Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    149s
  • max time network
    153s
  • platform
    windows7_x64
  • resource
    win7-20240708-en
  • resource tags

    arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
  • submitted
    22/12/2024, 20:35

General

  • Target

    JaffaCakes118_7e2e93f62eefe7c5b5240ae2eb17b24390ba1ee5ccb8aad541d7c27a1469b69f.exe

  • Size

    1.3MB

  • MD5

    1e3a7289f2d5e5bc19ef14741c17cee8

  • SHA1

    c0b546f8cf03f2f519384e0925fa1ddd26a56ac6

  • SHA256

    7e2e93f62eefe7c5b5240ae2eb17b24390ba1ee5ccb8aad541d7c27a1469b69f

  • SHA512

    abc9c6e5d651884c23db6b09fed1600d4d0da135e10e15d95f0a4e761fb4e1b72125a966e5dfa17317b43d63b88a1090ef1a6576d2765aff5b71fffda9db9ff8

  • SSDEEP

    24576:U2G/nvxW3Ww0t6TnzGmVBDh4+aknuRRZJND0gFJ4rD/IjC:UbA30GnzV/q+DnsXg

Malware Config

Signatures

  • DcRat

    DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

  • Dcrat family
  • Process spawned unexpected child process 36 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • DCRat payload 9 IoCs

    Detects payload of DCRat, commonly dropped by NSIS installers.

  • Command and Scripting Interpreter: PowerShell 1 TTPs 13 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

