dcrat | 91ab471421709327645fbf45ee7bd9b7a77ed3558f21a729f75e4fb0c70f3009

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
22-12-2024 20:37

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

JaffaCakes118_91ab471421709327645fbf45ee7bd9b7a77ed3558f21a729f75e4fb0c70f3009.exe
Size

1.3MB
MD5

cdc7edfa02506d18c09374011227dd04
SHA1

2a3243f30b3cb73d7d19aa2b24085b195b59ae36
SHA256

91ab471421709327645fbf45ee7bd9b7a77ed3558f21a729f75e4fb0c70f3009
SHA512

f84fc0637fd9ec8b1c057025207ed79984d96318509a4f27dd3bc417433e9eadc4a7ad76e86a56a0bac105e0ebc425bc67e4be1358501a824143a87834a46277
SSDEEP

24576:U2G/nvxW3Ww0t6TnzGmVBDh4+aknuRRZJND0gFJ4rD/IjC:UbA30GnzV/q+DnsXg

Score

10^/10

dcrat discovery execution infostealer rat

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat
Dcrat family
dcrat

Process spawned unexpected child process 9 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2276	3348	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2816	3348	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3784	3348	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4788	3348	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4864	3348	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2156	3348	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1304	3348	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2408	3348	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2932	3348	schtasks.exe	87

DCRat payload 2 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral2/files/0x000a000000023ba8-10.dat	dcrat
behavioral2/memory/3480-13-0x0000000000580000-0x0000000000690000-memory.dmp	dcrat

Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
212	powershell.exe
3616	powershell.exe
3016	powershell.exe
1936	powershell.exe

Checks computer location settings 2 TTPs 15 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation	sppsvc.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation	sppsvc.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation	sppsvc.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation	sppsvc.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation	DllCommonsvc.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation	sppsvc.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation	sppsvc.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation	sppsvc.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation	sppsvc.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation	JaffaCakes118_91ab471421709327645fbf45ee7bd9b7a77ed3558f21a729f75e4fb0c70f3009.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation	sppsvc.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation	WScript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation	sppsvc.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation	sppsvc.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation	sppsvc.exe

Executes dropped EXE 14 IoCs

pid	Process
3480	DllCommonsvc.exe
3500	sppsvc.exe
4296	sppsvc.exe
4832	sppsvc.exe
3084	sppsvc.exe
1264	sppsvc.exe
4752	sppsvc.exe
4536	sppsvc.exe
228	sppsvc.exe
4128	sppsvc.exe
3104	sppsvc.exe
3952	sppsvc.exe
1680	sppsvc.exe
548	sppsvc.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 13 IoCs

Web Service

T1102

flow	ioc
42	raw.githubusercontent.com
44	raw.githubusercontent.com
49	raw.githubusercontent.com
50	raw.githubusercontent.com
51	raw.githubusercontent.com
43	raw.githubusercontent.com
52	raw.githubusercontent.com
53	raw.githubusercontent.com
13	raw.githubusercontent.com
14	raw.githubusercontent.com
24	raw.githubusercontent.com
38	raw.githubusercontent.com
39	raw.githubusercontent.com

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\sppsvc.exe	DllCommonsvc.exe
File created	C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\0a1fd5f707cd16	DllCommonsvc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_91ab471421709327645fbf45ee7bd9b7a77ed3558f21a729f75e4fb0c70f3009.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Modifies registry class 13 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000_Classes\Local Settings	sppsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000_Classes\Local Settings	sppsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000_Classes\Local Settings	sppsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000_Classes\Local Settings	sppsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000_Classes\Local Settings	sppsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000_Classes\Local Settings	JaffaCakes118_91ab471421709327645fbf45ee7bd9b7a77ed3558f21a729f75e4fb0c70f3009.exe
Key created	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000_Classes\Local Settings	sppsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000_Classes\Local Settings	sppsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000_Classes\Local Settings	sppsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000_Classes\Local Settings	sppsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000_Classes\Local Settings	sppsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000_Classes\Local Settings	sppsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000_Classes\Local Settings	sppsvc.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 9 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4788	schtasks.exe
4864	schtasks.exe
2156	schtasks.exe
2276	schtasks.exe
3784	schtasks.exe
2408	schtasks.exe
2932	schtasks.exe
2816	schtasks.exe
1304	schtasks.exe

