Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    149s
  • max time network
    144s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    21/12/2024, 21:20

General

  • Target

    JaffaCakes118_6cd2385cfe01f8997b0f4f7f0609b0a4afed0bd490401225089efe4323ab9eb9.exe

  • Size

    1.3MB

  • MD5

    a5a1ca05b5811cc72ac6345d6dbfbf4b

  • SHA1

    83c6e7ef3c2f32184aa9187af415f5cacfa48d16

  • SHA256

    6cd2385cfe01f8997b0f4f7f0609b0a4afed0bd490401225089efe4323ab9eb9

  • SHA512

    b559d5c0fc8936e321c9fb601a49ffedcf28a3cd0aa0e1cba51dba80dd7aa01705c7c7ef4401dfcdabc766ff57fa8f5a40109bc8cf3fd09c9f1661c45272ea12

  • SSDEEP

    24576:U2G/nvxW3Ww0t6TnzGmVBDh4+aknuRRZJND0gFJ4rD/IjC:UbA30GnzV/q+DnsXg

Malware Config

Signatures

  • DcRat

    DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

  • Dcrat family
  • Process spawned unexpected child process 33 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • DCRat payload 11 IoCs

    Detects payload of DCRat, commonly dropped by NSIS installers.

  • Command and Scripting Interpreter: PowerShell 1 TTPs 12 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