  • Executes dropped EXE 12 IoCs
  • Loads dropped DLL 2 IoCs
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 13 IoCs
  • Drops file in Program Files directory 8 IoCs
  • Drops file in Windows directory 4 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Scheduled Task/Job: Scheduled Task 1 TTPs 36 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 25 IoCs
  • Suspicious use of AdjustPrivilegeToken 25 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_7e2e93f62eefe7c5b5240ae2eb17b24390ba1ee5ccb8aad541d7c27a1469b69f.exe
    "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_7e2e93f62eefe7c5b5240ae2eb17b24390ba1ee5ccb8aad541d7c27a1469b69f.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:2360
    • C:\Windows\SysWOW64\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\providercommon\yTUdeXjbLOhnrN32dgrxVg.vbe"
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:2308
      • C:\Windows\SysWOW64\cmd.exe
        cmd /c ""C:\providercommon\1zu9dW.bat" "
        3⤵
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:2416
        • C:\providercommon\DllCommonsvc.exe
          "C:\providercommon\DllCommonsvc.exe"
          4⤵
          • Executes dropped EXE
          • Drops file in Program Files directory
          • Drops file in Windows directory
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:2928
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\DllCommonsvc.exe'
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:2852
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\dwm.exe'
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:1712
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Windows Sidebar\it-IT\Idle.exe'
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:2884
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Windows Mail\ja-JP\conhost.exe'
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:1704
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Default\My Documents\winlogon.exe'
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:1792
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Windows Defender\ja-JP\csrss.exe'
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:1964
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\csrss.exe'
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:352
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\wininit.exe'
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:2448
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\8cdd6da2-3d81-11ef-9400-f2a3cf4ad94f\Idle.exe'
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:2272
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Internet Explorer\images\dllhost.exe'
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:2088
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\taskhost.exe'
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:2188
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\PLA\Templates\csrss.exe'
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:1356
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\assembly\winlogon.exe'
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:2632
          • C:\Users\Default\My Documents\winlogon.exe
            "C:\Users\Default\My Documents\winlogon.exe"
            5⤵
            • Executes dropped EXE
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of WriteProcessMemory
            PID:1676
            • C:\Windows\System32\cmd.exe
              "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\iu0amT0ExO.bat"
              6⤵
              • Suspicious use of WriteProcessMemory
              PID:2388
              • C:\Windows\system32\w32tm.exe
                w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                7⤵
                  PID:1836
                • C:\Users\Default\My Documents\winlogon.exe
                  "C:\Users\Default\My Documents\winlogon.exe"
                  7⤵
                  • Executes dropped EXE
                  • Suspicious behavior: EnumeratesProcesses
                  • Suspicious use of AdjustPrivilegeToken
                  • Suspicious use of WriteProcessMemory
                  PID:2924
                  • C:\Windows\System32\cmd.exe
                    "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\UWW2tbEWSD.bat"
                    8⤵
                      PID:2248
                      • C:\Windows\system32\w32tm.exe
                        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                        9⤵
                          PID:2700
                        • C:\Users\Default\My Documents\winlogon.exe
                          "C:\Users\Default\My Documents\winlogon.exe"
                          9⤵
                          • Executes dropped EXE
                          • Suspicious behavior: EnumeratesProcesses
                          • Suspicious use of AdjustPrivilegeToken
                          PID:2148
                          • C:\Windows\System32\cmd.exe
                            "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\2U51WDObLZ.bat"
                            10⤵
                              PID:2884
                              • C:\Windows\system32\w32tm.exe
                                w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                                11⤵
                                  PID:772
                                • C:\Users\Default\My Documents\winlogon.exe
                                  "C:\Users\Default\My Documents\winlogon.exe"
                                  11⤵
                                  • Executes dropped EXE
                                  • Suspicious behavior: EnumeratesProcesses
                                  • Suspicious use of AdjustPrivilegeToken
                                  PID:984
                                  • C:\Windows\System32\cmd.exe
                                    "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\TdlfhXh7Yo.bat"
                                    12⤵
                                      PID:2680
                                      • C:\Windows\system32\w32tm.exe
                                        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                                        13⤵
                                          PID:1264
                                        • C:\Users\Default\My Documents\winlogon.exe
                                          "C:\Users\Default\My Documents\winlogon.exe"
                                          13⤵
                                          • Executes dropped EXE
                                          • Suspicious behavior: EnumeratesProcesses
                                          • Suspicious use of AdjustPrivilegeToken
                                          PID:1588
                                          • C:\Windows\System32\cmd.exe
                                            "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\tYG4XGbOex.bat"
                                            14⤵
                                              PID:2472
                                              • C:\Windows\system32\w32tm.exe
                                                w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                                                15⤵
                                                  PID:2764
                                                • C:\Users\Default\My Documents\winlogon.exe
                                                  "C:\Users\Default\My Documents\winlogon.exe"
                                                  15⤵
                                                  • Executes dropped EXE
                                                  • Suspicious behavior: EnumeratesProcesses
                                                  • Suspicious use of AdjustPrivilegeToken
                                                  PID:2912
                                                  • C:\Windows\System32\cmd.exe
                                                    "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\yMeEqlK1gO.bat"
                                                    16⤵
                                                      PID:1768
                                                      • C:\Windows\system32\w32tm.exe
                                                        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                                                        17⤵
                                                          PID:2696
                                                        • C:\Users\Default\My Documents\winlogon.exe
                                                          "C:\Users\Default\My Documents\winlogon.exe"
                                                          17⤵
                                                          • Executes dropped EXE
                                                          • Suspicious behavior: EnumeratesProcesses
                                                          • Suspicious use of AdjustPrivilegeToken
                                                          PID:2384
                                                          • C:\Windows\System32\cmd.exe
                                                            "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\D9KWG0zl28.bat"
                                                            18⤵
                                                              PID:1088
                                                              • C:\Windows\system32\w32tm.exe
                                                                w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                                                                19⤵
                                                                  PID:888
                                                                • C:\Users\Default\My Documents\winlogon.exe
                                                                  "C:\Users\Default\My Documents\winlogon.exe"
                                                                  19⤵
                                                                  • Executes dropped EXE
                                                                  • Suspicious behavior: EnumeratesProcesses
                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                  PID:1636
                                                                  • C:\Windows\System32\cmd.exe
                                                                    "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\5DPJyftqFq.bat"
                                                                    20⤵
                                                                      PID:2760
