Overview

overview

10

Static

static

3

d264be7b02...bd.exe

windows7-x64

10

d264be7b02...bd.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    149s
  • max time network
    143s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20250314-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20250314-enlocale:en-usos:windows10-2004-x64system
  • submitted
    26/03/2025, 10:45

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    d264be7b02773b7c80509deaa970e2a2a8f681321e71b36a8a6377486bff23bd.exe

  • Size

    1.1MB

  • MD5

    66c9a250fe9e60c4df2c9a157ae39211

  • SHA1

    cabc35fd42f4534f5e05b5b9bd65dcfc85e469a7

  • SHA256

    d264be7b02773b7c80509deaa970e2a2a8f681321e71b36a8a6377486bff23bd

  • SHA512

    1439934414be0b92acf1b51e6b3ba0a1ad296b879361f42fc557b740bde42204515bbbccfe5e9c74b702caf786c201ececee76bc5841618560f56de047c9cdc8

  • SSDEEP

    12288:amc4TfAkdN7TPPl2Eh8Nv6L1FMCubuoGTeh46qTnnCPQeB89hNuD1hOp1i3l10gR:ah4TbLUEhZL/GspeYhkc9Soh2SfwJ

Score
10/10
dcratdefense_evasionexecutioninfostealerpersistencerattrojan

Malware Config

Signatures

  • DcRat

    DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

    ratinfostealerdcrat
  • Dcrat family
    dcrat
  • Modifies WinLogon for persistence 2 TTPs 8 IoCs
    persistence
  • Process spawned unexpected child process 8 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • UAC bypass 3 TTPs 51 IoCs
    defense_evasiontrojan
  • Command and Scripting Interpreter: PowerShell 1 TTPs 9 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution
  • Drops file in Drivers directory 1 IoCs
  • Checks computer location settings 2 TTPs 17 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 16 IoCs
  • Adds Run key to start application 2 TTPs 16 IoCs
    persistence
  • Checks whether UAC is enabled 1 TTPs 34 IoCs
    defense_evasiontrojan
  • Drops file in System32 directory 12 IoCs
  • Drops file in Program Files directory 4 IoCs
  • Drops file in Windows directory 8 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies registry class 17 IoCs
  • Scheduled Task/Job: Scheduled Task 1 TTPs 8 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistenceexecution
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 26 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • System policy modification 1 TTPs 51 IoCs
    defense_evasion
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\d264be7b02773b7c80509deaa970e2a2a8f681321e71b36a8a6377486bff23bd.exe
    "C:\Users\Admin\AppData\Local\Temp\d264be7b02773b7c80509deaa970e2a2a8f681321e71b36a8a6377486bff23bd.exe"
    1⤵
    • Modifies WinLogon for persistence
    • UAC bypass
    • Drops file in Drivers directory
    • Checks computer location settings
    • Adds Run key to start application
    • Checks whether UAC is enabled
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    • System policy modification
    PID:5444
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\d264be7b02773b7c80509deaa970e2a2a8f681321e71b36a8a6377486bff23bd.exe'
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2936
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Reference Assemblies\Microsoft\RuntimeBroker.exe'
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:528
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:\PerfLogs\upfc.exe'
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:828
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:\34c553de294c1d56d0a800105b\dllhost.exe'
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2652
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\System32\Windows.Internal.Management\spoolsv.exe'
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:3744
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\regedit\sysmon.exe'
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:3068
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\System32\AppXDeploymentExtensions.desktop\SppExtComObj.exe'
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:1928
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\explorer\explorer.exe'
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:1384
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\System32\wkscli\dllhost.exe'
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:1536
    • C:\Windows\System32\Windows.Internal.Management\spoolsv.exe
      "C:\Windows\System32\Windows.Internal.Management\spoolsv.exe"
      2⤵
      • UAC bypass
      • Checks computer location settings
      • Executes dropped EXE
      • Checks whether UAC is enabled
      • Modifies registry class
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      • System policy modification
      PID:4636
      • C:\Windows\System32\WScript.exe
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\5bf1361b-54e1-4c9c-855e-b2adf8ae13e3.vbs"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:4884
        • C:\Windows\System32\Windows.Internal.Management\spoolsv.exe
          C:\Windows\System32\Windows.Internal.Management\spoolsv.exe
          4⤵
          • UAC bypass
          • Checks computer location settings
          • Executes dropped EXE
          • Checks whether UAC is enabled
          • Modifies registry class
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          • System policy modification
          PID:3936
          • C:\Windows\System32\WScript.exe
            "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\3e7c627f-eddd-4796-9e10-090aa35fb51b.vbs"
            5⤵
            • Suspicious use of WriteProcessMemory
            PID:3428
            • C:\Windows\System32\Windows.Internal.Management\spoolsv.exe
              C:\Windows\System32\Windows.Internal.Management\spoolsv.exe
              6⤵
              • UAC bypass
              • Checks computer location settings
              • Executes dropped EXE
              • Checks whether UAC is enabled
              • Modifies registry class
              • Suspicious use of AdjustPrivilegeToken
              • Suspicious use of WriteProcessMemory
              • System policy modification
              PID:3508
              • C:\Windows\System32\WScript.exe
                "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\27790bb5-95da-4b74-b216-1a69df053256.vbs"
                7⤵
                • Suspicious use of WriteProcessMemory
                PID:5344
                • C:\Windows\System32\Windows.Internal.Management\spoolsv.exe
                  C:\Windows\System32\Windows.Internal.Management\spoolsv.exe
                  8⤵
                  • UAC bypass
                  • Checks computer location settings
                  • Executes dropped EXE
                  • Checks whether UAC is enabled
                  • Modifies registry class
                  • Suspicious use of AdjustPrivilegeToken
                  • Suspicious use of WriteProcessMemory
                  • System policy modification
                  PID:2852
                  • C:\Windows\System32\WScript.exe
                    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\47cabaee-a9a9-450b-8f49-d446e31a0f92.vbs"
                    9⤵
                    • Suspicious use of WriteProcessMemory
                    PID:2656
                    • C:\Windows\System32\Windows.Internal.Management\spoolsv.exe
                      C:\Windows\System32\Windows.Internal.Management\spoolsv.exe
                      10⤵
                      • UAC bypass
                      • Checks computer location settings
                      • Executes dropped EXE
                      • Checks whether UAC is enabled
                      • Modifies registry class
                      • Suspicious use of AdjustPrivilegeToken
                      • Suspicious use of WriteProcessMemory
                      • System policy modification
                      PID:2740
                      • C:\Windows\System32\WScript.exe
                        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\a562dbc3-9311-4664-9742-19d66915e300.vbs"
                        11⤵
                        • Suspicious use of WriteProcessMemory
                        PID:932
                        • C:\Windows\System32\Windows.Internal.Management\spoolsv.exe
                          C:\Windows\System32\Windows.Internal.Management\spoolsv.exe
                          12⤵
                          • UAC bypass
