dcrat | 993d6a31a0cf5809f0fbecf8ff45660c92159639348510d170d2a2e5575fb32b

Analysis

max time kernel
147s
max time network
142s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
01-11-2022 12:12

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

993d6a31a0cf5809f0fbecf8ff45660c92159639348510d170d2a2e5575fb32b.exe
Size

1.3MB
MD5

102ac8ccd8a5a0cffe8eb92d826a88ac
SHA1

1f5aca67bc02c9bab412489c53f52b68856b6c5e
SHA256

993d6a31a0cf5809f0fbecf8ff45660c92159639348510d170d2a2e5575fb32b
SHA512

89446d60274f416bc9dfc71dde33461d62c84a8011d9739e70c3746f1adff8858ce6a7753f11a2904ec4612aa955b952beee822e60724b5055dbcabcbaf9bf4f
SSDEEP

24576:U2G/nvxW3Ww0t6TnzGmVBDh4+aknuRRZJND0gFJ4rD/IjC:UbA30GnzV/q+DnsXg

Score

10^/10

dcrat infostealer rat

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat

Process spawned unexpected child process 12 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2084	644	schtasks.exe	62
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2268	644	schtasks.exe	62
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2604	644	schtasks.exe	62
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2796	644	schtasks.exe	62
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2416	644	schtasks.exe	62
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1276	644	schtasks.exe	62
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	488	644	schtasks.exe	62
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3988	644	schtasks.exe	62
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1292	644	schtasks.exe	62
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3672	644	schtasks.exe	62
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	988	644	schtasks.exe	62
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1140	644	schtasks.exe	62

DCRat payload 15 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral1/files/0x0003000000000723-137.dat	dcrat
behavioral1/files/0x0003000000000723-138.dat	dcrat
behavioral1/memory/216-139-0x0000000000AB0000-0x0000000000BC0000-memory.dmp	dcrat
behavioral1/files/0x0003000000000739-147.dat	dcrat
behavioral1/files/0x0003000000000739-148.dat	dcrat
behavioral1/files/0x0003000000000739-172.dat	dcrat
behavioral1/files/0x0003000000000739-180.dat	dcrat
behavioral1/files/0x0003000000000739-187.dat	dcrat
behavioral1/files/0x0003000000000739-194.dat	dcrat
behavioral1/files/0x0003000000000739-201.dat	dcrat
behavioral1/files/0x0003000000000739-208.dat	dcrat
behavioral1/files/0x0003000000000739-215.dat	dcrat
behavioral1/files/0x0003000000000739-222.dat	dcrat
behavioral1/files/0x0003000000000739-229.dat	dcrat
behavioral1/files/0x0003000000000739-236.dat	dcrat

Executes dropped EXE 12 IoCs

pid	Process
216	DllCommonsvc.exe
3952	explorer.exe
1836	explorer.exe
4888	explorer.exe
4092	explorer.exe
2624	explorer.exe
3248	explorer.exe
1416	explorer.exe
4556	explorer.exe
3400	explorer.exe
1572	explorer.exe
3484	explorer.exe

Checks computer location settings 2 TTPs 13 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation	DllCommonsvc.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation	explorer.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation	explorer.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation	explorer.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation	explorer.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation	explorer.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation	WScript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation	explorer.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation	explorer.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation	explorer.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation	explorer.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation	explorer.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation	993d6a31a0cf5809f0fbecf8ff45660c92159639348510d170d2a2e5575fb32b.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 12 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
2416	schtasks.exe
3988	schtasks.exe
1292	schtasks.exe
2084	schtasks.exe
2604	schtasks.exe
1276	schtasks.exe
488	schtasks.exe
3672	schtasks.exe
988	schtasks.exe
1140	schtasks.exe
2268	schtasks.exe
2796	schtasks.exe

Modifies registry class 11 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000_Classes\Local Settings	993d6a31a0cf5809f0fbecf8ff45660c92159639348510d170d2a2e5575fb32b.exe
Key created	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000_Classes\Local Settings	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000_Classes\Local Settings	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000_Classes\Local Settings	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000_Classes\Local Settings	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000_Classes\Local Settings	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000_Classes\Local Settings	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000_Classes\Local Settings	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000_Classes\Local Settings	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000_Classes\Local Settings	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000_Classes\Local Settings	explorer.exe