Suspicious behavior: EnumeratesProcesses 28 IoCs

pid	Process
3480	DllCommonsvc.exe
3480	DllCommonsvc.exe
3480	DllCommonsvc.exe
3480	DllCommonsvc.exe
3480	DllCommonsvc.exe
3480	DllCommonsvc.exe
3480	DllCommonsvc.exe
1936	powershell.exe
212	powershell.exe
3616	powershell.exe
3616	powershell.exe
3016	powershell.exe
3500	sppsvc.exe
1936	powershell.exe
212	powershell.exe
3016	powershell.exe
4296	sppsvc.exe
4832	sppsvc.exe
3084	sppsvc.exe
1264	sppsvc.exe
4752	sppsvc.exe
4536	sppsvc.exe
228	sppsvc.exe
4128	sppsvc.exe
3104	sppsvc.exe
3952	sppsvc.exe
1680	sppsvc.exe
548	sppsvc.exe

Suspicious use of AdjustPrivilegeToken 18 IoCs

description	pid	Process
Token: SeDebugPrivilege	3480	DllCommonsvc.exe
Token: SeDebugPrivilege	1936	powershell.exe
Token: SeDebugPrivilege	212	powershell.exe
Token: SeDebugPrivilege	3616	powershell.exe
Token: SeDebugPrivilege	3500	sppsvc.exe
Token: SeDebugPrivilege	3016	powershell.exe
Token: SeDebugPrivilege	4296	sppsvc.exe
Token: SeDebugPrivilege	4832	sppsvc.exe
Token: SeDebugPrivilege	3084	sppsvc.exe
Token: SeDebugPrivilege	1264	sppsvc.exe
Token: SeDebugPrivilege	4752	sppsvc.exe
Token: SeDebugPrivilege	4536	sppsvc.exe
Token: SeDebugPrivilege	228	sppsvc.exe
Token: SeDebugPrivilege	4128	sppsvc.exe
Token: SeDebugPrivilege	3104	sppsvc.exe
Token: SeDebugPrivilege	3952	sppsvc.exe
Token: SeDebugPrivilege	1680	sppsvc.exe
Token: SeDebugPrivilege	548	sppsvc.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4884 wrote to memory of 4880	4884	JaffaCakes118_91ab471421709327645fbf45ee7bd9b7a77ed3558f21a729f75e4fb0c70f3009.exe	83
PID 4884 wrote to memory of 4880	4884	JaffaCakes118_91ab471421709327645fbf45ee7bd9b7a77ed3558f21a729f75e4fb0c70f3009.exe	83
PID 4884 wrote to memory of 4880	4884	JaffaCakes118_91ab471421709327645fbf45ee7bd9b7a77ed3558f21a729f75e4fb0c70f3009.exe	83
PID 4880 wrote to memory of 2908	4880	WScript.exe	84
PID 4880 wrote to memory of 2908	4880	WScript.exe	84
PID 4880 wrote to memory of 2908	4880	WScript.exe	84
PID 2908 wrote to memory of 3480	2908	cmd.exe	86
PID 2908 wrote to memory of 3480	2908	cmd.exe	86
PID 3480 wrote to memory of 3016	3480	DllCommonsvc.exe	98
PID 3480 wrote to memory of 3016	3480	DllCommonsvc.exe	98
PID 3480 wrote to memory of 1936	3480	DllCommonsvc.exe	99
PID 3480 wrote to memory of 1936	3480	DllCommonsvc.exe	99
PID 3480 wrote to memory of 212	3480	DllCommonsvc.exe	100
PID 3480 wrote to memory of 212	3480	DllCommonsvc.exe	100
PID 3480 wrote to memory of 3616	3480	DllCommonsvc.exe	101
PID 3480 wrote to memory of 3616	3480	DllCommonsvc.exe	101
PID 3480 wrote to memory of 3500	3480	DllCommonsvc.exe	105
PID 3480 wrote to memory of 3500	3480	DllCommonsvc.exe	105
PID 3500 wrote to memory of 4388	3500	sppsvc.exe	108
PID 3500 wrote to memory of 4388	3500	sppsvc.exe	108
PID 4388 wrote to memory of 3528	4388	cmd.exe	110
PID 4388 wrote to memory of 3528	4388	cmd.exe	110
PID 4388 wrote to memory of 4296	4388	cmd.exe	117
PID 4388 wrote to memory of 4296	4388	cmd.exe	117
PID 4296 wrote to memory of 2916	4296	sppsvc.exe	126
PID 4296 wrote to memory of 2916	4296	sppsvc.exe	126
PID 2916 wrote to memory of 3028	2916	cmd.exe	128
PID 2916 wrote to memory of 3028	2916	cmd.exe	128
PID 2916 wrote to memory of 4832	2916	cmd.exe	131
