Overview

overview

10

Static

static

10

dridex

windows10-1703-x64

10

Analysis

  • max time kernel
    35s
  • max time network
    150s
  • platform
    windows10-1703_x64
  • resource
    win10-20220812-en
  • resource tags

    arch:x64arch:x86image:win10-20220812-enlocale:en-usos:windows10-1703-x64system
  • submitted
    31/10/2022, 22:54

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    68c80a1af2f37bf3f6d3af6f6319f062514ccaba2e5392bfd9ebdb0f78675e40.exe
  • Size 1.3MB
  • Sample221031-2vqljsdhf7
  • SHA256 68c80a1af2f37bf3f6d3af6f6319f062514ccaba2e5392bfd9ebdb0f78675e40
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
dcratinfostealerrat

Malware Config

Signatures

  • DcRat

    DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

    ratinfostealerdcrat
  • Process spawned unexpected child process 64 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • DCRat payload 24 IoCs

    Detects payload of DCRat, commonly dropped by NSIS installers.

    rat
  • Executes dropped EXE 21 IoCs
  • Drops file in System32 directory 2 IoCs
  • Drops file in Program Files directory 4 IoCs
  • Drops file in Windows directory 9 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Creates scheduled task(s) 1 TTPs 64 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistence
  • Modifies registry class 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 45 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\68c80a1af2f37bf3f6d3af6f6319f062514ccaba2e5392bfd9ebdb0f78675e40.exe
    "C:\Users\Admin\AppData\Local\Temp\68c80a1af2f37bf3f6d3af6f6319f062514ccaba2e5392bfd9ebdb0f78675e40.exe"
    1⤵
    • Modifies registry class
    • Suspicious use of WriteProcessMemory
    PID:2716
    • C:\Windows\SysWOW64\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\providercommon\yTUdeXjbLOhnrN32dgrxVg.vbe"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:4892
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /c ""C:\providercommon\1zu9dW.bat" "
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:2000
        • C:\providercommon\DllCommonsvc.exe
          "C:\providercommon\DllCommonsvc.exe"
          4⤵
          • Executes dropped EXE
          • Drops file in System32 directory
          • Drops file in Windows directory
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:3884
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\DllCommonsvc.exe'
            5⤵
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:4680
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\RuntimeBroker.exe'
            5⤵
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:4456
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\odt\dllhost.exe'
            5⤵
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:576
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\es-ES\winlogon.exe'
            5⤵
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:4544
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\SysWOW64\MsDtc\Trace\taskhostw.exe'
            5⤵
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:3904
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Default User\ShellExperienceHost.exe'
            5⤵
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:1672
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\PrintHood\dllhost.exe'
            5⤵
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:1236
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\dllhost.exe'
            5⤵
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:612
          • C:\providercommon\DllCommonsvc.exe
            "C:\providercommon\DllCommonsvc.exe"
            5⤵
            • Executes dropped EXE
            • Drops file in Program Files directory
            • Drops file in Windows directory
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of WriteProcessMemory
            PID:2288
            • C:\providercommon\powershell.exe
              "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\DllCommonsvc.exe'
              6⤵
              • Executes dropped EXE
              PID:4328
            • C:\providercommon\powershell.exe
              "powershell" -Command Add-MpPreference -ExclusionPath 'C:\odt\smss.exe'
              6⤵
              • Executes dropped EXE
              PID:3488
            • C:\providercommon\powershell.exe
              "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\All Users\Templates\dllhost.exe'
              6⤵
              • Executes dropped EXE
              PID:1280
            • C:\providercommon\powershell.exe
              "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\WindowsRE\explorer.exe'
              6⤵
              • Executes dropped EXE
              PID:2284
            • C:\providercommon\powershell.exe
              "powershell" -Command Add-MpPreference -ExclusionPath 'C:\odt\wininit.exe'
              6⤵
              • Executes dropped EXE
              PID:4060
            • C:\providercommon\powershell.exe