  • Executes dropped EXE 12 IoCs
  • Loads dropped DLL 2 IoCs
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 11 IoCs
  • Drops file in Windows directory 6 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Scheduled Task/Job: Scheduled Task 1 TTPs 33 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 26 IoCs
  • Suspicious use of AdjustPrivilegeToken 24 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_6cd2385cfe01f8997b0f4f7f0609b0a4afed0bd490401225089efe4323ab9eb9.exe
    "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_6cd2385cfe01f8997b0f4f7f0609b0a4afed0bd490401225089efe4323ab9eb9.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:2872
    • C:\Windows\SysWOW64\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\providercommon\yTUdeXjbLOhnrN32dgrxVg.vbe"
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:1228
      • C:\Windows\SysWOW64\cmd.exe
        cmd /c ""C:\providercommon\1zu9dW.bat" "
        3⤵
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:1052
        • C:\providercommon\DllCommonsvc.exe
          "C:\providercommon\DllCommonsvc.exe"
          4⤵
          • Executes dropped EXE
          • Drops file in Windows directory
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:1952
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\DllCommonsvc.exe'
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:1132
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\explorer.exe'
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:688
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\1b8b1de2-69f6-11ef-9774-62cb582c238c\winlogon.exe'
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:804
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\RemotePackages\RemoteApps\spoolsv.exe'
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:744
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\MSOCache\All Users\{90140000-0044-0409-0000-0000000FF1CE}-C\System.exe'
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:764
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\Migration\WTR\explorer.exe'
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:1876
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\explorer.exe'
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:1472
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\DigitalLocker\de-DE\taskhost.exe'
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:304
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\MSOCache\All Users\{90140000-0116-0409-1000-0000000FF1CE}-C\DllCommonsvc.exe'
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:1336
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\1b8b1de2-69f6-11ef-9774-62cb582c238c\lsm.exe'
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:1620
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Default User\services.exe'
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:604
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\Recent\spoolsv.exe'
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:3064
          • C:\Windows\System32\cmd.exe
            "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\GxMRaa2xsF.bat"
            5⤵
            • Suspicious use of WriteProcessMemory
            PID:280
            • C:\Windows\system32\w32tm.exe
              w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
              6⤵
                PID:1804
              • C:\providercommon\explorer.exe
                "C:\providercommon\explorer.exe"
                6⤵
                • Executes dropped EXE
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of AdjustPrivilegeToken
                • Suspicious use of WriteProcessMemory
                PID:2628
                • C:\Windows\System32\cmd.exe
                  "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\D9KWG0zl28.bat"
                  7⤵
                  • Suspicious use of WriteProcessMemory
                  PID:2624
                  • C:\Windows\system32\w32tm.exe
                    w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                    8⤵
                      PID:2904
                    • C:\providercommon\explorer.exe
                      "C:\providercommon\explorer.exe"
                      8⤵
                      • Executes dropped EXE
                      • Suspicious behavior: EnumeratesProcesses
                      • Suspicious use of AdjustPrivilegeToken
                      PID:1632
                      • C:\Windows\System32\cmd.exe
                        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\Bf5uratM3O.bat"
                        9⤵
                          PID:684
                          • C:\Windows\system32\w32tm.exe
                            w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                            10⤵
                              PID:2560
                            • C:\providercommon\explorer.exe
                              "C:\providercommon\explorer.exe"
                              10⤵
                              • Executes dropped EXE
                              • Suspicious behavior: EnumeratesProcesses
                              • Suspicious use of AdjustPrivilegeToken
                              PID:1876
                              • C:\Windows\System32\cmd.exe
                                "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\FnVhX1xwia.bat"
                                11⤵
                                  PID:2644
                                  • C:\Windows\system32\w32tm.exe
                                    w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                                    12⤵
                                      PID:1760
                                    • C:\providercommon\explorer.exe
                                      "C:\providercommon\explorer.exe"
                                      12⤵
                                      • Executes dropped EXE
                                      • Suspicious behavior: EnumeratesProcesses
                                      • Suspicious use of AdjustPrivilegeToken
                                      PID:2588
                                      • C:\Windows\System32\cmd.exe
                                        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\biigBqxW9T.bat"
                                        13⤵
                                          PID:2212
                                          • C:\Windows\system32\w32tm.exe
                                            w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                                            14⤵
                                              PID:632
                                            • C:\providercommon\explorer.exe
                                              "C:\providercommon\explorer.exe"
                                              14⤵
                                              • Executes dropped EXE
                                              • Suspicious behavior: EnumeratesProcesses
                                              • Suspicious use of AdjustPrivilegeToken
                                              PID:2544
                                              • C:\Windows\System32\cmd.exe
                                                "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\pCeLVPpGxY.bat"
                                                15⤵
                                                  PID:1812
                                                  • C:\Windows\system32\w32tm.exe
                                                    w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                                                    16⤵
                                                      PID:1764
                                                    • C:\providercommon\explorer.exe
                                                      "C:\providercommon\explorer.exe"
                                                      16⤵
                                                      • Executes dropped EXE
                                                      • Suspicious behavior: EnumeratesProcesses
                                                      • Suspicious use of AdjustPrivilegeToken
                                                      PID:800
                                                      • C:\Windows\System32\cmd.exe
                                                        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\vFDRBKGR2C.bat"
                                                        17⤵
                                                          PID:2748
                                                          • C:\Windows\system32\w32tm.exe
                                                            w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                                                            18⤵
                                                              PID:2200
                                                            • C:\providercommon\explorer.exe
                                                              "C:\providercommon\explorer.exe"
                                                              18⤵
                                                              • Executes dropped EXE
                                                              • Suspicious behavior: EnumeratesProcesses
                                                              • Suspicious use of AdjustPrivilegeToken
                                                              PID:1784
                                                              • C:\Windows\System32\cmd.exe
                                                                "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\53OVnhiNRT.bat"
                                                                19⤵
                                                                  PID:856
                                                                  • C:\Windows\system32\w32tm.exe
                                                                    w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                                                                    20⤵
                                                                      PID:1824
                                                                    • C:\providercommon\explorer.exe
                                                                      "C:\providercommon\explorer.exe"
                                                                      20⤵
                                                                      • Executes dropped EXE
                                                                      • Suspicious behavior: EnumeratesProcesses