PID 2916 wrote to memory of 4832	2916	cmd.exe	131
PID 4832 wrote to memory of 2268	4832	sppsvc.exe	133
PID 4832 wrote to memory of 2268	4832	sppsvc.exe	133
PID 2268 wrote to memory of 368	2268	cmd.exe	135
PID 2268 wrote to memory of 368	2268	cmd.exe	135
PID 2268 wrote to memory of 3084	2268	cmd.exe	137
PID 2268 wrote to memory of 3084	2268	cmd.exe	137
PID 3084 wrote to memory of 4888	3084	sppsvc.exe	139
PID 3084 wrote to memory of 4888	3084	sppsvc.exe	139
PID 4888 wrote to memory of 216	4888	cmd.exe	141
PID 4888 wrote to memory of 216	4888	cmd.exe	141
PID 4888 wrote to memory of 1264	4888	cmd.exe	143
PID 4888 wrote to memory of 1264	4888	cmd.exe	143
PID 1264 wrote to memory of 4424	1264	sppsvc.exe	145
PID 1264 wrote to memory of 4424	1264	sppsvc.exe	145
PID 4424 wrote to memory of 3924	4424	cmd.exe	147
PID 4424 wrote to memory of 3924	4424	cmd.exe	147
PID 4424 wrote to memory of 4752	4424	cmd.exe	149
PID 4424 wrote to memory of 4752	4424	cmd.exe	149
PID 4752 wrote to memory of 1460	4752	sppsvc.exe	151
PID 4752 wrote to memory of 1460	4752	sppsvc.exe	151
PID 1460 wrote to memory of 3816	1460	cmd.exe	153
PID 1460 wrote to memory of 3816	1460	cmd.exe	153
PID 1460 wrote to memory of 4536	1460	cmd.exe	155
PID 1460 wrote to memory of 4536	1460	cmd.exe	155
PID 4536 wrote to memory of 5040	4536	sppsvc.exe	157
PID 4536 wrote to memory of 5040	4536	sppsvc.exe	157
PID 5040 wrote to memory of 3172	5040	cmd.exe	159
PID 5040 wrote to memory of 3172	5040	cmd.exe	159
PID 5040 wrote to memory of 228	5040	cmd.exe	161
PID 5040 wrote to memory of 228	5040	cmd.exe	161
PID 228 wrote to memory of 3936	228	sppsvc.exe	163
PID 228 wrote to memory of 3936	228	sppsvc.exe	163
PID 3936 wrote to memory of 3360	3936	cmd.exe	165
PID 3936 wrote to memory of 3360	3936	cmd.exe	165

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_91ab471421709327645fbf45ee7bd9b7a77ed3558f21a729f75e4fb0c70f3009.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_91ab471421709327645fbf45ee7bd9b7a77ed3558f21a729f75e4fb0c70f3009.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4884
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\providercommon\yTUdeXjbLOhnrN32dgrxVg.vbe"
  2⤵
  - Checks computer location settings
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4880
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\providercommon\1zu9dW.bat" "
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2908
  - - C:\providercommon\DllCommonsvc.exe
      "C:\providercommon\DllCommonsvc.exe"
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Drops file in Program Files directory
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:3480
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\DllCommonsvc.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3016
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Default User\spoolsv.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1936
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\StartMenuExperienceHost.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:212
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\sppsvc.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3616
    - - C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\sppsvc.exe
        
