Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    143s
  • max time network
    138s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    22/12/2024, 12:50

General

  • Target

    JaffaCakes118_11931e904ddb30950482b46ef54e73bf048723912c9dc29996a16e6e9c388480.exe

  • Size

    1.3MB

  • MD5

    f2803766a2f7cea3e91c2840ac2f85a6

  • SHA1

    546004d9f413ae33db3b6d74eceea26e6453b596

  • SHA256

    11931e904ddb30950482b46ef54e73bf048723912c9dc29996a16e6e9c388480

  • SHA512

    c6116141dcc7ebb3efcffda6f128e9a5b0c586f26ce6bb86e738eb2d89a781bac053e4f77b7314236e59df4ecf6f4b561be131b025db9fedbf89ec0f1672f491

  • SSDEEP

    24576:U2G/nvxW3Ww0t6TnzGmVBDh4+aknuRRZJND0gFJ4rD/IjC:UbA30GnzV/q+DnsXg

Malware Config

Signatures

  • DcRat

    DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

  • Dcrat family
  • Process spawned unexpected child process 39 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • DCRat payload 10 IoCs

    Detects payload of DCRat, commonly dropped by NSIS installers.

  • Command and Scripting Interpreter: PowerShell 1 TTPs 14 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

  • Executes dropped EXE 12 IoCs
  • Loads dropped DLL 2 IoCs
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 11 IoCs
  • Drops file in Program Files directory 12 IoCs
  • Drops file in Windows directory 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Scheduled Task/Job: Scheduled Task 1 TTPs 39 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 30 IoCs
  • Suspicious use of AdjustPrivilegeToken 26 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_11931e904ddb30950482b46ef54e73bf048723912c9dc29996a16e6e9c388480.exe
    "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_11931e904ddb30950482b46ef54e73bf048723912c9dc29996a16e6e9c388480.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:2068
    • C:\Windows\SysWOW64\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\providercommon\yTUdeXjbLOhnrN32dgrxVg.vbe"
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:2368
      • C:\Windows\SysWOW64\cmd.exe
        cmd /c ""C:\providercommon\1zu9dW.bat" "
        3⤵
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:2284
        • C:\providercommon\DllCommonsvc.exe
          "C:\providercommon\DllCommonsvc.exe"
          4⤵
          • Executes dropped EXE
          • Drops file in Program Files directory
          • Drops file in Windows directory
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:2732
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\DllCommonsvc.exe'
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:2540
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Public\WMIADAP.exe'
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:3044
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Windows Portable Devices\WMIADAP.exe'
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:2132
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\OSPPSVC.exe'
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:700
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Microsoft Office\Office14\1033\OSPPSVC.exe'
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:556
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Windows Mail\en-US\dllhost.exe'
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:2264
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Microsoft Office\csrss.exe'
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:352
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\MSOCache\All Users\{90140000-001A-0409-0000-0000000FF1CE}-C\Idle.exe'
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:1916
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\WMIADAP.exe'
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:2448
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\audiodg.exe'
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:1660
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Windows Photo Viewer\de-DE\winlogon.exe'
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:2464
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Windows Mail\de-DE\audiodg.exe'
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:1416
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Public\Desktop\conhost.exe'
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:324
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\it-IT\audiodg.exe'
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:1020
          • C:\Program Files\Windows Photo Viewer\de-DE\winlogon.exe
            "C:\Program Files\Windows Photo Viewer\de-DE\winlogon.exe"
            5⤵
            • Executes dropped EXE
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of WriteProcessMemory
            PID:2584
            • C:\Windows\System32\cmd.exe
              "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\SvvYNrLnHE.bat"
              6⤵
              • Suspicious use of WriteProcessMemory
              PID:888
              • C:\Windows\system32\w32tm.exe
                w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                7⤵
                  PID:1560
                • C:\Program Files\Windows Photo Viewer\de-DE\winlogon.exe
                  "C:\Program Files\Windows Photo Viewer\de-DE\winlogon.exe"
                  7⤵
                  • Executes dropped EXE
                  • Suspicious behavior: EnumeratesProcesses
                  • Suspicious use of AdjustPrivilegeToken
                  PID:752
                  • C:\Windows\System32\cmd.exe
                    "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\JhFjyqSsxH.bat"
                    8⤵
                      PID:2976
                      • C:\Windows\system32\w32tm.exe
                        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                        9⤵
                          PID:988
                        • C:\Program Files\Windows Photo Viewer\de-DE\winlogon.exe
                          "C:\Program Files\Windows Photo Viewer\de-DE\winlogon.exe"
                          9⤵
                          • Executes dropped EXE
                          • Suspicious behavior: EnumeratesProcesses
                          • Suspicious use of AdjustPrivilegeToken
                          PID:2016
                          • C:\Windows\System32\cmd.exe
                            "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\Ph8sa6VtQm.bat"
                            10⤵
                              PID:1460
                              • C:\Windows\system32\w32tm.exe
                                w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                                11⤵
                                  PID:2920
                                • C:\Program Files\Windows Photo Viewer\de-DE\winlogon.exe
                                  "C:\Program Files\Windows Photo Viewer\de-DE\winlogon.exe"
                                  11⤵
                                  • Executes dropped EXE
                                  • Suspicious behavior: EnumeratesProcesses
                                  • Suspicious use of AdjustPrivilegeToken
                                  PID:1224
                                  • C:\Windows\System32\cmd.exe
                                    "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\yQDva2PSBr.bat"
                                    12⤵
                                      PID:1480
                                      • C:\Windows\system32\w32tm.exe
                                        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                                        13⤵
                                          PID:2184
                                        • C:\Program Files\Windows Photo Viewer\de-DE\winlogon.exe
                                          "C:\Program Files\Windows Photo Viewer\de-DE\winlogon.exe"
                                          13⤵
                                          • Executes dropped EXE
                                          • Suspicious behavior: EnumeratesProcesses
                                          • Suspicious use of AdjustPrivilegeToken
                                          PID:2452
                                          • C:\Windows\System32\cmd.exe
                                            "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\tbw0avzYF4.bat"
                                            14⤵
                                              PID:2156
                                              • C:\Windows\system32\w32tm.exe
                                                w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                                                15⤵
                                                  PID:1916
                                                • C:\Program Files\Windows Photo Viewer\de-DE\winlogon.exe
