Overview

overview

10

Static

static

3

e83194ac6a...f1.exe

windows7-x64

10

e83194ac6a...f1.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    149s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    18-01-2025 12:05

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    e83194ac6af90662225fd216fae289c52a2d8392bbc35a2b1e131bef7ae354f1.exe

  • Size

    1.5MB

  • MD5

    d36cc4a093e0bc7ca5a9342ab6012419

  • SHA1

    ce5387ec8626e899804182655ad84ed339771ed1

  • SHA256

    e83194ac6af90662225fd216fae289c52a2d8392bbc35a2b1e131bef7ae354f1

  • SHA512

    df08e46279f1726a78b73b2191b7e878512e84520eed04f5b45aa14553447e216bf9b3a44d0478947d340ced9c434b7526266b4380f0fe16196eb8da5c8206be

  • SSDEEP

    24576:UNNUtQhWhtqDfDXQdy+N+gfQqRsgFlDRluQ70eJiVbWpR:kzhWhCXQFN+0IEuQgyiVK

Score
10/10
dcratevasionexecutioninfostealerpersistencerattrojan

Malware Config

Signatures

  • DcRat

    DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

    ratinfostealerdcrat
  • Dcrat family
    dcrat
  • Modifies WinLogon for persistence 2 TTPs 6 IoCs
    persistence
  • Process spawned unexpected child process 6 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • UAC bypass 3 TTPs 51 IoCs
    evasiontrojan
  • Command and Scripting Interpreter: PowerShell 1 TTPs 7 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution
  • Drops file in Drivers directory 1 IoCs
  • Checks computer location settings 2 TTPs 17 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 16 IoCs
  • Adds Run key to start application 2 TTPs 12 IoCs
    persistence
  • Checks whether UAC is enabled 1 TTPs 34 IoCs
    evasiontrojan
  • Drops file in System32 directory 16 IoCs
  • Drops file in Windows directory 8 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies registry class 17 IoCs
  • Scheduled Task/Job: Scheduled Task 1 TTPs 6 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistenceexecution
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 24 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • System policy modification 1 TTPs 51 IoCs
    evasion
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\e83194ac6af90662225fd216fae289c52a2d8392bbc35a2b1e131bef7ae354f1.exe
    "C:\Users\Admin\AppData\Local\Temp\e83194ac6af90662225fd216fae289c52a2d8392bbc35a2b1e131bef7ae354f1.exe"
    1⤵
    • Modifies WinLogon for persistence
    • UAC bypass
    • Drops file in Drivers directory
    • Checks computer location settings
    • Adds Run key to start application
    • Checks whether UAC is enabled
    • Drops file in System32 directory
    • Drops file in Windows directory
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    • System policy modification
    PID:4616
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\e83194ac6af90662225fd216fae289c52a2d8392bbc35a2b1e131bef7ae354f1.exe'
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:4192
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\Cortana.Search\SearchApp.exe'
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:4372
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\System32\cscdll\sihost.exe'
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:1932
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\WindowsUpdate\explorer.exe'
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:388
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\System32\wldp\dwm.exe'
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:3240
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\System32\srclient\RuntimeBroker.exe'
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:4024
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\System32\winlogon\taskhostw.exe'
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2984
    • C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\cf2bdyTdRo.bat"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:2956
      • C:\Windows\system32\w32tm.exe
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        3⤵
          PID:2680
        • C:\Windows\System32\cscdll\sihost.exe
          "C:\Windows\System32\cscdll\sihost.exe"
          3⤵
          • UAC bypass
          • Checks computer location settings
          • Executes dropped EXE
          • Checks whether UAC is enabled
          • Modifies registry class
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          • System policy modification
          PID:736
          • C:\Windows\System32\WScript.exe
            "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\f3f5d778-41a6-4bc8-afb3-a805972b1390.vbs"
            4⤵
            • Suspicious use of WriteProcessMemory
            PID:1116
            • C:\Windows\System32\cscdll\sihost.exe
              C:\Windows\System32\cscdll\sihost.exe
              5⤵
              • UAC bypass
              • Checks computer location settings
              • Executes dropped EXE
              • Checks whether UAC is enabled
              • Modifies registry class
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              • Suspicious use of WriteProcessMemory
              • System policy modification
              PID:904
              • C:\Windows\System32\WScript.exe
                "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\0637d9ab-83e9-463e-8307-f1f10283c6e7.vbs"
                6⤵
                • Suspicious use of WriteProcessMemory
                PID:448
                • C:\Windows\System32\cscdll\sihost.exe
                  C:\Windows\System32\cscdll\sihost.exe
                  7⤵
                  • UAC bypass
                  • Checks computer location settings
                  • Executes dropped EXE
                  • Checks whether UAC is enabled
                  • Modifies registry class
                  • Suspicious behavior: EnumeratesProcesses
                  • Suspicious use of AdjustPrivilegeToken
                  • Suspicious use of WriteProcessMemory
                  • System policy modification
                  PID:4600
                  • C:\Windows\System32\WScript.exe
                    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\33b0585b-0db8-4060-a54a-55cbe8bf0f0b.vbs"
                    8⤵
                    • Suspicious use of WriteProcessMemory
                    PID:2912
                    • C:\Windows\System32\cscdll\sihost.exe
                      C:\Windows\System32\cscdll\sihost.exe
                      9⤵
                      • UAC bypass
                      • Checks computer location settings
                      • Executes dropped EXE
                      • Checks whether UAC is enabled
                      • Modifies registry class
                      • Suspicious use of AdjustPrivilegeToken
                      • Suspicious use of WriteProcessMemory
                      • System policy modification
                      PID:4544
                      • C:\Windows\System32\WScript.exe
                        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\20ddfa0e-29e5-4af0-b84d-4dff8c736e23.vbs"
                        10⤵
                        • Suspicious use of WriteProcessMemory
                        PID:4856
                        • C:\Windows\System32\cscdll\sihost.exe
                          C:\Windows\System32\cscdll\sihost.exe
                          11⤵
                          • UAC bypass
                          • Checks computer location settings
                          • Executes dropped EXE
                          • Checks whether UAC is enabled
                          • Modifies registry class
                          • Suspicious use of AdjustPrivilegeToken
                          • Suspicious use of WriteProcessMemory
                          • System policy modification
                          PID:1180
                          • C:\Windows\System32\WScript.exe
                            "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\fee87961-1f97-4b4f-b1f9-1ae5379291c0.vbs"
                            12⤵
                            • Suspicious use of WriteProcessMemory
                            PID:1268
                            • C:\Windows\System32\cscdll\sihost.exe
                              C:\Windows\System32\cscdll\sihost.exe
                              13⤵
                              • UAC bypass
                              • Checks computer location settings
                              • Executes dropped EXE
                              • Checks whether UAC is enabled
                              • Modifies registry class
                              • Suspicious use of AdjustPrivilegeToken
                              • Suspicious use of WriteProcessMemory
                              • System policy modification
                              PID:3984
                              • C:\Windows\System32\WScript.exe
                                "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\c8554884-6ad7-458f-9449-5807c527ab8c.vbs"
                                14⤵
                                • Suspicious use of WriteProcessMemory
                                PID:4960
                                • C:\Windows\System32\cscdll\sihost.exe
                                  C:\Windows\System32\cscdll\sihost.exe
                                  15⤵
                                  • UAC bypass
                                  • Checks computer location settings
                                  • Executes dropped EXE
                                  • Checks whether UAC is enabled
                                  • Modifies registry class
                                  • Suspicious use of AdjustPrivilegeToken
                                  • Suspicious use of WriteProcessMemory
                                  • System policy modification
                                  PID:4860
                                  • C:\Windows\System32\WScript.exe
                                    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\7d2eba0a-391e-470e-8c57-e42b734d9a07.vbs"
                                    16⤵
                                    • Suspicious use of WriteProcessMemory
                                    PID:540
                                    • C:\Windows\System32\cscdll\sihost.exe
                                      C:\Windows\System32\cscdll\sihost.exe
                                      17⤵
                                      • UAC bypass
                                      • Checks computer location settings
                                      • Executes dropped EXE
                                      • Checks whether UAC is enabled
                                      • Modifies registry class
                                      • Suspicious use of AdjustPrivilegeToken
                                      • Suspicious use of WriteProcessMemory
                                      • System policy modification
                                      PID:3964