        "C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\sppsvc.exe"
        5⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3500
      - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\Rhkc0SdEF2.bat"
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:4388
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        7⤵
        
        PID:3528
        
        C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\sppsvc.exe
        
        "C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\sppsvc.exe"
        7⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4296
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\WtQmBjXbDh.bat"
        8⤵
        Suspicious use of WriteProcessMemory
        
        PID:2916
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        9⤵
        
        PID:3028
        
        C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\sppsvc.exe
        
        "C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\sppsvc.exe"
        9⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4832
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\rZY5mW9Lj2.bat"
        10⤵
        Suspicious use of WriteProcessMemory
        
        PID:2268
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        11⤵
        
        PID:368
        
        C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\sppsvc.exe
        
        "C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\sppsvc.exe"
        11⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3084
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\Rhkc0SdEF2.bat"
        12⤵
        Suspicious use of WriteProcessMemory
        
        PID:4888
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        13⤵
        
        PID:216
        
        C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\sppsvc.exe
        
        "C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\sppsvc.exe"
        13⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1264
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\mWzz7cjAeP.bat"
        14⤵
        Suspicious use of WriteProcessMemory
        
        PID:4424
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        15⤵
        
        PID:3924
        
        C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\sppsvc.exe
        
        "C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\sppsvc.exe"
        15⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4752
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\qO35UmqwIy.bat"
        16⤵
        Suspicious use of WriteProcessMemory
        
        PID:1460
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        17⤵
        
        PID:3816
        
        C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\sppsvc.exe
        
        "C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\sppsvc.exe"
        17⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4536
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\bkUsYtfOrG.bat"
        18⤵
        Suspicious use of WriteProcessMemory
        
        PID:5040
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        19⤵
        
        PID:3172
        
        C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\sppsvc.exe
        
        "C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\sppsvc.exe"
        19⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:228
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\fjtq3MYUh4.bat"
        20⤵
        Suspicious use of WriteProcessMemory
        
        PID:3936
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        21⤵
        
        PID:3360
        
        C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\sppsvc.exe
        
        "C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\sppsvc.exe"
        21⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4128
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\J2mXRZwkCj.bat"
        22⤵
        
        PID:1636
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        23⤵
        
        PID:1040
        
        C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\sppsvc.exe
        
        "C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\sppsvc.exe"
        23⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3104
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\uMS4yFj28m.bat"
        24⤵
        
        PID:4596
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        25⤵
        
        PID:640
        
        C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\sppsvc.exe
        
        "C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\sppsvc.exe"
        25⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3952
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\ZgKlNS7JdR.bat"
        26⤵
        
        PID:1916
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        27⤵
        
        PID:1972
        
        C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\sppsvc.exe
        
        "C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\sppsvc.exe"
        27⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1680
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\gZmmY05In2.bat"
        28⤵
        
        PID:3932
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        29⤵
        
        PID:4224
        
        C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\sppsvc.exe
        
        "C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\sppsvc.exe"
        29⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:548

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 5 /tr "'C:\Users\Default User\spoolsv.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2276

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsv" /sc ONLOGON /tr "'C:\Users\Default User\spoolsv.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2816

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 11 /tr "'C:\Users\Default User\spoolsv.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3784

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "StartMenuExperienceHostS" /sc MINUTE /mo 10 /tr "'C:\providercommon\StartMenuExperienceHost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4788

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "StartMenuExperienceHost" /sc ONLOGON /tr "'C:\providercommon\StartMenuExperienceHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4864

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "StartMenuExperienceHostS" /sc MINUTE /mo 12 /tr "'C:\providercommon\StartMenuExperienceHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2156

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 6 /tr "'C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\sppsvc.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1304

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvc" /sc ONLOGON /tr "'C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\sppsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2408

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 10 /tr "'C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\sppsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2932

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
d85ba6ff808d9e5444a4b369f5bc2730