                                                  "C:\Program Files\Windows Photo Viewer\de-DE\winlogon.exe"
                                                  15⤵
                                                  • Executes dropped EXE
                                                  • Suspicious behavior: EnumeratesProcesses
                                                  • Suspicious use of AdjustPrivilegeToken
                                                  PID:2976
                                                  • C:\Windows\System32\cmd.exe
                                                    "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\VAhDAdBh8f.bat"
                                                    16⤵
                                                      PID:2824
                                                      • C:\Windows\system32\w32tm.exe
                                                        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                                                        17⤵
                                                          PID:1172
                                                        • C:\Program Files\Windows Photo Viewer\de-DE\winlogon.exe
                                                          "C:\Program Files\Windows Photo Viewer\de-DE\winlogon.exe"
                                                          17⤵
                                                          • Executes dropped EXE
                                                          • Suspicious behavior: EnumeratesProcesses
                                                          • Suspicious use of AdjustPrivilegeToken
                                                          PID:1460
                                                          • C:\Windows\System32\cmd.exe
                                                            "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\ZZzsG8LzQB.bat"
                                                            18⤵
                                                              PID:932
                                                              • C:\Windows\system32\w32tm.exe
                                                                w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                                                                19⤵
                                                                  PID:1668
                                                                • C:\Program Files\Windows Photo Viewer\de-DE\winlogon.exe
                                                                  "C:\Program Files\Windows Photo Viewer\de-DE\winlogon.exe"
                                                                  19⤵
                                                                  • Executes dropped EXE
                                                                  • Suspicious behavior: EnumeratesProcesses
                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                  PID:2812
                                                                  • C:\Windows\System32\cmd.exe
                                                                    "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\YQG5KQjShu.bat"
                                                                    20⤵
                                                                      PID:1940
                                                                      • C:\Windows\system32\w32tm.exe
                                                                        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                                                                        21⤵
                                                                          PID:2840
                                                                        • C:\Program Files\Windows Photo Viewer\de-DE\winlogon.exe
                                                                          "C:\Program Files\Windows Photo Viewer\de-DE\winlogon.exe"
                                                                          21⤵
                                                                          • Executes dropped EXE
                                                                          • Suspicious behavior: EnumeratesProcesses
                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                          PID:1064
                                                                          • C:\Windows\System32\cmd.exe
                                                                            "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\Y29a6RA8xz.bat"
                                                                            22⤵
                                                                              PID:824
                                                                              • C:\Windows\system32\w32tm.exe
                                                                                w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                                                                                23⤵
                                                                                  PID:2364
                                                                                • C:\Program Files\Windows Photo Viewer\de-DE\winlogon.exe
                                                                                  "C:\Program Files\Windows Photo Viewer\de-DE\winlogon.exe"
                                                                                  23⤵
                                                                                  • Executes dropped EXE
                                                                                  • Suspicious behavior: EnumeratesProcesses
                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                  PID:2416
                                                                                  • C:\Windows\System32\cmd.exe
                                                                                    "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\8t4fMT0wY0.bat"
                                                                                    24⤵
                                                                                      PID:2220
                                                                                      • C:\Windows\system32\w32tm.exe
                                                                                        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                                                                                        25⤵
                                                                                          PID:2968
                                                                                        • C:\Program Files\Windows Photo Viewer\de-DE\winlogon.exe
                                                                                          "C:\Program Files\Windows Photo Viewer\de-DE\winlogon.exe"
                                                                                          25⤵
                                                                                          • Executes dropped EXE
                                                                                          • Suspicious behavior: EnumeratesProcesses
                                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                                          PID:2728
                                        • C:\Windows\system32\schtasks.exe
                                          schtasks.exe /create /tn "WMIADAPW" /sc MINUTE /mo 6 /tr "'C:\Users\Public\WMIADAP.exe'" /f
                                          1⤵
                                          • Process spawned unexpected child process
                                          • Scheduled Task/Job: Scheduled Task
                                          PID:2908
                                        • C:\Windows\system32\schtasks.exe
                                          schtasks.exe /create /tn "WMIADAP" /sc ONLOGON /tr "'C:\Users\Public\WMIADAP.exe'" /rl HIGHEST /f
                                          1⤵
                                          • Process spawned unexpected child process
                                          • Scheduled Task/Job: Scheduled Task
                                          PID:948
                                        • C:\Windows\system32\schtasks.exe
                                          schtasks.exe /create /tn "WMIADAPW" /sc MINUTE /mo 11 /tr "'C:\Users\Public\WMIADAP.exe'" /rl HIGHEST /f
                                          1⤵
                                          • Process spawned unexpected child process