                                      • C:\Windows\System32\WScript.exe
                                        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\f4b8c685-103c-4c0f-acbf-4acd46f2ab2e.vbs"
                                        18⤵
                                          PID:2088
                                          • C:\Windows\System32\cscdll\sihost.exe
                                            C:\Windows\System32\cscdll\sihost.exe
                                            19⤵
                                            • UAC bypass
                                            • Checks computer location settings
                                            • Executes dropped EXE
                                            • Checks whether UAC is enabled
                                            • Modifies registry class
                                            • Suspicious use of AdjustPrivilegeToken
                                            • System policy modification
                                            PID:3844
                                            • C:\Windows\System32\WScript.exe
                                              "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\f09397b7-3608-46b4-abd6-9b2104c7c4c9.vbs"
                                              20⤵
                                                PID:4328
                                                • C:\Windows\System32\cscdll\sihost.exe
                                                  C:\Windows\System32\cscdll\sihost.exe
                                                  21⤵
                                                  • UAC bypass
                                                  • Checks computer location settings
                                                  • Executes dropped EXE
                                                  • Checks whether UAC is enabled
                                                  • Modifies registry class
                                                  • Suspicious use of AdjustPrivilegeToken
                                                  • System policy modification
                                                  PID:1248
                                                  • C:\Windows\System32\WScript.exe
                                                    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\92b85f56-aff0-49f6-892e-409dbe818ab0.vbs"
                                                    22⤵
                                                      PID:2960
                                                      • C:\Windows\System32\cscdll\sihost.exe
                                                        C:\Windows\System32\cscdll\sihost.exe
                                                        23⤵
                                                        • UAC bypass
                                                        • Checks computer location settings
                                                        • Executes dropped EXE
                                                        • Checks whether UAC is enabled
                                                        • Modifies registry class
                                                        • Suspicious use of AdjustPrivilegeToken
                                                        • System policy modification
                                                        PID:2848
                                                        • C:\Windows\System32\WScript.exe
                                                          "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\7d362c8f-a512-41ec-ac14-7c1e204c3b80.vbs"
                                                          24⤵
                                                            PID:2732
                                                            • C:\Windows\System32\cscdll\sihost.exe
                                                              C:\Windows\System32\cscdll\sihost.exe
                                                              25⤵
                                                              • UAC bypass
                                                              • Checks computer location settings
                                                              • Executes dropped EXE
                                                              • Checks whether UAC is enabled
                                                              • Modifies registry class
                                                              • Suspicious use of AdjustPrivilegeToken
                                                              • System policy modification
                                                              PID:2996
                                                              • C:\Windows\System32\WScript.exe
                                                                "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\981f4a58-b47d-42e3-990c-7b77f842d474.vbs"
                                                                26⤵
                                                                  PID:2164
                                                                  • C:\Windows\System32\cscdll\sihost.exe
                                                                    C:\Windows\System32\cscdll\sihost.exe
                                                                    27⤵
                                                                    • UAC bypass
                                                                    • Checks computer location settings
                                                                    • Executes dropped EXE
                                                                    • Checks whether UAC is enabled
                                                                    • Modifies registry class
                                                                    • Suspicious use of AdjustPrivilegeToken
                                                                    • System policy modification
                                                                    PID:3440
                                                                    • C:\Windows\System32\WScript.exe
                                                                      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\7b30baa7-2a92-4f10-aaee-cd2f147660c0.vbs"
                                                                      28⤵
                                                                        PID:2792
                                                                        • C:\Windows\System32\cscdll\sihost.exe
                                                                          C:\Windows\System32\cscdll\sihost.exe
                                                                          29⤵
                                                                          • UAC bypass
                                                                          • Checks computer location settings
                                                                          • Executes dropped EXE
                                                                          • Checks whether UAC is enabled
                                                                          • Modifies registry class
                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                          • System policy modification
                                                                          PID:4868
                                                                          • C:\Windows\System32\WScript.exe
                                                                            "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\cd164145-5d89-4ad6-89e1-18f50145213f.vbs"
                                                                            30⤵
                                                                              PID:4460
                                                                              • C:\Windows\System32\cscdll\sihost.exe
                                                                                C:\Windows\System32\cscdll\sihost.exe
                                                                                31⤵
                                                                                • UAC bypass
                                                                                • Checks computer location settings
                                                                                • Executes dropped EXE
                                                                                • Checks whether UAC is enabled
                                                                                • Modifies registry class
                                                                                • Suspicious use of AdjustPrivilegeToken
                                                                                • System policy modification
                                                                                PID:4280
                                                                                • C:\Windows\System32\WScript.exe
                                                                                  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\935d47e6-0174-45d6-bfb3-bdaef154d9fd.vbs"
                                                                                  32⤵
                                                                                    PID:556
                                                                                    • C:\Windows\System32\cscdll\sihost.exe
                                                                                      C:\Windows\System32\cscdll\sihost.exe
                                                                                      33⤵
                                                                                      • UAC bypass
                                                                                      • Checks computer location settings
                                                                                      • Executes dropped EXE
                                                                                      • Checks whether UAC is enabled
                                                                                      • Modifies registry class
                                                                                      • Suspicious use of AdjustPrivilegeToken
                                                                                      • System policy modification
                                                                                      PID:1720