SHA1
31aa9d96590fff6981b315e0b391b575e4c0804a

SHA256
84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

SHA512
8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\sppsvc.exe.log

Filesize
1KB

MD5
baf55b95da4a601229647f25dad12878

SHA1
abc16954ebfd213733c4493fc1910164d825cac8

SHA256
ee954c5d8156fd8890e582c716e5758ed9b33721258f10e758bdc31ccbcb1924

SHA512
24f502fedb1a305d0d7b08857ffc1db9b2359ff34e06d5748ecc84e35c985f29a20d9f0a533bea32d234ab37097ec0481620c63b14ac89b280e75e14d19fd545

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
62623d22bd9e037191765d5083ce16a3

SHA1
4a07da6872672f715a4780513d95ed8ddeefd259

SHA256
95d79fd575bbd21540e378fcbc1cd00d16f51af62ce15bae7080bb72c24e2010

SHA512
9a448b7a0d867466c2ea04ab84d2a9485d5fd20ab53b2b854f491831ee3f1d781b94d2635f7b0b35cb9f2d373cd52c67570879a56a42ed66bc9db06962ed4992

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
77d622bb1a5b250869a3238b9bc1402b

SHA1
d47f4003c2554b9dfc4c16f22460b331886b191b

SHA256
f97ff12a8abf4bf88bb6497bd2ac2da12628c8847a8ba5a9026bdbb76507cdfb

SHA512
d6789b5499f23c9035375a102271e17a8a82e57d6f5312fa24242e08a83efdeb8becb7622f55c4cf1b89c7d864b445df11f4d994cf7e2f87a900535bcca12fd9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
160B

MD5
1f8531ad8242ec92d98b6fcb5ddfef1d

SHA1
887d11b980faa385daaa29e0fd9dc7c76601283a

SHA256
7e88a183da6657e7c34814cfef9521849b8ae1a7519ca4eb0618b85e46b8bef3

SHA512
a907c2ae0739aaf6d7cf6246097c5b93b4f1ca8ba014be859c342df92c8a3addf76d6854b832c8d68bbdf449cf5d4422e865da3cebdef00e5039f778c47e80a8

Download Submit
C:\Users\Admin\AppData\Local\Temp\J2mXRZwkCj.bat

Filesize
243B

MD5
877255899aa4624122c200ede5b5d11e

SHA1
77ea38b8314385f8599ea363deed518fb27ffa1a

SHA256
36db8aa9155949d2a6fb0ade496b1e57a19e1877ff4a68bd8d8aae390377a6d1

SHA512
9f7826f30e7d233c20eda383bf40b5c82c4f5d547434d03cefacbc2cd3661e0be01f683edd73ddc050dff25c2d7a82abd5a82e025c8f37afcede267e0f06ac57

Download Submit
C:\Users\Admin\AppData\Local\Temp\Rhkc0SdEF2.bat

Filesize
243B

MD5
52ee91bd8b51ff7abc00cbf5124e66b7

SHA1
dcf58b54afa3488e287b6a8bf26ae84f1debe13e

SHA256
c01a081c759b77014684a3e5f0fc3b8c34aeb139d4bc61224498da193e9cd2a1

SHA512
107ee0bbd282f0221d8bc4462d5defaa1bdb9aae55e380f3ef8c78f5a74fedd27c2dce823694ab1177fb37ddd533d6b9f6d86ccb836989ff28944d72a1b2ab13

Download Submit
C:\Users\Admin\AppData\Local\Temp\WtQmBjXbDh.bat

Filesize
243B

MD5
7861cc9f13170c4e403f968b009dde3e

SHA1
e50da12149e877f78ee82488a73b64a6ca9967cf

SHA256
54fcaeed6b5a50e2fe832464057eddfe63abed7d30e80f562497314ff5851b00

SHA512
07089949915dcbd4d430cff5111ae08f9af5850ce29668ee4a749a8e5ce68df07d5760703a083e4f52e79dafc082c7456d2399ef269c06f5d69deff7d4c1ea8e