                                          • Scheduled Task/Job: Scheduled Task
                                          PID:2876
                                        • C:\Windows\system32\schtasks.exe
                                          schtasks.exe /create /tn "WMIADAPW" /sc MINUTE /mo 9 /tr "'C:\Program Files (x86)\Windows Portable Devices\WMIADAP.exe'" /f
                                          1⤵
                                          • Process spawned unexpected child process
                                          • Scheduled Task/Job: Scheduled Task
                                          PID:2596
                                        • C:\Windows\system32\schtasks.exe
                                          schtasks.exe /create /tn "WMIADAP" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Portable Devices\WMIADAP.exe'" /rl HIGHEST /f
                                          1⤵
                                          • Process spawned unexpected child process
                                          • Scheduled Task/Job: Scheduled Task
                                          PID:1860
                                        • C:\Windows\system32\schtasks.exe
                                          schtasks.exe /create /tn "WMIADAPW" /sc MINUTE /mo 5 /tr "'C:\Program Files (x86)\Windows Portable Devices\WMIADAP.exe'" /rl HIGHEST /f
                                          1⤵
                                          • Process spawned unexpected child process
                                          • Scheduled Task/Job: Scheduled Task
                                          PID:2224
                                        • C:\Windows\system32\schtasks.exe
                                          schtasks.exe /create /tn "OSPPSVCO" /sc MINUTE /mo 13 /tr "'C:\providercommon\OSPPSVC.exe'" /f
                                          1⤵
                                          • Process spawned unexpected child process
                                          • Scheduled Task/Job: Scheduled Task
                                          PID:2212
                                        • C:\Windows\system32\schtasks.exe
                                          schtasks.exe /create /tn "OSPPSVC" /sc ONLOGON /tr "'C:\providercommon\OSPPSVC.exe'" /rl HIGHEST /f
                                          1⤵
                                          • Process spawned unexpected child process
                                          • Scheduled Task/Job: Scheduled Task
                                          PID:2008
                                        • C:\Windows\system32\schtasks.exe
                                          schtasks.exe /create /tn "OSPPSVCO" /sc MINUTE /mo 10 /tr "'C:\providercommon\OSPPSVC.exe'" /rl HIGHEST /f
                                          1⤵
                                          • Process spawned unexpected child process
                                          • Scheduled Task/Job: Scheduled Task
                                          PID:2844
                                        • C:\Windows\system32\schtasks.exe
                                          schtasks.exe /create /tn "OSPPSVCO" /sc MINUTE /mo 9 /tr "'C:\Program Files\Microsoft Office\Office14\1033\OSPPSVC.exe'" /f
                                          1⤵
                                          • Process spawned unexpected child process
                                          • Scheduled Task/Job: Scheduled Task
                                          PID:2012
                                        • C:\Windows\system32\schtasks.exe
                                          schtasks.exe /create /tn "OSPPSVC" /sc ONLOGON /tr "'C:\Program Files\Microsoft Office\Office14\1033\OSPPSVC.exe'" /rl HIGHEST /f
                                          1⤵
                                          • Process spawned unexpected child process
                                          • Scheduled Task/Job: Scheduled Task
                                          PID:2020
                                        • C:\Windows\system32\schtasks.exe
                                          schtasks.exe /create /tn "OSPPSVCO" /sc MINUTE /mo 8 /tr "'C:\Program Files\Microsoft Office\Office14\1033\OSPPSVC.exe'" /rl HIGHEST /f
                                          1⤵
                                          • Process spawned unexpected child process
                                          • Scheduled Task/Job: Scheduled Task
                                          PID:1728
                                        • C:\Windows\system32\schtasks.exe
                                          schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 13 /tr "'C:\Program Files (x86)\Windows Mail\en-US\dllhost.exe'" /f
                                          1⤵
                                          • Process spawned unexpected child process
                                          • Scheduled Task/Job: Scheduled Task
                                          PID:2852
                                        • C:\Windows\system32\schtasks.exe
                                          schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Mail\en-US\dllhost.exe'" /rl HIGHEST /f
                                          1⤵
                                          • Process spawned unexpected child process
                                          • Scheduled Task/Job: Scheduled Task
                                          PID:1724
                                        • C:\Windows\system32\schtasks.exe
                                          schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 7 /tr "'C:\Program Files (x86)\Windows Mail\en-US\dllhost.exe'" /rl HIGHEST /f
                                          1⤵
                                          • Process spawned unexpected child process
                                          • Scheduled Task/Job: Scheduled Task
                                          PID:1812
                                        • C:\Windows\system32\schtasks.exe
                                          schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 12 /tr "'C:\Program Files (x86)\Microsoft Office\csrss.exe'" /f
                                          1⤵
                                          • Process spawned unexpected child process
                                          • Scheduled Task/Job: Scheduled Task
                                          PID:1384
                                        • C:\Windows\system32\schtasks.exe
                                          schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Program Files (x86)\Microsoft Office\csrss.exe'" /rl HIGHEST /f
                                          1⤵
                                          • Process spawned unexpected child process
                                          • Scheduled Task/Job: Scheduled Task
                                          PID:1892
                                        • C:\Windows\system32\schtasks.exe
                                          schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 12 /tr "'C:\Program Files (x86)\Microsoft Office\csrss.exe'" /rl HIGHEST /f
                                          1⤵
                                          • Process spawned unexpected child process
                                          • Scheduled Task/Job: Scheduled Task
                                          PID:1616
                                        • C:\Windows\system32\schtasks.exe
                                          schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 8 /tr "'C:\MSOCache\All Users\{90140000-001A-0409-0000-0000000FF1CE}-C\Idle.exe'" /f
                                          1⤵
                                          • Process spawned unexpected child process
                                          • Scheduled Task/Job: Scheduled Task
                                          PID:1836
                                        • C:\Windows\system32\schtasks.exe
                                          schtasks.exe /create /tn "Idle" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-001A-0409-0000-0000000FF1CE}-C\Idle.exe'" /rl HIGHEST /f
                                          1⤵
                                          • Process spawned unexpected child process
                                          • Scheduled Task/Job: Scheduled Task
                                          PID:1672
                                        • C:\Windows\system32\schtasks.exe
                                          schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 5 /tr "'C:\MSOCache\All Users\{90140000-001A-0409-0000-0000000FF1CE}-C\Idle.exe'" /rl HIGHEST /f
                                          1⤵