Suspicious behavior: EnumeratesProcesses 24 IoCs

pid	Process
216	DllCommonsvc.exe
216	DllCommonsvc.exe
216	DllCommonsvc.exe
2180	powershell.exe
4380	powershell.exe
2044	powershell.exe
388	powershell.exe
4692	powershell.exe
3952	explorer.exe
2180	powershell.exe
4380	powershell.exe
2044	powershell.exe
4692	powershell.exe
388	powershell.exe
1836	explorer.exe
4888	explorer.exe
4092	explorer.exe
2624	explorer.exe
3248	explorer.exe
1416	explorer.exe
4556	explorer.exe
3400	explorer.exe
1572	explorer.exe
3484	explorer.exe

Suspicious use of AdjustPrivilegeToken 17 IoCs

description	pid	Process
Token: SeDebugPrivilege	216	DllCommonsvc.exe
Token: SeDebugPrivilege	2180	powershell.exe
Token: SeDebugPrivilege	4380	powershell.exe
Token: SeDebugPrivilege	2044	powershell.exe
Token: SeDebugPrivilege	388	powershell.exe
Token: SeDebugPrivilege	4692	powershell.exe
Token: SeDebugPrivilege	3952	explorer.exe
Token: SeDebugPrivilege	1836	explorer.exe
Token: SeDebugPrivilege	4888	explorer.exe
Token: SeDebugPrivilege	4092	explorer.exe
Token: SeDebugPrivilege	2624	explorer.exe
Token: SeDebugPrivilege	3248	explorer.exe
Token: SeDebugPrivilege	1416	explorer.exe
Token: SeDebugPrivilege	4556	explorer.exe
Token: SeDebugPrivilege	3400	explorer.exe
Token: SeDebugPrivilege	1572	explorer.exe
Token: SeDebugPrivilege	3484	explorer.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3440 wrote to memory of 4828	3440	993d6a31a0cf5809f0fbecf8ff45660c92159639348510d170d2a2e5575fb32b.exe	80
PID 3440 wrote to memory of 4828	3440	993d6a31a0cf5809f0fbecf8ff45660c92159639348510d170d2a2e5575fb32b.exe	80
PID 3440 wrote to memory of 4828	3440	993d6a31a0cf5809f0fbecf8ff45660c92159639348510d170d2a2e5575fb32b.exe	80
PID 4828 wrote to memory of 2340	4828	WScript.exe	84
PID 4828 wrote to memory of 2340	4828	WScript.exe	84
PID 4828 wrote to memory of 2340	4828	WScript.exe	84
PID 2340 wrote to memory of 216	2340	cmd.exe	86
PID 2340 wrote to memory of 216	2340	cmd.exe	86
PID 216 wrote to memory of 388	216	DllCommonsvc.exe	100
PID 216 wrote to memory of 388	216	DllCommonsvc.exe	100
PID 216 wrote to memory of 2180	216	DllCommonsvc.exe	101
PID 216 wrote to memory of 2180	216	DllCommonsvc.exe	101
PID 216 wrote to memory of 2044	216	DllCommonsvc.exe	102
PID 216 wrote to memory of 2044	216	DllCommonsvc.exe	102
PID 216 wrote to memory of 4380	216	DllCommonsvc.exe	107
PID 216 wrote to memory of 4380	216	DllCommonsvc.exe	107
PID 216 wrote to memory of 4692	216	DllCommonsvc.exe	104
PID 216 wrote to memory of 4692	216	DllCommonsvc.exe	104
PID 216 wrote to memory of 3952	216	DllCommonsvc.exe	110
PID 216 wrote to memory of 3952	216	DllCommonsvc.exe	110
PID 3952 wrote to memory of 3276	3952	explorer.exe	113
PID 3952 wrote to memory of 3276	3952	explorer.exe	113
PID 3276 wrote to memory of 4368	3276	cmd.exe	115
PID 3276 wrote to memory of 4368	3276	cmd.exe	115
PID 3276 wrote to memory of 1836	3276	cmd.exe	117
PID 3276 wrote to memory of 1836	3276	cmd.exe	117
PID 1836 wrote to memory of 4928	1836	explorer.exe	118
PID 1836 wrote to memory of 4928	1836	explorer.exe	118
PID 4928 wrote to memory of 2472	4928	cmd.exe	120
PID 4928 wrote to memory of 2472	4928	cmd.exe	120
PID 4928 wrote to memory of 4888	4928	cmd.exe	121
PID 4928 wrote to memory of 4888	4928	cmd.exe	121
PID 4888 wrote to memory of 2200	4888	explorer.exe	122
PID 4888 wrote to memory of 2200	4888	explorer.exe	122
PID 2200 wrote to memory of 3268	2200	cmd.exe	124
PID 2200 wrote to memory of 3268	2200	cmd.exe	124
PID 2200 wrote to memory of 4092	2200	cmd.exe	125
PID 2200 wrote to memory of 4092	2200	cmd.exe	125
PID 4092 wrote to memory of 2404	4092	explorer.exe	126
PID 4092 wrote to memory of 2404	4092	explorer.exe	126
PID 2404 wrote to memory of 3916	2404	cmd.exe	128
PID 2404 wrote to memory of 3916	2404	cmd.exe	128
PID 2404 wrote to memory of 2624	2404	cmd.exe	129
PID 2404 wrote to memory of 2624	2404	cmd.exe	129
PID 2624 wrote to memory of 3956	2624	explorer.exe	130
PID 2624 wrote to memory of 3956	2624	explorer.exe	130
PID 3956 wrote to memory of 5040	3956	cmd.exe	132
PID 3956 wrote to memory of 5040	3956	cmd.exe	132
PID 3956 wrote to memory of 3248	3956	cmd.exe	133
PID 3956 wrote to memory of 3248	3956	cmd.exe	133
PID 3248 wrote to memory of 3948	3248	explorer.exe	134
PID 3248 wrote to memory of 3948	3248	explorer.exe	134
PID 3948 wrote to memory of 3968	3948	cmd.exe	136
PID 3948 wrote to memory of 3968	3948	cmd.exe	136
PID 3948 wrote to memory of 1416	3948	cmd.exe	137
PID 3948 wrote to memory of 1416	3948	cmd.exe	137
PID 1416 wrote to memory of 4308	1416	explorer.exe	138
PID 1416 wrote to memory of 4308	1416	explorer.exe	138
PID 4308 wrote to memory of 4064	4308	cmd.exe	140
PID 4308 wrote to memory of 4064	4308	cmd.exe	140
PID 4308 wrote to memory of 4556	4308	cmd.exe	141
PID 4308 wrote to memory of 4556	4308	cmd.exe	141
PID 4556 wrote to memory of 4520	4556	explorer.exe	142
PID 4556 wrote to memory of 4520	4556	explorer.exe	142