                          • Checks computer location settings
                          • Executes dropped EXE
                          • Checks whether UAC is enabled
                          • Modifies registry class
                          • Suspicious use of AdjustPrivilegeToken
                          • Suspicious use of WriteProcessMemory
                          • System policy modification
                          PID:4776
                          • C:\Windows\System32\WScript.exe
                            "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\3d7d6b0f-c1f5-4ef4-bd0b-84c03f0cfee4.vbs"
                            13⤵
                            • Suspicious use of WriteProcessMemory
                            PID:3816
                            • C:\Windows\System32\Windows.Internal.Management\spoolsv.exe
                              C:\Windows\System32\Windows.Internal.Management\spoolsv.exe
                              14⤵
                              • UAC bypass
                              • Checks computer location settings
                              • Executes dropped EXE
                              • Checks whether UAC is enabled
                              • Modifies registry class
                              • Suspicious use of AdjustPrivilegeToken
                              • Suspicious use of WriteProcessMemory
                              • System policy modification
                              PID:4324
                              • C:\Windows\System32\WScript.exe
                                "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\9bca4b02-cb08-4fa9-a46d-c369717f7c8f.vbs"
                                15⤵
                                • Suspicious use of WriteProcessMemory
                                PID:1656
                                • C:\Windows\System32\Windows.Internal.Management\spoolsv.exe
                                  C:\Windows\System32\Windows.Internal.Management\spoolsv.exe
                                  16⤵
                                  • UAC bypass
                                  • Checks computer location settings
                                  • Executes dropped EXE
                                  • Checks whether UAC is enabled
                                  • Modifies registry class
                                  • Suspicious use of AdjustPrivilegeToken
                                  • Suspicious use of WriteProcessMemory
                                  • System policy modification
                                  PID:3308
                                  • C:\Windows\System32\WScript.exe
                                    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\3b4a8f7c-76bf-492d-94a2-04cb58117f35.vbs"
                                    17⤵
                                      PID:5992
                                      • C:\Windows\System32\Windows.Internal.Management\spoolsv.exe
                                        C:\Windows\System32\Windows.Internal.Management\spoolsv.exe
                                        18⤵
                                        • UAC bypass
                                        • Checks computer location settings
                                        • Executes dropped EXE
                                        • Checks whether UAC is enabled
                                        • Modifies registry class
                                        • Suspicious use of AdjustPrivilegeToken
                                        • System policy modification
                                        PID:2136
                                        • C:\Windows\System32\WScript.exe
                                          "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\15363ac1-53d6-4392-8793-7c8c34e8bc86.vbs"
                                          19⤵
                                            PID:4800
                                            • C:\Windows\System32\Windows.Internal.Management\spoolsv.exe
                                              C:\Windows\System32\Windows.Internal.Management\spoolsv.exe
                                              20⤵
                                              • UAC bypass
                                              • Checks computer location settings
                                              • Executes dropped EXE
                                              • Checks whether UAC is enabled
                                              • Modifies registry class
                                              • Suspicious use of AdjustPrivilegeToken
                                              • System policy modification
                                              PID:920
                                              • C:\Windows\System32\WScript.exe
                                                "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\4e9d9230-9079-4cad-a0d9-0f9558e3811e.vbs"
                                                21⤵
                                                  PID:3648
                                                  • C:\Windows\System32\Windows.Internal.Management\spoolsv.exe
                                                    C:\Windows\System32\Windows.Internal.Management\spoolsv.exe
                                                    22⤵
                                                    • UAC bypass
                                                    • Checks computer location settings
                                                    • Executes dropped EXE
                                                    • Checks whether UAC is enabled
                                                    • Modifies registry class
                                                    • Suspicious use of AdjustPrivilegeToken
                                                    • System policy modification
                                                    PID:1184
                                                    • C:\Windows\System32\WScript.exe
                                                      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\89c7af54-b9d3-46cf-a1a6-3b3950b7e1c5.vbs"
                                                      23⤵
                                                        PID:4708
                                                        • C:\Windows\System32\Windows.Internal.Management\spoolsv.exe
                                                          C:\Windows\System32\Windows.Internal.Management\spoolsv.exe
                                                          24⤵
                                                          • UAC bypass
                                                          • Checks computer location settings
                                                          • Executes dropped EXE
                                                          • Checks whether UAC is enabled
                                                          • Modifies registry class
                                                          • Suspicious use of AdjustPrivilegeToken
                                                          • System policy modification
                                                          PID:1800
                                                          • C:\Windows\System32\WScript.exe
                                                            "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\b0826851-58fa-44cb-91da-b5df79e56a39.vbs"
                                                            25⤵
                                                              PID:2808
                                                              • C:\Windows\System32\Windows.Internal.Management\spoolsv.exe
                                                                C:\Windows\System32\Windows.Internal.Management\spoolsv.exe
                                                                26⤵
                                                                • UAC bypass
                                                                • Checks computer location settings
                                                                • Executes dropped EXE
                                                                • Checks whether UAC is enabled