                                                                      • Suspicious use of AdjustPrivilegeToken
                                                                      PID:1660
                                                                      • C:\Windows\System32\cmd.exe
                                                                        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\BDITavvsiM.bat"
                                                                        21⤵
                                                                          PID:1808
                                                                          • C:\Windows\system32\w32tm.exe
                                                                            w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                                                                            22⤵
                                                                              PID:2096
                                                                            • C:\providercommon\explorer.exe
                                                                              "C:\providercommon\explorer.exe"
                                                                              22⤵
                                                                              • Executes dropped EXE
                                                                              • Suspicious behavior: EnumeratesProcesses
                                                                              • Suspicious use of AdjustPrivilegeToken
                                                                              PID:3032
                                                                              • C:\Windows\System32\cmd.exe
                                                                                "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\p9sA7N8NGm.bat"
                                                                                23⤵
                                                                                  PID:1948
                                                                                  • C:\Windows\system32\w32tm.exe
                                                                                    w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                                                                                    24⤵
                                                                                      PID:1600
                                                                                    • C:\providercommon\explorer.exe
                                                                                      "C:\providercommon\explorer.exe"
                                                                                      24⤵
                                                                                      • Executes dropped EXE
                                                                                      • Suspicious behavior: EnumeratesProcesses
                                                                                      • Suspicious use of AdjustPrivilegeToken
                                                                                      PID:2840
                                                                                      • C:\Windows\System32\cmd.exe
                                                                                        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\00vfQAbtTV.bat"
                                                                                        25⤵
                                                                                          PID:2724
                                                                                          • C:\Windows\system32\w32tm.exe
                                                                                            w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                                                                                            26⤵
                                                                                              PID:1436
                                                                                            • C:\providercommon\explorer.exe
                                                                                              "C:\providercommon\explorer.exe"
                                                                                              26⤵
                                                                                              • Executes dropped EXE
                                                                                              • Suspicious behavior: EnumeratesProcesses
                                                                                              • Suspicious use of AdjustPrivilegeToken
                                                                                              PID:2156
                                          • C:\Windows\system32\schtasks.exe
                                            schtasks.exe /create /tn "explorere" /sc MINUTE /mo 7 /tr "'C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\explorer.exe'" /f
                                            1⤵
                                            • Process spawned unexpected child process
                                            • Scheduled Task/Job: Scheduled Task
                                            PID:2708
                                          • C:\Windows\system32\schtasks.exe
                                            schtasks.exe /create /tn "explorer" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\explorer.exe'" /rl HIGHEST /f
                                            1⤵
                                            • Process spawned unexpected child process
                                            • Scheduled Task/Job: Scheduled Task
                                            PID:2748
                                          • C:\Windows\system32\schtasks.exe
                                            schtasks.exe /create /tn "explorere" /sc MINUTE /mo 14 /tr "'C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\explorer.exe'" /rl HIGHEST /f
                                            1⤵
                                            • Process spawned unexpected child process
                                            • Scheduled Task/Job: Scheduled Task
                                            PID:2648
                                          • C:\Windows\system32\schtasks.exe
                                            schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 5 /tr "'C:\Recovery\1b8b1de2-69f6-11ef-9774-62cb582c238c\winlogon.exe'" /f
                                            1⤵
                                            • Process spawned unexpected child process
                                            • Scheduled Task/Job: Scheduled Task
                                            PID:2608
                                          • C:\Windows\system32\schtasks.exe
                                            schtasks.exe /create /tn "winlogon" /sc ONLOGON /tr "'C:\Recovery\1b8b1de2-69f6-11ef-9774-62cb582c238c\winlogon.exe'" /rl HIGHEST /f
                                            1⤵
                                            • Process spawned unexpected child process
                                            • Scheduled Task/Job: Scheduled Task
                                            PID:2776
                                          • C:\Windows\system32\schtasks.exe
                                            schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 5 /tr "'C:\Recovery\1b8b1de2-69f6-11ef-9774-62cb582c238c\winlogon.exe'" /rl HIGHEST /f
                                            1⤵
                                            • Process spawned unexpected child process
                                            • Scheduled Task/Job: Scheduled Task
                                            PID:2796
                                          • C:\Windows\system32\schtasks.exe
                                            schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 6 /tr "'C:\Windows\RemotePackages\RemoteApps\spoolsv.exe'" /f
                                            1⤵
                                            • Process spawned unexpected child process
                                            • Scheduled Task/Job: Scheduled Task
                                            PID:2628
                                          • C:\Windows\system32\schtasks.exe
                                            schtasks.exe /create /tn "spoolsv" /sc ONLOGON /tr "'C:\Windows\RemotePackages\RemoteApps\spoolsv.exe'" /rl HIGHEST /f
                                            1⤵
                                            • Process spawned unexpected child process
                                            • Scheduled Task/Job: Scheduled Task
                                            PID:2540
                                          • C:\Windows\system32\schtasks.exe
                                            schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 11 /tr "'C:\Windows\RemotePackages\RemoteApps\spoolsv.exe'" /rl HIGHEST /f
                                            1⤵
                                            • Process spawned unexpected child process
                                            • Scheduled Task/Job: Scheduled Task
                                            PID:2488
                                          • C:\Windows\system32\schtasks.exe
                                            schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 7 /tr "'C:\MSOCache\All Users\{90140000-0044-0409-0000-0000000FF1CE}-C\System.exe'" /f
                                            1⤵
                                            • Process spawned unexpected child process
                                            • Scheduled Task/Job: Scheduled Task
                                            PID:2568
                                          • C:\Windows\system32\schtasks.exe
                                            schtasks.exe /create /tn "System" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-0044-0409-0000-0000000FF1CE}-C\System.exe'" /rl HIGHEST /f
                                            1⤵
                                            • Process spawned unexpected child process
                                            • Scheduled Task/Job: Scheduled Task
                                            PID:2952
                                          • C:\Windows\system32\schtasks.exe
