dcrat | 73b461a9d859f019ed4f0dda1e0cc86a36b826bde0f318e806503876056b41c0

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
13-01-2025 12:09

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

SearchIndexer.exe
Size

3.6MB
MD5

f2997dfb6f126670204c83344b678f0e
SHA1

fb1a90117ff594cac3b2cebbbbd072674f246ce3
SHA256

73b461a9d859f019ed4f0dda1e0cc86a36b826bde0f318e806503876056b41c0
SHA512

20bd6c2e2aebf5e96f8d9497880538061f23ed8b925cf916749da16db6339a2dd2ff5166aa0c096e23f7654e5b2959d9af108cf5ccf68291cc80f8c7c2d235ad
SSDEEP

98304:NzRppqmmRX+6fo6du/5P2nPNWNG5trztTgyz+65WzU:NzRppqVDqOnVWNG5bR+65WzU

Score

10^/10

dcrat neshta discovery execution infostealer persistence rat spyware stealer

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat
Dcrat family
dcrat

Detect Neshta payload 4 IoCs

resource	yara_rule
behavioral2/files/0x0006000000020228-19.dat	family_neshta
behavioral2/memory/3084-362-0x0000000000400000-0x000000000041B000-memory.dmp	family_neshta
behavioral2/memory/3084-367-0x0000000000400000-0x000000000041B000-memory.dmp	family_neshta
behavioral2/memory/3084-390-0x0000000000400000-0x000000000041B000-memory.dmp	family_neshta

Neshta
Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.
persistence spyware neshta
Neshta family
neshta

Process spawned unexpected child process 18 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1760	4832	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1764	4832	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4516	4832	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	212	4832	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4996	4832	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2256	4832	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1036	4832	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3620	4832	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2932	4832	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1496	4832	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	764	4832	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	376	4832	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1080	4832	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4080	4832	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	724	4832	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	448	4832	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3168	4832	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4972	4832	schtasks.exe	83

Command and Scripting Interpreter: PowerShell 1 TTPs 17 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
920	powershell.exe
652	powershell.exe
3052	powershell.exe
4740	powershell.exe
1440	powershell.exe
4760	powershell.exe
1600	powershell.exe
2592	powershell.exe
4540	powershell.exe
4568	powershell.exe
1072	powershell.exe
5000	powershell.exe
1696	powershell.exe
3264	powershell.exe
3956	powershell.exe
676	powershell.exe
4668	powershell.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\International\Geo\Nation	SearchIndexer.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\International\Geo\Nation	SearchIndexer.exe