                                                                • Modifies registry class
                                                                • Suspicious use of AdjustPrivilegeToken
                                                                • System policy modification
                                                                PID:996
                                                                • C:\Windows\System32\WScript.exe
                                                                  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\e56ffa2f-e72d-4b7e-9921-7be3225e2fed.vbs"
                                                                  27⤵
                                                                    PID:5008
                                                                    • C:\Windows\System32\Windows.Internal.Management\spoolsv.exe
                                                                      C:\Windows\System32\Windows.Internal.Management\spoolsv.exe
                                                                      28⤵
                                                                      • UAC bypass
                                                                      • Checks computer location settings
                                                                      • Executes dropped EXE
                                                                      • Checks whether UAC is enabled
                                                                      • Modifies registry class
                                                                      • Suspicious use of AdjustPrivilegeToken
                                                                      • System policy modification
                                                                      PID:1768
                                                                      • C:\Windows\System32\WScript.exe
                                                                        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\c0113ac0-9bb6-4c87-93c8-0f9c3b8aa4a0.vbs"
                                                                        29⤵
                                                                          PID:3512
                                                                          • C:\Windows\System32\Windows.Internal.Management\spoolsv.exe
                                                                            C:\Windows\System32\Windows.Internal.Management\spoolsv.exe
                                                                            30⤵
                                                                            • UAC bypass
                                                                            • Checks computer location settings
                                                                            • Executes dropped EXE
                                                                            • Checks whether UAC is enabled
                                                                            • Modifies registry class
                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                            • System policy modification
                                                                            PID:3496
                                                                            • C:\Windows\System32\WScript.exe
                                                                              "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\7198c7aa-7935-434a-816d-7a16dc2d109f.vbs"
                                                                              31⤵
                                                                                PID:856
                                                                                • C:\Windows\System32\Windows.Internal.Management\spoolsv.exe
                                                                                  C:\Windows\System32\Windows.Internal.Management\spoolsv.exe
                                                                                  32⤵
                                                                                  • UAC bypass
                                                                                  • Checks computer location settings
                                                                                  • Executes dropped EXE
                                                                                  • Checks whether UAC is enabled
                                                                                  • Modifies registry class
                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                  • System policy modification
                                                                                  PID:4736
                                                                                  • C:\Windows\System32\WScript.exe
                                                                                    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\8c7b1df4-3592-437d-91d3-b3d3ac57baa3.vbs"
                                                                                    33⤵
                                                                                      PID:1924
                                                                                    • C:\Windows\System32\WScript.exe
                                                                                      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\302419e6-c771-45f0-824a-a1813a5dd008.vbs"
                                                                                      33⤵
                                                                                        PID:3744
                                                                                  • C:\Windows\System32\WScript.exe
                                                                                    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\bc14ecc9-46e1-4980-be79-521640fe438f.vbs"
                                                                                    31⤵
                                                                                      PID:4540
                                                                                • C:\Windows\System32\WScript.exe
                                                                                  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\b66f3b29-c124-4735-a5eb-78421ee7a4ea.vbs"
                                                                                  29⤵
                                                                                    PID:5288
                                                                              • C:\Windows\System32\WScript.exe
                                                                                "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\83410e0f-b450-4f48-8020-cbcbae5827a1.vbs"
                                                                                27⤵
                                                                                  PID:4432
                                                                            • C:\Windows\System32\WScript.exe
                                                                              "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\788f89ec-a2e0-46d1-9960-a7ac502998be.vbs"
                                                                              25⤵
                                                                                PID:3432
                                                                          • C:\Windows\System32\WScript.exe
                                                                            "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\1b2d389e-977c-44f1-9018-7caa03e49d47.vbs"
                                                                            23⤵
                                                                              PID:4212
                                                                        • C:\Windows\System32\WScript.exe