C:\Users\Admin\AppData\Local\Temp\993d6a31a0cf5809f0fbecf8ff45660c92159639348510d170d2a2e5575fb32b.exe
"C:\Users\Admin\AppData\Local\Temp\993d6a31a0cf5809f0fbecf8ff45660c92159639348510d170d2a2e5575fb32b.exe"
1⤵
- Checks computer location settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3440
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\providercommon\yTUdeXjbLOhnrN32dgrxVg.vbe"
  2⤵
  - Checks computer location settings
  - Suspicious use of WriteProcessMemory
  PID:4828
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\providercommon\1zu9dW.bat" "
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2340
  - - C:\providercommon\DllCommonsvc.exe
      "C:\providercommon\DllCommonsvc.exe"
      4⤵
      Executes dropped EXE
      Checks computer location settings
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:216
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\DllCommonsvc.exe'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:388
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\odt\dwm.exe'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2180
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Default\Recent\sihost.exe'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2044
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\odt\OfficeClickToRun.exe'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4692
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\explorer.exe'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4380
    - - C:\providercommon\explorer.exe
        
        "C:\providercommon\explorer.exe"
        5⤵
        Executes dropped EXE
        Checks computer location settings
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3952
      - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\iMm147yiIR.bat"
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:3276
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        7⤵
        
        PID:4368
        
        C:\providercommon\explorer.exe
        
        "C:\providercommon\explorer.exe"
        7⤵
        Executes dropped EXE
        Checks computer location settings
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1836
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\hJP5Gj8VmP.bat"
        8⤵
        Suspicious use of WriteProcessMemory
        