                                                                      • C:\Windows\system32\w32tm.exe
                                                                        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                                                                        21⤵
                                                                          PID:1656
                                                                        • C:\Users\Default\My Documents\winlogon.exe
                                                                          "C:\Users\Default\My Documents\winlogon.exe"
                                                                          21⤵
                                                                          • Executes dropped EXE
                                                                          • Suspicious behavior: EnumeratesProcesses
                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                          PID:408
                                                                          • C:\Windows\System32\cmd.exe
                                                                            "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\svzewrKVsp.bat"
                                                                            22⤵
                                                                              PID:1680
                                                                              • C:\Windows\system32\w32tm.exe
                                                                                w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                                                                                23⤵
                                                                                  PID:668
                                                                                • C:\Users\Default\My Documents\winlogon.exe
                                                                                  "C:\Users\Default\My Documents\winlogon.exe"
                                                                                  23⤵
                                                                                  • Executes dropped EXE
                                                                                  • Suspicious behavior: EnumeratesProcesses
                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                  PID:3004
                                                                                  • C:\Windows\System32\cmd.exe
                                                                                    "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\uOEGMIRuqZ.bat"
                                                                                    24⤵
                                                                                      PID:1440
                                                                                      • C:\Windows\system32\w32tm.exe
                                                                                        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                                                                                        25⤵
                                                                                          PID:1092
                                                                                        • C:\Users\Default\My Documents\winlogon.exe
                                                                                          "C:\Users\Default\My Documents\winlogon.exe"
                                                                                          25⤵
                                                                                          • Executes dropped EXE
                                                                                          • Suspicious behavior: EnumeratesProcesses
                                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                                          PID:2804
                                        • C:\Windows\system32\schtasks.exe
                                          schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 11 /tr "'C:\providercommon\dwm.exe'" /f
                                          1⤵
                                          • Process spawned unexpected child process
                                          • Scheduled Task/Job: Scheduled Task
                                          PID:2792
                                        • C:\Windows\system32\schtasks.exe
                                          schtasks.exe /create /tn "dwm" /sc ONLOGON /tr "'C:\providercommon\dwm.exe'" /rl HIGHEST /f
                                          1⤵
                                          • Process spawned unexpected child process
                                          • Scheduled Task/Job: Scheduled Task
                                          PID:2720
                                        • C:\Windows\system32\schtasks.exe
                                          schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 11 /tr "'C:\providercommon\dwm.exe'" /rl HIGHEST /f
                                          1⤵
                                          • Process spawned unexpected child process
                                          • Scheduled Task/Job: Scheduled Task
                                          PID:2548
                                        • C:\Windows\system32\schtasks.exe
                                          schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 13 /tr "'C:\Program Files\Windows Sidebar\it-IT\Idle.exe'" /f
                                          1⤵
                                          • Process spawned unexpected child process
                                          • Scheduled Task/Job: Scheduled Task
                                          PID:2616
                                        • C:\Windows\system32\schtasks.exe
                                          schtasks.exe /create /tn "Idle" /sc ONLOGON /tr "'C:\Program Files\Windows Sidebar\it-IT\Idle.exe'" /rl HIGHEST /f
                                          1⤵
                                          • Process spawned unexpected child process
                                          • Scheduled Task/Job: Scheduled Task
                                          PID:2996
                                        • C:\Windows\system32\schtasks.exe
                                          schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 5 /tr "'C:\Program Files\Windows Sidebar\it-IT\Idle.exe'" /rl HIGHEST /f
                                          1⤵
                                          • Process spawned unexpected child process
                                          • Scheduled Task/Job: Scheduled Task
                                          PID:2428
                                        • C:\Windows\system32\schtasks.exe
                                          schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 13 /tr "'C:\Program Files (x86)\Windows Mail\ja-JP\conhost.exe'" /f
                                          1⤵
                                          • Process spawned unexpected child process
                                          • Scheduled Task/Job: Scheduled Task
                                          PID:1656
                                        • C:\Windows\system32\schtasks.exe
                                          schtasks.exe /create /tn "conhost" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Mail\ja-JP\conhost.exe'" /rl HIGHEST /f
                                          1⤵
                                          • Process spawned unexpected child process
                                          • Scheduled Task/Job: Scheduled Task
                                          PID:2068
                                        • C:\Windows\system32\schtasks.exe
                                          schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 6 /tr "'C:\Program Files (x86)\Windows Mail\ja-JP\conhost.exe'" /rl HIGHEST /f
                                          1⤵
                                          • Process spawned unexpected child process
                                          • Scheduled Task/Job: Scheduled Task
                                          PID:2816
                                        • C:\Windows\system32\schtasks.exe
                                          schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 9 /tr "'C:\Users\Default\My Documents\winlogon.exe'" /f
                                          1⤵
                                          • Process spawned unexpected child process
                                          • Scheduled Task/Job: Scheduled Task
                                          PID:1992
                                        • C:\Windows\system32\schtasks.exe
                                          schtasks.exe /create /tn "winlogon" /sc ONLOGON /tr "'C:\Users\Default\My Documents\winlogon.exe'" /rl HIGHEST /f
                                          1⤵
                                          • Process spawned unexpected child process
                                          • Scheduled Task/Job: Scheduled Task
                                          PID:2092
                                        • C:\Windows\system32\schtasks.exe
                                          schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 8 /tr "'C:\Users\Default\My Documents\winlogon.exe'" /rl HIGHEST /f
                                          1⤵
                                          • Process spawned unexpected child process
                                          • Scheduled Task/Job: Scheduled Task
                                          PID:588
                                        • C:\Windows\system32\schtasks.exe
                                          schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 10 /tr "'C:\Program Files (x86)\Windows Defender\ja-JP\csrss.exe'" /f
                                          1⤵
                                          • Process spawned unexpected child process
                                          • Scheduled Task/Job: Scheduled Task
                                          PID:1340
                                        • C:\Windows\system32\schtasks.exe
                                          schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Defender\ja-JP\csrss.exe'" /rl HIGHEST /f
                                          1⤵
                                          • Process spawned unexpected child process
                                          • Scheduled Task/Job: Scheduled Task