              "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\WindowsRE\powershell.exe'
              6⤵
              • Executes dropped EXE
              PID:4388
            • C:\providercommon\powershell.exe
              "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\WindowsRE\smss.exe'
              6⤵
              • Executes dropped EXE
              PID:4792
            • C:\providercommon\powershell.exe
              "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\7-Zip\Lang\conhost.exe'
              6⤵
              • Executes dropped EXE
              PID:4312
            • C:\providercommon\powershell.exe
              "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\ModemLogs\sppsvc.exe'
              6⤵
              • Executes dropped EXE
              PID:4292
            • C:\providercommon\powershell.exe
              "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\powershell.exe'
              6⤵
              • Executes dropped EXE
              PID:5096
            • C:\providercommon\powershell.exe
              "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\powershell.exe'
              6⤵
              • Executes dropped EXE
              PID:4580
            • C:\providercommon\powershell.exe
              "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\DigitalLocker\smss.exe'
              6⤵
              • Executes dropped EXE
              PID:1688
            • C:\providercommon\powershell.exe
              "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\Idle.exe'
              6⤵
              • Executes dropped EXE
              PID:4748
            • C:\providercommon\powershell.exe
              "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\Microsoft.NET\Framework64\1041\cmd.exe'
              6⤵
              • Executes dropped EXE
              PID:2388
            • C:\providercommon\powershell.exe
              "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\OneDrive\conhost.exe'
              6⤵
              • Executes dropped EXE
              PID:4344
            • C:\providercommon\powershell.exe
              "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Windows Mail\en-US\explorer.exe'
              6⤵
              • Executes dropped EXE
              PID:1112
            • C:\providercommon\powershell.exe
              "C:\providercommon\powershell.exe"
              6⤵
              • Executes dropped EXE
              • Suspicious behavior: EnumeratesProcesses
              PID:4544
            • C:\providercommon\powershell.exe
              "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\explorer.exe'
              6⤵
              • Executes dropped EXE
              PID:4824
            • C:\providercommon\powershell.exe
              "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Default User\lsass.exe'
              6⤵
              • Executes dropped EXE
              PID:2220
  • C:\Windows\system32\schtasks.exe
    schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 5 /tr "'C:\Windows\es-ES\winlogon.exe'" /f
    1⤵
    • Process spawned unexpected child process
    • Creates scheduled task(s)
    PID:4952
  • C:\Windows\system32\schtasks.exe
    schtasks.exe /create /tn "winlogon" /sc ONLOGON /tr "'C:\Windows\es-ES\winlogon.exe'" /rl HIGHEST /f
    1⤵
    • Process spawned unexpected child process
    • Creates scheduled task(s)
    PID:3144
  • C:\Windows\system32\schtasks.exe
    schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 11 /tr "'C:\Windows\es-ES\winlogon.exe'" /rl HIGHEST /f
    1⤵
    • Process spawned unexpected child process
    • Creates scheduled task(s)
    PID:4316
  • C:\Windows\system32\schtasks.exe
    schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 10 /tr "'C:\providercommon\RuntimeBroker.exe'" /f
    1⤵
    • Process spawned unexpected child process
    • Creates scheduled task(s)
    PID:4320
  • C:\Windows\system32\schtasks.exe
    schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\providercommon\RuntimeBroker.exe'" /rl HIGHEST /f
    1⤵
    • Process spawned unexpected child process
    • Creates scheduled task(s)
    PID:4312
  • C:\Windows\system32\schtasks.exe
    schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 5 /tr "'C:\providercommon\RuntimeBroker.exe'" /rl HIGHEST /f
    1⤵
    • Process spawned unexpected child process
    • Creates scheduled task(s)
    PID:4640
  • C:\Windows\system32\schtasks.exe
    schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 12 /tr "'C:\odt\dllhost.exe'" /f
    1⤵
    • Process spawned unexpected child process
    PID:3704
  • C:\Windows\system32\schtasks.exe
    schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\odt\dllhost.exe'" /rl HIGHEST /f
    1⤵
    • Process spawned unexpected child process
    • Creates scheduled task(s)
    PID:5056
  • C:\Windows\system32\schtasks.exe
    schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 6 /tr "'C:\odt\dllhost.exe'" /rl HIGHEST /f
    1⤵
    • Process spawned unexpected child process