                                                                          "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\2ef02e45-8041-46c9-8b85-e551f47b4feb.vbs"
                                                                          21⤵
                                                                            PID:876
                                                                      • C:\Windows\System32\WScript.exe
                                                                        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\de7d40d6-ae35-40fe-b009-650a79f628ad.vbs"
                                                                        19⤵
                                                                          PID:5880
                                                                    • C:\Windows\System32\WScript.exe
                                                                      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\80f30c3c-9418-4785-8da3-224483b16b89.vbs"
                                                                      17⤵
                                                                        PID:2476
                                                                  • C:\Windows\System32\WScript.exe
                                                                    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\9f48643b-5805-4500-a543-8298ec1739cd.vbs"
                                                                    15⤵
                                                                      PID:5368
                                                                • C:\Windows\System32\WScript.exe
                                                                  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\4832f3ce-b0e3-4e33-bc00-313184f207d2.vbs"
                                                                  13⤵
                                                                    PID:5412
                                                              • C:\Windows\System32\WScript.exe
                                                                "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\65862cc8-03c7-42c5-b5a1-1e615eebefaa.vbs"
                                                                11⤵
                                                                  PID:1620
                                                            • C:\Windows\System32\WScript.exe
                                                              "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\3241a55b-b186-48e6-9251-d992cfb30a7d.vbs"
                                                              9⤵
                                                                PID:1140
                                                          • C:\Windows\System32\WScript.exe
                                                            "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\5f452528-676e-49af-9b42-38ba8a01b0f2.vbs"
                                                            7⤵
                                                              PID:2148
                                                        • C:\Windows\System32\WScript.exe
                                                          "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\e3886a44-71b0-49f8-aee6-43c1fc267995.vbs"
                                                          5⤵
                                                            PID:2780
                                                      • C:\Windows\System32\WScript.exe
                                                        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\3fa5d4f1-06b6-4922-b3a9-dcd4f40cc660.vbs"
                                                        3⤵
                                                          PID:1664
                                                    • C:\Windows\system32\schtasks.exe
                                                      schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Program Files (x86)\Reference Assemblies\Microsoft\RuntimeBroker.exe'" /rl HIGHEST /f
                                                      1⤵
                                                      • Process spawned unexpected child process
                                                      • Scheduled Task/Job: Scheduled Task
                                                      PID:4632
                                                    • C:\Windows\system32\schtasks.exe
                                                      schtasks.exe /create /tn "upfc" /sc ONLOGON /tr "'C:\PerfLogs\upfc.exe'" /rl HIGHEST /f
                                                      1⤵
                                                      • Process spawned unexpected child process
                                                      • Scheduled Task/Job: Scheduled Task
                                                      PID:2200
                                                    • C:\Windows\system32\schtasks.exe
                                                      schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\34c553de294c1d56d0a800105b\dllhost.exe'" /rl HIGHEST /f
                                                      1⤵
                                                      • Process spawned unexpected child process
                                                      • Scheduled Task/Job: Scheduled Task
                                                      PID:4608
                                                    • C:\Windows\system32\schtasks.exe
                                                      schtasks.exe /create /tn "spoolsv" /sc ONLOGON /tr "'C:\Windows\System32\Windows.Internal.Management\spoolsv.exe'" /rl HIGHEST /f
                                                      1⤵
                                                      • Process spawned unexpected child process
                                                      • Scheduled Task/Job: Scheduled Task
                                                      PID:4732
                                                    • C:\Windows\system32\schtasks.exe
                                                      schtasks.exe /create /tn "sysmon" /sc ONLOGON /tr "'C:\Windows\regedit\sysmon.exe'" /rl HIGHEST /f
                                                      1⤵
                                                      • Process spawned unexpected child process
                                                      • Scheduled Task/Job: Scheduled Task
                                                      PID:4776
                                                    • C:\Windows\system32\schtasks.exe
                                                      schtasks.exe /create /tn "SppExtComObj" /sc ONLOGON /tr "'C:\Windows\System32\AppXDeploymentExtensions.desktop\SppExtComObj.exe'" /rl HIGHEST /f
                                                      1⤵
                                                      • Process spawned unexpected child process
                                                      • Scheduled Task/Job: Scheduled Task
                                                      PID:4936
                                                    • C:\Windows\system32\schtasks.exe
                                                      schtasks.exe /create /tn "explorer" /sc ONLOGON /tr "'C:\Windows\explorer\explorer.exe'" /rl HIGHEST /f
                                                      1⤵
                                                      • Process spawned unexpected child process
                                                      • Scheduled Task/Job: Scheduled Task
                                                      PID:4680
                                                    • C:\Windows\system32\schtasks.exe
                                                      schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Windows\System32\wkscli\dllhost.exe'" /rl HIGHEST /f
                                                      1⤵
                                                      • Process spawned unexpected child process
                                                      • Scheduled Task/Job: Scheduled Task
                                                      PID:4020