                                          PID:1920
                                        • C:\Windows\system32\schtasks.exe
                                          schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 14 /tr "'C:\Program Files (x86)\Windows Defender\ja-JP\csrss.exe'" /rl HIGHEST /f
                                          1⤵
                                          • Process spawned unexpected child process
                                          • Scheduled Task/Job: Scheduled Task
                                          PID:2612
                                        • C:\Windows\system32\schtasks.exe
                                          schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 14 /tr "'C:\providercommon\csrss.exe'" /f
                                          1⤵
                                          • Process spawned unexpected child process
                                          • Scheduled Task/Job: Scheduled Task
                                          PID:1624
                                        • C:\Windows\system32\schtasks.exe
                                          schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\providercommon\csrss.exe'" /rl HIGHEST /f
                                          1⤵
                                          • Process spawned unexpected child process
                                          • Scheduled Task/Job: Scheduled Task
                                          PID:1016
                                        • C:\Windows\system32\schtasks.exe
                                          schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 5 /tr "'C:\providercommon\csrss.exe'" /rl HIGHEST /f
                                          1⤵
                                          • Process spawned unexpected child process
                                          • Scheduled Task/Job: Scheduled Task
                                          PID:1120
                                        • C:\Windows\system32\schtasks.exe
                                          schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 7 /tr "'C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\wininit.exe'" /f
                                          1⤵
                                          • Process spawned unexpected child process
                                          • Scheduled Task/Job: Scheduled Task
                                          PID:2648
                                        • C:\Windows\system32\schtasks.exe
                                          schtasks.exe /create /tn "wininit" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\wininit.exe'" /rl HIGHEST /f
                                          1⤵
                                          • Process spawned unexpected child process
                                          • Scheduled Task/Job: Scheduled Task
                                          PID:2184
                                        • C:\Windows\system32\schtasks.exe
                                          schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 6 /tr "'C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\wininit.exe'" /rl HIGHEST /f
                                          1⤵
                                          • Process spawned unexpected child process
                                          • Scheduled Task/Job: Scheduled Task
                                          PID:2148
                                        • C:\Windows\system32\schtasks.exe
                                          schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 8 /tr "'C:\Recovery\8cdd6da2-3d81-11ef-9400-f2a3cf4ad94f\Idle.exe'" /f
                                          1⤵
                                          • Process spawned unexpected child process
                                          • Scheduled Task/Job: Scheduled Task
                                          PID:2376
                                        • C:\Windows\system32\schtasks.exe
                                          schtasks.exe /create /tn "Idle" /sc ONLOGON /tr "'C:\Recovery\8cdd6da2-3d81-11ef-9400-f2a3cf4ad94f\Idle.exe'" /rl HIGHEST /f
                                          1⤵
                                          • Process spawned unexpected child process
                                          • Scheduled Task/Job: Scheduled Task
                                          PID:2944
                                        • C:\Windows\system32\schtasks.exe
                                          schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 5 /tr "'C:\Recovery\8cdd6da2-3d81-11ef-9400-f2a3cf4ad94f\Idle.exe'" /rl HIGHEST /f
                                          1⤵
                                          • Process spawned unexpected child process
                                          • Scheduled Task/Job: Scheduled Task
                                          PID:2164
                                        • C:\Windows\system32\schtasks.exe
                                          schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 5 /tr "'C:\Program Files\Internet Explorer\images\dllhost.exe'" /f
                                          1⤵
                                          • Process spawned unexpected child process
                                          • Scheduled Task/Job: Scheduled Task
                                          PID:2292
                                        • C:\Windows\system32\schtasks.exe
                                          schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Program Files\Internet Explorer\images\dllhost.exe'" /rl HIGHEST /f
                                          1⤵
                                          • Process spawned unexpected child process
                                          • Scheduled Task/Job: Scheduled Task
                                          PID:2864
                                        • C:\Windows\system32\schtasks.exe
                                          schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 12 /tr "'C:\Program Files\Internet Explorer\images\dllhost.exe'" /rl HIGHEST /f
                                          1⤵
                                          • Process spawned unexpected child process
                                          • Scheduled Task/Job: Scheduled Task
                                          PID:1524
                                        • C:\Windows\system32\schtasks.exe
                                          schtasks.exe /create /tn "taskhostt" /sc MINUTE /mo 14 /tr "'C:\providercommon\taskhost.exe'" /f
                                          1⤵
                                          • Process spawned unexpected child process
                                          • Scheduled Task/Job: Scheduled Task
                                          PID:2432
                                        • C:\Windows\system32\schtasks.exe
                                          schtasks.exe /create /tn "taskhost" /sc ONLOGON /tr "'C:\providercommon\taskhost.exe'" /rl HIGHEST /f
                                          1⤵
                                          • Process spawned unexpected child process
                                          • Scheduled Task/Job: Scheduled Task
                                          PID:1932
                                        • C:\Windows\system32\schtasks.exe
                                          schtasks.exe /create /tn "taskhostt" /sc MINUTE /mo 14 /tr "'C:\providercommon\taskhost.exe'" /rl HIGHEST /f
                                          1⤵
                                          • Process spawned unexpected child process
                                          • Scheduled Task/Job: Scheduled Task
                                          PID:1308
                                        • C:\Windows\system32\schtasks.exe
                                          schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 14 /tr "'C:\Windows\PLA\Templates\csrss.exe'" /f
                                          1⤵
                                          • Process spawned unexpected child process
                                          • Scheduled Task/Job: Scheduled Task
                                          PID:1576
                                        • C:\Windows\system32\schtasks.exe
                                          schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Windows\PLA\Templates\csrss.exe'" /rl HIGHEST /f
                                          1⤵
                                          • Process spawned unexpected child process
                                          • Scheduled Task/Job: Scheduled Task
                                          PID:2036
                                        • C:\Windows\system32\schtasks.exe
                                          schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 13 /tr "'C:\Windows\PLA\Templates\csrss.exe'" /rl HIGHEST /f
                                          1⤵
                                          • Process spawned unexpected child process
                                          • Scheduled Task/Job: Scheduled Task
                                          PID:2320
                                        • C:\Windows\system32\schtasks.exe
                                          schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 13 /tr "'C:\Windows\assembly\winlogon.exe'" /f
                                          1⤵
                                          • Process spawned unexpected child process
                                          • Scheduled Task/Job: Scheduled Task
                                          PID:2196
                                        • C:\Windows\system32\schtasks.exe
                                          schtasks.exe /create /tn "winlogon" /sc ONLOGON /tr "'C:\Windows\assembly\winlogon.exe'" /rl HIGHEST /f
                                          1⤵
                                          • Process spawned unexpected child process
                                          • Scheduled Task/Job: Scheduled Task
                                          PID:1372
                                        • C:\Windows\system32\schtasks.exe
                                          schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 5 /tr "'C:\Windows\assembly\winlogon.exe'" /rl HIGHEST /f
                                          1⤵
                                          • Process spawned unexpected child process
                                          • Scheduled Task/Job: Scheduled Task
                                          PID:1088