    • Creates scheduled task(s)
    PID:5068
  • C:\Windows\system32\schtasks.exe
    schtasks.exe /create /tn "taskhostwt" /sc MINUTE /mo 12 /tr "'C:\Windows\SysWOW64\MsDtc\Trace\taskhostw.exe'" /f
    1⤵
    • Process spawned unexpected child process
    • Creates scheduled task(s)
    PID:4980
  • C:\Windows\system32\schtasks.exe
    schtasks.exe /create /tn "taskhostw" /sc ONLOGON /tr "'C:\Windows\SysWOW64\MsDtc\Trace\taskhostw.exe'" /rl HIGHEST /f
    1⤵
    • Process spawned unexpected child process
    • Creates scheduled task(s)
    PID:5088
  • C:\Windows\system32\schtasks.exe
    schtasks.exe /create /tn "taskhostwt" /sc MINUTE /mo 11 /tr "'C:\Windows\SysWOW64\MsDtc\Trace\taskhostw.exe'" /rl HIGHEST /f
    1⤵
    • Process spawned unexpected child process
    • Creates scheduled task(s)
    PID:4424
  • C:\Windows\system32\schtasks.exe
    schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 11 /tr "'C:\Users\Admin\PrintHood\dllhost.exe'" /f
    1⤵
    • Process spawned unexpected child process
    PID:3156
  • C:\Windows\system32\schtasks.exe
    schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Users\Admin\PrintHood\dllhost.exe'" /rl HIGHEST /f
    1⤵
    • Process spawned unexpected child process
    • Creates scheduled task(s)
    PID:4604
  • C:\Windows\system32\schtasks.exe
    schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 10 /tr "'C:\Users\Admin\PrintHood\dllhost.exe'" /rl HIGHEST /f
    1⤵
    • Process spawned unexpected child process
    • Creates scheduled task(s)
    PID:2528
  • C:\Windows\system32\schtasks.exe
    schtasks.exe /create /tn "ShellExperienceHostS" /sc MINUTE /mo 5 /tr "'C:\Users\Default User\ShellExperienceHost.exe'" /f
    1⤵
    • Process spawned unexpected child process
    • Creates scheduled task(s)
    PID:3028
  • C:\Windows\system32\schtasks.exe
    schtasks.exe /create /tn "ShellExperienceHost" /sc ONLOGON /tr "'C:\Users\Default User\ShellExperienceHost.exe'" /rl HIGHEST /f
    1⤵
    • Process spawned unexpected child process
    • Creates scheduled task(s)
    PID:3260
  • C:\Windows\system32\schtasks.exe
    schtasks.exe /create /tn "ShellExperienceHostS" /sc MINUTE /mo 7 /tr "'C:\Users\Default User\ShellExperienceHost.exe'" /rl HIGHEST /f
    1⤵
    • Process spawned unexpected child process
    • Creates scheduled task(s)
    PID:4580
  • C:\Windows\system32\schtasks.exe
    schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 5 /tr "'C:\providercommon\dllhost.exe'" /f
    1⤵
    • Process spawned unexpected child process
    • Creates scheduled task(s)
    PID:4576
  • C:\Windows\system32\schtasks.exe
    schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\providercommon\dllhost.exe'" /rl HIGHEST /f
    1⤵
    • Process spawned unexpected child process
    • Creates scheduled task(s)
    PID:4500
  • C:\Windows\system32\schtasks.exe
    schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 5 /tr "'C:\providercommon\dllhost.exe'" /rl HIGHEST /f
    1⤵
    • Process spawned unexpected child process
    • Creates scheduled task(s)
    PID:4536
  • C:\Windows\system32\schtasks.exe
    schtasks.exe /create /tn "smsss" /sc MINUTE /mo 11 /tr "'C:\odt\smss.exe'" /f
    1⤵
    • Process spawned unexpected child process
    PID:928
  • C:\Windows\system32\schtasks.exe
    schtasks.exe /create /tn "smss" /sc ONLOGON /tr "'C:\odt\smss.exe'" /rl HIGHEST /f
    1⤵
    • Process spawned unexpected child process
    • Creates scheduled task(s)
    PID:3316
  • C:\Windows\system32\schtasks.exe
    schtasks.exe /create /tn "smsss" /sc MINUTE /mo 9 /tr "'C:\odt\smss.exe'" /rl HIGHEST /f
    1⤵
    • Process spawned unexpected child process
    • Creates scheduled task(s)
    PID:3368
  • C:\Windows\system32\schtasks.exe
    schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 10 /tr "'C:\Users\All Users\Templates\dllhost.exe'" /f
    1⤵
    • Process spawned unexpected child process
    PID:4932
  • C:\Windows\system32\schtasks.exe
    schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Users\All Users\Templates\dllhost.exe'" /rl HIGHEST /f
    1⤵
    • Process spawned unexpected child process
    • Creates scheduled task(s)
    PID:2232
  • C:\Windows\system32\schtasks.exe
    schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 9 /tr "'C:\Users\All Users\Templates\dllhost.exe'" /rl HIGHEST /f
    1⤵
    • Process spawned unexpected child process
    • Creates scheduled task(s)
    PID:3880
  • C:\Windows\system32\schtasks.exe
    schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 10 /tr "'C:\odt\wininit.exe'" /f
    1⤵
    • Process spawned unexpected child process
    • Creates scheduled task(s)
    PID:2808
  • C:\Windows\system32\schtasks.exe
    schtasks.exe /create /tn "wininit" /sc ONLOGON /tr "'C:\odt\wininit.exe'" /rl HIGHEST /f
    1⤵
    • Process spawned unexpected child process
    • Creates scheduled task(s)
    PID:4296
  • C:\Windows\system32\schtasks.exe
    schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 11 /tr "'C:\odt\wininit.exe'" /rl HIGHEST /f