Executes dropped EXE 2 IoCs

pid	Process
264	SearchIndexer.exe
5612	winlogon.exe

Modifies system executable filetype association 2 TTPs 1 IoCs

persistence

Modify Registry

T1112

Change Default File Association

T1546.001

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*"	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\plug_ins\PI_BRO~1\32BITM~1.EXE	SearchIndexer.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\READER~1.EXE	SearchIndexer.exe
File opened for modification	C:\PROGRA~2\COMMON~1\Adobe\ARM\1.0\AdobeARM.exe	SearchIndexer.exe
File opened for modification	C:\PROGRA~2\Google\Update\1336~1.371\GOOGLE~2.EXE	SearchIndexer.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\MSEDGE~3.EXE	SearchIndexer.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\PWAHEL~1.EXE	SearchIndexer.exe
File opened for modification	C:\PROGRA~2\WINDOW~2\wab.exe	SearchIndexer.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\Browser\WCCHRO~1\WCCHRO~1.EXE	SearchIndexer.exe
File opened for modification	C:\PROGRA~2\INTERN~1\iexplore.exe	SearchIndexer.exe
File opened for modification	C:\PROGRA~2\WINDOW~4\setup_wm.exe	SearchIndexer.exe
File opened for modification	C:\PROGRA~2\WINDOW~4\wmprph.exe	SearchIndexer.exe
File opened for modification	C:\PROGRA~3\PACKAG~1\{4D8DC~1\VC_RED~1.EXE	SearchIndexer.exe
File opened for modification	C:\PROGRA~3\PACKAG~1\{63880~1\WINDOW~1.EXE	SearchIndexer.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\Eula.exe	SearchIndexer.exe
File opened for modification	C:\PROGRA~2\COMMON~1\Adobe\ARM\1.0\ADOBEA~1.EXE	SearchIndexer.exe
File opened for modification	C:\PROGRA~2\WINDOW~4\wmpconfig.exe	SearchIndexer.exe
File opened for modification	C:\Program Files\Windows Photo Viewer\uk-UA\RuntimeBroker.exe	SearchIndexer.exe
File opened for modification	C:\PROGRA~2\Google\Update\DISABL~1.EXE	SearchIndexer.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\BHO\IE_TO_~1.EXE	SearchIndexer.exe
File opened for modification	C:\PROGRA~2\WINDOW~4\wmpshare.exe	SearchIndexer.exe
File created	C:\Program Files (x86)\Windows Multimedia Platform\7a0fd90576e088	SearchIndexer.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\FULLTR~1.EXE	SearchIndexer.exe
File opened for modification	C:\PROGRA~2\INTERN~1\ielowutil.exe	SearchIndexer.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\msedge.exe	SearchIndexer.exe
File created	C:\Program Files (x86)\Windows Multimedia Platform\explorer.exe	SearchIndexer.exe
File opened for modification	C:\PROGRA~2\Google\Update\1336~1.371\GOOGLE~1.EXE	SearchIndexer.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\MSEDGE~2.EXE	SearchIndexer.exe
File opened for modification	C:\PROGRA~2\MICROS~1\EDGEUP~1\13147~1.37\MICROS~3.EXE	SearchIndexer.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\AcroCEF\RdrCEF.exe	SearchIndexer.exe
File opened for modification	C:\PROGRA~2\INTERN~1\ieinstal.exe	SearchIndexer.exe
File created	C:\Program Files\Windows Photo Viewer\uk-UA\RuntimeBroker.exe	SearchIndexer.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\ADOBEC~1.EXE	SearchIndexer.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\WOW_HE~1.EXE	SearchIndexer.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\MSInfo\msinfo32.exe	SearchIndexer.exe
File opened for modification	C:\PROGRA~2\INTERN~1\ExtExport.exe	SearchIndexer.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\ELEVAT~1.EXE	SearchIndexer.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\IDENTI~1.EXE	SearchIndexer.exe
File opened for modification	C:\PROGRA~2\MICROS~1\EDGEUP~1\13147~1.37\MID1AD~1.EXE	SearchIndexer.exe
File opened for modification	C:\PROGRA~2\Google\Update\1336~1.371\GOBD5D~1.EXE	SearchIndexer.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\MSEDGE~1.EXE	SearchIndexer.exe
File opened for modification	C:\PROGRA~2\MOZILL~1\MAINTE~1.EXE	SearchIndexer.exe
File opened for modification	C:\PROGRA~3\PACKAG~1\{33D1F~1\VCREDI~1.EXE	SearchIndexer.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\AcroRd32.exe	SearchIndexer.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\ADelRCP.exe	SearchIndexer.exe
File opened for modification	C:\PROGRA~2\MICROS~1\EDGEUP~1\13147~1.37\MICROS~4.EXE	SearchIndexer.exe
File opened for modification	C:\PROGRA~2\MOZILL~1\UNINST~1.EXE	SearchIndexer.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\ACROBR~1.EXE	SearchIndexer.exe
File opened for modification	C:\PROGRA~2\COMMON~1\Java\JAVAUP~1\jaureg.exe	SearchIndexer.exe
File opened for modification	C:\PROGRA~2\COMMON~1\Oracle\Java\javapath\javaw.exe	SearchIndexer.exe
File opened for modification	C:\PROGRA~2\COMMON~1\Oracle\Java\javapath\javaws.exe	SearchIndexer.exe
File opened for modification	C:\PROGRA~2\WINDOW~3\ACCESS~1\wordpad.exe	SearchIndexer.exe
File opened for modification	C:\PROGRA~3\PACKAG~1\{EF6B0~1\VCREDI~1.EXE	SearchIndexer.exe
File created	C:\Program Files\Windows Photo Viewer\uk-UA\9e8d7a4ca61bd9	SearchIndexer.exe
File opened for modification	C:\PROGRA~3\PACKAG~1\{EF5AF~1\WINDOW~1.EXE	SearchIndexer.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\arh.exe	SearchIndexer.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\VSTO\10.0\VSTOIN~1.EXE	SearchIndexer.exe
File opened for modification	C:\PROGRA~2\Google\Update\1336~1.371\GOOGLE~4.EXE	SearchIndexer.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\INSTAL~1\setup.exe	SearchIndexer.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\MSEDGE~1.EXE	SearchIndexer.exe
File opened for modification	C:\PROGRA~2\MICROS~1\EDGEUP~1\13147~1.37\MICROS~1.EXE	SearchIndexer.exe
File opened for modification	C:\PROGRA~3\PACKAG~1\{D87AE~1\WINDOW~1.EXE	SearchIndexer.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\ACROTE~1.EXE	SearchIndexer.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\LOGTRA~1.EXE	SearchIndexer.exe
File opened for modification	C:\PROGRA~2\COMMON~1\Oracle\Java\javapath\java.exe	SearchIndexer.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File created	C:\Windows\Cursors\886983d96e3d3e	SearchIndexer.exe
File opened for modification	C:\Windows\svchost.com	SearchIndexer.exe
File created	C:\Windows\Cursors\csrss.exe	SearchIndexer.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SearchIndexer.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
5152	PING.EXE