        PID:4928
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        9⤵
        
        PID:2472
        
        C:\providercommon\explorer.exe
        
        "C:\providercommon\explorer.exe"
        9⤵
        Executes dropped EXE
        Checks computer location settings
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4888
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\nDq7RH5Uwz.bat"
        10⤵
        Suspicious use of WriteProcessMemory
        
        PID:2200
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        11⤵
        
        PID:3268
        
        C:\providercommon\explorer.exe
        
        "C:\providercommon\explorer.exe"
        11⤵
        Executes dropped EXE
        Checks computer location settings
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4092
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\lHo4kC1bcD.bat"
        12⤵
        Suspicious use of WriteProcessMemory
        
        PID:2404
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        13⤵
        
        PID:3916
        
        C:\providercommon\explorer.exe
        
        "C:\providercommon\explorer.exe"
        13⤵
        Executes dropped EXE
        Checks computer location settings
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2624
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\kQw8FYVnXF.bat"
        14⤵
        Suspicious use of WriteProcessMemory
        
        PID:3956
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        15⤵
        
        PID:5040
        
        C:\providercommon\explorer.exe
        
        "C:\providercommon\explorer.exe"
        15⤵
        Executes dropped EXE
        Checks computer location settings
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3248
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\2wxi7FenmH.bat"
        16⤵
        Suspicious use of WriteProcessMemory
        
        PID:3948
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        17⤵
        
        PID:3968
        
        C:\providercommon\explorer.exe
        
        "C:\providercommon\explorer.exe"
        17⤵
        Executes dropped EXE
        Checks computer location settings
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1416
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\fZs2sOO0th.bat"
        18⤵
        Suspicious use of WriteProcessMemory
        
        PID:4308
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        19⤵
        
        PID:4064
        
        C:\providercommon\explorer.exe
        
        "C:\providercommon\explorer.exe"
        19⤵
        Executes dropped EXE
        Checks computer location settings
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4556
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\VeFqpJq3BV.bat"
        20⤵
        
        PID:4520
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        21⤵
        
        PID:2288
        
        C:\providercommon\explorer.exe
        
        "C:\providercommon\explorer.exe"
        21⤵
        Executes dropped EXE
        Checks computer location settings
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3400
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\bbT3NvUu3s.bat"
        22⤵
        
        PID:3500
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        23⤵
        
        PID:1640
        
        C:\providercommon\explorer.exe
        
        "C:\providercommon\explorer.exe"
        23⤵
        Executes dropped EXE
        Checks computer location settings
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1572
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\hJP5Gj8VmP.bat"
        24⤵
        
        PID:4704
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        25⤵
        
        PID:1628
        
        C:\providercommon\explorer.exe
        
        "C:\providercommon\explorer.exe"
        25⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3484

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 12 /tr "'C:\odt\dwm.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2084

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwm" /sc ONLOGON /tr "'C:\odt\dwm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2268

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 12 /tr "'C:\odt\dwm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2604

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sihosts" /sc MINUTE /mo 5 /tr "'C:\Users\Default\Recent\sihost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2796

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sihost" /sc ONLOGON /tr "'C:\Users\Default\Recent\sihost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2416

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sihosts" /sc MINUTE /mo 10 /tr "'C:\Users\Default\Recent\sihost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1276

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 11 /tr "'C:\providercommon\explorer.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:488

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorer" /sc ONLOGON /tr "'C:\providercommon\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3988

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 14 /tr "'C:\providercommon\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1292

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OfficeClickToRunO" /sc MINUTE /mo 8 /tr "'C:\odt\OfficeClickToRun.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3672

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OfficeClickToRun" /sc ONLOGON /tr "'C:\odt\OfficeClickToRun.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:988

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OfficeClickToRunO" /sc MINUTE /mo 11 /tr "'C:\odt\OfficeClickToRun.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1140

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Web Service

T1102

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\explorer.exe.log

Filesize
1KB

MD5
baf55b95da4a601229647f25dad12878

SHA1
abc16954ebfd213733c4493fc1910164d825cac8

SHA256
ee954c5d8156fd8890e582c716e5758ed9b33721258f10e758bdc31ccbcb1924

SHA512
24f502fedb1a305d0d7b08857ffc1db9b2359ff34e06d5748ecc84e35c985f29a20d9f0a533bea32d234ab37097ec0481620c63b14ac89b280e75e14d19fd545

