote to memory of 1752	2740	DllCommonsvc.exe	58
PID 2740 wrote to memory of 1752	2740	DllCommonsvc.exe	58
PID 2740 wrote to memory of 1752	2740	DllCommonsvc.exe	58
PID 2740 wrote to memory of 2568	2740	DllCommonsvc.exe	59
PID 2740 wrote to memory of 2568	2740	DllCommonsvc.exe	59
PID 2740 wrote to memory of 2568	2740	DllCommonsvc.exe	59
PID 2740 wrote to memory of 2084	2740	DllCommonsvc.exe	67
PID 2740 wrote to memory of 2084	2740	DllCommonsvc.exe	67
PID 2740 wrote to memory of 2084	2740	DllCommonsvc.exe	67
PID 2084 wrote to memory of 1480	2084	cmd.exe	69
PID 2084 wrote to memory of 1480	2084	cmd.exe	69
PID 2084 wrote to memory of 1480	2084	cmd.exe	69
PID 2084 wrote to memory of 2664	2084	cmd.exe	70
PID 2084 wrote to memory of 2664	2084	cmd.exe	70
PID 2084 wrote to memory of 2664	2084	cmd.exe	70
PID 2664 wrote to memory of 1616	2664	wininit.exe	71
PID 2664 wrote to memory of 1616	2664	wininit.exe	71
PID 2664 wrote to memory of 1616	2664	wininit.exe	71
PID 1616 wrote to memory of 1744	1616	cmd.exe	73
PID 1616 wrote to memory of 1744	1616	cmd.exe	73
PID 1616 wrote to memory of 1744	1616	cmd.exe	73
PID 1616 wrote to memory of 2920	1616	cmd.exe	74
PID 1616 wrote to memory of 2920	1616	cmd.exe	74
PID 1616 wrote to memory of 2920	1616	cmd.exe	74
PID 2920 wrote to memory of 2684	2920	wininit.exe	75
PID 2920 wrote to memory of 2684	2920	wininit.exe	75
PID 2920 wrote to memory of 2684	2920	wininit.exe	75
PID 2684 wrote to memory of 1560	2684	cmd.exe	77
PID 2684 wrote to memory of 1560	2684	cmd.exe	77
PID 2684 wrote to memory of 1560	2684	cmd.exe	77
PID 2684 wrote to memory of 2592	2684	cmd.exe	78
PID 2684 wrote to memory of 2592	2684	cmd.exe	78
PID 2684 wrote to memory of 2592	2684	cmd.exe	78
PID 2592 wrote to memory of 2144	2592	wininit.exe	79
PID 2592 wrote to memory of 2144	2592	wininit.exe	79
PID 2592 wrote to memory of 2144	2592	wininit.exe	79
PID 2144 wrote to memory of 1648	2144	cmd.exe	81

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\510a32139a79df7c7f5fb36bc540e5d1c8ad46e3baf9df5e3e1d4f7e38255b83.exe
"C:\Users\Admin\AppData\Local\Temp\510a32139a79df7c7f5fb36bc540e5d1c8ad46e3baf9df5e3e1d4f7e38255b83.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2476
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\providercommon\yTUdeXjbLOhnrN32dgrxVg.vbe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2140
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c ""C:\providercommon\1zu9dW.bat" "
    3⤵
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3056
  - - C:\providercommon\DllCommonsvc.exe
      "C:\providercommon\DllCommonsvc.exe"
      4⤵
      Executes dropped EXE
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:2740
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\DllCommonsvc.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1896
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Public\Documents\My Videos\Idle.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3068
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\31f19e42-8726-11ef-be9a-dab21757c799\csrss.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1056
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\Favorites\Links\wininit.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1244
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\MSOCache\All Users\{90140000-001A-0409-0000-0000000FF1CE}-C\cmd.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2036
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\Documents\My Music\System.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1752
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\conhost.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2568
    - - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\IuDiLqiv5E.bat"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:2084
      - C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        6⤵
        
        PID:1480
      - C:\Users\Admin\Favorites\Links\wininit.exe
        
        "C:\Users\Admin\Favorites\Links\wininit.exe"
        6⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2664
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\Favorites\Links\dTyUSGczOF.bat"
        7⤵
        Suspicious use of WriteProcessMemory
        
        PID:1616
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        8⤵
        
        PID:1744
        
        C:\Users\Admin\Favorites\Links\wininit.exe
        
        "C:\Users\Admin\Favorites\Links\wininit.exe"
        8⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2920
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\Favorites\Links\4dWy1cAril.bat"
        9⤵
        Suspicious use of WriteProcessMemory
        