Modifies registry class 2 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*"	SearchIndexer.exe
Key created	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000_Classes\Local Settings	SearchIndexer.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
5152	PING.EXE

Scheduled Task/Job: Scheduled Task 1 TTPs 18 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
1764	schtasks.exe
448	schtasks.exe
4516	schtasks.exe
212	schtasks.exe
4996	schtasks.exe
1080	schtasks.exe
1760	schtasks.exe
2932	schtasks.exe
1496	schtasks.exe
376	schtasks.exe
4080	schtasks.exe
3168	schtasks.exe
2256	schtasks.exe
1036	schtasks.exe
3620	schtasks.exe
764	schtasks.exe
724	schtasks.exe
4972	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
264	SearchIndexer.exe
264	SearchIndexer.exe
264	SearchIndexer.exe
264	SearchIndexer.exe
264	SearchIndexer.exe
264	SearchIndexer.exe
264	SearchIndexer.exe
264	SearchIndexer.exe
264	SearchIndexer.exe
264	SearchIndexer.exe
264	SearchIndexer.exe
264	SearchIndexer.exe
264	SearchIndexer.exe
264	SearchIndexer.exe
264	SearchIndexer.exe
264	SearchIndexer.exe
264	SearchIndexer.exe
264	SearchIndexer.exe
264	SearchIndexer.exe
264	SearchIndexer.exe
264	SearchIndexer.exe
264	SearchIndexer.exe
264	SearchIndexer.exe
264	SearchIndexer.exe
264	SearchIndexer.exe
264	SearchIndexer.exe
264	SearchIndexer.exe
264	SearchIndexer.exe
264	SearchIndexer.exe
264	SearchIndexer.exe
264	SearchIndexer.exe
264	SearchIndexer.exe
264	SearchIndexer.exe
264	SearchIndexer.exe
264	SearchIndexer.exe
264	SearchIndexer.exe
264	SearchIndexer.exe
264	SearchIndexer.exe
264	SearchIndexer.exe
264	SearchIndexer.exe
264	SearchIndexer.exe
264	SearchIndexer.exe
264	SearchIndexer.exe
264	SearchIndexer.exe
264	SearchIndexer.exe
264	SearchIndexer.exe
264	SearchIndexer.exe
264	SearchIndexer.exe
264	SearchIndexer.exe
264	SearchIndexer.exe
264	SearchIndexer.exe
264	SearchIndexer.exe
264	SearchIndexer.exe
264	SearchIndexer.exe
264	SearchIndexer.exe
264	SearchIndexer.exe
264	SearchIndexer.exe
264	SearchIndexer.exe
264	SearchIndexer.exe
264	SearchIndexer.exe
264	SearchIndexer.exe
264	SearchIndexer.exe
264	SearchIndexer.exe
264	SearchIndexer.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
5612	winlogon.exe