Download Submit
C:\Users\Admin\AppData\Local\Temp\ZgKlNS7JdR.bat

Filesize
243B

MD5
8a974d5fceeee7a1b3ad2a787c38fc22

SHA1
d735f24076e3ad22da1f8ba3b576695cd880a138

SHA256
db62e2a806c0ce6eadbf74fc68c686328cabcf4205d709cc0d90dd0e1823bf93

SHA512
51896162932326096d9696d8fc27fe085c6b54d2046e39b19dffaa28be77e5e85a51fb1d8d6b798b00b47078fea052c6b63b509c6a1c561f507a93e7d6d4f73c

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_hqj3imjw.mqp.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\bkUsYtfOrG.bat

Filesize
243B

MD5
39b9b6f0567256843c651b680effae2b

SHA1
2821438ae9f8c4d9c30fd9956917977e330b016d

SHA256
778aa7ce817a9fd138915e44806c121f65fa86f5f10bee5281f03170a5d3fa46

SHA512
d94dacebc07ccce216c00e68ff96b265fa6a1bbb59e8e953e0ad112b897b50e01b2ce741e6ac44cbafe4fedaf41af285535a2cb26a8a09b70f57cb829abf7728

Download Submit
C:\Users\Admin\AppData\Local\Temp\fjtq3MYUh4.bat

Filesize
243B

MD5
36736d518752835a9ae5c09a0f86ce6b

SHA1
5b0597e26bfdf98d3fc4190c852b255e271f3ddf

SHA256
89e254d9f588d0425ba9203f0d235f59f72868caa5340a4335e68f238e559b3f

SHA512
dd3b06ac34b4033dbb35d652bfbd3c4a9b1214885472a344b932a904dd8ee91c271d0d16f0109f6bafaabd8a302bf0c394efd9021ce0e7e0469503203470ddbe

Download Submit
C:\Users\Admin\AppData\Local\Temp\gZmmY05In2.bat

Filesize
243B

MD5
a1e2f9c13f7fad241ec618588c1f078e

SHA1
d0d6c9b818af17c93580703d6ade1dc8eb888f45

SHA256
96b4e1a5b0364b3628fa92f05beacfaa7b15dd4e516f4f6222c206a16beb0f45

SHA512
3dd5e578717362b566ee04d1807ccdee259814c2dadd1dd0e492d627562a6ee6aac595f33472bb4a03ecf7dafec42d76743aa10e09de5839224d610bc41e9e13

Download Submit
C:\Users\Admin\AppData\Local\Temp\mWzz7cjAeP.bat

Filesize
243B

MD5
423f9a8fb6b286fcb32cdfa6ed2cebb5

SHA1
77ecb6ff9f941b56a466683be22b71b51f778b14

SHA256
39869a1ceea83c32fe3a53fc5db379d758b8921591f01b2c5e729fbc794053c4

SHA512
a3c349bf7853ec28be405233ed8e62e97e34f180ac4cae47770748cdcae7d9f6081a355510f6f7be4f7a4de66c4a2735b37996a54b38f2815c442a62bb5306ac

Download Submit
C:\Users\Admin\AppData\Local\Temp\qO35UmqwIy.bat

Filesize
243B

MD5
5b7501a334018ba603940826c6e51594

SHA1
3536544e48e6f73977996c45abac6b200245daea

SHA256
cfee1f58f49e0e5abd39a85ac151b90852f198e6ff6b803c7e6263c62c2f743c

SHA512
f80d8cd438b3e4eef18e13e07787920be1dbff0063f324bf3ce6e15411fab6585b5de50c2b1113b5840b91e3e8172bb7bb27316d899d8502bd550da878370f16

Download Submit
C:\Users\Admin\AppData\Local\Temp\rZY5mW9Lj2.bat

Filesize
243B

MD5
bc19f4f6b5c0145b5f69cc6b86a2a726

SHA1
2cb433ec7f2e824144deabeafb7fe51be13a0824

SHA256
da61025ee9baa83ee66f6ef640a33396d46960cc977b7770bf8c2825aadb6f11

SHA512
b374def06566107abdfa2bb1e5f26652c2363f24e71879aaab6a0dce7c7b3176b8d7ff31b89de4743ba1fb7d2f4ff243769ccb5ae787761298098da336fac9f9