                                            schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 5 /tr "'C:\MSOCache\All Users\{90140000-0044-0409-0000-0000000FF1CE}-C\System.exe'" /rl HIGHEST /f
                                            1⤵
                                            • Process spawned unexpected child process
                                            • Scheduled Task/Job: Scheduled Task
                                            PID:2180
                                          • C:\Windows\system32\schtasks.exe
                                            schtasks.exe /create /tn "explorere" /sc MINUTE /mo 12 /tr "'C:\Windows\Migration\WTR\explorer.exe'" /f
                                            1⤵
                                            • Process spawned unexpected child process
                                            • Scheduled Task/Job: Scheduled Task
                                            PID:632
                                          • C:\Windows\system32\schtasks.exe
                                            schtasks.exe /create /tn "explorer" /sc ONLOGON /tr "'C:\Windows\Migration\WTR\explorer.exe'" /rl HIGHEST /f
                                            1⤵
                                            • Process spawned unexpected child process
                                            • Scheduled Task/Job: Scheduled Task
                                            PID:664
                                          • C:\Windows\system32\schtasks.exe
                                            schtasks.exe /create /tn "explorere" /sc MINUTE /mo 8 /tr "'C:\Windows\Migration\WTR\explorer.exe'" /rl HIGHEST /f
                                            1⤵
                                            • Process spawned unexpected child process
                                            • Scheduled Task/Job: Scheduled Task
                                            PID:2320
                                          • C:\Windows\system32\schtasks.exe
                                            schtasks.exe /create /tn "explorere" /sc MINUTE /mo 13 /tr "'C:\providercommon\explorer.exe'" /f
                                            1⤵
                                            • Process spawned unexpected child process
                                            • Scheduled Task/Job: Scheduled Task
                                            PID:2272
                                          • C:\Windows\system32\schtasks.exe
                                            schtasks.exe /create /tn "explorer" /sc ONLOGON /tr "'C:\providercommon\explorer.exe'" /rl HIGHEST /f
                                            1⤵
                                            • Process spawned unexpected child process
                                            • Scheduled Task/Job: Scheduled Task
                                            PID:2292
                                          • C:\Windows\system32\schtasks.exe
                                            schtasks.exe /create /tn "explorere" /sc MINUTE /mo 11 /tr "'C:\providercommon\explorer.exe'" /rl HIGHEST /f
                                            1⤵
                                            • Process spawned unexpected child process
                                            • Scheduled Task/Job: Scheduled Task
                                            PID:1056
                                          • C:\Windows\system32\schtasks.exe
                                            schtasks.exe /create /tn "taskhostt" /sc MINUTE /mo 5 /tr "'C:\Windows\DigitalLocker\de-DE\taskhost.exe'" /f
                                            1⤵
                                            • Process spawned unexpected child process
                                            • Scheduled Task/Job: Scheduled Task
                                            PID:540
                                          • C:\Windows\system32\schtasks.exe
                                            schtasks.exe /create /tn "taskhost" /sc ONLOGON /tr "'C:\Windows\DigitalLocker\de-DE\taskhost.exe'" /rl HIGHEST /f
                                            1⤵
                                            • Process spawned unexpected child process
                                            • Scheduled Task/Job: Scheduled Task
                                            PID:1960
                                          • C:\Windows\system32\schtasks.exe
                                            schtasks.exe /create /tn "taskhostt" /sc MINUTE /mo 12 /tr "'C:\Windows\DigitalLocker\de-DE\taskhost.exe'" /rl HIGHEST /f
                                            1⤵
                                            • Process spawned unexpected child process
                                            • Scheduled Task/Job: Scheduled Task
                                            PID:328
                                          • C:\Windows\system32\schtasks.exe
                                            schtasks.exe /create /tn "DllCommonsvcD" /sc MINUTE /mo 7 /tr "'C:\MSOCache\All Users\{90140000-0116-0409-1000-0000000FF1CE}-C\DllCommonsvc.exe'" /f
                                            1⤵
                                            • Process spawned unexpected child process
                                            • Scheduled Task/Job: Scheduled Task
                                            PID:1780
                                          • C:\Windows\system32\schtasks.exe
                                            schtasks.exe /create /tn "DllCommonsvc" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-0116-0409-1000-0000000FF1CE}-C\DllCommonsvc.exe'" /rl HIGHEST /f
                                            1⤵
                                            • Process spawned unexpected child process
                                            • Scheduled Task/Job: Scheduled Task
                                            PID:1280
                                          • C:\Windows\system32\schtasks.exe
                                            schtasks.exe /create /tn "DllCommonsvcD" /sc MINUTE /mo 5 /tr "'C:\MSOCache\All Users\{90140000-0116-0409-1000-0000000FF1CE}-C\DllCommonsvc.exe'" /rl HIGHEST /f
                                            1⤵
                                            • Process spawned unexpected child process
                                            • Scheduled Task/Job: Scheduled Task
                                            PID:1416
                                          • C:\Windows\system32\schtasks.exe
                                            schtasks.exe /create /tn "lsml" /sc MINUTE /mo 10 /tr "'C:\Recovery\1b8b1de2-69f6-11ef-9774-62cb582c238c\lsm.exe'" /f
                                            1⤵
                                            • Process spawned unexpected child process
                                            • Scheduled Task/Job: Scheduled Task
                                            PID:1624
                                          • C:\Windows\system32\schtasks.exe
                                            schtasks.exe /create /tn "lsm" /sc ONLOGON /tr "'C:\Recovery\1b8b1de2-69f6-11ef-9774-62cb582c238c\lsm.exe'" /rl HIGHEST /f
                                            1⤵
                                            • Process spawned unexpected child process
                                            • Scheduled Task/Job: Scheduled Task
                                            PID:1580
                                          • C:\Windows\system32\schtasks.exe
                                            schtasks.exe /create /tn "lsml" /sc MINUTE /mo 11 /tr "'C:\Recovery\1b8b1de2-69f6-11ef-9774-62cb582c238c\lsm.exe'" /rl HIGHEST /f
                                            1⤵
                                            • Process spawned unexpected child process
                                            • Scheduled Task/Job: Scheduled Task
                                            PID:2732
                                          • C:\Windows\system32\schtasks.exe
                                            schtasks.exe /create /tn "servicess" /sc MINUTE /mo 5 /tr "'C:\Users\Default User\services.exe'" /f
                                            1⤵
                                            • Process spawned unexpected child process
                                            • Scheduled Task/Job: Scheduled Task
                                            PID:2940
                                          • C:\Windows\system32\schtasks.exe
                                            schtasks.exe /create /tn "services" /sc ONLOGON /tr "'C:\Users\Default User\services.exe'" /rl HIGHEST /f
                                            1⤵
                                            • Process spawned unexpected child process
                                            • Scheduled Task/Job: Scheduled Task
                                            PID:2176
                                          • C:\Windows\system32\schtasks.exe
                                            schtasks.exe /create /tn "servicess" /sc MINUTE /mo 12 /tr "'C:\Users\Default User\services.exe'" /rl HIGHEST /f
                                            1⤵
                                            • Process spawned unexpected child process
                                            • Scheduled Task/Job: Scheduled Task
                                            PID:2156
                                          • C:\Windows\system32\schtasks.exe
                                            schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 14 /tr "'C:\Users\Admin\Recent\spoolsv.exe'" /f
                                            1⤵
                                            • Process spawned unexpected child process
                                            • Scheduled Task/Job: Scheduled Task
                                            PID:1640
                                          • C:\Windows\system32\schtasks.exe
                                            schtasks.exe /create /tn "spoolsv" /sc ONLOGON /tr "'C:\Users\Admin\Recent\spoolsv.exe'" /rl HIGHEST /f
                                            1⤵
                                            • Process spawned unexpected child process
                                            • Scheduled Task/Job: Scheduled Task
                                            PID:1868
                                          • C:\Windows\system32\schtasks.exe
                                            schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 6 /tr "'C:\Users\Admin\Recent\spoolsv.exe'" /rl HIGHEST /f
                                            1⤵
                                            • Process spawned unexpected child process
                                            • Scheduled Task/Job: Scheduled Task
                                            PID:908