                                                                                      • C:\Windows\System32\WScript.exe
                                                                                        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\0ac6de1d-ca46-4682-9733-d2800cd10f31.vbs"
                                                                                        34⤵
                                                                                          PID:2632
                                                                                        • C:\Windows\System32\WScript.exe
                                                                                          "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\f269d916-b767-43ab-b1c9-954bf1e40f08.vbs"
                                                                                          34⤵
                                                                                            PID:1996
                                                                                      • C:\Windows\System32\WScript.exe
                                                                                        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\753058dd-b6a1-475e-bbbf-aa8277f463cc.vbs"
                                                                                        32⤵
                                                                                          PID:704
                                                                                    • C:\Windows\System32\WScript.exe
                                                                                      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\5d5a00ae-f935-470e-ba65-ac0040f23e32.vbs"
                                                                                      30⤵
                                                                                        PID:2276
                                                                                  • C:\Windows\System32\WScript.exe
                                                                                    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\b372d5bc-4b85-47cb-b157-7078f6d487ad.vbs"
                                                                                    28⤵
                                                                                      PID:1152
                                                                                • C:\Windows\System32\WScript.exe
                                                                                  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\0dda75d2-7d95-4b8a-af7a-be6d25dff0cb.vbs"
                                                                                  26⤵
                                                                                    PID:4496
                                                                              • C:\Windows\System32\WScript.exe
                                                                                "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\51f1c9df-74c3-41a8-ba2f-c389bb631484.vbs"
                                                                                24⤵
                                                                                  PID:1888
                                                                            • C:\Windows\System32\WScript.exe
                                                                              "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\28d976be-8722-4dd1-b8d6-646fcc213086.vbs"
                                                                              22⤵
                                                                                PID:3840
                                                                          • C:\Windows\System32\WScript.exe
                                                                            "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\e2d5dda9-4c0c-4eeb-99f1-9fd5b54bba53.vbs"
                                                                            20⤵
                                                                              PID:3856
                                                                        • C:\Windows\System32\WScript.exe
                                                                          "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\2302d77b-652c-4051-a967-0b2383f9922e.vbs"
                                                                          18⤵
                                                                            PID:2220
                                                                      • C:\Windows\System32\WScript.exe
                                                                        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\bd98f52c-1cb7-404a-b6a5-625a47a54462.vbs"
                                                                        16⤵
                                                                          PID:2700
                                                                    • C:\Windows\System32\WScript.exe
                                                                      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\9729a3cd-e99c-4f75-a760-9e6f52c020e0.vbs"
                                                                      14⤵
                                                                        PID:2688
                                                                  • C:\Windows\System32\WScript.exe
                                                                    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\bc75aca2-e5cf-4921-92c8-d42ee970c6fe.vbs"
                                                                    12⤵
                                                                      PID:1376
                                                                • C:\Windows\System32\WScript.exe
                                                                  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\b85fcd48-7912-444e-a629-e68acea76c43.vbs"
                                                                  10⤵
                                                                    PID:4324
                                                              • C:\Windows\System32\WScript.exe
                                                                "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\da93b303-9f65-44cb-b560-1f15d6de785f.vbs"
                                                                8⤵
                                                                  PID:3760
                                                            • C:\Windows\System32\WScript.exe
                                                              "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\a85376e1-94f6-4926-8aee-372b12c00014.vbs"
                                                              6⤵
                                                                PID:4356
                                                          • C:\Windows\System32\WScript.exe
                                                            "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\f1633512-6901-4c7a-9f2f-f0236599c64b.vbs"
                                                            4⤵
                                                              PID:4100
                                                      • C:\Windows\system32\schtasks.exe
                                                        schtasks.exe /create /tn "SearchApp" /sc ONLOGON /tr "'C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\Cortana.Search\SearchApp.exe'" /rl HIGHEST /f
                                                        1⤵
                                                        • Process spawned unexpected child process
                                                        • Scheduled Task/Job: Scheduled Task
                                                        PID:1896
                                                      • C:\Windows\system32\schtasks.exe
                                                        schtasks.exe /create /tn "sihost" /sc ONLOGON /tr "'C:\Windows\System32\cscdll\sihost.exe'" /rl HIGHEST /f
                                                        1⤵
                                                        • Process spawned unexpected child process
                                                        • Scheduled Task/Job: Scheduled Task
                                                        PID:840
                                                      • C:\Windows\system32\schtasks.exe
                                                        schtasks.exe /create /tn "explorer" /sc ONLOGON /tr "'C:\Windows\WindowsUpdate\explorer.exe'" /rl HIGHEST /f
                                                        1⤵
                                                        • Process spawned unexpected child process
                                                        • Scheduled Task/Job: Scheduled Task
                                                        PID:456
                                                      • C:\Windows\system32\schtasks.exe
                                                        schtasks.exe /create /tn "dwm" /sc ONLOGON /tr "'C:\Windows\System32\wldp\dwm.exe'" /rl HIGHEST /f
                                                        1⤵
                                                        • Process spawned unexpected child process
                                                        • Scheduled Task/Job: Scheduled Task
                                                        PID:2968
                                                      • C:\Windows\system32\schtasks.exe
                                                        schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Windows\System32\srclient\RuntimeBroker.exe'" /rl HIGHEST /f
                                                        1⤵
                                                        • Process spawned unexpected child process
                                                        • Scheduled Task/Job: Scheduled Task
                                                        PID:3516
                                                      • C:\Windows\system32\schtasks.exe
                                                        schtasks.exe /create /tn "taskhostw" /sc ONLOGON /tr "'C:\Windows\System32\winlogon\taskhostw.exe'" /rl HIGHEST /f
                                                        1⤵
                                                        • Process spawned unexpected child process
                                                        • Scheduled Task/Job: Scheduled Task
                                                        PID:3616