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
d85ba6ff808d9e5444a4b369f5bc2730

SHA1
31aa9d96590fff6981b315e0b391b575e4c0804a

SHA256
84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

SHA512
8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
3a6bad9528f8e23fb5c77fbd81fa28e8

SHA1
f127317c3bc6407f536c0f0600dcbcf1aabfba36

SHA256
986366767de5873f1b170a63f2a33ce05132d1afd90c8f5017afbca8ef1beb05

SHA512
846002154a0ece6f3e9feda6f115d3161dc21b3789525dd62ae1d9188495171293efdbe7be4710666dd8a15e66b557315b5a02918a741ed1d5f3ff0c515b98e2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
3a6bad9528f8e23fb5c77fbd81fa28e8

SHA1
f127317c3bc6407f536c0f0600dcbcf1aabfba36

SHA256
986366767de5873f1b170a63f2a33ce05132d1afd90c8f5017afbca8ef1beb05

SHA512
846002154a0ece6f3e9feda6f115d3161dc21b3789525dd62ae1d9188495171293efdbe7be4710666dd8a15e66b557315b5a02918a741ed1d5f3ff0c515b98e2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
3a6bad9528f8e23fb5c77fbd81fa28e8

SHA1
f127317c3bc6407f536c0f0600dcbcf1aabfba36

SHA256
986366767de5873f1b170a63f2a33ce05132d1afd90c8f5017afbca8ef1beb05

SHA512
846002154a0ece6f3e9feda6f115d3161dc21b3789525dd62ae1d9188495171293efdbe7be4710666dd8a15e66b557315b5a02918a741ed1d5f3ff0c515b98e2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
59d97011e091004eaffb9816aa0b9abd

SHA1
1602a56b01dd4b7c577ca27d3117e4bcc1aa657b

SHA256
18f381e0db020a763b8c515c346ef58679ab9c403267eacfef5359e272f7e71d

SHA512
d9ca49c1a17580981e2c1a50d73c0eecaa7a62f8514741512172e395af2a3d80aeb0f71c58bc7f52c18246d57ba67af09b6bff4776877d6cc6f0245c30e092d6

Download Submit
C:\Users\Admin\AppData\Local\Temp\2wxi7FenmH.bat

Filesize
195B

MD5
277f5840acd0a11c4a59d1d337596a8d

SHA1
787fc0f914d52cfcaaa15b15ef1e00ef03a6751b

SHA256
eb3f3bddfa61f848b5874782a129af15d611a796784278f7eee67b1326d25b59

SHA512
bc3f30d93bbf1ee19aa47ab75c9fd6630d36e42706069a7256e2aec8d0a704656c24d40ea43df2b2ab245e0abc9fda55911ef79eeb11510822bc45c414a397cc

Download Submit
C:\Users\Admin\AppData\Local\Temp\VeFqpJq3BV.bat

Filesize
195B

MD5
6dda2f186ef36a71f26272d1f343320c

SHA1
c1e029b3ab59949c45ac1f0472c347cb2b962624

SHA256
45aed1db8cd0c0737e1cb0f3fd1b9fa7907985402049bf941cd37e862f400a5f

SHA512
065647128b681a4714fe45bc4e939a1d41368058ee2e41f317449b91af73d590227c3c28dcb65ce7fce9ec0e0587c89b4814aa3519a90c2b77e2c783bd4dabc8

Download Submit
C:\Users\Admin\AppData\Local\Temp\bbT3NvUu3s.bat

Filesize
195B

MD5
9786b38d647124949057ae27e03fdbf5

SHA1
833a8550067c1802b87f264ad2b1c18017a34780

SHA256
6825b5c8e6bed380f4faecabf65a615ba9399f89b45b2c572ae5a15fda143661

SHA512
a371cf2e81c9af001cbf98f8b8ae4bbf4f63f7dc0969ee1ec5254581617e62a2c5e235f3c41b58eba66268f7ec7df8e8be9b85ef0c51741251a6818c4b7f845a