Suspicious use of AdjustPrivilegeToken 19 IoCs

description	pid	Process
Token: SeDebugPrivilege	264	SearchIndexer.exe
Token: SeDebugPrivilege	3956	powershell.exe
Token: SeDebugPrivilege	3264	powershell.exe
Token: SeDebugPrivilege	3052	powershell.exe
Token: SeDebugPrivilege	5000	powershell.exe
Token: SeDebugPrivilege	4568	powershell.exe
Token: SeDebugPrivilege	1440	powershell.exe
Token: SeDebugPrivilege	4668	powershell.exe
Token: SeDebugPrivilege	2592	powershell.exe
Token: SeDebugPrivilege	1600	powershell.exe
Token: SeDebugPrivilege	920	powershell.exe
Token: SeDebugPrivilege	4740	powershell.exe
Token: SeDebugPrivilege	676	powershell.exe
Token: SeDebugPrivilege	4760	powershell.exe
Token: SeDebugPrivilege	1072	powershell.exe
Token: SeDebugPrivilege	652	powershell.exe
Token: SeDebugPrivilege	4540	powershell.exe
Token: SeDebugPrivilege	1696	powershell.exe
Token: SeDebugPrivilege	5612	winlogon.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
5612	winlogon.exe

Suspicious use of WriteProcessMemory 44 IoCs

description	pid	Process	procid_target
PID 3084 wrote to memory of 264	3084	SearchIndexer.exe	82
PID 3084 wrote to memory of 264	3084	SearchIndexer.exe	82
PID 264 wrote to memory of 4540	264	SearchIndexer.exe	102
PID 264 wrote to memory of 4540	264	SearchIndexer.exe	102
PID 264 wrote to memory of 3956	264	SearchIndexer.exe	103
PID 264 wrote to memory of 3956	264	SearchIndexer.exe	103
PID 264 wrote to memory of 3264	264	SearchIndexer.exe	104
PID 264 wrote to memory of 3264	264	SearchIndexer.exe	104
PID 264 wrote to memory of 1696	264	SearchIndexer.exe	105
PID 264 wrote to memory of 1696	264	SearchIndexer.exe	105
PID 264 wrote to memory of 4568	264	SearchIndexer.exe	106
PID 264 wrote to memory of 4568	264	SearchIndexer.exe	106
PID 264 wrote to memory of 920	264	SearchIndexer.exe	107
PID 264 wrote to memory of 920	264	SearchIndexer.exe	107
PID 264 wrote to memory of 5000	264	SearchIndexer.exe	108
PID 264 wrote to memory of 5000	264	SearchIndexer.exe	108
PID 264 wrote to memory of 1072	264	SearchIndexer.exe	109
PID 264 wrote to memory of 1072	264	SearchIndexer.exe	109
PID 264 wrote to memory of 2592	264	SearchIndexer.exe	110
PID 264 wrote to memory of 2592	264	SearchIndexer.exe	110
PID 264 wrote to memory of 1440	264	SearchIndexer.exe	111
PID 264 wrote to memory of 1440	264	SearchIndexer.exe	111
PID 264 wrote to memory of 4668	264	SearchIndexer.exe	112
PID 264 wrote to memory of 4668	264	SearchIndexer.exe	112
PID 264 wrote to memory of 4740	264	SearchIndexer.exe	113
PID 264 wrote to memory of 4740	264	SearchIndexer.exe	113
PID 264 wrote to memory of 1600	264	SearchIndexer.exe	114
PID 264 wrote to memory of 1600	264	SearchIndexer.exe	114
PID 264 wrote to memory of 3052	264	SearchIndexer.exe	115
PID 264 wrote to memory of 3052	264	SearchIndexer.exe	115
PID 264 wrote to memory of 4760	264	SearchIndexer.exe	116
PID 264 wrote to memory of 4760	264	SearchIndexer.exe	116
PID 264 wrote to memory of 676	264	SearchIndexer.exe	117
PID 264 wrote to memory of 676	264	SearchIndexer.exe	117
PID 264 wrote to memory of 652	264	SearchIndexer.exe	122
PID 264 wrote to memory of 652	264	SearchIndexer.exe	122
PID 264 wrote to memory of 2004	264	SearchIndexer.exe	136
PID 264 wrote to memory of 2004	264	SearchIndexer.exe	136
PID 2004 wrote to memory of 4864	2004	cmd.exe	138
PID 2004 wrote to memory of 4864	2004	cmd.exe	138
PID 2004 wrote to memory of 5152	2004	cmd.exe	139
PID 2004 wrote to memory of 5152	2004	cmd.exe	139
PID 2004 wrote to memory of 5612	2004	cmd.exe	145
PID 2004 wrote to memory of 5612	2004	cmd.exe	145