        PID:2684
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        10⤵
        
        PID:1560
        
        C:\Users\Admin\Favorites\Links\wininit.exe
        
        "C:\Users\Admin\Favorites\Links\wininit.exe"
        10⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2592
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\Favorites\Links\tbUKdYNpRM.bat"
        11⤵
        Suspicious use of WriteProcessMemory
        
        PID:2144
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        12⤵
        
        PID:1648
        
        C:\Users\Admin\Favorites\Links\wininit.exe
        
        "C:\Users\Admin\Favorites\Links\wininit.exe"
        12⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1096
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\Favorites\Links\sctnVaGS5S.bat"
        13⤵
        
        PID:1876
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        14⤵
        
        PID:2852
        
        C:\Users\Admin\Favorites\Links\wininit.exe
        
        "C:\Users\Admin\Favorites\Links\wininit.exe"
        14⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2376
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\Favorites\Links\FbLWgslcYe.bat"
        15⤵
        
        PID:1840
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        16⤵
        
        PID:2220
        
        C:\Users\Admin\Favorites\Links\wininit.exe
        
        "C:\Users\Admin\Favorites\Links\wininit.exe"
        16⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1128
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\Favorites\Links\HdAFbxPsUY.bat"
        17⤵
        
        PID:3068
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        18⤵
        
        PID:2428
        
        C:\Users\Admin\Favorites\Links\wininit.exe
        
        "C:\Users\Admin\Favorites\Links\wininit.exe"
        18⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1636
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\Favorites\Links\JlQH4wpJPy.bat"
        19⤵
        
        PID:2844
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        20⤵
        
        PID:2448
        
        C:\Users\Admin\Favorites\Links\wininit.exe
        
        "C:\Users\Admin\Favorites\Links\wininit.exe"
        20⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1924
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\Favorites\Links\whWAIQFMnl.bat"
        21⤵
        
        PID:2180
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        22⤵
        
        PID:1584
        
        C:\Users\Admin\Favorites\Links\wininit.exe
        
        "C:\Users\Admin\Favorites\Links\wininit.exe"
        22⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:696
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\Favorites\Links\Afm444wN3x.bat"
        23⤵
        
        PID:1888
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        24⤵
        
        PID:2100

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 7 /tr "'C:\Users\Public\Documents\My Videos\Idle.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2804

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Idle" /sc ONLOGON /tr "'C:\Users\Public\Documents\My Videos\Idle.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2168

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 11 /tr "'C:\Users\Public\Documents\My Videos\Idle.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1668

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 12 /tr "'C:\Recovery\31f19e42-8726-11ef-be9a-dab21757c799\csrss.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2716

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Recovery\31f19e42-8726-11ef-be9a-dab21757c799\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:884

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 11 /tr "'C:\Recovery\31f19e42-8726-11ef-be9a-dab21757c799\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2184

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 12 /tr "'C:\Users\Admin\Favorites\Links\wininit.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2260

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininit" /sc ONLOGON /tr "'C:\Users\Admin\Favorites\Links\wininit.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2360

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 13 /tr "'C:\Users\Admin\Favorites\Links\wininit.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:588

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "cmdc" /sc MINUTE /mo 5 /tr "'C:\MSOCache\All Users\{90140000-001A-0409-0000-0000000FF1CE}-C\cmd.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1816

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "cmd" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-001A-0409-0000-0000000FF1CE}-C\cmd.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1252

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "cmdc" /sc MINUTE /mo 9 /tr "'C:\MSOCache\All Users\{90140000-001A-0409-0000-0000000FF1CE}-C\cmd.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1564

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 13 /tr "'C:\Users\Admin\Documents\My Music\System.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1624

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "System" /sc ONLOGON /tr "'C:\Users\Admin\Documents\My Music\System.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1500

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 9 /tr "'C:\Users\Admin\Documents\My Music\System.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1424

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 7 /tr "'C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\conhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1344

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhost" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\conhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2304

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 12 /tr "'C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\conhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1768

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
aab5a6930a9657c7031ffe37173ffef5

SHA1
8615800610e16f4be99594899f4bb2cfe65f58cd

SHA256
497f1f234aeae5c0ce6873d56c9c959d53bfd88e4ad7bab39d92043136a4899f

SHA512
4a599fcd170c203d9e936995097bd635049e435f9910eaccb0b46eb7a1c72af8374dec71c6d03298d27baeda21fade06863c277467f34d79a86f4b340099dcc6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1de3ac1bed65299ad8b0d910a0f2fbbc