                                          • Process spawned unexpected child process
                                          • Scheduled Task/Job: Scheduled Task
                                          PID:2688
                                        • C:\Windows\system32\schtasks.exe
                                          schtasks.exe /create /tn "WMIADAPW" /sc MINUTE /mo 6 /tr "'C:\providercommon\WMIADAP.exe'" /f
                                          1⤵
                                          • Process spawned unexpected child process
                                          • Scheduled Task/Job: Scheduled Task
                                          PID:2180
                                        • C:\Windows\system32\schtasks.exe
                                          schtasks.exe /create /tn "WMIADAP" /sc ONLOGON /tr "'C:\providercommon\WMIADAP.exe'" /rl HIGHEST /f
                                          1⤵
                                          • Process spawned unexpected child process
                                          • Scheduled Task/Job: Scheduled Task
                                          PID:2244
                                        • C:\Windows\system32\schtasks.exe
                                          schtasks.exe /create /tn "WMIADAPW" /sc MINUTE /mo 9 /tr "'C:\providercommon\WMIADAP.exe'" /rl HIGHEST /f
                                          1⤵
                                          • Process spawned unexpected child process
                                          • Scheduled Task/Job: Scheduled Task
                                          PID:2552
                                        • C:\Windows\system32\schtasks.exe
                                          schtasks.exe /create /tn "audiodga" /sc MINUTE /mo 13 /tr "'C:\providercommon\audiodg.exe'" /f
                                          1⤵
                                          • Process spawned unexpected child process
                                          • Scheduled Task/Job: Scheduled Task
                                          PID:1192
                                        • C:\Windows\system32\schtasks.exe
                                          schtasks.exe /create /tn "audiodg" /sc ONLOGON /tr "'C:\providercommon\audiodg.exe'" /rl HIGHEST /f
                                          1⤵
                                          • Process spawned unexpected child process
                                          • Scheduled Task/Job: Scheduled Task
                                          PID:2184
                                        • C:\Windows\system32\schtasks.exe
                                          schtasks.exe /create /tn "audiodga" /sc MINUTE /mo 10 /tr "'C:\providercommon\audiodg.exe'" /rl HIGHEST /f
                                          1⤵
                                          • Process spawned unexpected child process
                                          • Scheduled Task/Job: Scheduled Task
                                          PID:1244
                                        • C:\Windows\system32\schtasks.exe
                                          schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 9 /tr "'C:\Program Files\Windows Photo Viewer\de-DE\winlogon.exe'" /f
                                          1⤵
                                          • Process spawned unexpected child process
                                          • Scheduled Task/Job: Scheduled Task
                                          PID:3024
                                        • C:\Windows\system32\schtasks.exe
                                          schtasks.exe /create /tn "winlogon" /sc ONLOGON /tr "'C:\Program Files\Windows Photo Viewer\de-DE\winlogon.exe'" /rl HIGHEST /f
                                          1⤵
                                          • Process spawned unexpected child process
                                          • Scheduled Task/Job: Scheduled Task
                                          PID:2972
                                        • C:\Windows\system32\schtasks.exe
                                          schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 13 /tr "'C:\Program Files\Windows Photo Viewer\de-DE\winlogon.exe'" /rl HIGHEST /f
                                          1⤵
                                          • Process spawned unexpected child process
                                          • Scheduled Task/Job: Scheduled Task
                                          PID:944
                                        • C:\Windows\system32\schtasks.exe
                                          schtasks.exe /create /tn "audiodga" /sc MINUTE /mo 10 /tr "'C:\Program Files (x86)\Windows Mail\de-DE\audiodg.exe'" /f
                                          1⤵
                                          • Process spawned unexpected child process
                                          • Scheduled Task/Job: Scheduled Task
                                          PID:1776
                                        • C:\Windows\system32\schtasks.exe
                                          schtasks.exe /create /tn "audiodg" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Mail\de-DE\audiodg.exe'" /rl HIGHEST /f
                                          1⤵
                                          • Process spawned unexpected child process
                                          • Scheduled Task/Job: Scheduled Task
                                          PID:1224
                                        • C:\Windows\system32\schtasks.exe
                                          schtasks.exe /create /tn "audiodga" /sc MINUTE /mo 8 /tr "'C:\Program Files (x86)\Windows Mail\de-DE\audiodg.exe'" /rl HIGHEST /f
                                          1⤵
                                          • Process spawned unexpected child process
                                          • Scheduled Task/Job: Scheduled Task
                                          PID:1612
                                        • C:\Windows\system32\schtasks.exe
                                          schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 12 /tr "'C:\Users\Public\Desktop\conhost.exe'" /f
                                          1⤵
                                          • Process spawned unexpected child process
                                          • Scheduled Task/Job: Scheduled Task
                                          PID:1940
                                        • C:\Windows\system32\schtasks.exe
                                          schtasks.exe /create /tn "conhost" /sc ONLOGON /tr "'C:\Users\Public\Desktop\conhost.exe'" /rl HIGHEST /f
                                          1⤵
                                          • Process spawned unexpected child process
                                          • Scheduled Task/Job: Scheduled Task
                                          PID:1500
                                        • C:\Windows\system32\schtasks.exe
                                          schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 11 /tr "'C:\Users\Public\Desktop\conhost.exe'" /rl HIGHEST /f
                                          1⤵
                                          • Process spawned unexpected child process
                                          • Scheduled Task/Job: Scheduled Task
                                          PID:688
                                        • C:\Windows\system32\schtasks.exe
                                          schtasks.exe /create /tn "audiodga" /sc MINUTE /mo 14 /tr "'C:\Windows\it-IT\audiodg.exe'" /f
                                          1⤵
                                          • Process spawned unexpected child process
                                          • Scheduled Task/Job: Scheduled Task
                                          PID:1460
                                        • C:\Windows\system32\schtasks.exe
                                          schtasks.exe /create /tn "audiodg" /sc ONLOGON /tr "'C:\Windows\it-IT\audiodg.exe'" /rl HIGHEST /f
                                          1⤵
                                          • Process spawned unexpected child process
                                          • Scheduled Task/Job: Scheduled Task
                                          PID:1684
                                        • C:\Windows\system32\schtasks.exe
                                          schtasks.exe /create /tn "audiodga" /sc MINUTE /mo 14 /tr "'C:\Windows\it-IT\audiodg.exe'" /rl HIGHEST /f
                                          1⤵
                                          • Process spawned unexpected child process
                                          • Scheduled Task/Job: Scheduled Task
                                          PID:572