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\SearchIndexer.exe
"C:\Users\Admin\AppData\Local\Temp\SearchIndexer.exe"
1⤵
- Checks computer location settings
- Modifies system executable filetype association
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3084
- C:\Users\Admin\AppData\Local\Temp\3582-490\SearchIndexer.exe
  "C:\Users\Admin\AppData\Local\Temp\3582-490\SearchIndexer.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Drops file in Program Files directory
  - Drops file in Windows directory
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:264
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell" -Command Add-MpPreference -ExclusionPath 'C:/'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious use of AdjustPrivilegeToken
    PID:4540
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell" -Command Add-MpPreference -ExclusionPath 'C:/$Recycle.Bin/'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious use of AdjustPrivilegeToken
    PID:3956
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Documents and Settings/'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious use of AdjustPrivilegeToken
    PID:3264
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell" -Command Add-MpPreference -ExclusionPath 'C:/PerfLogs/'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious use of AdjustPrivilegeToken
    PID:1696
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files/'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious use of AdjustPrivilegeToken
    PID:4568
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files (x86)/'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious use of AdjustPrivilegeToken
    PID:920
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell" -Command Add-MpPreference -ExclusionPath 'C:/ProgramData/'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious use of AdjustPrivilegeToken
    PID:5000
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Recovery/'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious use of AdjustPrivilegeToken
    PID:1072
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell" -Command Add-MpPreference -ExclusionPath 'C:/System Volume Information/'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious use of AdjustPrivilegeToken
    PID:2592
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Users/'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious use of AdjustPrivilegeToken
    PID:1440
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Windows/'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious use of AdjustPrivilegeToken
    PID:4668
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Windows Multimedia Platform\explorer.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious use of AdjustPrivilegeToken
    PID:4740
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\Cursors\csrss.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious use of AdjustPrivilegeToken
    PID:1600
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Default User\winlogon.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious use of AdjustPrivilegeToken
    PID:3052
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\csrss.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious use of AdjustPrivilegeToken
    PID:4760
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Windows Photo Viewer\uk-UA\RuntimeBroker.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious use of AdjustPrivilegeToken
    PID:676
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\3582-490\SearchIndexer.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious use of AdjustPrivilegeToken
    PID:652
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\33xIhOuCJk.bat"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2004
  - - C:\Windows\system32\chcp.com
      chcp 65001
      4⤵
      PID:4864
  - - C:\Windows\system32\PING.EXE
      ping -n 10 localhost
      4⤵
      System Network Configuration Discovery: Internet Connection Discovery
      Runs ping.exe
      PID:5152
  - - C:\Users\Default User\winlogon.exe
      "C:\Users\Default User\winlogon.exe"
      4⤵
      Executes dropped EXE
      Suspicious behavior: GetForegroundWindowSpam
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of SetWindowsHookEx
      PID:5612