Download Submit
C:\Users\Admin\AppData\Local\Temp\uMS4yFj28m.bat

Filesize
243B

MD5
89a275892fe1965a6fb15bb91ea5d6e5

SHA1
1eb6479cc44f86237ca07911a25825986649f2d4

SHA256
c9a92a3889c28c7345e02ab806c053f45abddbd6eab0113853dc73ce158b296c

SHA512
11d6f6c1cc48fb10668dab1fa1da7d5fa60a8ba76eec55893cccea4480b0506f140cbea240944764f477b4003afdb0bd46249ee54ce938aee5436ecf9de9b21f

Download Submit
C:\providercommon\1zu9dW.bat

Filesize
36B

MD5
6783c3ee07c7d151ceac57f1f9c8bed7

SHA1
17468f98f95bf504cc1f83c49e49a78526b3ea03

SHA256
8ab782f0f327a2021530e7230d3aee8abbecb7eed59482a3a46e78b9e3862322

SHA512
c6012d4bfac1ed14d0fd9f0eabd0e1c3d647b343db292a907b246271d52a4b7469c809db43910ddba2e8c5045f9cb3d24d0af62d363281e6cb8b39ee94a183e8

Download Submit
C:\providercommon\DllCommonsvc.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\providercommon\yTUdeXjbLOhnrN32dgrxVg.vbe

Filesize
197B

MD5
8088241160261560a02c84025d107592

SHA1
083121f7027557570994c9fc211df61730455bb5

SHA256
2072cc9a4a3b84d4c5178ab41c5588eea7d0103e3928e34d64f17bf97f3d1cc1

SHA512
20d9369dd359315848ea30144383a0bb479d86059fdbc3b3256ac84f998193512feb3b1799ab663619920c99fe7e0ebba33ada31a3855094b956fcd351c90478

Download Submit
memory/228-133-0x0000000001900000-0x0000000001912000-memory.dmp

Filesize
72KB

Download
memory/228-138-0x000000001CB00000-0x000000001CC6A000-memory.dmp

Filesize
1.4MB

Download
memory/1264-117-0x000000001C2D0000-0x000000001C371000-memory.dmp

Filesize
644KB

Download
memory/1680-161-0x0000000001740000-0x0000000001752000-memory.dmp

Filesize
72KB

Download
memory/3084-104-0x00000000012A0000-0x00000000012B2000-memory.dmp

Filesize
72KB

Download
memory/3084-109-0x000000001C520000-0x000000001C5C1000-memory.dmp

Filesize
644KB

Download
memory/3104-147-0x0000000002420000-0x0000000002432000-memory.dmp

Filesize
72KB

Download
memory/3480-15-0x000000001B2B0000-0x000000001B2BC000-memory.dmp

Filesize
48KB

Download
memory/3480-17-0x0000000002830000-0x000000000283C000-memory.dmp

Filesize
48KB

Download
memory/3480-16-0x0000000002820000-0x000000000282C000-memory.dmp

Filesize
48KB

Download
memory/3480-14-0x0000000002810000-0x0000000002822000-memory.dmp

Filesize
72KB

Download
memory/3480-13-0x0000000000580000-0x0000000000690000-memory.dmp

Filesize
1.1MB

Download
memory/3480-12-0x00007FFC4F053000-0x00007FFC4F055000-memory.dmp

Filesize
8KB

Download
memory/3616-38-0x0000018D46ED0000-0x0000018D46EF2000-memory.dmp

Filesize
136KB

Download
memory/3952-154-0x0000000002780000-0x0000000002792000-memory.dmp

Filesize
72KB

Download
memory/4296-89-0x00000000022C0000-0x00000000022D2000-memory.dmp

Filesize
72KB

Download
memory/4296-95-0x000000001B5A0000-0x000000001B6A2000-memory.dmp

Filesize
1.0MB

Download
memory/4752-124-0x000000001BC60000-0x000000001BD01000-memory.dmp

Filesize
644KB

Download
memory/4752-119-0x0000000003180000-0x0000000003192000-memory.dmp

Filesize
72KB

Download
memory/4832-101-0x000000001C610000-0x000000001C6B1000-memory.dmp

Filesize
644KB

Download