    1⤵
    • Process spawned unexpected child process
    • Creates scheduled task(s)
    PID:4980
  • C:\Windows\system32\schtasks.exe
    schtasks.exe /create /tn "explorere" /sc MINUTE /mo 7 /tr "'C:\Recovery\WindowsRE\explorer.exe'" /f
    1⤵
    • Process spawned unexpected child process
    • Creates scheduled task(s)
    PID:584
  • C:\Windows\system32\schtasks.exe
    schtasks.exe /create /tn "explorer" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\explorer.exe'" /rl HIGHEST /f
    1⤵
    • Process spawned unexpected child process
    • Creates scheduled task(s)
    PID:1460
  • C:\Windows\system32\schtasks.exe
    schtasks.exe /create /tn "explorere" /sc MINUTE /mo 5 /tr "'C:\Recovery\WindowsRE\explorer.exe'" /rl HIGHEST /f
    1⤵
    • Process spawned unexpected child process
    • Creates scheduled task(s)
    PID:4504
  • C:\Windows\system32\schtasks.exe
    schtasks.exe /create /tn "powershellp" /sc MINUTE /mo 11 /tr "'C:\Recovery\WindowsRE\powershell.exe'" /f
    1⤵
    • Process spawned unexpected child process
    PID:1280
  • C:\Windows\system32\schtasks.exe
    schtasks.exe /create /tn "powershell" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\powershell.exe'" /rl HIGHEST /f
    1⤵
    • Process spawned unexpected child process
    • Creates scheduled task(s)
    PID:3064
  • C:\Windows\system32\schtasks.exe
    schtasks.exe /create /tn "powershellp" /sc MINUTE /mo 9 /tr "'C:\Recovery\WindowsRE\powershell.exe'" /rl HIGHEST /f
    1⤵
    • Process spawned unexpected child process
    • Creates scheduled task(s)
    PID:3516
  • C:\Windows\system32\schtasks.exe
    schtasks.exe /create /tn "smsss" /sc MINUTE /mo 9 /tr "'C:\Recovery\WindowsRE\smss.exe'" /f
    1⤵
    • Process spawned unexpected child process
    • Creates scheduled task(s)
    PID:2980
  • C:\Windows\system32\schtasks.exe
    schtasks.exe /create /tn "smss" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\smss.exe'" /rl HIGHEST /f
    1⤵
    • Process spawned unexpected child process
    • Creates scheduled task(s)
    PID:4432
  • C:\Windows\system32\schtasks.exe
    schtasks.exe /create /tn "smsss" /sc MINUTE /mo 6 /tr "'C:\Recovery\WindowsRE\smss.exe'" /rl HIGHEST /f
    1⤵
    • Process spawned unexpected child process
    • Creates scheduled task(s)
    PID:3392
  • C:\Windows\system32\schtasks.exe
    schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 10 /tr "'C:\Program Files\7-Zip\Lang\conhost.exe'" /f
    1⤵
    • Process spawned unexpected child process
    • Creates scheduled task(s)
    PID:4388
  • C:\Windows\system32\schtasks.exe
    schtasks.exe /create /tn "conhost" /sc ONLOGON /tr "'C:\Program Files\7-Zip\Lang\conhost.exe'" /rl HIGHEST /f
    1⤵
    • Process spawned unexpected child process
    • Creates scheduled task(s)
    PID:4076
  • C:\Windows\system32\schtasks.exe
    schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 10 /tr "'C:\Program Files\7-Zip\Lang\conhost.exe'" /rl HIGHEST /f
    1⤵
    • Process spawned unexpected child process
    • Creates scheduled task(s)
    PID:1316
  • C:\Windows\system32\schtasks.exe
    schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 9 /tr "'C:\Windows\ModemLogs\sppsvc.exe'" /f
    1⤵
    • Process spawned unexpected child process
    • Creates scheduled task(s)
    PID:4196
  • C:\Windows\system32\schtasks.exe
    schtasks.exe /create /tn "sppsvc" /sc ONLOGON /tr "'C:\Windows\ModemLogs\sppsvc.exe'" /rl HIGHEST /f
    1⤵
    • Process spawned unexpected child process
    • Creates scheduled task(s)
    PID:3144
  • C:\Windows\system32\schtasks.exe
    schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 9 /tr "'C:\Windows\ModemLogs\sppsvc.exe'" /rl HIGHEST /f
    1⤵
    • Process spawned unexpected child process
    • Creates scheduled task(s)
    PID:4324
  • C:\Windows\system32\schtasks.exe
    schtasks.exe /create /tn "powershellp" /sc MINUTE /mo 12 /tr "'C:\providercommon\powershell.exe'" /f
    1⤵
    • Process spawned unexpected child process
    • Creates scheduled task(s)
    PID:5080
  • C:\Windows\system32\schtasks.exe
    schtasks.exe /create /tn "powershell" /sc ONLOGON /tr "'C:\providercommon\powershell.exe'" /rl HIGHEST /f
    1⤵
    • Process spawned unexpected child process
    • Creates scheduled task(s)
    PID:3156
  • C:\Windows\system32\schtasks.exe
    schtasks.exe /create /tn "powershellp" /sc MINUTE /mo 13 /tr "'C:\providercommon\powershell.exe'" /rl HIGHEST /f
    1⤵
    • Process spawned unexpected child process
    • Creates scheduled task(s)
    PID:3760
  • C:\Windows\system32\schtasks.exe
    schtasks.exe /create /tn "powershellp" /sc MINUTE /mo 11 /tr "'C:\providercommon\powershell.exe'" /f
    1⤵
    • Process spawned unexpected child process
    • Creates scheduled task(s)
    PID:4380
  • C:\Windows\system32\schtasks.exe
    schtasks.exe /create /tn "powershell" /sc ONLOGON /tr "'C:\providercommon\powershell.exe'" /rl HIGHEST /f
    1⤵
    • Process spawned unexpected child process
    • Creates scheduled task(s)