                                        Network

                                        MITRE ATT&CK Enterprise v15

                                        Replay Monitor

                                        Loading Replay Monitor...

                                        Downloads

                                        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

                                          Filesize

                                          342B

                                          MD5

                                          e4090f11d683def34e4903549107bc62

                                          SHA1

                                          2d8ae392dae0fe45e64da0b6bd6c45047d833ab9

                                          SHA256

                                          c2c5d80aeb19f3bae9e2f4888c1d4f650aac5ee06f31e2df181850f7c9398aa5

                                          SHA512

                                          5d7723cec8774d06c811b8d75a9be88a8965a6f7f3a44aea0a80199014d4aff3281aab22c00f10756f827df719a51779b34056dfa15214f827b3704fd79b35a5

                                        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

                                          Filesize

                                          342B

                                          MD5

                                          0064915aeffcd748fad3c78f0e1de20f

                                          SHA1

                                          80043483268f9c64b320a8acb8102fed370b210f

                                          SHA256

                                          1a8c0044d1d84ca846a372276481c17af1f2c5c4569ae083cc9579370f186ff4

                                          SHA512

                                          5ee12cab3a874a825817fa7408f5c2112fa231f162d35102726d234f74bb5788374bafc20ed856680bbf96b89bc32f73378be818444aa5e61d4112ae1b8eada4

                                        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

                                          Filesize

                                          342B

                                          MD5

                                          043b358a97d41e19d9f09af5878ce111

                                          SHA1

                                          c0110d9c737188a1545e66d491a0f6510b2d8675

                                          SHA256

                                          fce673061b0c74b5a8b0e4b6189bdbec260e86871fff03f11e8ff6d84a42619d

                                          SHA512

                                          be5b70f0ef6f5a9cfb4d7ae656e81f9d278831a23faf71b148b0db1775a97cc131394035549cb08daded2f2f7c42a0076b602709d1f4756ebcc78f41996860e7