SHA1
d6b7fd6f94a233b90ae4cd318b9f8710ca1aa909

SHA256
d12fc3a4b2974d547bebf14435386326303210b3535ca380beb4411bdf1c1967

SHA512
d4cc2727ff7fad2b8c29a2c83f09140ed324db2da7b8948093af8eae3da07bd3b297e685ff9a62366d72d5d35f6d8bf55c2c3255d6e4f6f619991eef40cce8b1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
726baee1407d197b462e0a5990a7e296

SHA1
b14be00cbc706e4a70d1ae50f0c29a7fa5628bca

SHA256
69faecb6f2feff580d69d0c990ba4df6bab022b4bd9d89c96590478d8177599d

SHA512
3e74ca27e6ed60135a00866c30338e165a79eddd87f0ca5dd77171947643b1a2823ecc41dda5bba0c899c80db5d864a0c2aab445c5a14a64a5fd0e6d77ed0e6d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
197381ad4c1941d06fab69e8f34e2920

SHA1
a5ec550587df877e870b9fbd2d0b88df59d5d41b

SHA256
638d17db5655ee8e66e3aed42ff6858a7fc6c36fc1e8dd8ba091cd9ba0e626af

SHA512
8fd7700c8fd9765929babab7382f27e181914c3a879e075563fc31d5cd752452b357aeee1f49b9531dcb4296b038a2e3a8ef363edea21625bc482c1ca9902d38

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3258b69890f90751a95fa06a33921ac2

SHA1
cc09251894198a3c7d57f25ff2ce99a90345ada9

SHA256
df3076eca165ae972a78729cba11adf72bc03269220d1452e26c7a81a7d0542b

SHA512
46f6c0addab4935ffd9b102a071b066b2c92ae44d270e71a83d40ee6983d3ac3b6c4251bc403c4883d36c3f23e41286f29e740652886cd6fbe0c858b536b8ecf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d63b207e4ab14bdced8b4988b8f37ab9

SHA1
6f0b3156fdf6212c5311f287ee1f95735caf34fb

SHA256
ebee44b31a84dfacf5d9af0334967a17ad14d79feea0499191b4755778c69163

SHA512
39794742352f4ead44cc6c56970cc5bd1fc16830e5c803892055dd958f879e4a79dda0ee77128cbb486032234e094edc28b9748a4578d0556560ee6f748711ea

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ca224a51bde96d6e7c4014a2a8e0b99b

SHA1
69c956e09477405ae49aa316b37b395ca94f3fa9

SHA256
5c6fb2343af88494b46c6d18c5e4294360c9e84a5f2a03c307ca8f757ab6354d

SHA512
8696f0365ad22950a1917a185a4e3afe755d0e035892b80071550534e5158a2afe284e1bc4b1ee1f4f7effd820545be8353c2249d64ecaa47e4f5b7e72c772a5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
cef4c84f8ceb0a94aebfcdadf2b042bb

SHA1
2c9ab96abd22baac82722ec71fc486c6ca05fdc6

SHA256
0d9dc57e593c254fe7fa467c385ee3cb19a6cbac312a3ef016610e13c68e0db1

SHA512
460b17976178bd087558aa2c557047499863d425b5e7866d740c86cf232fac2e4e270ea6fe6d5c561cf1f68f67c5d567d534c971914745b685a4a6ecb30903ef

Download Submit
C:\Users\Admin\AppData\LocalLow\Temp\Cab4406.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\LocalLow\Temp\Tar4458.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit
C:\Users\Admin\AppData\Local\Temp\IuDiLqiv5E.bat

Filesize
207B

MD5
a9171b7131f246b15aca2ec0aa1ff450

SHA1
788244b26d2e68a8a953905ee31a5e6cc4973241

SHA256
0568869d8319787aa53f3970ce83dd0e96c87dd9d7c9b4640c80fc08b307976b

SHA512
d7622df206b44e19e410abc11757c35b73a033fa14148c77dd43dee93468243d679e66667d617446531da05f127085d43473f297cc2a9df6f8b352c21d1d6e00