    PID:3260
  • C:\Windows\system32\schtasks.exe
    schtasks.exe /create /tn "powershellp" /sc MINUTE /mo 9 /tr "'C:\providercommon\powershell.exe'" /rl HIGHEST /f
    1⤵
    • Process spawned unexpected child process
    • Creates scheduled task(s)
    PID:4552
  • C:\Windows\system32\schtasks.exe
    schtasks.exe /create /tn "smsss" /sc MINUTE /mo 10 /tr "'C:\Windows\DigitalLocker\smss.exe'" /f
    1⤵
    • Process spawned unexpected child process
    • Creates scheduled task(s)
    PID:4584
  • C:\Windows\system32\schtasks.exe
    schtasks.exe /create /tn "smss" /sc ONLOGON /tr "'C:\Windows\DigitalLocker\smss.exe'" /rl HIGHEST /f
    1⤵
    • Process spawned unexpected child process
    • Creates scheduled task(s)
    PID:1036
  • C:\Windows\system32\schtasks.exe
    schtasks.exe /create /tn "smsss" /sc MINUTE /mo 8 /tr "'C:\Windows\DigitalLocker\smss.exe'" /rl HIGHEST /f
    1⤵
    • Process spawned unexpected child process
    • Creates scheduled task(s)
    PID:1924
  • C:\Windows\system32\schtasks.exe
    schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 8 /tr "'C:\Users\Default User\lsass.exe'" /f
    1⤵
    • Process spawned unexpected child process
    • Creates scheduled task(s)
    PID:4576
  • C:\Windows\system32\schtasks.exe
    schtasks.exe /create /tn "lsass" /sc ONLOGON /tr "'C:\Users\Default User\lsass.exe'" /rl HIGHEST /f
    1⤵
    • Process spawned unexpected child process
    • Creates scheduled task(s)
    PID:4512
  • C:\Windows\system32\schtasks.exe
    schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 9 /tr "'C:\Users\Default User\lsass.exe'" /rl HIGHEST /f
    1⤵
    • Process spawned unexpected child process
    • Creates scheduled task(s)
    PID:4684
  • C:\Windows\system32\schtasks.exe
    schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 6 /tr "'C:\providercommon\Idle.exe'" /f
    1⤵
    • Process spawned unexpected child process
    • Creates scheduled task(s)
    PID:1816
  • C:\Windows\system32\schtasks.exe
    schtasks.exe /create /tn "Idle" /sc ONLOGON /tr "'C:\providercommon\Idle.exe'" /rl HIGHEST /f
    1⤵
    • Process spawned unexpected child process
    PID:804
  • C:\Windows\system32\schtasks.exe
    schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 9 /tr "'C:\providercommon\Idle.exe'" /rl HIGHEST /f
    1⤵
    • Process spawned unexpected child process
    • Creates scheduled task(s)
    PID:5004
  • C:\Windows\system32\schtasks.exe
    schtasks.exe /create /tn "cmdc" /sc MINUTE /mo 7 /tr "'C:\Windows\Microsoft.NET\Framework64\1041\cmd.exe'" /f
    1⤵
    • Process spawned unexpected child process
    • Creates scheduled task(s)
    PID:4484
  • C:\Windows\system32\schtasks.exe
    schtasks.exe /create /tn "cmd" /sc ONLOGON /tr "'C:\Windows\Microsoft.NET\Framework64\1041\cmd.exe'" /rl HIGHEST /f
    1⤵
    • Process spawned unexpected child process
    • Creates scheduled task(s)
    PID:2352
  • C:\Windows\system32\schtasks.exe
    schtasks.exe /create /tn "cmdc" /sc MINUTE /mo 5 /tr "'C:\Windows\Microsoft.NET\Framework64\1041\cmd.exe'" /rl HIGHEST /f
    1⤵
    • Process spawned unexpected child process
    PID:1652
  • C:\Windows\system32\schtasks.exe
    schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 11 /tr "'C:\Users\Admin\OneDrive\conhost.exe'" /f
    1⤵
    • Process spawned unexpected child process
    • Creates scheduled task(s)
    PID:3784
  • C:\Windows\system32\schtasks.exe
    schtasks.exe /create /tn "conhost" /sc ONLOGON /tr "'C:\Users\Admin\OneDrive\conhost.exe'" /rl HIGHEST /f
    1⤵
    • Creates scheduled task(s)
    PID:3424
  • C:\Windows\system32\schtasks.exe
    schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 10 /tr "'C:\Users\Admin\OneDrive\conhost.exe'" /rl HIGHEST /f
    1⤵
    • Creates scheduled task(s)
    PID:4260
  • C:\Windows\system32\schtasks.exe
    schtasks.exe /create /tn "explorere" /sc MINUTE /mo 6 /tr "'C:\providercommon\explorer.exe'" /f
    1⤵
    • Creates scheduled task(s)
    PID:3444
  • C:\Windows\system32\schtasks.exe
    schtasks.exe /create /tn "explorer" /sc ONLOGON /tr "'C:\providercommon\explorer.exe'" /rl HIGHEST /f
    1⤵
    • Creates scheduled task(s)
    PID:5100
  • C:\Windows\system32\schtasks.exe
    schtasks.exe /create /tn "explorere" /sc MINUTE /mo 6 /tr "'C:\providercommon\explorer.exe'" /rl HIGHEST /f
    1⤵
      PID:1932
    • C:\Windows\system32\schtasks.exe
      schtasks.exe /create /tn "explorere" /sc MINUTE /mo 10 /tr "'C:\Program Files\Windows Mail\en-US\explorer.exe'" /f
      1⤵
      • Creates scheduled task(s)
      PID:3304
    • C:\Windows\system32\schtasks.exe
      schtasks.exe /create /tn "explorer" /sc ONLOGON /tr "'C:\Program Files\Windows Mail\en-US\explorer.exe'" /rl HIGHEST /f
      1⤵
      • Creates scheduled task(s)
      PID:4504
    • C:\Windows\system32\schtasks.exe
      schtasks.exe /create /tn "explorere" /sc MINUTE /mo 5 /tr "'C:\Program Files\Windows Mail\en-US\explorer.exe'" /rl HIGHEST /f
      1⤵
      • Creates scheduled task(s)
      PID:3752