                                        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

                                          Filesize

                                          342B

                                          MD5

                                          cc08b951b818c6f9bb18ef7fde523e50

                                          SHA1

                                          c3b835da4c86d60aa5d2c13b6a12a8423b37a9a8

                                          SHA256

                                          bd8ce838ca3cbf50b8518c2e05e3630b37d537f484ba3e26f4074268dee9e982

                                          SHA512

                                          16df44a9ae44d52fe3fd4d1571a979167cac6aaad12a0911519d1a1698affd1dc2ca36d5c910d47cfb5ef1806d0feff423234018ec705c73484edbe2ed62f7e8

                                        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

                                          Filesize

                                          342B

                                          MD5

                                          8a7ed8cc962d902f2150a71dbf0b3491

                                          SHA1

                                          87a70ce98058452c69738de4bd5db470d6816add

                                          SHA256

                                          3a26c1a90484708e22ba7ef3fa279fb46aad3b0f53958e5a8228fcb7fca9f264

                                          SHA512

                                          d5a4f7c84d057a5327304d94c6d7b4a534fcfa29ba297f24f7e883443caf8dd8372124cf87482ecaacaf05d32d158889e84fd49003778921cf4d278f32e4a9d0

                                        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

                                          Filesize

                                          342B

                                          MD5

                                          297bbdd85fa7a4ae53bbad1fd85837c2

                                          SHA1

                                          b47f04a66ca278186e3ab2929888ac7eff58de37

                                          SHA256

                                          dbc9748d3127a5ced92ca61ed8f31ce40563931abb054a3b2d4df07c31112754

                                          SHA512

                                          7bf2f9e024c34f1e507c05a57975403b2e110027dec8ffba2435a213e216feb3be609794d43cf8a17bcfe15451fa443dcc1763f6c689d50c9fe71eb47869e70a

                                        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

                                          Filesize

                                          342B

                                          MD5

                                          cba6e95807e28bc8defda5a2d47d62f6

                                          SHA1

                                          305063a44f2bd1d11b63a524dc9fba7ad52b6957

                                          SHA256

                                          39ac0b0408713c531a95edd17de06b4287c79861398ae82d4ae08dec5a40d009

                                          SHA512

                                          4b3a433bbf14bae33bce9930654f23d9c578205a98d5fa8817439a1c7022c9953f753dc37edcf9d50c66230744ddab184d2f2df08e25b2c5c3cc8f86cdc29aed

                                        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

                                          Filesize

                                          342B

                                          MD5

                                          bf534c510f956468fb7e0d7b0b836b6f

                                          SHA1

                                          25463a59d94e1b4d4436e38e1b78b669fb3a1e34

                                          SHA256

                                          723aaab1a65b0d5be485dcb6ade3031d55d06cb7ea4a2b311fb672d1793ad214

                                          SHA512

                                          ea7dea9f6be9b727507d3a19c1b3c98dcbf34cd2ffe389c4f141a098631fab4817820b96eaf9397c0d5e8cd94ef71019596d3bc706d5099ee5bd5e5fc2ee6c84

                                        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

                                          Filesize

                                          342B

                                          MD5

                                          2ca426afec7562e0c9d52347e03be346

                                          SHA1

                                          e36bdf81354235ff88373b143d93189e7e340e83

                                          SHA256

                                          396bba821c64f01fccdc609a04c5a8c6b1ccdb601a18f4a107939682a997f580

                                          SHA512

                                          6a91ae804dc38d6580f8bebc5aeceeffd32093b3016c08e0615901a97656d7783ce55c2c69e4659219d05d1564ab33c9deb2a3315f9053f968d69bfebc501066

                                        • C:\Users\Admin\AppData\Local\Temp\8t4fMT0wY0.bat

                                          Filesize

                                          221B

                                          MD5

                                          6979bd9ed25b0c94b4f2c31e0f9d497f

                                          SHA1

                                          d2e9fb4adcc880f95b4e94e9d7d02428f5307632

                                          SHA256

                                          2fc46fbf651948605e2076fdbe999a71ef56354c8f48cd12916f6259ebc24102

                                          SHA512

                                          2a23bca4993974d689f8b8db03cadd0ab0c29e6b9bc9bcf095ffe991bc78fe28cde1f0733c20e044b900689d92d96c96080caaedf583cbe62c1bf73b95a12aa2

                                        • C:\Users\Admin\AppData\Local\Temp\Cab122C.tmp

                                          Filesize

                                          70KB

                                          MD5

                                          49aebf8cbd62d92ac215b2923fb1b9f5

                                          SHA1

                                          1723be06719828dda65ad804298d0431f6aff976

                                          SHA256

                                          b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

                                          SHA512

                                          bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

                                        • C:\Users\Admin\AppData\Local\Temp\JhFjyqSsxH.bat

                                          Filesize

                                          221B

                                          MD5

                                          67a5e9ef6e40e08f909deda48dc299b7

                                          SHA1

                                          0a5ec871c11195412f519c50e0ae70fb66e43807

                                          SHA256

                                          844d23b62e59243f7c588df22b86375402a3786d0ad591555b1524ca8f2a93c6

                                          SHA512

                                          4ef54884246731814150590cb3115b5724edfde69eb22cec3da09d381df756948bd1ecd3c21fee4c704fd9583a4a12243797441706703b733a06c3c6a82033c2