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
7KB

MD5
8c9dc942df4d8714505e63635eddc7fa

SHA1
ce6d5659a86812bba69a69773cf385bcfc9ce9e9

SHA256
0c2323c18f072757d93df7c47a653b83b4bd5118298bcd229122eb84c5d8402c

SHA512
7c39a1f95bf7d693165347d8e553e1536f5cabd0b1760b97d3b00cfd992ebad15cae42ba3644682e0e29340bb7b466b42193744339c145b112bf55cbddde4fd3

Download Submit
C:\Users\Admin\Favorites\Links\4dWy1cAril.bat

Filesize
203B

MD5
5a3e63568d8e1f2d79924511f19ce270

SHA1
dca3f00371ea64f49bff2b3a75a37bb362230d49

SHA256
5c6a22a3bc6caa60cffe29c7bbf690fe11cb4c24fc9c5386efc3253faf4da2ac

SHA512
26e33a7763cbeb2d55b7a0554e76ddea3be2207422d9b46b154d666c194340a3e121b60b1cd62c0d7336379d3f75847fa73a9b0f0117ff3190d90a1891a3ea16

Download Submit
C:\Users\Admin\Favorites\Links\Afm444wN3x.bat

Filesize
203B

MD5
b842aee426ded701d784ef6b964aaee5

SHA1
0bfe3ec996217653a68c141f33c77a3b7c11b92c

SHA256
79be552c6af279d7a5ff7fe320bb476b3fafd3e2bd11cb86b04bda8c18923b1d

SHA512
d53541dc9e3cbcb395023b62f6a1a54bd4c4507617ac05b9c85c0ab4de2bcd3891b58da32a3eea16ba44615ee49a6a59d1b1e2607fe4aea4743db8fdecab950a

Download Submit
C:\Users\Admin\Favorites\Links\FbLWgslcYe.bat

Filesize
203B

MD5
815e69e48327af755fc735fd18210b44

SHA1
672786b401c5ed5c48c985ca78b1abffb49ab2f4

SHA256
93fa85459f3ea9ae8087a2a7c4ab64ea772a975fb723f430773f278aa109e06d

SHA512
b28fc38a1d0afec276df24a1df57437b541bb843940c7360be075d707f1d281409433967048eec7dffe49ada265d3f8f00a5e2403c47e3279695ea5327724ee3

Download Submit
C:\Users\Admin\Favorites\Links\HdAFbxPsUY.bat

Filesize
203B

MD5
a3ff407e8d750b5765dd8b41e89540a4

SHA1
541c40dc40c76ba2eca0c2f4d6fbffbaef6467fb

SHA256
625397202cbc266ada17b05e6ab1a711a2972fd420359cb567e30f806218c344

SHA512
df00265ed71d8f8c145feba9a475c7b1cfbd9a373f1c3f61fcbfe572f6b4bdd1d22483b81b917e8ee157e9b9bb64f6e25b497ff63ad8ac3da0c4df1e272d2b2f

Download Submit
C:\Users\Admin\Favorites\Links\JlQH4wpJPy.bat

Filesize
203B

MD5
bf6eea6a7d68bdd45dc0f405c2d35f77

SHA1
c5cf73ea5e2f2d494fbdbd5287b8f1b18abad72c

SHA256
d4fa70e911558ce2d1e9bc664a6fec16a1f2e611c165d06cbf23c58e15aeacfc

SHA512
dc0569a9ddbbcb73aa35eeed66c9258172e97084a02f44f9dca8fdf75a8753e09c8dc24e0c39f0b523a2acbd1d9043569b21076d7c55f92724f83555190b0123

Download Submit
C:\Users\Admin\Favorites\Links\dTyUSGczOF.bat

Filesize
203B

MD5
c8e8a00bc54f966a065ffdc1735d0a2f

SHA1
29512669644d61cc6c58bfe3dc0559febefa8ae6

SHA256
f9fb625b3ee0d8a2316f1dda537708559ab9bac4fda3cad17a26018e1de35d82

SHA512
89751126335c76d92edc0d1ff5a7d898bc20a4515ce002d4638d91ebcd018408484192411fc17fbb588a38c06ebc0685775dfdc2c008275f0c0331024fb02e29

Download Submit
C:\Users\Admin\Favorites\Links\sctnVaGS5S.bat

Filesize
203B

MD5
b17c2211d78a0c25cb5325759bc310bd

SHA1
b7bacbdb54f1dc88ba2bee7220aa8da416d80e09

SHA256
8a2ad36ccb3d7ee20b8db76505ca044dba8b71735c05d1224d962cc0483a4f24

SHA512
39130eabe858130c5d9e8194cb8ff894a17ca66a93984a50cd5cb18871eb27f6af3de38267ed7a5f7b1030e8d510f69e4ca0da59dd33df0b00f7d076de66f12d