Download Submit
C:\Users\Admin\AppData\Local\Temp\fZs2sOO0th.bat

Filesize
195B

MD5
4263dac60b6050295b9835c9eb84a6d6

SHA1
41d37d3d49367f8ad0ab77c0404f4ccf2c790914

SHA256
77a19d481a38c8d92549177cc0c2d0968784ee80d78b59e4c7b468867d48b582

SHA512
9aebe314cd95e7109f2ee0392c720addea312fd7a616cdc5065e4539d4e6dccb6fee004a6cc98badf821bbcff083793728c89f8ce99c32bde7391c9f711b2f2e

Download Submit
C:\Users\Admin\AppData\Local\Temp\hJP5Gj8VmP.bat

Filesize
195B

MD5
591636822170c1fca210766c7020df48

SHA1
af112c45ba120286383e44f8aeb119ac8a29cb9e

SHA256
59139c5997d1cc651abce2f32f972cd2c51d7435f37450d83fdec25ed9d6272e

SHA512
fad2160df8b4655ef2027a59ca885d31bd707c55411c35eb993dde0baad87afa13efedae6174620270f97c9dd16fe0d521b77eeb79f9c86d45580df9b0dc1cae

Download Submit
C:\Users\Admin\AppData\Local\Temp\hJP5Gj8VmP.bat

Filesize
195B

MD5
591636822170c1fca210766c7020df48

SHA1
af112c45ba120286383e44f8aeb119ac8a29cb9e

SHA256
59139c5997d1cc651abce2f32f972cd2c51d7435f37450d83fdec25ed9d6272e

SHA512
fad2160df8b4655ef2027a59ca885d31bd707c55411c35eb993dde0baad87afa13efedae6174620270f97c9dd16fe0d521b77eeb79f9c86d45580df9b0dc1cae

Download Submit
C:\Users\Admin\AppData\Local\Temp\iMm147yiIR.bat

Filesize
195B

MD5
cc6b5abb6adc405f5e8c74f7f0906d86

SHA1
c1c110cdc8aec3a3e59a2e1c23fc29e149c94772

SHA256
2be4c2fc89afb498fff3d73064e514e11584b88b74ebb73067365c890f20b9d5

SHA512
c73986c402fa137e04edba5b407a8ffaad8bce61d89d8023afccd1b0ac553e1e2813cb437357f6c705bbc2370f0caee2b00a62b0942205db6cfe7664678db20f

Download Submit
C:\Users\Admin\AppData\Local\Temp\kQw8FYVnXF.bat

Filesize
195B

MD5
73ee813b95678ac27bd60267470a573d

SHA1
94c7a5e6813dd37169e0a9fdacbe8b15b9c08d65

SHA256
82d3b2a61eb49aa6dc51f61c2fd6304c2544ca98df9d7a4c0578240f51403c5c

SHA512
1d3ed1d7827ee8b7b76ddbd66bf3856dee74b2ed1bf7892b188567cf1b6bdd5d296618577db11630cfe1e62b3a4b328818d62440a017e30ab782c82807962015

Download Submit
C:\Users\Admin\AppData\Local\Temp\lHo4kC1bcD.bat

Filesize
195B

MD5
077508066109898aea50a108044a2a60

SHA1
b896125edc80a5032c882c9041f4caaf6faf28b7

SHA256
b4d5d065d7c9db5d368047c94ba51d866f63291f9bb6de8e1a74522976ac7817

SHA512
e4b37762e4ccad968e5e9b3f4137dabdd3642c98c3c16fb7fb344104d83e16cdbb9bc69233a8009a3f88f35719a3580f6cd5cd5980b3ca0e795919b4f3a96541

Download Submit
C:\Users\Admin\AppData\Local\Temp\nDq7RH5Uwz.bat

Filesize
195B

MD5
7e10230b43b2a5ec2faf68da252f507b

SHA1
3180e2bdf4fcbc9d8ea3681e0afe36c8758fd3b6

SHA256
579149c7000117fb122cc03cf1509f32dc4ffa26175a53084e6aed7554b9ebcb

SHA512
7382280552028c93044b2d29a3c492f39eaf91841761531dcdecde68a5925630aafb67e084b8766c92a51aa25e26ea15e863f983f1824163efeabd67d7824cde