    Network

          MITRE ATT&CK Enterprise v6

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          DllCommonsvc.exe.log
          • Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\DllCommonsvc.exe.log
          • Size 1KB
          • SHA256 61d17affcc8d91ecb1858e710c455186f9d0ccfc4d8ae17a1145d87bc7317879
          • MD5 SHA1 SHA512
          Submit Download

          powershell.exe.log
          • Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
          • Size 3KB
          • SHA256 c9e6cb04d6c893458d5a7e12eb575cf97c3172f5e312b1f63a667cbbc5f0c033
          • MD5 SHA1 SHA512
          Submit Download

          StartupProfileData-NonInteractive
          • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
          • Size 1KB
          • SHA256 4c8946ef444ac60d731d674ad3d32a42edcd2a8d5fc984366f7c09eb24f5a272
          • MD5 SHA1 SHA512
          Submit Download

          StartupProfileData-NonInteractive
          • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
          • Size 1KB
          • SHA256 4c8946ef444ac60d731d674ad3d32a42edcd2a8d5fc984366f7c09eb24f5a272
          • MD5 SHA1 SHA512
          Submit Download

          StartupProfileData-NonInteractive
          • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
          • Size 1KB
          • SHA256 8f87916468b41e7b623aeff0bd0cf8fc229a600c3e2ad6fd658bf7676d9ed3f2
          • MD5 SHA1 SHA512
          Submit Download

          StartupProfileData-NonInteractive
          • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
          • Size 1KB
          • SHA256 e5d94cb19f98851096d1c2114e3d18543082cbfe1d91c42f927fcde3b7be75a7
          • MD5 SHA1 SHA512
          Submit Download

          StartupProfileData-NonInteractive
          • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
          • Size 1KB
          • SHA256 2913fcb0ba9c883a39984545cc43be1a35b2cc4675304f109aec03ce197be6c5
          • MD5 SHA1 SHA512
          Submit Download

          StartupProfileData-NonInteractive
          • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
          • Size 1KB
          • SHA256 2913fcb0ba9c883a39984545cc43be1a35b2cc4675304f109aec03ce197be6c5
          • MD5 SHA1 SHA512
          Submit Download

          StartupProfileData-NonInteractive
          • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
          • Size 1KB
          • SHA256 d0416df7bc7f535bf09de98008733d43ccf416fb6bb4085b9a95f018c5b34ff7
          • MD5 SHA1 SHA512
          Submit Download

          1zu9dW.bat
          • Path C:\providercommon\1zu9dW.bat
          • Size 36B
          • SHA256 8ab782f0f327a2021530e7230d3aee8abbecb7eed59482a3a46e78b9e3862322
          • MD5 SHA1 SHA512
          Submit Download