                                                      Network

                                                      MITRE ATT&CK Enterprise v15

                                                      Reconnaissance

                                                      Resource Development

                                                      Initial Access

                                                      Execution

                                                      Command and Scripting Interpreter

                                                      1
                                                      T1059

                                                      PowerShell

                                                      1
                                                      T1059.001

                                                      Scheduled Task/Job

                                                      1
                                                      T1053

                                                      Scheduled Task

                                                      1
                                                      T1053.005

                                                      Persistence

                                                      Boot or Logon Autostart Execution

                                                      2
                                                      T1547

                                                      Registry Run Keys / Startup Folder

                                                      1
                                                      T1547.001

                                                      Winlogon Helper DLL

                                                      1
                                                      T1547.004

                                                      Scheduled Task/Job

                                                      1
                                                      T1053

                                                      Scheduled Task

                                                      1
                                                      T1053.005

                                                      Privilege Escalation

                                                      Abuse Elevation Control Mechanism

                                                      1
                                                      T1548

                                                      Bypass User Account Control

                                                      1
                                                      T1548.002

                                                      Boot or Logon Autostart Execution

                                                      2
                                                      T1547

                                                      Registry Run Keys / Startup Folder

                                                      1
                                                      T1547.001

                                                      Winlogon Helper DLL

                                                      1
                                                      T1547.004

                                                      Scheduled Task/Job

                                                      1
                                                      T1053

                                                      Scheduled Task

                                                      1
                                                      T1053.005

                                                      Defense Evasion

                                                      Abuse Elevation Control Mechanism

                                                      1
                                                      T1548

                                                      Bypass User Account Control

                                                      1
                                                      T1548.002

                                                      Impair Defenses

                                                      1
                                                      T1562

                                                      Disable or Modify Tools

                                                      1
                                                      T1562.001

                                                      Modify Registry

                                                      4
                                                      T1112

                                                      Credential Access

                                                      Discovery

                                                      Query Registry

                                                      2
                                                      T1012

                                                      System Information Discovery

                                                      3
                                                      T1082

                                                      Lateral Movement

                                                      Collection

                                                      Command and Control

                                                      Exfiltration

                                                      Impact

                                                      Replay Monitor

                                                      Loading Replay Monitor...