Download Submit
C:\providercommon\1zu9dW.bat

Filesize
36B

MD5
6783c3ee07c7d151ceac57f1f9c8bed7

SHA1
17468f98f95bf504cc1f83c49e49a78526b3ea03

SHA256
8ab782f0f327a2021530e7230d3aee8abbecb7eed59482a3a46e78b9e3862322

SHA512
c6012d4bfac1ed14d0fd9f0eabd0e1c3d647b343db292a907b246271d52a4b7469c809db43910ddba2e8c5045f9cb3d24d0af62d363281e6cb8b39ee94a183e8

Download Submit
C:\providercommon\DllCommonsvc.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\providercommon\DllCommonsvc.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\providercommon\explorer.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\providercommon\explorer.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\providercommon\explorer.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\providercommon\explorer.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\providercommon\explorer.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\providercommon\explorer.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\providercommon\explorer.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\providercommon\explorer.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\providercommon\explorer.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\providercommon\explorer.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\providercommon\explorer.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\providercommon\explorer.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\providercommon\yTUdeXjbLOhnrN32dgrxVg.vbe

Filesize
197B

MD5
8088241160261560a02c84025d107592

SHA1
083121f7027557570994c9fc211df61730455bb5

SHA256
2072cc9a4a3b84d4c5178ab41c5588eea7d0103e3928e34d64f17bf97f3d1cc1

SHA512
20d9369dd359315848ea30144383a0bb479d86059fdbc3b3256ac84f998193512feb3b1799ab663619920c99fe7e0ebba33ada31a3855094b956fcd351c90478