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 10 /tr "'C:\Program Files (x86)\Windows Multimedia Platform\explorer.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1760

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorer" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Multimedia Platform\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1764

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 11 /tr "'C:\Program Files (x86)\Windows Multimedia Platform\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4516

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 14 /tr "'C:\Windows\Cursors\csrss.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:212

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Windows\Cursors\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4996

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 9 /tr "'C:\Windows\Cursors\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2256

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 8 /tr "'C:\Users\Default User\winlogon.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1036

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogon" /sc ONLOGON /tr "'C:\Users\Default User\winlogon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3620

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 6 /tr "'C:\Users\Default User\winlogon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2932

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 6 /tr "'C:\Users\Admin\csrss.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1496

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Users\Admin\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:764

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 10 /tr "'C:\Users\Admin\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:376

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 13 /tr "'C:\Program Files\Windows Photo Viewer\uk-UA\RuntimeBroker.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1080

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Program Files\Windows Photo Viewer\uk-UA\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4080

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 14 /tr "'C:\Program Files\Windows Photo Viewer\uk-UA\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:724

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SearchIndexerS" /sc MINUTE /mo 11 /tr "'C:\Users\Admin\AppData\Local\Temp\3582-490\SearchIndexer.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:448

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SearchIndexer" /sc ONLOGON /tr "'C:\Users\Admin\AppData\Local\Temp\3582-490\SearchIndexer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3168

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SearchIndexerS" /sc MINUTE /mo 9 /tr "'C:\Users\Admin\AppData\Local\Temp\3582-490\SearchIndexer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4972

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Event Triggered Execution

T1546

Change Default File Association

T1546.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Event Triggered Execution

T1546

Change Default File Association

T1546.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\PROGRA~2\Adobe\ACROBA~1\Reader\ACROTE~1.EXE

Filesize
86KB

MD5
3b73078a714bf61d1c19ebc3afc0e454

SHA1
9abeabd74613a2f533e2244c9ee6f967188e4e7e

SHA256
ded54d1fcca07b6bff2bc3b9a1131eac29ff1f836e5d7a7c5c325ec5abe96e29

SHA512
75959d4e8a7649c3268b551a2a378e6d27c0bfb03d2422ebeeb67b0a3f78c079473214057518930f2d72773ce79b106fd2d78405e8e3d8883459dcbb49c163c4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
d85ba6ff808d9e5444a4b369f5bc2730

SHA1
31aa9d96590fff6981b315e0b391b575e4c0804a

SHA256
84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

SHA512
8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
3a6bad9528f8e23fb5c77fbd81fa28e8

SHA1
f127317c3bc6407f536c0f0600dcbcf1aabfba36

SHA256
986366767de5873f1b170a63f2a33ce05132d1afd90c8f5017afbca8ef1beb05

SHA512
846002154a0ece6f3e9feda6f115d3161dc21b3789525dd62ae1d9188495171293efdbe7be4710666dd8a15e66b557315b5a02918a741ed1d5f3ff0c515b98e2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
62623d22bd9e037191765d5083ce16a3

SHA1
4a07da6872672f715a4780513d95ed8ddeefd259

SHA256
95d79fd575bbd21540e378fcbc1cd00d16f51af62ce15bae7080bb72c24e2010

SHA512
9a448b7a0d867466c2ea04ab84d2a9485d5fd20ab53b2b854f491831ee3f1d781b94d2635f7b0b35cb9f2d373cd52c67570879a56a42ed66bc9db06962ed4992

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
6d3e9c29fe44e90aae6ed30ccf799ca8

SHA1
c7974ef72264bbdf13a2793ccf1aed11bc565dce

SHA256
2360634e63e8f0b5748e2c56ebb8f4aa78e71008ea7b5c9ca1c49be03b49557d

SHA512
60c38c4367352537545d859f64b9c5cbada94240478d1d039fd27b5ecba4dc1c90051557c16d802269703b873546ead416279c0a80c6fd5e49ad361cef22596a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
e243a38635ff9a06c87c2a61a2200656