          DllCommonsvc.exe
          • Path C:\providercommon\DllCommonsvc.exe
          • Size 1.0MB
          • SHA256 b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          DllCommonsvc.exe
          • Path C:\providercommon\DllCommonsvc.exe
          • Size 1.0MB
          • SHA256 b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          DllCommonsvc.exe
          • Path C:\providercommon\DllCommonsvc.exe
          • Size 1.0MB
          • SHA256 b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          powershell.exe
          • Path C:\providercommon\powershell.exe
          • Size 1.0MB
          • SHA256 b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          powershell.exe
          • Path C:\providercommon\powershell.exe
          • Size 1.0MB
          • SHA256 b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          powershell.exe
          • Path C:\providercommon\powershell.exe
          • Size 1.0MB
          • SHA256 b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          powershell.exe
          • Path C:\providercommon\powershell.exe
          • Size 1.0MB
          • SHA256 b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          powershell.exe
          • Path C:\providercommon\powershell.exe
          • Size 1.0MB
          • SHA256 b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          powershell.exe
          • Path C:\providercommon\powershell.exe
          • Size 1.0MB
          • SHA256 b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          powershell.exe
          • Path C:\providercommon\powershell.exe
          • Size 1.0MB
          • SHA256 b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          powershell.exe
          • Path C:\providercommon\powershell.exe
          • Size 1.0MB
          • SHA256 b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          powershell.exe
          • Path C:\providercommon\powershell.exe
          • Size 1.0MB
          • SHA256 b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          powershell.exe
          • Path C:\providercommon\powershell.exe
          • Size 1.0MB
          • SHA256 b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          powershell.exe
          • Path C:\providercommon\powershell.exe
          • Size 1.0MB
          • SHA256 b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          powershell.exe
          • Path C:\providercommon\powershell.exe
          • Size 1.0MB
          • SHA256 b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          powershell.exe
          • Path C:\providercommon\powershell.exe
          • Size 1.0MB
          • SHA256 b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          powershell.exe
          • Path C:\providercommon\powershell.exe
          • Size 1.0MB
          • SHA256 b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          powershell.exe
          • Path C:\providercommon\powershell.exe
          • Size 1.0MB
          • SHA256 b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          powershell.exe
          • Path C:\providercommon\powershell.exe
          • Size 1.0MB
          • SHA256 b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          powershell.exe
          • Path C:\providercommon\powershell.exe
          • Size 1.0MB
          • SHA256 b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          powershell.exe
          • Path C:\providercommon\powershell.exe
          • Size 1.0MB
          • SHA256 b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          powershell.exe
          • Path C:\providercommon\powershell.exe
          • Size 1.0MB
          • SHA256 b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          powershell.exe
          • Path C:\providercommon\powershell.exe
          • Size 1.0MB
          • SHA256 b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          yTUdeXjbLOhnrN32dgrxVg.vbe
          • Path C:\providercommon\yTUdeXjbLOhnrN32dgrxVg.vbe
          • Size 197B
          • SHA256 2072cc9a4a3b84d4c5178ab41c5588eea7d0103e3928e34d64f17bf97f3d1cc1
          • MD5 SHA1 SHA512
          Submit Download

          memory/2288-330-0x0000000001430000-0x0000000001442000-memory.dmp
          Download

          memory/2716-150-0x0000000077A60000-0x0000000077BEE000-memory.dmp
          Download

          memory/2716-133-0x0000000077A60000-0x0000000077BEE000-memory.dmp
          Download

          memory/2716-167-0x0000000077A60000-0x0000000077BEE000-memory.dmp
          Download

          memory/2716-168-0x0000000077A60000-0x0000000077BEE000-memory.dmp
          Download

          memory/2716-169-0x0000000077A60000-0x0000000077BEE000-memory.dmp
          Download

          memory/2716-170-0x0000000077A60000-0x0000000077BEE000-memory.dmp
          Download

          memory/2716-171-0x0000000077A60000-0x0000000077BEE000-memory.dmp
          Download

          memory/2716-172-0x0000000077A60000-0x0000000077BEE000-memory.dmp
          Download

          memory/2716-174-0x0000000077A60000-0x0000000077BEE000-memory.dmp
          Download

          memory/2716-173-0x0000000077A60000-0x0000000077BEE000-memory.dmp
          Download

          memory/2716-175-0x0000000077A60000-0x0000000077BEE000-memory.dmp
          Download

          memory/2716-176-0x0000000077A60000-0x0000000077BEE000-memory.dmp
          Download

          memory/2716-177-0x0000000077A60000-0x0000000077BEE000-memory.dmp
          Download

          memory/2716-178-0x0000000077A60000-0x0000000077BEE000-memory.dmp
          Download

          memory/2716-179-0x0000000077A60000-0x0000000077BEE000-memory.dmp
          Download

          memory/2716-117-0x0000000077A60000-0x0000000077BEE000-memory.dmp
          Download

          memory/2716-118-0x0000000077A60000-0x0000000077BEE000-memory.dmp
          Download

          memory/2716-119-0x0000000077A60000-0x0000000077BEE000-memory.dmp
          Download

          memory/2716-158-0x0000000077A60000-0x0000000077BEE000-memory.dmp
          Download

          memory/2716-159-0x0000000077A60000-0x0000000077BEE000-memory.dmp
          Download

          memory/2716-116-0x0000000077A60000-0x0000000077BEE000-memory.dmp
          Download

          memory/2716-121-0x0000000077A60000-0x0000000077BEE000-memory.dmp
          Download

          memory/2716-157-0x0000000077A60000-0x0000000077BEE000-memory.dmp
          Download