                                                      Downloads

                                                      • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
                                                        Filesize

                                                        2KB

                                                        MD5

                                                        d85ba6ff808d9e5444a4b369f5bc2730

                                                        SHA1

                                                        31aa9d96590fff6981b315e0b391b575e4c0804a

                                                        SHA256

                                                        84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

                                                        SHA512

                                                        8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

                                                        Download Submit

                                                      • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\sihost.exe.log
                                                        Filesize

                                                        1KB

                                                        MD5

                                                        baf55b95da4a601229647f25dad12878

                                                        SHA1

                                                        abc16954ebfd213733c4493fc1910164d825cac8

                                                        SHA256

                                                        ee954c5d8156fd8890e582c716e5758ed9b33721258f10e758bdc31ccbcb1924

                                                        SHA512

                                                        24f502fedb1a305d0d7b08857ffc1db9b2359ff34e06d5748ecc84e35c985f29a20d9f0a533bea32d234ab37097ec0481620c63b14ac89b280e75e14d19fd545

                                                        Download Submit

                                                      • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                        Filesize

                                                        944B

                                                        MD5

                                                        d28a889fd956d5cb3accfbaf1143eb6f

                                                        SHA1

                                                        157ba54b365341f8ff06707d996b3635da8446f7

                                                        SHA256

                                                        21e5d7ccf80a293e6ba30ed728846ca19c929c52b96e2c8d34e27cd2234f1d45

                                                        SHA512

                                                        0b6d88deb9be85722e6a78d5886d49f2caf407a59e128d2b4ed74c1356f9928c40048a62731959f2460e9ff9d9feee311043d2a37abe3bb92c2b76a44281478c

                                                        Download Submit

                                                      • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                        Filesize

                                                        944B

                                                        MD5

                                                        2e907f77659a6601fcc408274894da2e

                                                        SHA1

                                                        9f5b72abef1cd7145bf37547cdb1b9254b4efe9d

                                                        SHA256

                                                        385da35673330e21ac02545220552fe301fe54dedefbdafc097ac4342a295233

                                                        SHA512

                                                        34fa0fff24f6550f55f828541aaefe5d75c86f8f0842d54b50065e9746f9662bb7209c74c9a9571540b9855bb3851f01db613190024e89b198d485bb5dc07721

                                                        Download Submit

                                                      • C:\Users\Admin\AppData\Local\Temp\0637d9ab-83e9-463e-8307-f1f10283c6e7.vbs
                                                        Filesize

                                                        712B

                                                        MD5

                                                        3cd0beada7cd4817a5b59263b81e6780

                                                        SHA1

                                                        0d07ed7e8b76ee8a53463330483b464397d04277

                                                        SHA256

                                                        6b5407a4fe12c88d63d03a8628f2046325992b9d75df722bff9c757e500be63c

                                                        SHA512

                                                        6be4ec294823ed0a8865c605a70951093e10be990f2c986d3a461c3c971b8110284bf29a641111f80334f4733ffae24003dda31aadaa755caa6051b2e9d9c484

                                                        Download Submit

                                                      • C:\Users\Admin\AppData\Local\Temp\20ddfa0e-29e5-4af0-b84d-4dff8c736e23.vbs
                                                        Filesize

                                                        713B

                                                        MD5

                                                        04f99e4bee89ee75e4cbc810a5ee9815

                                                        SHA1

                                                        93fbd4a9d1300c51e6040861766e09172614c2fb

                                                        SHA256

                                                        5a6b55bab45b44c89523268c9d4de1018d8516edb94d750cbd56e50ab4867847

                                                        SHA512

                                                        9b00dae85eaeeebb4c53d1efd0fbfb0eb5e2a81a1d327daa95f78680d6f2042693c45187b9d9b7b6eefc2ce7637637985d77dbc62fcbc684939920408fa0a032

                                                        Download Submit

                                                      • C:\Users\Admin\AppData\Local\Temp\33b0585b-0db8-4060-a54a-55cbe8bf0f0b.vbs
                                                        Filesize

                                                        713B

                                                        MD5

                                                        b8abfea9866a91f705fd8975893c3b6d

                                                        SHA1

                                                        83f41288db38d6b6165de625e62ca854f6a0ce8f

                                                        SHA256

                                                        36ccc9015f8910cb5ed18efce85bdbc017604c1782c3aeb5938e908989bf9b0a

                                                        SHA512

                                                        c86aeebeb82c063baa75dd77141821e2efbe5648d25eb1b055c299e0cbde318439e38fca891114bc9b6097dcae74b11d96583e596150143c88119b59ddd9d11d

                                                        Download Submit

                                                      • C:\Users\Admin\AppData\Local\Temp\7b30baa7-2a92-4f10-aaee-cd2f147660c0.vbs
                                                        Filesize