                                          Network

                                          MITRE ATT&CK Enterprise v15

                                          Replay Monitor

                                          Loading Replay Monitor...

                                          Downloads

                                          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

                                            Filesize

                                            342B

                                            MD5

                                            cf9bd548dbfa05945dbcef68d5301461

                                            SHA1

                                            cf9e0327590231aed10260f1f3d558c30f8b0482

                                            SHA256

                                            868e6bd5fb5c16e9b5e2ed4fb624695855919555574ea99948cced2522c2ecd0

                                            SHA512

                                            c71ec7035e3e14da336a5a8f40f3a57b798f766cd796c0544c94b592da1c1c967a6b1b0986fb2db9674122fe4944bbefbb7135adec8f0f761dffc5e69c92736a

                                          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

                                            Filesize

                                            342B

                                            MD5

                                            ec01a626ff1a325c2c6889b3a684b8b6

                                            SHA1

                                            737b896f3e51c0daa5c83aefc5f3a5458d7918d2

                                            SHA256

                                            ee7fb1f971664a3c4a32c761e6e6c9b88c5cb1eefdc3175d443dd8964b692445

                                            SHA512

                                            597d572ffe69e92242f065c7850f8e972e4743bd43de4baad254351e1e35ff92455b19bf80445e29dd448367fcbe265e3be3be306139635ff79aa1585ac4d341

                                          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

                                            Filesize

                                            342B

                                            MD5

                                            286a3208b82448c34a4c012286fed76a

                                            SHA1

                                            b9564511db49869149eda5ff9a87ee06eec4696d

                                            SHA256

                                            98dd1f32837b6b4458726f20a37dd1bd9394219dee03e54709cc4e63b4d2c1a1

                                            SHA512

                                            f6368b559b49feeb508e0098516759ec3cf5c6e43068e5a2eefa5d32dd865abe394a1cf020ac4e47f30897fe1a20a5f2dedf8b2834c1ffc879830ca7a35960be

                                          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

                                            Filesize

                                            342B

                                            MD5

                                            52410fc8f8bd6d827444f6db5d81b964

                                            SHA1

                                            b3df05848e58169e573a1c389a07f42a675ba597

                                            SHA256

                                            5cd15120afe34309dcc368a24111df7f42efe6c48242be64a0b6fcb1039dc8dc

                                            SHA512

                                            0ce0fdacbbf1a62948dc7435f99bf9647fc29104fc0045a72822238d9be75d51f08e2702f5ec5283e0d8949fa7d4d8f2c20662d6464f4abbf5e99e6f8104d874

                                          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

                                            Filesize

                                            342B

                                            MD5

                                            04f2b9cdfb99c3f83dbef1ff6b0dc753

                                            SHA1

                                            1d1958814584a61222950719883ae8f85bc4c15c

                                            SHA256

                                            81e2b7d3bb53cefe46e8020e8b953b150831c3d5691ca50cc816e79ee6deff5d

                                            SHA512

                                            f239359c9ae2c448510e794ad74526de97d19ac757f202ebb4c2b8ab0d406d51f068829558de7aa5b241c891d17fc83a49795636882b953411bdd6cb98d6e3f6

                                          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

                                            Filesize

                                            342B

                                            MD5

                                            ef322f1ed000c507156f908a167694e9

                                            SHA1

                                            2d94feca96eb6c1a3e7df16551c99b1861b83247

                                            SHA256

                                            aaa7f1ca51ec644ea93830f9ebd7cb80895facbd6cd28d73444a9b0a40311ec6

                                            SHA512

                                            e98c53262aa2468f2884864285fc595b331e7e11443a47eb2c4cd4ea3fab4e7df5f231d85080522aaea982e73e2293ba8e24569cbc51ecccd999e417575cb8f3