                                        • C:\Users\Admin\AppData\Local\Temp\Ph8sa6VtQm.bat

                                          Filesize

                                          221B

                                          MD5

                                          65685c8f3aab6321198a9a2436ac9427

                                          SHA1

                                          d1a4007f34241c15a3086ddaa25411101f7d6d37

                                          SHA256

                                          6f31acf34cd2400078d1d0e6a460ab12a55811aa9a454dd0c07d6c913e48fbcd

                                          SHA512

                                          090f855d14b1fe16eff5df14a94322d742cb6b67fd2028c402fd739df20b0b621d527e6d9100e2f33802b1bb0dbca1940e5be557671837f6235e5acce02895ab

                                        • C:\Users\Admin\AppData\Local\Temp\SvvYNrLnHE.bat

                                          Filesize

                                          221B

                                          MD5

                                          96f8954a8d0b97c8d9985cad2637df32

                                          SHA1

                                          ff31b963e15a24e03eace7c564bf11f32d5934e6

                                          SHA256

                                          6c77c206d2504bbe0e5cec1154ed815a4fb189e43cb8bd06e12afe499b3a2bd0

                                          SHA512

                                          9ce765a0bf2eac0fa218d76e836f79f39d658bbd2a0745a3061ae37980b04e2e4a223621c433a4feedaf2ef0354af523c2508a2684a63e5352bea19afcc9580a

                                        • C:\Users\Admin\AppData\Local\Temp\Tar124E.tmp

                                          Filesize

                                          181KB

                                          MD5

                                          4ea6026cf93ec6338144661bf1202cd1

                                          SHA1

                                          a1dec9044f750ad887935a01430bf49322fbdcb7

                                          SHA256

                                          8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

                                          SHA512

                                          6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

                                        • C:\Users\Admin\AppData\Local\Temp\VAhDAdBh8f.bat

                                          Filesize

                                          221B

                                          MD5

                                          645c1928fbef5364b90994eb78d8588c

                                          SHA1

                                          c9358552fbf75d859a85c89622d01ffe37eb9674

                                          SHA256

                                          03bae5e2ae4edef27e8ee123876d772f62df889d54b1f68f47dc5cfb7a3c6f37

                                          SHA512

                                          993ef85f662c8f30f00a7f4b88dbe620e3f8fa62a6037115bab577d43939438331c3995dd3d9405954a2bdf75954a620dafbe66d2ff961723cb2dcef83060896

                                        • C:\Users\Admin\AppData\Local\Temp\Y29a6RA8xz.bat

                                          Filesize

                                          221B

                                          MD5

                                          cb0b89567f2824a6d1ee0459d4573099

                                          SHA1

                                          065af58ea21649c17aa1e5d81fa3264625eb5653

                                          SHA256

                                          071fec8cc659d9278d5d261d2794eff133603d51385f1e9313e632dd62a4eed8

                                          SHA512

                                          46803dfe0f216094542445ffcf4a67c17191407fd4e9391df9c618b69c0894bc0e72569309af3dbbdf8d21baf929c96f88b41fe5f8c31178e7a522009cb6f053

                                        • C:\Users\Admin\AppData\Local\Temp\YQG5KQjShu.bat

                                          Filesize

                                          221B

                                          MD5

                                          a52adee42ef0cc5bd40ec2cf365e4816

                                          SHA1

                                          f3989216aaffcff88a88902ca62b324dbd8c3451

                                          SHA256

                                          1c7378fc87ce1a052671e6379a8db5c05884776851235a346c6092cabc1dd6f7

                                          SHA512

                                          03d04af9b46d9a7ffb434a30e13bbd2b5eb8b0960f136bd8a2513cd91145e9d8c0206e9aa150060fd1210931d3eae1039937a7d19200773160192608ac50bbdb

                                        • C:\Users\Admin\AppData\Local\Temp\ZZzsG8LzQB.bat

                                          Filesize

                                          221B

                                          MD5

                                          02e529a28bd6ce2f2fdc46b9f1c7c216

                                          SHA1

                                          46bdeb447675e8d2bf6b8bf1df2cfe54235a54c4

                                          SHA256

                                          245b7daff3b42dee5ffac926df3705a4dee4ebfddc268d053a2c8a459942569e

                                          SHA512

                                          ce79c0b641667bd9c32d8608a2de3649e7e519391afa167944811d490105bd32962eb2a180a810c13f582d81046af76eba671aaca99147cc89bb460bc63af126

                                        • C:\Users\Admin\AppData\Local\Temp\tbw0avzYF4.bat

                                          Filesize

                                          221B

                                          MD5

                                          a2f7d2a0b081d7f752a4751d60b1e3a6

                                          SHA1

                                          c310a424c56168feae23a6b5c35f51ebc77cefb9

                                          SHA256

                                          b3dd15a5c1e0bacc24d87eefe69068a4d216a7b75f8f2edb1f554970674b6a82

                                          SHA512

                                          7304a3d21351585c4fc13a7271b4ebf955e3ba89cfba1e3b4efd7e11bd85245677b1197b327b065e6cc3dd5fc609dfbb6b53341941825b95773d197728fbe470