                                                        713B

                                                        MD5

                                                        82b1b5af7a2c8e9770addf503daabf1b

                                                        SHA1

                                                        d02cf326ef0265bd0e788b93d2517866d529976f

                                                        SHA256

                                                        120105cd2ba7f5cc1c50261767bb72502784a07d135f3452615d9a99a1943cd7

                                                        SHA512

                                                        833cc27bbe6988793651095b58540a5bf54448d1e160574428d2fcb9d2aace5742f0f402c06c8721d498de9b68632c9f20b1584a99895da3f4845d849592ab5c

                                                        Download Submit

                                                      • C:\Users\Admin\AppData\Local\Temp\7d2eba0a-391e-470e-8c57-e42b734d9a07.vbs
                                                        Filesize

                                                        713B

                                                        MD5

                                                        c576918e28490fc643e18d81493ef9f7

                                                        SHA1

                                                        0e930fb200037d5165f9b4af755061fdd0e9e0a3

                                                        SHA256

                                                        c87835a5298b5fc5fca7cca5015f12122cc422756dd8e4a912a2051f0d0354c8

                                                        SHA512

                                                        4934ded0d9a3b8f28f8bd70291324a52a0ff100daeeea08bf771e7cd1da846063e3fec73c6514243527f91ff028b2205c0674bac4f53952cc078e6bf1a0c7b67

                                                        Download Submit

                                                      • C:\Users\Admin\AppData\Local\Temp\7d362c8f-a512-41ec-ac14-7c1e204c3b80.vbs
                                                        Filesize

                                                        713B

                                                        MD5

                                                        7bc5d8fbdd09ec87e10ccbff7b72aadf

                                                        SHA1

                                                        08e14739fc5a05a273379698707f94423e3e28bf

                                                        SHA256

                                                        2957b808cb175ce23c2162e5507c9f16444ed5a9b8b354a7d67079333a00d8d5

                                                        SHA512

                                                        c33ac5496df66fa1b3daf5dc87ea6a8dc306ef0bbd2b5e0d5188f1af06fc81675efdcfcc239970f4a79c014182a4af14c957b7c63d0646b67eb099b4acd93c03

                                                        Download Submit

                                                      • C:\Users\Admin\AppData\Local\Temp\92b85f56-aff0-49f6-892e-409dbe818ab0.vbs
                                                        Filesize

                                                        713B

                                                        MD5

                                                        c7ad854acc1e5fc5cccc83d1104b6ec7

                                                        SHA1

                                                        e22e8408aa4798c5e0ccf7896cf02c342b2644d3

                                                        SHA256

                                                        6fd597b1c7f50f47c6ed8d14817e94dd710cd03f259445f4ff2b53263fb2ef4a

                                                        SHA512

                                                        ce7ae8618d6b3db608182452649f1710c2e3630a5aab4b5807b01de0ff359b3d18571d40287bed3b1194720e6d88c1338e8dfa7bffcebdbf77c7088b11aadcb8

                                                        Download Submit

                                                      • C:\Users\Admin\AppData\Local\Temp\981f4a58-b47d-42e3-990c-7b77f842d474.vbs
                                                        Filesize

                                                        713B

                                                        MD5

                                                        a6d5583c0ee1d761c51ff96b30f11f12

                                                        SHA1

                                                        da52a5d93516fa3237cb55cbd7ef7e3b1272de44

                                                        SHA256

                                                        8d9bee9153f6ed57a631bb698d942e6ce35456fe91415ab7692cab3406f285a5

                                                        SHA512

                                                        f317ced3faf197f5504e6b77521b8f9d7f0b23d965f416041d8067166ba487c086049286231ba77f9daea0283f77b7ca5a8b9fac0cb51c9ed9189d2c77421097

                                                        Download Submit

                                                      • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_zn4q4bn0.bip.ps1
                                                        Filesize

                                                        60B

                                                        MD5

                                                        d17fe0a3f47be24a6453e9ef58c94641

                                                        SHA1

                                                        6ab83620379fc69f80c0242105ddffd7d98d5d9d

                                                        SHA256

                                                        96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

                                                        SHA512

                                                        5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

                                                        Download Submit

                                                      • C:\Users\Admin\AppData\Local\Temp\c8554884-6ad7-458f-9449-5807c527ab8c.vbs
                                                        Filesize

                                                        713B

                                                        MD5

                                                        fbd424d77f588b6462f7f7bf11db1328

                                                        SHA1

                                                        700279912fcf67df1b9f7cfa12507d4030dddb43

                                                        SHA256

                                                        e759244bb7bccaa28a34d3b7ec84681469f73d6fe2dddf695e93653a5b21ad87

                                                        SHA512

                                                        f3c5d06594face35339e7bbc2c98f6e7bcd58d0ba10b9ae8f3dc88f8498d80eeb7c5bbe13ea142dc853b317ed905dc4a20aef76a8752e1f8526b8c43c0f9d212

                                                        Download Submit

                                                      • C:\Users\Admin\AppData\Local\Temp\cd164145-5d89-4ad6-89e1-18f50145213f.vbs
                                                        Filesize

                                                        713B

                                                        MD5

                                                        a7c1ccb1d408e0eb21b3d3795d25c86c

                                                        SHA1

                                                        bfb7fc1841486691b92d4a0609d40a37448b9276

                                                        SHA256

                                                        6875fb926b24bbb937fbd84a9d032c24f9f29f09a6a2acfb71de82fac8d0dfb8

                                                        SHA512

                                                        e2efbac14075e5c51898b84a36fa989c778c8645d736a8ff3f23414f85499bac9b1cf67fb7a19da75132d8901010718a7517953840a7a086027be432cdd9e62d