          memory/2716-156-0x0000000077A60000-0x0000000077BEE000-memory.dmp
          Download

          memory/2716-161-0x0000000077A60000-0x0000000077BEE000-memory.dmp
          Download

          memory/2716-122-0x0000000077A60000-0x0000000077BEE000-memory.dmp
          Download

          memory/2716-149-0x0000000077A60000-0x0000000077BEE000-memory.dmp
          Download

          memory/2716-124-0x0000000077A60000-0x0000000077BEE000-memory.dmp
          Download

          memory/2716-125-0x0000000077A60000-0x0000000077BEE000-memory.dmp
          Download

          memory/2716-126-0x0000000077A60000-0x0000000077BEE000-memory.dmp
          Download

          memory/2716-127-0x0000000077A60000-0x0000000077BEE000-memory.dmp
          Download

          memory/2716-128-0x0000000077A60000-0x0000000077BEE000-memory.dmp
          Download

          memory/2716-155-0x0000000077A60000-0x0000000077BEE000-memory.dmp
          Download

          memory/2716-162-0x0000000077A60000-0x0000000077BEE000-memory.dmp
          Download

          memory/2716-154-0x0000000077A60000-0x0000000077BEE000-memory.dmp
          Download

          memory/2716-153-0x0000000077A60000-0x0000000077BEE000-memory.dmp
          Download

          memory/2716-152-0x0000000077A60000-0x0000000077BEE000-memory.dmp
          Download

          memory/2716-166-0x0000000077A60000-0x0000000077BEE000-memory.dmp
          Download

          memory/2716-151-0x0000000077A60000-0x0000000077BEE000-memory.dmp
          Download

          memory/2716-129-0x0000000077A60000-0x0000000077BEE000-memory.dmp
          Download

          memory/2716-164-0x0000000077A60000-0x0000000077BEE000-memory.dmp
          Download

          memory/2716-130-0x0000000077A60000-0x0000000077BEE000-memory.dmp
          Download

          memory/2716-160-0x0000000077A60000-0x0000000077BEE000-memory.dmp
          Download

          memory/2716-148-0x0000000077A60000-0x0000000077BEE000-memory.dmp
          Download

          memory/2716-131-0x0000000077A60000-0x0000000077BEE000-memory.dmp
          Download

          memory/2716-139-0x0000000077A60000-0x0000000077BEE000-memory.dmp
          Download

          memory/2716-132-0x0000000077A60000-0x0000000077BEE000-memory.dmp
          Download

          memory/2716-144-0x0000000077A60000-0x0000000077BEE000-memory.dmp
          Download

          memory/2716-145-0x0000000077A60000-0x0000000077BEE000-memory.dmp
          Download

          memory/2716-143-0x0000000077A60000-0x0000000077BEE000-memory.dmp
          Download

          memory/2716-146-0x0000000077A60000-0x0000000077BEE000-memory.dmp
          Download

          memory/2716-142-0x0000000077A60000-0x0000000077BEE000-memory.dmp
          Download

          memory/2716-165-0x0000000077A60000-0x0000000077BEE000-memory.dmp
          Download

          memory/2716-141-0x0000000077A60000-0x0000000077BEE000-memory.dmp
          Download

          memory/2716-147-0x0000000077A60000-0x0000000077BEE000-memory.dmp
          Download

          memory/2716-140-0x0000000077A60000-0x0000000077BEE000-memory.dmp
          Download

          memory/2716-138-0x0000000077A60000-0x0000000077BEE000-memory.dmp
          Download

          memory/2716-137-0x0000000077A60000-0x0000000077BEE000-memory.dmp
          Download

          memory/2716-163-0x0000000077A60000-0x0000000077BEE000-memory.dmp
          Download

          memory/2716-134-0x0000000077A60000-0x0000000077BEE000-memory.dmp
          Download

          memory/2716-135-0x0000000077A60000-0x0000000077BEE000-memory.dmp
          Download

          memory/2716-136-0x0000000077A60000-0x0000000077BEE000-memory.dmp
          Download

          memory/3884-284-0x00000000017D0000-0x00000000017DC000-memory.dmp
          Download

          memory/3884-285-0x0000000002F90000-0x0000000002F9C000-memory.dmp
          Download

          memory/3884-286-0x0000000002FA0000-0x0000000002FAC000-memory.dmp
          Download

          memory/3884-283-0x00000000017C0000-0x00000000017D2000-memory.dmp
          Download

          memory/3884-282-0x0000000000E20000-0x0000000000F30000-memory.dmp
          Download

          memory/4544-329-0x000001FDAB6D0000-0x000001FDAB6F2000-memory.dmp
          Download

          memory/4680-335-0x000002657B4D0000-0x000002657B546000-memory.dmp
          Download

          memory/4892-182-0x0000000077A60000-0x0000000077BEE000-memory.dmp
          Download

          memory/4892-181-0x0000000077A60000-0x0000000077BEE000-memory.dmp
          Download