                                        Network

                                        MITRE ATT&CK Enterprise v15

                                        Replay Monitor

                                        Loading Replay Monitor...

                                        Downloads

                                        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

                                          Filesize

                                          342B

                                          MD5

                                          5b59e37f0ed63048c6dd118dd56c7893

                                          SHA1

                                          ce8683dcef3d19abb649d4d03d08466e2a3cf4a1

                                          SHA256

                                          18113095208bbf1312174c605ea55d5464ee97f1df48baff2850db2bd5d7a12e

                                          SHA512

                                          5277cad78a1788463c428b1e742fcbcbccb4976cd9b9d71fcf575d93f15ed11088e9aa3c7257d66c9fc78c37ba7589f390fa8ad33fb169bde3e68f5c82490a58

                                        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

                                          Filesize

                                          342B

                                          MD5

                                          e6f6057684600895e8b8d82e04a5bef5

                                          SHA1

                                          7c4a08bf309b3b190bfbf28097a58ed38e85d4db

                                          SHA256

                                          e7c024aee70ac7f0356dec7c3310e46eaee831dcefd6da9b1232dae980a0fd97

                                          SHA512

                                          c65529743d121cb060c27ceb50834a0b2894eefad0c7c00c77eea99d885fa27475a93be536d4942e760c0e3869281cb02c8b22b95c6927c0cdd7ed6ee5a3e677

                                        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

                                          Filesize

                                          342B

                                          MD5

                                          3acaa38a8e4db7510649158dd890a78e

                                          SHA1

                                          5f1581066d48654982d875359e3180e1ddbb7d58

                                          SHA256

                                          6b296a21c35c6935f93c180538678d5232ad95cf0826e6fc4b77503453b16545

                                          SHA512

                                          e4e702e9f78d9eb22ef9ea547cdbb27b2f2aea71264c6dd06a54400177e8e62460a658cd8194a902a83d64f37ff0eeea9fb0e03240f185ceaf00af5810c1292e

                                        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

                                          Filesize

                                          342B

                                          MD5

                                          2bb17c0b0589c6c2f639c5f458aa1cef

                                          SHA1

                                          e1ab93ac72661c3fea266ee7ec0781430cae6bb9

                                          SHA256

                                          200bd2f997d8498e4fe02502223bc29d27709c7b1a86bf59af05df7aba5a977f

                                          SHA512

                                          fe93ddbedb408130cfee34a4794fc0d4df26d6c2c081540098386ba7445fe78f2a4e6524302b3b6b8d044c51e1a70e3d3304600b08ebb7384952529257c6a628

                                        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

                                          Filesize

                                          342B

                                          MD5

                                          1d3ab54d97eb1a87e70d9ad7005c59ce

                                          SHA1

                                          de4a6251c261a23b3aa3436b2529071742a7acda

                                          SHA256

                                          0ee99a092ca87f6dc37b64be49c87db6f1c39cf7525d7d812a63127b6fd53b20

                                          SHA512

                                          c04800286262f6ff5389e483141b4c7bc58fc52989284aa4d27ff5de223e665dba35d1d38700518d8eed2d461e061512c9e809955eb086ddce5f8b3a685b17f7