                                                    Network

                                                    MITRE ATT&CK Enterprise v15

                                                    Reconnaissance

                                                    Resource Development

                                                    Initial Access

                                                    Execution

                                                    Command and Scripting Interpreter

                                                    1
                                                    T1059

                                                    PowerShell

                                                    1
                                                    T1059.001

                                                    Scheduled Task/Job

                                                    1
                                                    T1053

                                                    Scheduled Task

                                                    1
                                                    T1053.005

                                                    Persistence

                                                    Boot or Logon Autostart Execution

                                                    2
                                                    T1547

                                                    Registry Run Keys / Startup Folder

                                                    1
                                                    T1547.001

                                                    Winlogon Helper DLL

                                                    1
                                                    T1547.004

                                                    Scheduled Task/Job

                                                    1
                                                    T1053

                                                    Scheduled Task

                                                    1
                                                    T1053.005

                                                    Privilege Escalation

                                                    Abuse Elevation Control Mechanism

                                                    1
                                                    T1548

                                                    Bypass User Account Control

                                                    1
                                                    T1548.002

                                                    Boot or Logon Autostart Execution

                                                    2
                                                    T1547

                                                    Registry Run Keys / Startup Folder

                                                    1
                                                    T1547.001

                                                    Winlogon Helper DLL

                                                    1
                                                    T1547.004

                                                    Scheduled Task/Job

                                                    1
                                                    T1053

                                                    Scheduled Task

                                                    1
                                                    T1053.005

                                                    Defense Evasion

                                                    Abuse Elevation Control Mechanism

                                                    1
                                                    T1548

                                                    Bypass User Account Control

                                                    1
                                                    T1548.002

                                                    Impair Defenses

                                                    1
                                                    T1562

                                                    Disable or Modify Tools

                                                    1
                                                    T1562.001

                                                    Modify Registry

                                                    4
                                                    T1112

                                                    Credential Access

                                                    Discovery

                                                    Query Registry

                                                    2
                                                    T1012

                                                    System Information Discovery

                                                    3
                                                    T1082

                                                    Lateral Movement

                                                    Collection

                                                    Command and Control

                                                    Exfiltration

                                                    Impact

                                                    Replay Monitor

                                                    Loading Replay Monitor...

                                                    Downloads

                                                    • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
                                                      Filesize

                                                      2KB

                                                      MD5

                                                      a43e653ffb5ab07940f4bdd9cc8fade4

                                                      SHA1

                                                      af43d04e3427f111b22dc891c5c7ee8a10ac4123

                                                      SHA256

                                                      c4c53abb13e99475aebfbe9fec7a8fead81c14c80d9dcc2b81375304f3a683fe

                                                      SHA512

                                                      62a97e95e1f19a8d4302847110dae44f469877eed6aa8ea22345c6eb25ee220e7d310fa0b7ec5df42356815421c0af7c46a0f1fee8933cc446641800eda6cd1b

                                                      Download Submit

                                                    • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\spoolsv.exe.log
                                                      Filesize

                                                      1KB

                                                      MD5

                                                      baf55b95da4a601229647f25dad12878

                                                      SHA1

                                                      abc16954ebfd213733c4493fc1910164d825cac8

                                                      SHA256

                                                      ee954c5d8156fd8890e582c716e5758ed9b33721258f10e758bdc31ccbcb1924

                                                      SHA512

                                                      24f502fedb1a305d0d7b08857ffc1db9b2359ff34e06d5748ecc84e35c985f29a20d9f0a533bea32d234ab37097ec0481620c63b14ac89b280e75e14d19fd545

                                                      Download Submit

                                                    • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                      Filesize

                                                      944B

                                                      MD5

                                                      4a7baa2b3c35d23eda09bdef4265fb47

                                                      SHA1

                                                      eda288e5c03a1b226ad16d487d71742ab2b94e35

                                                      SHA256

                                                      993d3f32343d257e089e83ca383bff11bf8ff41a01ead2e8ffddeceeff1039b8

                                                      SHA512

                                                      6a0d62d00857efc8333569fd3535bc89073213af4fe6c7ffc1d417299b6b377680e8114d80f09d679b12d452f2992a55ad0992f54cc21338b09459a53d654134

                                                      Download Submit

                                                    • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                      Filesize

                                                      944B

                                                      MD5

                                                      e3196c875759f12b19de76e7989c1ade

                                                      SHA1

                                                      2a9c952b123b87c988caf9bf64fc5fd777b5c876

                                                      SHA256

                                                      5f2b6782f01575ba7a1e68e3d46995679700b506293536afdb7b43cdd80628ed

                                                      SHA512

                                                      5493bb1c8af856285f9ba79aa8a58763861bbaf2f4abac7248761cc5bce77f9e132bf108f4e13b2ff95042647e5384e74167ed4301f8d59e308bbce1f93eb5d6

                                                      Download Submit

                                                    • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                      Filesize

                                                      944B

                                                      MD5

                                                      a39de506d9f3cb0eef9451868bf8f3ff

                                                      SHA1

                                                      183758ff7964ae923989989be46a822e0d4dc37f

                                                      SHA256

                                                      d982bcb0bdbe495e997ead8d128c2f8f0bb66c41fc5e0142d4fb5bf9193e1416

                                                      SHA512

                                                      041df31ed5f2668dcf99143cbffcc7891394f33c6229f2459cba2226f07a8fcf31e072db62c6735fdb4b9fbc103998094a735a285db84a69bb7d983ffb96efaa

                                                      Download Submit

                                                    • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                      Filesize

                                                      944B

                                                      MD5

                                                      fb7fc2c643e952a1d3241b5fac8ef241

                                                      SHA1

                                                      4310dc08d34678c0a48c7cacb94f313f9fdd3720

                                                      SHA256

                                                      7ac9e52f11de3f117d7a7f1bda793dd60756b764e4f0217ff87c66a20bf96d16

                                                      SHA512

                                                      8ceb0a588e3b3cabf9edf80dbfbc24b1f3fb2f379e3cf9262c6ba762ab1d5b89d4f394a67c2756f58e7bd879ab94e232e41bd7d8c611fcfcca976fb3188f3099

                                                      Download Submit

                                                    • C:\Users\Admin\AppData\Local\Temp\15363ac1-53d6-4392-8793-7c8c34e8bc86.vbs
                                                      Filesize