                                        • C:\Users\Admin\AppData\Local\Temp\yQDva2PSBr.bat

                                          Filesize

                                          221B

                                          MD5

                                          c835736a78bf064d529557a9a6ec5e2f

                                          SHA1

                                          a78bb8495ea7e3bdd252fe853798ed3da16c3b95

                                          SHA256

                                          feac4c82a98572c17d699e72e64218add82e70a1b0f6f2345870ae6b8a7e6877

                                          SHA512

                                          f9ae3e90f949d80e334d2cd7dbea153b6b15170ad86e675fdb31101d3d9d91a1cd65b4e470e7579b7e783f70de83aae91b6d3b0c77ef6207bb2952f0ed99a768

                                        • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

                                          Filesize

                                          7KB

                                          MD5

                                          0d48d9ede5e58d4735709893bb584d7a

                                          SHA1

                                          129f1edf37b22134ef57066472d16a84ec047de5

                                          SHA256

                                          bef3356be89308492bc2614c543d4ea8ba781a8ee02cacb59a5a96708c4b4560

                                          SHA512

                                          d669fa044f3377081f2751d79b83bb633ef5c685b0a8787791497ca02c5234095610c670573fa29bd7cc10ab7632bf91c69a7079ac60f3f8bd622bed5790ae8c

                                        • C:\providercommon\1zu9dW.bat

                                          Filesize

                                          36B

                                          MD5

                                          6783c3ee07c7d151ceac57f1f9c8bed7

                                          SHA1

                                          17468f98f95bf504cc1f83c49e49a78526b3ea03

                                          SHA256

                                          8ab782f0f327a2021530e7230d3aee8abbecb7eed59482a3a46e78b9e3862322

                                          SHA512

                                          c6012d4bfac1ed14d0fd9f0eabd0e1c3d647b343db292a907b246271d52a4b7469c809db43910ddba2e8c5045f9cb3d24d0af62d363281e6cb8b39ee94a183e8

                                        • C:\providercommon\yTUdeXjbLOhnrN32dgrxVg.vbe

                                          Filesize

                                          197B

                                          MD5

                                          8088241160261560a02c84025d107592

                                          SHA1

                                          083121f7027557570994c9fc211df61730455bb5

                                          SHA256

                                          2072cc9a4a3b84d4c5178ab41c5588eea7d0103e3928e34d64f17bf97f3d1cc1

                                          SHA512

                                          20d9369dd359315848ea30144383a0bb479d86059fdbc3b3256ac84f998193512feb3b1799ab663619920c99fe7e0ebba33ada31a3855094b956fcd351c90478

                                        • \providercommon\DllCommonsvc.exe

                                          Filesize

                                          1.0MB

                                          MD5

                                          bd31e94b4143c4ce49c17d3af46bcad0

                                          SHA1

                                          f8c51ff3ff909531d9469d4ba1bbabae101853ff

                                          SHA256

                                          b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

                                          SHA512

                                          f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

                                        • memory/700-59-0x000000001B5B0000-0x000000001B892000-memory.dmp

                                          Filesize

                                          2.9MB

                                        • memory/700-61-0x0000000002720000-0x0000000002728000-memory.dmp

                                          Filesize

                                          32KB

                                        • memory/752-181-0x0000000000140000-0x0000000000152000-memory.dmp

                                          Filesize

                                          72KB

                                        • memory/752-180-0x0000000000220000-0x0000000000330000-memory.dmp

                                          Filesize

                                          1.1MB

                                        • memory/1064-602-0x0000000001130000-0x0000000001240000-memory.dmp

                                          Filesize

                                          1.1MB

                                        • memory/1064-603-0x0000000000550000-0x0000000000562000-memory.dmp

                                          Filesize

                                          72KB

                                        • memory/1224-301-0x0000000000590000-0x00000000005A2000-memory.dmp

                                          Filesize

                                          72KB

                                        • memory/1460-482-0x0000000000140000-0x0000000000152000-memory.dmp

                                          Filesize

                                          72KB

                                        • memory/1460-481-0x0000000000150000-0x0000000000260000-memory.dmp

                                          Filesize

                                          1.1MB

                                        • memory/2016-241-0x0000000000C20000-0x0000000000D30000-memory.dmp

                                          Filesize

                                          1.1MB

                                        • memory/2452-361-0x0000000000E90000-0x0000000000FA0000-memory.dmp

                                          Filesize

                                          1.1MB

                                        • memory/2584-60-0x0000000000300000-0x0000000000410000-memory.dmp

                                          Filesize

                                          1.1MB

                                        • memory/2732-17-0x0000000000AE0000-0x0000000000AEC000-memory.dmp

                                          Filesize

                                          48KB

                                        • memory/2732-16-0x00000000004C0000-0x00000000004CC000-memory.dmp

                                          Filesize

                                          48KB

                                        • memory/2732-15-0x00000000003F0000-0x00000000003FC000-memory.dmp

                                          Filesize

                                          48KB

                                        • memory/2732-14-0x00000000003E0000-0x00000000003F2000-memory.dmp

                                          Filesize

                                          72KB

                                        • memory/2732-13-0x0000000000CC0000-0x0000000000DD0000-memory.dmp

                                          Filesize

                                          1.1MB

                                        • memory/2812-542-0x0000000001100000-0x0000000001210000-memory.dmp

                                          Filesize

                                          1.1MB

                                        • memory/2976-421-0x0000000001200000-0x0000000001310000-memory.dmp

                                          Filesize

                                          1.1MB