                                          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

                                            Filesize

                                            342B

                                            MD5

                                            71661278e29f7776ebefe214b23e6663

                                            SHA1

                                            6b08320589fa455d5addc1489eca6fbc5a699267

                                            SHA256

                                            14ffdb3d2acbff9a51f7425f03ae26a15c576fe527cfdf8e37153fe939ef7f55

                                            SHA512

                                            4bd09b4b55ec3ded0d420ef81fb75cb9caefeb1c6a8604abf7d3ba554e326212a8b4217849c2a4e3e61d58daf27e7109044cf79b3e7b95cba5f7aea4e8a8a8ea

                                          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

                                            Filesize

                                            342B

                                            MD5

                                            1082ad5de6aff23bfbdee2e1ca0e9d12

                                            SHA1

                                            d61cbf9ae325544c94979ef3eb2d17a816c42148

                                            SHA256

                                            1312fa43148d2d468f7ab84a5d65f38fbf164cb675902aa46ecb7f8864669db5

                                            SHA512

                                            4f8c12e0f2493be4aec5e436e685b1be5b66938d79c729511840f6c065a84362548013680144596aa9e1dafe0f7fce4cae26a0edc8cc793c878f5ca9482f2192

                                          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

                                            Filesize

                                            342B

                                            MD5

                                            3d38fd408f70995a99adc909aae09366

                                            SHA1

                                            1e340b4b8898184c9f5930db2b68eff0ae5a936c

                                            SHA256

                                            00466c90b8f6b773e36324ce479e9e85195014c2071df05b0861c354fb445411

                                            SHA512

                                            e83b27ded9706b5df5a53a9ac498350d5d53378b7ef3cff839ad52309aa61b13cf16b0dc0d62d895f48faa8e1a427c386ca8c654b9d87085c06842a1d9b02414

                                          • C:\Users\Admin\AppData\Local\Temp\00vfQAbtTV.bat

                                            Filesize

                                            195B

                                            MD5

                                            c37cfa9a263f2595c7c58b79fb60e86b

                                            SHA1

                                            cd018d7323e883958d59661f4b2e0d88db8d87fa

                                            SHA256

                                            2388493af9a399a30c81b2fd1a4a939563cc0bb729c625087d097d75afa8c7a6

                                            SHA512

                                            db449a9fc2d6e1239e99ec8acee0e3f12031c3e1282c0b4796acff27dc9894fe7c4282018204ab43013128002cb5a26fb07275608db84430319d086ab5e9c344

                                          • C:\Users\Admin\AppData\Local\Temp\53OVnhiNRT.bat

                                            Filesize

                                            195B

                                            MD5

                                            d32f5ea24c1a55dfdc436ea9d49ec2e2

                                            SHA1

                                            6093df9c407504e70773e602c5f190bc07b51f2a

                                            SHA256

                                            0e077a73a07d5ae67b14ca47fdb5fa3f6f27a2a243fc670da9db9a815af8467f

                                            SHA512

                                            9f83987963382287f3bea9708ef81236f3a492ae5d1eda742110827e2b59736e1995c6727752d56a57dbccc178389f8195a29346c1012c72a4f566c19156c8e2

                                          • C:\Users\Admin\AppData\Local\Temp\BDITavvsiM.bat

                                            Filesize

                                            195B

                                            MD5

                                            d9c5e472f0b07106c65f5a3f9efb7bcd

                                            SHA1

                                            bcc42f953966b4005d4be5f13358a478d9c4b230

                                            SHA256

                                            c476624a8a88a5c58a31686d46e9233a5a33b59084b245c4c3741d707da3ce36

                                            SHA512

                                            70376b9dd8f2e618d6f383fc15677416d0dc24f457e9e539e6dc34931329548dfc429d88061caa18e5f8b911838f6ea7f5945e12954b8668c81635a561244523

                                          • C:\Users\Admin\AppData\Local\Temp\Bf5uratM3O.bat

                                            Filesize

                                            195B

                                            MD5

                                            105386c323eeb15e03b228ec49ea6a15

                                            SHA1

                                            66221ebd86641243b31f8b8347e4126746213cdb

                                            SHA256

                                            acbd4cdf751e0b8e9fa71956501cc044ad3bf20a165eb1216917d982a3a6babe

                                            SHA512

                                            79e8aae5bcfe5148d57a2a7f1cc0f44a5db5a42cbe24658f49e58f910ceb1cceb479cafba434aa08f57adcf4f3415f197decd102c19ddef119c18e913ca54794