Download Submit
C:\Users\Admin\Favorites\Links\tbUKdYNpRM.bat

Filesize
203B

MD5
ec3ebc364e925ea22eb04aa81be973e1

SHA1
dbf5562b514218b9d75bee48e0d88d134f1c11a2

SHA256
40c6c3e5d5c3049c1e97214f0292668b0cda1c8a29578bba5e26a54a6663e57b

SHA512
d9f8f71132bfb5fd008c5e1cc0c9e98fbb1418ecfa9a65bdf4dd85b64c7e50c4848eeca083ca90a1206ab56e475a8079b69703b5d4c2e3b47e5b018da5ccd6f2

Download Submit
C:\Users\Admin\Favorites\Links\whWAIQFMnl.bat

Filesize
203B

MD5
dede66b639a8e7b95793d33eb41fd5e1

SHA1
c7658430d18386c442a497ce22d4512ee03bb664

SHA256
d1f02a4098aaabe020807fc3c4e8a8f649305eb68d2a10d01a47de353f8275de

SHA512
ab756e742e898c8a7f442527634352493791e2b32cfdb1cd10f6ce02cfad075d022198fa39dcff86c9c9ad10bc18146700468c26c0c99a7da766d0365e480e67

Download Submit
C:\providercommon\1zu9dW.bat

Filesize
36B

MD5
6783c3ee07c7d151ceac57f1f9c8bed7

SHA1
17468f98f95bf504cc1f83c49e49a78526b3ea03

SHA256
8ab782f0f327a2021530e7230d3aee8abbecb7eed59482a3a46e78b9e3862322

SHA512
c6012d4bfac1ed14d0fd9f0eabd0e1c3d647b343db292a907b246271d52a4b7469c809db43910ddba2e8c5045f9cb3d24d0af62d363281e6cb8b39ee94a183e8

Download Submit
C:\providercommon\yTUdeXjbLOhnrN32dgrxVg.vbe

Filesize
197B

MD5
8088241160261560a02c84025d107592

SHA1
083121f7027557570994c9fc211df61730455bb5

SHA256
2072cc9a4a3b84d4c5178ab41c5588eea7d0103e3928e34d64f17bf97f3d1cc1

SHA512
20d9369dd359315848ea30144383a0bb479d86059fdbc3b3256ac84f998193512feb3b1799ab663619920c99fe7e0ebba33ada31a3855094b956fcd351c90478

Download Submit
\providercommon\DllCommonsvc.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
memory/696-551-0x0000000000430000-0x0000000000442000-memory.dmp

Filesize
72KB

Download
memory/696-550-0x0000000000B50000-0x0000000000C60000-memory.dmp

Filesize
1.1MB

Download
memory/1056-69-0x000000001B440000-0x000000001B722000-memory.dmp

Filesize
2.9MB

Download
memory/1056-70-0x0000000001E60000-0x0000000001E68000-memory.dmp

Filesize
32KB

Download
memory/1096-253-0x0000000000240000-0x0000000000252000-memory.dmp

Filesize
72KB

Download
memory/1924-490-0x00000000001A0000-0x00000000002B0000-memory.dmp

Filesize
1.1MB

Download
memory/2592-193-0x00000000011C0000-0x00000000012D0000-memory.dmp

Filesize
1.1MB

Download
memory/2664-74-0x0000000000360000-0x0000000000372000-memory.dmp

Filesize
72KB

Download
memory/2664-73-0x0000000000150000-0x0000000000260000-memory.dmp

Filesize
1.1MB

Download
memory/2740-15-0x00000000004E0000-0x00000000004EC000-memory.dmp

Filesize
48KB

Download
memory/2740-14-0x00000000004C0000-0x00000000004D2000-memory.dmp

Filesize
72KB

Download
memory/2740-13-0x00000000002D0000-0x00000000003E0000-memory.dmp

Filesize
1.1MB

Download
memory/2740-16-0x00000000004F0000-0x00000000004FC000-memory.dmp

Filesize
48KB

Download
memory/2740-17-0x0000000000500000-0x000000000050C000-memory.dmp

Filesize
48KB

Download
memory/2920-133-0x0000000000390000-0x00000000004A0000-memory.dmp

Filesize
1.1MB

Download