                                        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

                                          Filesize

                                          342B

                                          MD5

                                          16431ea79154483c649d0067ec9e382a

                                          SHA1

                                          6014d0fe5dc7d909c6f25dfa0a38133a082c5df2

                                          SHA256

                                          c50aa8dec007239be5aad8f049cdc9728d410e091101bf85ff86fe8342218593

                                          SHA512

                                          c0246ccfb4d28bf7dea00843c8971e3f9d724e4fc60830273bcecaa65056788d0395b9c9ebf3c7cb1e06fbd0941e14024d1056206d3a05617d7e40e8fed7fd27

                                        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

                                          Filesize

                                          342B

                                          MD5

                                          d9f166f78f32da645fbdfb29316240e4

                                          SHA1

                                          b0b29dbcaee5f2d58603d3840da2feeadf57b4bf

                                          SHA256

                                          c545542463b1172cc45265309e68b9fa1b2d165f9fa3e78d3167f4658b23a503

                                          SHA512

                                          1b38a43152762bc294b3052eecab983ddeb33553cd4609566ba32dadf7ab4ba9865830bf928b9bfad2e5b53df681755e66e0e9f2f316b9c3e180d287db83252f

                                        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

                                          Filesize

                                          342B

                                          MD5

                                          5d69d7eeed2df6faeec231c753ecee22

                                          SHA1

                                          64ac2caac1fdad745f690cc8b0a312b86c9b145c

                                          SHA256

                                          6f484ff17a51704ef8f648b2ec383a87e59b6d08ccfb0b373628b90d8f097506

                                          SHA512

                                          1b2501ae8b9a59be2bb68449515312c0a3a795744c9bb2568d22359bc72207646e693a0d54ae62e8619090c05fd756364b1ce8c6f6999b96810f6e0eefe1135d

                                        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

                                          Filesize

                                          342B

                                          MD5

                                          8ad3792b2054433745ad7408dd2599d4

                                          SHA1

                                          13f6547f50d02814c12186f412a11246f995d942

                                          SHA256

                                          71b392acf38a2ce0873b32d0e85a9ed63c4b6381f08f21b0b62137638a35ffaa

                                          SHA512

                                          587f5358a90143b4a866a6b54d8e80ae9ec600bc7675e06231e6634b5b47407b2dd954e39a4d14690ea0d0b8c6f6cc410b31b6d6a085785318fa84708086f32c

                                        • C:\Users\Admin\AppData\Local\Temp\2U51WDObLZ.bat

                                          Filesize

                                          207B

                                          MD5

                                          0c0fb8931e81ff381ff5e57eefa40489

                                          SHA1

                                          5a4447103cfb069b03c208f9e1d397b17726744d

                                          SHA256

                                          98f8bc20fe0d77e46ff132fba810d0334781d484ab432567e843673b1c1f7105

                                          SHA512

                                          4d2991b24ed8661f6f93f0670a0dde253a9c4337cdcba2501673755f766c9a0702f93e6c579ea4daa004047a1aca2eaee22c70dcc1d91e3885e9a76d597aeac2

                                        • C:\Users\Admin\AppData\Local\Temp\5DPJyftqFq.bat

                                          Filesize

                                          207B

                                          MD5

                                          f5db194213df67981bc3bb165041b71b

                                          SHA1

                                          a42ea65765687d41b38c76776f50a56cf827ea7d

                                          SHA256

                                          2d438e30c9deaeecbe093ba88ef0ae471419ceee4bdc98f1012375db6d4b5df2

                                          SHA512

                                          47b34b1cb01e2cdec61dc6d1d13956e3f85519a75e7a442177e768006500a0608bbce22d074e3e18a062fa832a4d15f4d32192eb9e817b52c6a19d4d27532716

                                        • C:\Users\Admin\AppData\Local\Temp\Cab2242.tmp

                                          Filesize

                                          70KB

                                          MD5

                                          49aebf8cbd62d92ac215b2923fb1b9f5

                                          SHA1

                                          1723be06719828dda65ad804298d0431f6aff976

                                          SHA256

                                          b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

                                          SHA512

                                          bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

                                        • C:\Users\Admin\AppData\Local\Temp\D9KWG0zl28.bat

                                          Filesize

                                          207B

                                          MD5

                                          a9ecf1f53458e165e148858566d85401

                                          SHA1

                                          eae7c08328bdc815dc9f63a0f91ea8dcb5fa209c

                                          SHA256

                                          7567d2709d9799f399b0faf110bdc3620110e7206174b24d11417d652964f9d6

                                          SHA512

                                          68e41bcb1835477df4d2c708b24c1ab3e4e4632aeab8e3cfefd559b2a6be47208a3861f65e2a64c770c01cb7e34a2968807fc5d02d324ddd283c67766b7166f8