                                          • C:\Users\Admin\AppData\Local\Temp\CabE4D5.tmp

                                            Filesize

                                            70KB

                                            MD5

                                            49aebf8cbd62d92ac215b2923fb1b9f5

                                            SHA1

                                            1723be06719828dda65ad804298d0431f6aff976

                                            SHA256

                                            b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

                                            SHA512

                                            bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

                                          • C:\Users\Admin\AppData\Local\Temp\D9KWG0zl28.bat

                                            Filesize

                                            195B

                                            MD5

                                            fbde7e5bb1059f27b725603de742f18f

                                            SHA1

                                            a729b54ce6a6609bf70c34b8aa20c42861ee6ba2

                                            SHA256

                                            b87bbfd8442e8be1e67ac68b781ee15e0702919134b753746af87ad229c1868d

                                            SHA512

                                            b69979455b8d0185505e1de08ddeab000776266bfec71e2371878aacce406b49100f3b2cdb94df6ede31ce7a5f9b3fb95c1875a8c10914d47c42dd20118ca04b

                                          • C:\Users\Admin\AppData\Local\Temp\FnVhX1xwia.bat

                                            Filesize

                                            195B

                                            MD5

                                            98455f6f0cc16ba9e2d188043af22b77

                                            SHA1

                                            edc6796b7a47d32adac6a5f6cac4e762a3069c8f

                                            SHA256

                                            1a65751d0082b433308d0ce23486200cefb60d6025e1183b185a808add07562f

                                            SHA512

                                            abb0d9f88615cfc80cb9ce1ed106d7e2604cb8686cb9ba90cefc55f36a8ce93b3091063b6109ecf52f520cd92810d05d3323452399b9cc505e00c12e2d202a01

                                          • C:\Users\Admin\AppData\Local\Temp\GxMRaa2xsF.bat

                                            Filesize

                                            195B

                                            MD5

                                            16f82d641f0b10adfaf756aaedc6d53a

                                            SHA1

                                            35bfa3eb400a80031e52d9eb0e0555873833972f

                                            SHA256

                                            2ea69b551d3508e00770ce32b72e1da9d8534d3050596841f778fd15c05c0ad5

                                            SHA512

                                            fffa5d5f60dc773f49358b2d6cf15968572864dfe2774bca56b3382147c719268eac2663936727cb98daf6b3a4a3622f2f6acd0738e62ac53751b2cafa9866a6

                                          • C:\Users\Admin\AppData\Local\Temp\TarE4E8.tmp

                                            Filesize

                                            181KB

                                            MD5

                                            4ea6026cf93ec6338144661bf1202cd1

                                            SHA1

                                            a1dec9044f750ad887935a01430bf49322fbdcb7

                                            SHA256

                                            8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

                                            SHA512

                                            6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

                                          • C:\Users\Admin\AppData\Local\Temp\biigBqxW9T.bat

                                            Filesize

                                            195B

                                            MD5

                                            ae15c972d78fe37fee60a5a0e23c4e49

                                            SHA1

                                            aab09d4e8b644abce21c557a8dd8c68c6f4c659f

                                            SHA256

                                            de70084a2b60ae58f5215a7622cfa8a1df889633bd2430316cab620d343d5051

                                            SHA512

                                            b8c7ccfb133e2b7fc7a1ef62baceeddfac40765d170fc1fad458010d5ff766a235758d9488a6d964aa73a416a87ccd4b41267f8bf47b2dec9d0b2871ace66fe6

                                          • C:\Users\Admin\AppData\Local\Temp\p9sA7N8NGm.bat

                                            Filesize

                                            195B

                                            MD5

                                            ee8cc788a60790dacc106c794ec3e2da

                                            SHA1

                                            43e71e645e9029f651832353bc483fa2f81561f0

                                            SHA256

                                            7ed00ae43b06146bfd5cb751d746ab54fd95c16cfa4c00976a59b64be288a7dd

                                            SHA512

                                            d40453ba4f3f26e810d5f8b51b7ee46a04bc25caf43433beb2baf591b9d53bdd6bd9fe956118544462eb121b77f30adb726a11b5d6dfc18897eeeedd712c9c55

                                          • C:\Users\Admin\AppData\Local\Temp\pCeLVPpGxY.bat

                                            Filesize

                                            195B

                                            MD5

                                            ffaa0c33beaaba34eb3709985c226bc4

                                            SHA1

                                            2bec7f627af624753ef62dc1e797d69413982e2a

                                            SHA256

                                            b13550e9884cba309ce4dab7219158659769bc4d7bb480146699ae402e41932e

                                            SHA512

                                            e0494be6f3dc554c41be2503b48466e919f43e9648e934f749179a8a5d99c6199c5ebc3f291a9267ce86645ad696fcd753555c3a40f87c494aaa079fd0cf69ee

                                          • C:\Users\Admin\AppData\Local\Temp\vFDRBKGR2C.bat

                                            Filesize

                                            195B

                                            MD5

                                            7e948a2572e7d90f5225ba6dbce6b928

                                            SHA1

                                            7ab73b318848a67863bce6add3587388c4991e6d

                                            SHA256

                                            136cb494413f496e7f43f4e9bb779851d171a2443b01de853b238c98b2b9992b

                                            SHA512

                                            7359b4314b80387072de363319377ce5dbb7237ebafc3c666cd77e4a5a784d7063f6e459e22b3488e7f0d8ffdc28f4be0f0f9a8953ad59cd6f73627f798b68c4