                                                      735B

                                                      MD5

                                                      b5b4a08d3c2d9db785ad11623b1025db

                                                      SHA1

                                                      4e180f27f97fb94804d3a4a8cd60ec068db88084

                                                      SHA256

                                                      4766bcd013a61658153d423294a3d74e43905f4bf0e3ba4e5977ff98105b57a3

                                                      SHA512

                                                      6f398df9d2e47fd020ac5e43abcf460c8f4e27def3a0e4141004a90aa852f9d1e7e1afc66e0921676ee706a02e6fa402128c7c239500427833ed9102d537bb6d

                                                      Download Submit

                                                    • C:\Users\Admin\AppData\Local\Temp\27790bb5-95da-4b74-b216-1a69df053256.vbs
                                                      Filesize

                                                      735B

                                                      MD5

                                                      783f995245a744256f7366c3c2dcc46c

                                                      SHA1

                                                      56a16629f6ce934fd36462fd5d637fafb056813f

                                                      SHA256

                                                      d68a84fcfcdf2cd6d6aff6e5144050cb699798867e73df6551bf5b5c21195a6d

                                                      SHA512

                                                      0c8f39298bda947c642f43c3737c4d4d0206e25eb1d035a6210b5c07bca3c07b7a9fbcc4691babd110b744564326f1d389ad5e87683e1cd365c7b4655a06db0c

                                                      Download Submit

                                                    • C:\Users\Admin\AppData\Local\Temp\3b4a8f7c-76bf-492d-94a2-04cb58117f35.vbs
                                                      Filesize

                                                      735B

                                                      MD5

                                                      be9a7c8e244685c4829722392869adb3

                                                      SHA1

                                                      18dfff3722a6c8473e102ab63e06f837bb822502

                                                      SHA256

                                                      0b3ed20815363d90554b14c226cf887eab462ebf346acef1a0cf7ab976177eaa

                                                      SHA512

                                                      faa8dcc8367cf491f723036dba02786ffd6872c7cff2a215be3716efc88c49f27c52cd49aa5fecfad2bfb5e5823fb6ca4204fd62e35d47e52bc312f8fe20da4a

                                                      Download Submit

                                                    • C:\Users\Admin\AppData\Local\Temp\3d7d6b0f-c1f5-4ef4-bd0b-84c03f0cfee4.vbs
                                                      Filesize

                                                      735B

                                                      MD5

                                                      297f9f5017a79d5e2c59c62429880b08

                                                      SHA1

                                                      f4c4d16724259031f45c12c599ec0c813f12b42e

                                                      SHA256

                                                      cc31f04a195efb0930c07d8682d89b5a55e4831b88b28933e86458ce5c71a8fc

                                                      SHA512

                                                      96c5b72ff7f51c2a17bcec13b1fe653ed8f8bdc28a62854dae653cc7dea58518914be232e9798bf3d181b40f944f7ecb8e871113175c81132648acdbde2a2468

                                                      Download Submit

                                                    • C:\Users\Admin\AppData\Local\Temp\3e7c627f-eddd-4796-9e10-090aa35fb51b.vbs
                                                      Filesize

                                                      735B

                                                      MD5

                                                      2e88e07d31e6bcfa1a2f82bdce429a65

                                                      SHA1

                                                      faaf3e8e5b3ff18e884790da43bb7243445e5152

                                                      SHA256

                                                      860167db88e927a08541fb084b9456312407145933e7ede80db1e478721a024c

                                                      SHA512

                                                      36d9078d56b0ace6f0ef551c1df45dfba4c27ccf3b154200461ca43459ec2281f96ca267064aebd992fd4a7e26dd56f0835af7e046cd4669814b725381eded0d

                                                      Download Submit

                                                    • C:\Users\Admin\AppData\Local\Temp\3fa5d4f1-06b6-4922-b3a9-dcd4f40cc660.vbs
                                                      Filesize

                                                      511B

                                                      MD5

                                                      69b5bcc6fee77698a7bcef66febd706a

                                                      SHA1

                                                      35f44cf5b78f554abbdab2d1aec40d7c61f58990

                                                      SHA256

                                                      bf817e7e3ceac3a03c52ef4b1732cf6397bf4a266efe8646aef40bb598162812

                                                      SHA512

                                                      c95e094649747f64c26db0263eb3f801163273fb32117712698879af4fd3f069f9014308fd9a72980acbf7f3d333e1a27722fc79ab4046790d10cd22298baa70

                                                      Download Submit

                                                    • C:\Users\Admin\AppData\Local\Temp\47cabaee-a9a9-450b-8f49-d446e31a0f92.vbs
                                                      Filesize

                                                      735B

                                                      MD5

                                                      d8414bb135ed54afee16055df5056cc3

                                                      SHA1

                                                      39659f3f4c44ae27537e5ef1ca635e29dd458e00

                                                      SHA256

                                                      438839ea356555811e19562bd062c8af4cc83d9dadca4e7c34918064b9110e6a

                                                      SHA512

                                                      8b84aa953fae422aa5aa5d28b0f412174f848c15d81de852205cb84495afea923998ab8640283236fe210b983e8c5257940b6d714116d77ad079342b4d83baf5

                                                      Download Submit

                                                    • C:\Users\Admin\AppData\Local\Temp\4e9d9230-9079-4cad-a0d9-0f9558e3811e.vbs
                                                      Filesize

                                                      734B

                                                      MD5

                                                      eb1cda6340e8b27ef50ccb6ead7de3b4

                                                      SHA1

                                                      9d1fec244861294227585a1171f3886722ae9427

                                                      SHA256

                                                      1e738682bfc29fa00ea4c37cfdf8886aac1bbf1754e446bf0b0cf3efd0102dd1

                                                      SHA512

                                                      5343ce6690894f61574acc38203e5dffff985725f41277f838866eaa3266ae4dba436ef162927fd24012a91907a0dd34769038bef4bf448b86cf568fa163c7a6