                                                        Download Submit

                                                      • C:\Users\Admin\AppData\Local\Temp\cf2bdyTdRo.bat
                                                        Filesize

                                                        201B

                                                        MD5

                                                        65eaf58ae4a70432f168be62a7543bf0

                                                        SHA1

                                                        0d13356a352539d87503fb40ab8c71e3a06a687a

                                                        SHA256

                                                        06839d49572adcf50eafafd80a648086dd317ca2851fa07da062513a10b2a629

                                                        SHA512

                                                        5f50a5eeab8c29f4f6f00b3d813dda1113f33b9c33af937c5f1a648fed0e7f1bff953f4d72f8744cf6ff49333e9fa8e45d2ee6d88d828c18d90b16d4c0a74441

                                                        Download Submit

                                                      • C:\Users\Admin\AppData\Local\Temp\f09397b7-3608-46b4-abd6-9b2104c7c4c9.vbs
                                                        Filesize

                                                        713B

                                                        MD5

                                                        c2944ef0c8fe3f8025845684861540b3

                                                        SHA1

                                                        57cebb8cec4bc6f3592a73d2c3f196a3c7fa94d3

                                                        SHA256

                                                        8b6c4b2ae13a1d3c579398bfe1c5faf90b7bd0423cb912ee1ec57357a1e99687

                                                        SHA512

                                                        25e7cd83f95ee4f50c6985f0f69146d548f4615b0a449cee8ab8bcff696b75813b0d4fe9f4cf3d11132d9e002dd464164d7b2e592887b372afe911f64ae44fde

                                                        Download Submit

                                                      • C:\Users\Admin\AppData\Local\Temp\f1633512-6901-4c7a-9f2f-f0236599c64b.vbs
                                                        Filesize

                                                        489B

                                                        MD5

                                                        3851935a885cf01b5b60e55f91bde400

                                                        SHA1

                                                        a6f541f2e5e8553f4c12cb080ae1232606557117

                                                        SHA256

                                                        9c503c753e67101f6a35ca27450f3ac6bde4d1871d04a01d311edb1ed237f3ae

                                                        SHA512

                                                        4f3dba192fa3e34611ff3b7cec9e4ac59ddc96da09212f04f13f8e7502f9541f5df5126100370449791ac3a0ef70df62d8cae2d674c572590e416f2483cca9a1

                                                        Download Submit

                                                      • C:\Users\Admin\AppData\Local\Temp\f3f5d778-41a6-4bc8-afb3-a805972b1390.vbs
                                                        Filesize

                                                        712B

                                                        MD5

                                                        484b1aa24c7c2cc615f305cb3857a2aa

                                                        SHA1

                                                        92c259278c275c419019b2fd494056efb00a38bf

                                                        SHA256

                                                        b6845126a114e420c563a65ed0a1de28fca1b2ddd4c0bf5daec1456ff55d2c60

                                                        SHA512

                                                        f07848da76773edd0a8786bfd63919ed16056ab51d0346fb0296e47155c519dab92a82acba84b499ec4744a55ce59004503106b7d143a307f48a19a33c00372b

                                                        Download Submit

                                                      • C:\Users\Admin\AppData\Local\Temp\f4b8c685-103c-4c0f-acbf-4acd46f2ab2e.vbs
                                                        Filesize

                                                        713B

                                                        MD5

                                                        4e02f2ff2107a87e67271cea7dfb8345

                                                        SHA1

                                                        2a0c8bc8352b04cbfde18d07a0203814fb466242

                                                        SHA256

                                                        eaf4a00a700a4a91e2e67145f54606a123e5a66c9afe8457acb9557b43d71f56

                                                        SHA512

                                                        a4e596373bf76a284345f75ccb6246b5684b517989b8b053c78c8f7a24a5a720f7d7939fc5dce2297b7a11ad95fa21c4e7fa0bd609adef98e9164c7a516155b3

                                                        Download Submit

                                                      • C:\Users\Admin\AppData\Local\Temp\fee87961-1f97-4b4f-b1f9-1ae5379291c0.vbs
                                                        Filesize

                                                        713B

                                                        MD5

                                                        01c207b6b6dd28ef77dd3da2693ac646

                                                        SHA1

                                                        6e8da6e46e077c3eb99b91583cddb5584005c687

                                                        SHA256

                                                        96202f3cfa1b80dfd21b87ef83ec411ef6c09a60cb96a04b135e248cad522738

                                                        SHA512

                                                        3a3ef9430405a6c172ed3fafcbb13ca9f9a14a88976a4ec8498fe0aa9ac03e44e7537f8e5991a26e1fa788ed2fb2abdb0245640df9979c2587465e0bc0964339

                                                        Download Submit

                                                      • C:\Windows\System32\srclient\RuntimeBroker.exe
                                                        Filesize

                                                        1.5MB

                                                        MD5

                                                        d36cc4a093e0bc7ca5a9342ab6012419

                                                        SHA1

                                                        ce5387ec8626e899804182655ad84ed339771ed1

                                                        SHA256

                                                        e83194ac6af90662225fd216fae289c52a2d8392bbc35a2b1e131bef7ae354f1

                                                        SHA512

                                                        df08e46279f1726a78b73b2191b7e878512e84520eed04f5b45aa14553447e216bf9b3a44d0478947d340ced9c434b7526266b4380f0fe16196eb8da5c8206be