                                        • C:\Users\Admin\AppData\Local\Temp\Tar2283.tmp

                                          Filesize

                                          181KB

                                          MD5

                                          4ea6026cf93ec6338144661bf1202cd1

                                          SHA1

                                          a1dec9044f750ad887935a01430bf49322fbdcb7

                                          SHA256

                                          8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

                                          SHA512

                                          6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

                                        • C:\Users\Admin\AppData\Local\Temp\TdlfhXh7Yo.bat

                                          Filesize

                                          207B

                                          MD5

                                          9a58a601460b870b32d23d6e0de54c32

                                          SHA1

                                          a0b1380ba0a5b0f9c1ede69d12aec775667dbf79

                                          SHA256

                                          9cc36ebb043cc867cf6ac3dee5f8db751fb7108f1764e130c5fda25732ffdea4

                                          SHA512

                                          0ed0d3250d12b87f4dec50149adfd7fc41207c22d0c3cac7eae44dbf708f04d5638868f04fc94d57c7d2ab4c3f1a50953836e7e34a3afe9407ca14f66567daf1

                                        • C:\Users\Admin\AppData\Local\Temp\UWW2tbEWSD.bat

                                          Filesize

                                          207B

                                          MD5

                                          5947b7d7214629c8d5812adb9d035edf

                                          SHA1

                                          fd407bda1533acf02e25d072f7fe34f186aef6d0

                                          SHA256

                                          8ff74483c5bae4d4f55c5774e3c3c2a4d6231e2e782b54db0e801375c5178bc0

                                          SHA512

                                          8a04bba8a00828fe025b83257b196fbd88af9d7877ff837eced47300919eee9cb90d601d6af1a14885cc372bb23c4045980a9f9188cdfa5db9512dfd76c2ee4b

                                        • C:\Users\Admin\AppData\Local\Temp\iu0amT0ExO.bat

                                          Filesize

                                          207B

                                          MD5

                                          44313bd024773c5a9ce6385ab05a6ac7

                                          SHA1

                                          dfdea22a5c20d5ebf4b15c0562585ae92ced60a2

                                          SHA256

                                          cd0135103cf8c142591ab5fa34ed7281e106aed75083e05285626ed951111ee8

                                          SHA512

                                          ae368d0264dd157ac7a8c267e8e29e266c1a92a53b55e58f1f0697575b55c9a83a04216a6d18abd3867331611edcc1e49e49c685850c7ad198a7d767d25f09d1

                                        • C:\Users\Admin\AppData\Local\Temp\svzewrKVsp.bat

                                          Filesize

                                          207B

                                          MD5

                                          7cbcf87fdee2290d86dcc6096295c997

                                          SHA1

                                          e214f716ec079c832be83361d692e9b007426d7f

                                          SHA256

                                          f22a8b277236d83507aaaaadb0404cce41b4ec15f7c094f13e5a312bb9934761

                                          SHA512

                                          c41d1d1d9a666328ea585d3d1924fe10336e72d8d34f701fe347bccb850a863a8adfa0f635101e2d47f970b517d1977fb692016eaf312479bfbc0eff41c7b223

                                        • C:\Users\Admin\AppData\Local\Temp\tYG4XGbOex.bat

                                          Filesize

                                          207B

                                          MD5

                                          8c28beb8b4ce007fd9d54486b10a818f

                                          SHA1

                                          07b17d2c20b86f866af76335f826103a9de74efc

                                          SHA256

                                          48ba383436f2af36f8f83db4c55888f990913b63e90bf86da381308fe82a458b

                                          SHA512

                                          cc32614e8b0d06de534b8b6ffe6b77a667c6b94a4b283b3cf716269c533cf6e95e723df9b8298a8e73be35aab4c300e55f650ee45105ff5520fc38431905a19f

                                        • C:\Users\Admin\AppData\Local\Temp\uOEGMIRuqZ.bat

                                          Filesize

                                          207B

                                          MD5

                                          d97e542d1ddf4ac06cfdcc84826ac14e

                                          SHA1

                                          60999681214ce26069d83c6c4754901b75f32ea4

                                          SHA256

                                          93b7e471af68e9ce49788c67b80a1a7169d7f5e4078caade56f378e43c84348b

                                          SHA512

                                          96a9fd7182aee354d0fdbfb8a5d7ab01c4bd3c06f7e2ab833ab73caa3d9f6749806ac143bd39db6d56438890a1681db7503426e3b57dccc9bc82cd23ac08be62