SHA1
ecd95ed5bf1a9fbe96a8448fc2814a0210fa2afc

SHA256
af5782703f3f2d5a29fb313dae6680a64134db26064d4a321a3f23b75f6ca00f

SHA512
4418957a1b10eee44cf270c81816ae707352411c4f5ac14b6b61ab537c91480e24e0a0a2c276a6291081b4984c123cf673a45dcedb0ceeef682054ba0fc19cb4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
a8e8360d573a4ff072dcc6f09d992c88

SHA1
3446774433ceaf0b400073914facab11b98b6807

SHA256
bf5e284e8f95122bf75ead61c7e2b40f55c96742b05330b5b1cb7915991df13b

SHA512
4ee5167643d82082f57c42616007ef9be57f43f9731921bdf7bca611a914724ad94072d3c8f5b130fa54129e5328ccdebf37ba74339c37deb53e79df5cdf0dbe

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
3a5e1f1efff867a822c6a57ee928dd66

SHA1
b017854d8a1deb05f1447e9dd6002902fb66bf6b

SHA256
8222fe869b025493591ca2ffbabe089c2e682449e77b754fc864ba62d64ee957

SHA512
25fc0fd6a71595c44efe34d281c4bc4924ac82f76b9f697497d0019fa2c8e0cadf58f92ae4272f00b1ef1e97dfd93bd740a9e7f7d9dc93cb1cadbde5f93d1782

Download Submit
C:\Users\Admin\AppData\Local\Temp\33xIhOuCJk.bat

Filesize
162B

MD5
6878cfe7c1227e4576ef193eef2f56c6

SHA1
8799c859391bc653b3fb6cf5969bb8c9ff295a8d

SHA256
4607156956ba5da61b12244bff36a373b08a6048b1e0ee07634d84b61b2b2471

SHA512
7026d212b2db7ba2e301f6b274f49c0f7bed070ed60f2befba2e5c1c3955e443b82a71cfccaa2201c6d0039f53ddca9ba8d9bb5cd2cb0617978a48234c350b2b

Download Submit
C:\Users\Admin\AppData\Local\Temp\3582-490\SearchIndexer.exe

Filesize
3.5MB

MD5
3e3fe7663181211e5983da48431ddf33

SHA1
0bea67a96dba0798541ea15426fb0ac38c10ff06

SHA256
cc398c54d30b3c0c1ff1d54f03fb157578346d088c9ce38fc6347698f25fc166

SHA512
80056c508dade773729c239bd0b43d92c9e6d8de513b19776bf28665e37e44d022fd6c5f33ebfa3fe31b9480ce0705e9581d872b8e79703931da459d4f5922a0

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_vco25seq.a1r.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
memory/264-133-0x000000001BF80000-0x000000001C4A8000-memory.dmp