                                          • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

                                            Filesize

                                            7KB

                                            MD5

                                            fb9d1af04dd9258bc45964fcbda0db48

                                            SHA1

                                            c3407a3ebd012f357ad0c5b334f61158ade76aa2

                                            SHA256

                                            e41aad4a58b787eb2a61190a7d178d6163ef5cb39552960aa64efb9fdbb6a101

                                            SHA512

                                            004ce62255018deb0dc9417bdc445c804741117ed3d3ee72f2e2c62fd703e62d5810e40f7c92a8fb19122678f74cfe32ef4b2f5a76f9e6f94f607963751c21fa

                                          • C:\providercommon\1zu9dW.bat

                                            Filesize

                                            36B

                                            MD5

                                            6783c3ee07c7d151ceac57f1f9c8bed7

                                            SHA1

                                            17468f98f95bf504cc1f83c49e49a78526b3ea03

                                            SHA256

                                            8ab782f0f327a2021530e7230d3aee8abbecb7eed59482a3a46e78b9e3862322

                                            SHA512

                                            c6012d4bfac1ed14d0fd9f0eabd0e1c3d647b343db292a907b246271d52a4b7469c809db43910ddba2e8c5045f9cb3d24d0af62d363281e6cb8b39ee94a183e8

                                          • C:\providercommon\DllCommonsvc.exe

                                            Filesize

                                            1.0MB

                                            MD5

                                            bd31e94b4143c4ce49c17d3af46bcad0

                                            SHA1

                                            f8c51ff3ff909531d9469d4ba1bbabae101853ff

                                            SHA256

                                            b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

                                            SHA512

                                            f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

                                          • C:\providercommon\yTUdeXjbLOhnrN32dgrxVg.vbe

                                            Filesize

                                            197B

                                            MD5

                                            8088241160261560a02c84025d107592

                                            SHA1

                                            083121f7027557570994c9fc211df61730455bb5

                                            SHA256

                                            2072cc9a4a3b84d4c5178ab41c5588eea7d0103e3928e34d64f17bf97f3d1cc1

                                            SHA512

                                            20d9369dd359315848ea30144383a0bb479d86059fdbc3b3256ac84f998193512feb3b1799ab663619920c99fe7e0ebba33ada31a3855094b956fcd351c90478

                                          • memory/688-55-0x0000000001FF0000-0x0000000001FF8000-memory.dmp

                                            Filesize

                                            32KB

                                          • memory/688-53-0x000000001B5C0000-0x000000001B8A2000-memory.dmp

                                            Filesize

                                            2.9MB

                                          • memory/800-407-0x0000000000240000-0x0000000000252000-memory.dmp

                                            Filesize

                                            72KB

                                          • memory/1632-165-0x00000000005E0000-0x00000000005F2000-memory.dmp

                                            Filesize

                                            72KB

                                          • memory/1632-164-0x00000000003A0000-0x00000000004B0000-memory.dmp

                                            Filesize

                                            1.1MB

                                          • memory/1660-528-0x0000000000950000-0x0000000000A60000-memory.dmp

                                            Filesize

                                            1.1MB

                                          • memory/1784-467-0x0000000000180000-0x0000000000290000-memory.dmp

                                            Filesize

                                            1.1MB

                                          • memory/1784-468-0x0000000000580000-0x0000000000592000-memory.dmp

                                            Filesize

                                            72KB

                                          • memory/1876-226-0x0000000000640000-0x0000000000652000-memory.dmp

                                            Filesize

                                            72KB

                                          • memory/1876-225-0x0000000000380000-0x0000000000490000-memory.dmp

                                            Filesize

                                            1.1MB

                                          • memory/1952-17-0x0000000000460000-0x000000000046C000-memory.dmp

                                            Filesize

                                            48KB

                                          • memory/1952-16-0x0000000000450000-0x000000000045C000-memory.dmp

                                            Filesize

                                            48KB

                                          • memory/1952-15-0x00000000002C0000-0x00000000002CC000-memory.dmp

                                            Filesize

                                            48KB

                                          • memory/1952-14-0x00000000002B0000-0x00000000002C2000-memory.dmp

                                            Filesize

                                            72KB

                                          • memory/1952-13-0x0000000000C90000-0x0000000000DA0000-memory.dmp

                                            Filesize

                                            1.1MB

                                          • memory/2544-346-0x0000000000BE0000-0x0000000000CF0000-memory.dmp

                                            Filesize

                                            1.1MB

                                          • memory/2544-347-0x0000000000350000-0x0000000000362000-memory.dmp

                                            Filesize

                                            72KB

                                          • memory/2588-286-0x0000000000960000-0x0000000000A70000-memory.dmp

                                            Filesize

                                            1.1MB

                                          • memory/2628-105-0x0000000000FC0000-0x00000000010D0000-memory.dmp

                                            Filesize

                                            1.1MB

                                          • memory/2840-648-0x00000000011F0000-0x0000000001300000-memory.dmp

                                            Filesize

                                            1.1MB

                                          • memory/3032-588-0x0000000000D30000-0x0000000000E40000-memory.dmp

                                            Filesize

                                            1.1MB