                                        • C:\Users\Admin\AppData\Local\Temp\yMeEqlK1gO.bat

                                          Filesize

                                          207B

                                          MD5

                                          afd15bcb66476fb665c541ea8f3fc5e9

                                          SHA1

                                          fe56d739db9ce74d48a14c4c60205fca86381a03

                                          SHA256

                                          e8d98f47297150d7874a4f5c3e996368caacf9851879c80212e5591a08eb98ad

                                          SHA512

                                          d81795959fcaa4a3f68d236e640db220ddee136231533543fc4df158f08446fb51c6a2f2e6029e1652937a60d7723ddd5c5ff7a29fe88fcdf435a520a825b0c7

                                        • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

                                          Filesize

                                          7KB

                                          MD5

                                          42ff730d1f44b82fa52908df171c506f

                                          SHA1

                                          92241cb0ea7fb47a0d1de0b5eab1402a4fee22c3

                                          SHA256

                                          1106507172b5d1ecbbb6c09d67a304f00414cae10b80d7694f6092e72971db76

                                          SHA512

                                          2016cbd5310817900d9bb6b02b87cfba273ad75d32b1e584f3204a4bb8d0011965756f170932673c6b9efd7dac20a7b335f0dd1449b191364a2aad309aa7e18e

                                        • C:\providercommon\1zu9dW.bat

                                          Filesize

                                          36B

                                          MD5

                                          6783c3ee07c7d151ceac57f1f9c8bed7

                                          SHA1

                                          17468f98f95bf504cc1f83c49e49a78526b3ea03

                                          SHA256

                                          8ab782f0f327a2021530e7230d3aee8abbecb7eed59482a3a46e78b9e3862322

                                          SHA512

                                          c6012d4bfac1ed14d0fd9f0eabd0e1c3d647b343db292a907b246271d52a4b7469c809db43910ddba2e8c5045f9cb3d24d0af62d363281e6cb8b39ee94a183e8

                                        • C:\providercommon\yTUdeXjbLOhnrN32dgrxVg.vbe

                                          Filesize

                                          197B

                                          MD5

                                          8088241160261560a02c84025d107592

                                          SHA1

                                          083121f7027557570994c9fc211df61730455bb5

                                          SHA256

                                          2072cc9a4a3b84d4c5178ab41c5588eea7d0103e3928e34d64f17bf97f3d1cc1

                                          SHA512

                                          20d9369dd359315848ea30144383a0bb479d86059fdbc3b3256ac84f998193512feb3b1799ab663619920c99fe7e0ebba33ada31a3855094b956fcd351c90478

                                        • \providercommon\DllCommonsvc.exe

                                          Filesize

                                          1.0MB

                                          MD5

                                          bd31e94b4143c4ce49c17d3af46bcad0

                                          SHA1

                                          f8c51ff3ff909531d9469d4ba1bbabae101853ff

                                          SHA256

                                          b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

                                          SHA512

                                          f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

                                        • memory/984-294-0x0000000000AD0000-0x0000000000BE0000-memory.dmp

                                          Filesize

                                          1.1MB

                                        • memory/984-295-0x0000000000440000-0x0000000000452000-memory.dmp

                                          Filesize

                                          72KB

                                        • memory/1588-355-0x0000000000DE0000-0x0000000000EF0000-memory.dmp

                                          Filesize

                                          1.1MB

                                        • memory/1676-115-0x0000000000240000-0x0000000000252000-memory.dmp

                                          Filesize

                                          72KB

                                        • memory/1676-114-0x0000000000B80000-0x0000000000C90000-memory.dmp

                                          Filesize

                                          1.1MB

                                        • memory/1712-52-0x000000001B5E0000-0x000000001B8C2000-memory.dmp

                                          Filesize

                                          2.9MB

                                        • memory/2148-234-0x0000000000180000-0x0000000000290000-memory.dmp

                                          Filesize

                                          1.1MB

                                        • memory/2384-474-0x0000000000EF0000-0x0000000001000000-memory.dmp

                                          Filesize

                                          1.1MB

                                        • memory/2804-711-0x0000000001010000-0x0000000001120000-memory.dmp

                                          Filesize

                                          1.1MB

                                        • memory/2852-68-0x0000000001D60000-0x0000000001D68000-memory.dmp

                                          Filesize

                                          32KB

                                        • memory/2924-174-0x0000000000240000-0x0000000000350000-memory.dmp

                                          Filesize

                                          1.1MB

                                        • memory/2928-17-0x00000000004E0000-0x00000000004EC000-memory.dmp

                                          Filesize

                                          48KB

                                        • memory/2928-16-0x00000000004D0000-0x00000000004DC000-memory.dmp

                                          Filesize

                                          48KB

                                        • memory/2928-15-0x0000000000440000-0x000000000044C000-memory.dmp

                                          Filesize

                                          48KB

                                        • memory/2928-14-0x0000000000340000-0x0000000000352000-memory.dmp

                                          Filesize

                                          72KB

                                        • memory/2928-13-0x0000000000B50000-0x0000000000C60000-memory.dmp

                                          Filesize

                                          1.1MB