Download Submit
memory/216-151-0x00007FFA67560000-0x00007FFA68021000-memory.dmp

Filesize
10.8MB

Download
memory/216-136-0x0000000000000000-mapping.dmp

Download
memory/216-140-0x00007FFA67560000-0x00007FFA68021000-memory.dmp

Filesize
10.8MB

Download
memory/216-139-0x0000000000AB0000-0x0000000000BC0000-memory.dmp

Filesize
1.1MB

Download
memory/388-165-0x00007FFA67560000-0x00007FFA68021000-memory.dmp

Filesize
10.8MB

Download
memory/388-141-0x0000000000000000-mapping.dmp

Download
memory/388-155-0x00007FFA67560000-0x00007FFA68021000-memory.dmp

Filesize
10.8MB

Download
memory/1416-207-0x0000000000000000-mapping.dmp

Download
memory/1416-213-0x00007FFA67560000-0x00007FFA68021000-memory.dmp

Filesize
10.8MB

Download
memory/1416-209-0x00007FFA67560000-0x00007FFA68021000-memory.dmp

Filesize
10.8MB

Download
memory/1572-234-0x00007FFA67560000-0x00007FFA68021000-memory.dmp

Filesize
10.8MB

Download
memory/1572-230-0x00007FFA67560000-0x00007FFA68021000-memory.dmp

Filesize
10.8MB

Download
memory/1572-228-0x0000000000000000-mapping.dmp

Download
memory/1628-233-0x0000000000000000-mapping.dmp

Download
memory/1640-226-0x0000000000000000-mapping.dmp

Download
memory/1836-178-0x00007FFA67560000-0x00007FFA68021000-memory.dmp

Filesize
10.8MB

Download
memory/1836-174-0x00007FFA67560000-0x00007FFA68021000-memory.dmp

Filesize
10.8MB

Download
memory/1836-171-0x0000000000000000-mapping.dmp

Download
memory/2044-166-0x00007FFA67560000-0x00007FFA68021000-memory.dmp

Filesize
10.8MB

Download
memory/2044-143-0x0000000000000000-mapping.dmp

Download
memory/2044-153-0x00007FFA67560000-0x00007FFA68021000-memory.dmp

Filesize
10.8MB

Download
memory/2180-142-0x0000000000000000-mapping.dmp

Download
memory/2180-152-0x00007FFA67560000-0x00007FFA68021000-memory.dmp

Filesize
10.8MB

Download
memory/2180-163-0x00007FFA67560000-0x00007FFA68021000-memory.dmp

Filesize
10.8MB

Download
memory/2200-182-0x0000000000000000-mapping.dmp

Download
memory/2288-219-0x0000000000000000-mapping.dmp

Download
memory/2340-135-0x0000000000000000-mapping.dmp

Download
memory/2404-189-0x0000000000000000-mapping.dmp

Download
memory/2472-177-0x0000000000000000-mapping.dmp

Download
memory/2624-193-0x0000000000000000-mapping.dmp

Download
memory/2624-195-0x00007FFA67560000-0x00007FFA68021000-memory.dmp

Filesize
10.8MB

Download
memory/2624-199-0x00007FFA67560000-0x00007FFA68021000-memory.dmp

Filesize
10.8MB

Download
memory/3248-202-0x00007FFA67560000-0x00007FFA68021000-memory.dmp

Filesize
10.8MB

Download
memory/3248-206-0x00007FFA67560000-0x00007FFA68021000-memory.dmp

Filesize
10.8MB

Download
memory/3248-200-0x0000000000000000-mapping.dmp

Download
memory/3268-184-0x0000000000000000-mapping.dmp

Download
memory/3276-167-0x0000000000000000-mapping.dmp

Download
memory/3400-221-0x0000000000000000-mapping.dmp

Download
memory/3400-223-0x00007FFA67560000-0x00007FFA68021000-memory.dmp

Filesize
10.8MB

Download
memory/3400-227-0x00007FFA67560000-0x00007FFA68021000-memory.dmp

Filesize
10.8MB

Download
memory/3484-237-0x00007FFA67560000-0x00007FFA68021000-memory.dmp

Filesize
10.8MB

Download
memory/3484-235-0x0000000000000000-mapping.dmp

Download
memory/3500-224-0x0000000000000000-mapping.dmp

Download
memory/3916-191-0x0000000000000000-mapping.dmp

Download
memory/3948-203-0x0000000000000000-mapping.dmp

Download
memory/3952-146-0x0000000000000000-mapping.dmp

Download
memory/3952-156-0x00007FFA67560000-0x00007FFA68021000-memory.dmp

Filesize
10.8MB

Download
memory/3952-168-0x00007FFA67560000-0x00007FFA68021000-memory.dmp

Filesize
10.8MB

Download
memory/3956-196-0x0000000000000000-mapping.dmp

Download
memory/3968-205-0x0000000000000000-mapping.dmp

Download
memory/4064-212-0x0000000000000000-mapping.dmp

Download
memory/4092-186-0x0000000000000000-mapping.dmp

Download
memory/4092-188-0x00007FFA67560000-0x00007FFA68021000-memory.dmp

Filesize
10.8MB

Download
memory/4092-192-0x00007FFA67560000-0x00007FFA68021000-memory.dmp

Filesize
10.8MB

Download
memory/4308-210-0x0000000000000000-mapping.dmp

Download
memory/4368-170-0x0000000000000000-mapping.dmp

Download
memory/4380-149-0x000002317B5D0000-0x000002317B5F2000-memory.dmp

Filesize
136KB

Download
memory/4380-144-0x0000000000000000-mapping.dmp

Download
memory/4380-161-0x00007FFA67560000-0x00007FFA68021000-memory.dmp

Filesize
10.8MB

Download
memory/4380-150-0x00007FFA67560000-0x00007FFA68021000-memory.dmp

Filesize
10.8MB

Download
memory/4520-217-0x0000000000000000-mapping.dmp

Download
memory/4556-220-0x00007FFA67560000-0x00007FFA68021000-memory.dmp

Filesize
10.8MB

Download
memory/4556-216-0x00007FFA67560000-0x00007FFA68021000-memory.dmp

Filesize
10.8MB

Download
memory/4556-214-0x0000000000000000-mapping.dmp

Download
memory/4692-162-0x00007FFA67560000-0x00007FFA68021000-memory.dmp

Filesize
10.8MB

Download
memory/4692-154-0x00007FFA67560000-0x00007FFA68021000-memory.dmp

Filesize
10.8MB

Download
memory/4692-145-0x0000000000000000-mapping.dmp

Download
memory/4704-231-0x0000000000000000-mapping.dmp

Download
memory/4828-132-0x0000000000000000-mapping.dmp

Download
memory/4888-179-0x0000000000000000-mapping.dmp

Download
memory/4888-181-0x00007FFA67560000-0x00007FFA68021000-memory.dmp

Filesize
10.8MB

Download
memory/4888-185-0x00007FFA67560000-0x00007FFA68021000-memory.dmp

Filesize
10.8MB

Download
memory/4928-175-0x0000000000000000-mapping.dmp

Download
memory/5040-198-0x0000000000000000-mapping.dmp

Download