                                                        Download Submit

                                                      • memory/736-170-0x000000001B680000-0x000000001B692000-memory.dmp

                                                        Filesize

                                                        72KB

                                                        Download

                                                      • memory/1180-216-0x0000000002FF0000-0x0000000003002000-memory.dmp

                                                        Filesize

                                                        72KB

                                                        Download

                                                      • memory/2984-94-0x000002613B340000-0x000002613B362000-memory.dmp

                                                        Filesize

                                                        136KB

                                                        Download

                                                      • memory/3440-307-0x0000000002750000-0x0000000002762000-memory.dmp

                                                        Filesize

                                                        72KB

                                                        Download

                                                      • memory/3844-262-0x00000000032D0000-0x00000000032E2000-memory.dmp

                                                        Filesize

                                                        72KB

                                                        Download

                                                      • memory/3984-228-0x000000001BA80000-0x000000001BA92000-memory.dmp

                                                        Filesize

                                                        72KB

                                                        Download

                                                      • memory/4280-329-0x00000000028C0000-0x00000000028D2000-memory.dmp

                                                        Filesize

                                                        72KB

                                                        Download

                                                      • memory/4616-0-0x00007FFD9A553000-0x00007FFD9A555000-memory.dmp

                                                        Filesize

                                                        8KB

                                                        Download

                                                      • memory/4616-8-0x0000000002F30000-0x0000000002F38000-memory.dmp

                                                        Filesize

                                                        32KB

                                                        Download

                                                      • memory/4616-17-0x000000001B8A0000-0x000000001B8AC000-memory.dmp

                                                        Filesize

                                                        48KB

                                                        Download

                                                      • memory/4616-16-0x000000001B890000-0x000000001B898000-memory.dmp

                                                        Filesize

                                                        32KB

                                                        Download

                                                      • memory/4616-15-0x000000001B880000-0x000000001B88A000-memory.dmp

                                                        Filesize

                                                        40KB

                                                        Download

                                                      • memory/4616-14-0x000000001B870000-0x000000001B87C000-memory.dmp

                                                        Filesize

                                                        48KB

                                                        Download

                                                      • memory/4616-12-0x000000001B850000-0x000000001B858000-memory.dmp

                                                        Filesize

                                                        32KB

                                                        Download

                                                      • memory/4616-13-0x000000001B860000-0x000000001B86A000-memory.dmp

                                                        Filesize

                                                        40KB

                                                        Download

                                                      • memory/4616-11-0x000000001B840000-0x000000001B850000-memory.dmp

                                                        Filesize

                                                        64KB

                                                        Download

                                                      • memory/4616-20-0x000000001B8C0000-0x000000001B8CC000-memory.dmp

                                                        Filesize

                                                        48KB

                                                        Download

                                                      • memory/4616-10-0x000000001B830000-0x000000001B840000-memory.dmp

                                                        Filesize

                                                        64KB

                                                        Download

                                                      • memory/4616-21-0x000000001C150000-0x000000001C158000-memory.dmp

                                                        Filesize

                                                        32KB

                                                        Download

                                                      • memory/4616-9-0x0000000002F40000-0x0000000002F4C000-memory.dmp

                                                        Filesize

                                                        48KB

                                                        Download

                                                      • memory/4616-18-0x000000001B8B0000-0x000000001B8B8000-memory.dmp

                                                        Filesize

                                                        32KB

                                                        Download

                                                      • memory/4616-6-0x0000000002F00000-0x0000000002F0A000-memory.dmp

                                                        Filesize

                                                        40KB

                                                        Download

                                                      • memory/4616-24-0x00007FFD9A550000-0x00007FFD9B011000-memory.dmp

                                                        Filesize

                                                        10.8MB

                                                        Download

                                                      • memory/4616-7-0x0000000002F20000-0x0000000002F2C000-memory.dmp

                                                        Filesize

                                                        48KB

                                                        Download

                                                      • memory/4616-5-0x0000000002F10000-0x0000000002F1C000-memory.dmp

                                                        Filesize

                                                        48KB

                                                        Download

                                                      • memory/4616-3-0x00000000015D0000-0x00000000015D8000-memory.dmp

                                                        Filesize

                                                        32KB

                                                        Download

                                                      • memory/4616-4-0x0000000002EE0000-0x0000000002EF2000-memory.dmp

                                                        Filesize

                                                        72KB

                                                        Download

                                                      • memory/4616-96-0x00007FFD9A550000-0x00007FFD9B011000-memory.dmp

                                                        Filesize

                                                        10.8MB

                                                        Download

                                                      • memory/4616-2-0x00007FFD9A550000-0x00007FFD9B011000-memory.dmp

                                                        Filesize

                                                        10.8MB

                                                        Download

                                                      • memory/4616-25-0x00007FFD9A550000-0x00007FFD9B011000-memory.dmp

                                                        Filesize

                                                        10.8MB

                                                        Download

                                                      • memory/4616-1-0x0000000000B40000-0x0000000000CBE000-memory.dmp

                                                        Filesize

                                                        1.5MB

                                                        Download

                                                      • memory/4868-319-0x0000000001000000-0x0000000001012000-memory.dmp

                                                        Filesize

                                                        72KB

                                                        Download