                                                      Download Submit

                                                    • C:\Users\Admin\AppData\Local\Temp\5bf1361b-54e1-4c9c-855e-b2adf8ae13e3.vbs
                                                      Filesize

                                                      735B

                                                      MD5

                                                      b73e8459ab12b99878cb30a4740197ee

                                                      SHA1

                                                      7f4933c1c1dfe8d81e3cfb0e176e4d769f826ed9

                                                      SHA256

                                                      e584baf138e6aed31e2638f8fcc42534c1468c05df3bedd3a93a6fa6aa717a64

                                                      SHA512

                                                      032c78eb0798a90890bd3ba7c9f972e19475169321801048d31fda5fb168390efe3cff6b683103178475d64a84a0e85d2cbf8847616124c71afedd004ccfe86b

                                                      Download Submit

                                                    • C:\Users\Admin\AppData\Local\Temp\89c7af54-b9d3-46cf-a1a6-3b3950b7e1c5.vbs
                                                      Filesize

                                                      735B

                                                      MD5

                                                      a894d0ed6f7362f4a81e438f2d80f6e9

                                                      SHA1

                                                      9e90f365748b16b3b6b2f1a83f0a090d73b37f17

                                                      SHA256

                                                      eb7e94e9cf136e0b4032a0a7e6f033fe35e98212536b6ca971841b5f6f855183

                                                      SHA512

                                                      46e8ee5a927f9136771a38549db036e11c4c00062c4f5c61b968551ce98f2dd1662708894dc593a29aa780f626fadbfb4a11bb5a06555411fde05313578f6345

                                                      Download Submit

                                                    • C:\Users\Admin\AppData\Local\Temp\9bca4b02-cb08-4fa9-a46d-c369717f7c8f.vbs
                                                      Filesize

                                                      735B

                                                      MD5

                                                      0b0fdd8027626bfb7a59ed451aacfc9d

                                                      SHA1

                                                      d8c5a060525edc7872dc4f329699329ea56765ec

                                                      SHA256

                                                      72dea3e5720867b29daaf3c239ed11a331124e45996074a4d86f314b541dc0cb

                                                      SHA512

                                                      28776b4d5eb6586c7e8cca2b8b43b5248f8b2c05992ac139a7b91c0b503880e1d64ed113ee461935d50c11a71a63db9064bdb1284b9891fa1e294602ac71766c

                                                      Download Submit

                                                    • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_d0a3qn0d.nud.ps1
                                                      Filesize

                                                      60B

                                                      MD5

                                                      d17fe0a3f47be24a6453e9ef58c94641

                                                      SHA1

                                                      6ab83620379fc69f80c0242105ddffd7d98d5d9d

                                                      SHA256

                                                      96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

                                                      SHA512

                                                      5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

                                                      Download Submit

                                                    • C:\Users\Admin\AppData\Local\Temp\a562dbc3-9311-4664-9742-19d66915e300.vbs
                                                      Filesize

                                                      735B

                                                      MD5

                                                      7473783452638e0b4746d14773e1698d

                                                      SHA1

                                                      10740e085680cb5878dd7546637ad31400e5406c

                                                      SHA256

                                                      4e6cb192e4a670fa82f5a4913b9973d478481aa391fa7a471608bd7818067111

                                                      SHA512

                                                      f284b1019cc1d3e9a450910aff1ad0c569b1f507e9b58fe79e481c84c2fa5339e034a5d67d680afe67db3e8b004e7e3af9e46171e26286a8f54d7ebbafb8c2aa

                                                      Download Submit

                                                    • C:\Users\Admin\AppData\Local\Temp\b0826851-58fa-44cb-91da-b5df79e56a39.vbs
                                                      Filesize

                                                      735B

                                                      MD5

                                                      e3254f632a0174677eac02aa2f48b247

                                                      SHA1

                                                      8524d6969a07a580f941c9b95acf1cc408838dd0

                                                      SHA256

                                                      a27e84bdbff3b62f20f5ace932b5fae094694cd07c94ca7d798daae5b21ae925

                                                      SHA512

                                                      3292ef7c0335339ae6ff1ec591c46b6793d3abe5abb23020c36cc58d6c25d5bc24b0f1ac12d599f06af4a56876356e9d85fbea336b0a7dfcedb5c378a063e221

                                                      Download Submit

                                                    • C:\Users\Admin\AppData\Local\Temp\e56ffa2f-e72d-4b7e-9921-7be3225e2fed.vbs
                                                      Filesize

                                                      734B

                                                      MD5

                                                      519a5b9e8d20849c9c67b18ec13afa67

                                                      SHA1

                                                      f126a7e79bfdf308e404907179605abdc865bce4

                                                      SHA256

                                                      125f97a083331500cdb119754516ab17c88114a5a0b26780ea7a7fa8c2456dd4

                                                      SHA512

                                                      5eb558499556d54b6ab4f356ab7fcc61214de25e768a067cd8f1e6f9fa10433198de64cff2f246b2d07225a8962fdbf74b4131fe56ccf8fde589ddf598ea2a65

                                                      Download Submit

                                                    • C:\Windows\regedit\sysmon.exe
                                                      Filesize