Filesize
5.2MB

Download
memory/264-145-0x000000001BA60000-0x000000001BA70000-memory.dmp

Filesize
64KB

Download
memory/264-94-0x000000001B9C0000-0x000000001BA10000-memory.dmp

Filesize
320KB

Download
memory/264-97-0x0000000002AB0000-0x0000000002AC0000-memory.dmp

Filesize
64KB

Download
memory/264-102-0x000000001B540000-0x000000001B558000-memory.dmp

Filesize
96KB

Download
memory/264-103-0x00007FFC7EB30000-0x00007FFC7F5F1000-memory.dmp

Filesize
10.8MB

Download
memory/264-105-0x0000000002AC0000-0x0000000002AD0000-memory.dmp

Filesize
64KB

Download
memory/264-108-0x0000000002B30000-0x0000000002B40000-memory.dmp

Filesize
64KB

Download
memory/264-106-0x00007FFC7EB30000-0x00007FFC7F5F1000-memory.dmp

Filesize
10.8MB

Download
memory/264-113-0x000000001B580000-0x000000001B592000-memory.dmp

Filesize
72KB

Download
memory/264-111-0x00007FFC7EB30000-0x00007FFC7F5F1000-memory.dmp

Filesize
10.8MB

Download
memory/264-110-0x000000001B520000-0x000000001B52E000-memory.dmp

Filesize
56KB

Download
memory/264-118-0x000000001B530000-0x000000001B540000-memory.dmp

Filesize
64KB

Download
memory/264-116-0x00007FFC7EB30000-0x00007FFC7F5F1000-memory.dmp

Filesize
10.8MB

Download
memory/264-129-0x000000001BA10000-0x000000001BA26000-memory.dmp

Filesize
88KB

Download
memory/264-132-0x00007FFC7EB30000-0x00007FFC7F5F1000-memory.dmp

Filesize
10.8MB

Download
memory/264-131-0x000000001BA30000-0x000000001BA42000-memory.dmp

Filesize
72KB

Download
memory/264-90-0x0000000002A60000-0x0000000002A6E000-memory.dmp

Filesize
56KB

Download
memory/264-135-0x000000001B560000-0x000000001B56E000-memory.dmp

Filesize
56KB

Download
memory/264-137-0x000000001B570000-0x000000001B580000-memory.dmp

Filesize
64KB

Download
memory/264-139-0x000000001B5A0000-0x000000001B5B0000-memory.dmp

Filesize
64KB

Download
memory/264-141-0x000000001BAB0000-0x000000001BB0A000-memory.dmp

Filesize
360KB

Download
memory/264-143-0x000000001BA50000-0x000000001BA5E000-memory.dmp

Filesize
56KB

Download
memory/264-93-0x0000000002AD0000-0x0000000002AEC000-memory.dmp

Filesize
112KB

Download
memory/264-147-0x000000001BA70000-0x000000001BA7E000-memory.dmp

Filesize
56KB

Download
memory/264-149-0x000000001BB10000-0x000000001BB28000-memory.dmp

Filesize
96KB

Download
memory/264-151-0x000000001BA80000-0x000000001BA8C000-memory.dmp

Filesize
48KB

Download
memory/264-153-0x000000001BD80000-0x000000001BDCE000-memory.dmp

Filesize
312KB

Download
memory/264-91-0x00007FFC7EB30000-0x00007FFC7F5F1000-memory.dmp

Filesize
10.8MB

Download
memory/264-170-0x000000001C900000-0x000000001C9CD000-memory.dmp

Filesize
820KB

Download
memory/264-176-0x00007FFC7EB30000-0x00007FFC7F5F1000-memory.dmp

Filesize
10.8MB

Download
memory/264-12-0x00007FFC7EB33000-0x00007FFC7EB35000-memory.dmp

Filesize
8KB

Download
memory/264-79-0x00007FFC7EB30000-0x00007FFC7F5F1000-memory.dmp

Filesize
10.8MB

Download
memory/264-78-0x00007FFC7EB30000-0x00007FFC7F5F1000-memory.dmp

Filesize
10.8MB

Download
memory/264-77-0x0000000002B00000-0x0000000002B26000-memory.dmp

Filesize
152KB

Download
memory/264-42-0x00007FFC7EB30000-0x00007FFC7F5F1000-memory.dmp

Filesize
10.8MB

Download
memory/264-15-0x00007FFC7EB30000-0x00007FFC7F5F1000-memory.dmp

Filesize
10.8MB

Download
memory/264-14-0x00007FFC7EB30000-0x00007FFC7F5F1000-memory.dmp

Filesize
10.8MB

Download
memory/264-13-0x0000000000500000-0x000000000088E000-memory.dmp

Filesize
3.6MB

Download
memory/3084-362-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/3084-367-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/3084-390-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/5000-183-0x00000200B8D50000-0x00000200B8D72000-memory.dmp

Filesize
136KB

Download
memory/5612-391-0x000000001BA70000-0x000000001BB3D000-memory.dmp

Filesize
820KB

Download
memory/5612-392-0x000000001CFC0000-0x000000001D0D5000-memory.dmp

Filesize
1.1MB

Download