                                                      1.1MB

                                                      MD5

                                                      66c9a250fe9e60c4df2c9a157ae39211

                                                      SHA1

                                                      cabc35fd42f4534f5e05b5b9bd65dcfc85e469a7

                                                      SHA256

                                                      d264be7b02773b7c80509deaa970e2a2a8f681321e71b36a8a6377486bff23bd

                                                      SHA512

                                                      1439934414be0b92acf1b51e6b3ba0a1ad296b879361f42fc557b740bde42204515bbbccfe5e9c74b702caf786c201ececee76bc5841618560f56de047c9cdc8

                                                      Download Submit

                                                    • memory/920-362-0x0000000001470000-0x0000000001482000-memory.dmp

                                                      Filesize

                                                      72KB

                                                      Download

                                                    • memory/996-396-0x0000000001120000-0x0000000001132000-memory.dmp

                                                      Filesize

                                                      72KB

                                                      Download

                                                    • memory/1384-156-0x000001B37BD40000-0x000001B37BD62000-memory.dmp

                                                      Filesize

                                                      136KB

                                                      Download

                                                    • memory/1768-408-0x0000000001450000-0x0000000001462000-memory.dmp

                                                      Filesize

                                                      72KB

                                                      Download

                                                    • memory/3936-272-0x00000000026A0000-0x00000000026B2000-memory.dmp

                                                      Filesize

                                                      72KB

                                                      Download

                                                    • memory/4776-317-0x0000000002890000-0x00000000028A2000-memory.dmp

                                                      Filesize

                                                      72KB

                                                      Download

                                                    • memory/5444-12-0x000000001BB30000-0x000000001BB38000-memory.dmp

                                                      Filesize

                                                      32KB

                                                      Download

                                                    • memory/5444-11-0x000000001BB20000-0x000000001BB30000-memory.dmp

                                                      Filesize

                                                      64KB

                                                      Download

                                                    • memory/5444-20-0x000000001BBB0000-0x000000001BBBC000-memory.dmp

                                                      Filesize

                                                      48KB

                                                      Download

                                                    • memory/5444-18-0x000000001BBA0000-0x000000001BBA8000-memory.dmp

                                                      Filesize

                                                      32KB

                                                      Download

                                                    • memory/5444-17-0x000000001BB90000-0x000000001BB9C000-memory.dmp

                                                      Filesize

                                                      48KB

                                                      Download

                                                    • memory/5444-16-0x000000001BB80000-0x000000001BB88000-memory.dmp

                                                      Filesize

                                                      32KB

                                                      Download

                                                    • memory/5444-15-0x000000001BB70000-0x000000001BB7A000-memory.dmp

                                                      Filesize

                                                      40KB

                                                      Download

                                                    • memory/5444-24-0x00007FFF46BB0000-0x00007FFF47671000-memory.dmp

                                                      Filesize

                                                      10.8MB

                                                      Download

                                                    • memory/5444-14-0x000000001BB60000-0x000000001BB6C000-memory.dmp

                                                      Filesize

                                                      48KB

                                                      Download

                                                    • memory/5444-0-0x00007FFF46BB3000-0x00007FFF46BB5000-memory.dmp

                                                      Filesize

                                                      8KB

                                                      Download

                                                    • memory/5444-13-0x000000001BB50000-0x000000001BB5A000-memory.dmp

                                                      Filesize

                                                      40KB

                                                      Download

                                                    • memory/5444-21-0x000000001BC20000-0x000000001BC28000-memory.dmp

                                                      Filesize

                                                      32KB

                                                      Download

                                                    • memory/5444-25-0x00007FFF46BB0000-0x00007FFF47671000-memory.dmp

                                                      Filesize

                                                      10.8MB

                                                      Download

                                                    • memory/5444-10-0x000000001BB10000-0x000000001BB20000-memory.dmp

                                                      Filesize

                                                      64KB

                                                      Download

                                                    • memory/5444-9-0x000000001BB00000-0x000000001BB0C000-memory.dmp

                                                      Filesize

                                                      48KB

                                                      Download

                                                    • memory/5444-8-0x000000001BAF0000-0x000000001BAF8000-memory.dmp

                                                      Filesize

                                                      32KB

                                                      Download

                                                    • memory/5444-6-0x000000001BAD0000-0x000000001BADA000-memory.dmp

                                                      Filesize

                                                      40KB

                                                      Download

                                                    • memory/5444-7-0x000000001BAE0000-0x000000001BAEC000-memory.dmp

                                                      Filesize

                                                      48KB

                                                      Download

                                                    • memory/5444-5-0x00000000031A0000-0x00000000031AC000-memory.dmp

                                                      Filesize

                                                      48KB

                                                      Download

                                                    • memory/5444-4-0x0000000003190000-0x00000000031A2000-memory.dmp

                                                      Filesize

                                                      72KB

                                                      Download

                                                    • memory/5444-3-0x0000000003180000-0x0000000003188000-memory.dmp

                                                      Filesize

                                                      32KB

                                                      Download

                                                    • memory/5444-2-0x00007FFF46BB0000-0x00007FFF47671000-memory.dmp

                                                      Filesize

                                                      10.8MB

                                                      Download

                                                    • memory/5444-1-0x0000000000E90000-0x0000000000FA4000-memory.dmp

                                                      Filesize

                                                      1.1MB

                                                      Download

                                                    • memory/5444-242-0x00007FFF46BB0000-0x00007FFF47671000-memory.dmp

                                                      Filesize

                                                      10.8MB

                                                      Download