Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    151s
  • max time network
    152s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220812-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
  • submitted
    02/11/2022, 06:16

General

  • Target

    c2951f3235965e1e63051cad63ab3334b6203d5d140530592f54a791b12d2e4e.exe

  • Size

    1.3MB

  • MD5

    b8c412d799e0ba5dbd0eba2db4866d13

  • SHA1

    b1b526412090b7c01cdfc53df3e5c846e6ba0b62

  • SHA256

    c2951f3235965e1e63051cad63ab3334b6203d5d140530592f54a791b12d2e4e

  • SHA512

    fe3bfb648824d9e698d1f7c7c6967236f3884a9dea1020f742d3ba99f9102ae3b6f6d136ca17d6e824ebbb903ceae8a70123616aade6416147afc6bfacd48e28

  • SSDEEP

    24576:U2G/nvxW3Ww0t6TnzGmVBDh4+aknuRRZJND0gFJ4rD/IjC:UbA30GnzV/q+DnsXg

Score
10/10

Malware Config

Signatures

  • DcRat

    DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

  • Process spawned unexpected child process 24 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • DCRat payload 15 IoCs

    Detects payload of DCRat, commonly dropped by NSIS installers.

  • Executes dropped EXE 12 IoCs
  • Checks computer location settings 2 TTPs 14 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Legitimate hosting services abused for malware hosting/C2 1 TTPs
  • Drops file in System32 directory 3 IoCs
  • Drops file in Program Files directory 2 IoCs
  • Drops file in Windows directory 8 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Creates scheduled task(s) 1 TTPs 24 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Modifies registry class 12 IoCs
  • Suspicious behavior: EnumeratesProcesses 40 IoCs
  • Suspicious use of AdjustPrivilegeToken 21 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\c2951f3235965e1e63051cad63ab3334b6203d5d140530592f54a791b12d2e4e.exe
    "C:\Users\Admin\AppData\Local\Temp\c2951f3235965e1e63051cad63ab3334b6203d5d140530592f54a791b12d2e4e.exe"
    1⤵
    • Checks computer location settings
    • Modifies registry class
    • Suspicious use of WriteProcessMemory
    PID:2268
    • C:\Windows\SysWOW64\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\providercommon\yTUdeXjbLOhnrN32dgrxVg.vbe"
      2⤵
      • Checks computer location settings
      • Suspicious use of WriteProcessMemory
      PID:3744
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /c ""C:\providercommon\1zu9dW.bat" "
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:4888
        • C:\providercommon\DllCommonsvc.exe
          "C:\providercommon\DllCommonsvc.exe"
          4⤵
          • Executes dropped EXE
          • Checks computer location settings
          • Drops file in System32 directory
          • Drops file in Program Files directory
          • Drops file in Windows directory
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:2080
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\DllCommonsvc.exe'
            5⤵
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:1516
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\SysWOW64\sru\explorer.exe'
            5⤵
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:1936
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\WindowsRE\wininit.exe'
            5⤵
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:2176
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\RuntimeBroker.exe'
            5⤵
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:2504
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\ShellExperiences\dllhost.exe'
            5⤵
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:4612
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\AppReadiness\RuntimeBroker.exe'
            5⤵
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:4680
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Windows Mail\dllhost.exe'
            5⤵
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:1340
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\Containers\serviced\WaaSMedicAgent.exe'
            5⤵
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:5044
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\addins\conhost.exe'
            5⤵
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:4500
          • C:\Windows\Containers\serviced\WaaSMedicAgent.exe
            "C:\Windows\Containers\serviced\WaaSMedicAgent.exe"
            5⤵
            • Executes dropped EXE
            • Checks computer location settings
            • Modifies registry class
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of WriteProcessMemory
            PID:2216
            • C:\Windows\System32\cmd.exe
              "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\5irhJyFUC1.bat"
              6⤵
              • Suspicious use of WriteProcessMemory
              PID:1272
              • C:\Windows\Containers\serviced\WaaSMedicAgent.exe
                "C:\Windows\Containers\serviced\WaaSMedicAgent.exe"
                7⤵
                • Executes dropped EXE
                • Checks computer location settings
                • Modifies registry class
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of AdjustPrivilegeToken
                • Suspicious use of WriteProcessMemory
                PID:4184
                • C:\Windows\System32\cmd.exe
                  "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\hGpPWS23Hw.bat"
                  8⤵
                  • Suspicious use of WriteProcessMemory
                  PID:3656
                  • C:\Windows\system32\w32tm.exe
                    w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                    9⤵
                      PID:640
                    • C:\Windows\Containers\serviced\WaaSMedicAgent.exe
                      "C:\Windows\Containers\serviced\WaaSMedicAgent.exe"
                      9⤵
                      • Executes dropped EXE
                      • Checks computer location settings
                      • Modifies registry class
                      • Suspicious behavior: EnumeratesProcesses
                      • Suspicious use of AdjustPrivilegeToken
                      • Suspicious use of WriteProcessMemory
                      PID:4744
                      • C:\Windows\System32\cmd.exe
                        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\hGpPWS23Hw.bat"
                        10⤵
                        • Suspicious use of WriteProcessMemory
                        PID:396
                        • C:\Windows\system32\w32tm.exe
                          w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                          11⤵
                            PID:1064
                          • C:\Windows\Containers\serviced\WaaSMedicAgent.exe
                            "C:\Windows\Containers\serviced\WaaSMedicAgent.exe"
                            11⤵
                            • Executes dropped EXE
                            • Checks computer location settings
                            • Modifies registry class
                            • Suspicious behavior: EnumeratesProcesses
                            • Suspicious use of AdjustPrivilegeToken
                            • Suspicious use of WriteProcessMemory
                            PID:1636
                            • C:\Windows\System32\cmd.exe
                              "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\KVYyjDtEXm.bat"
                              12⤵
                              • Suspicious use of WriteProcessMemory
                              PID:1128
                              • C:\Windows\system32\w32tm.exe
                                w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                                13⤵
                                  PID:744
                                • C:\Windows\Containers\serviced\WaaSMedicAgent.exe
                                  "C:\Windows\Containers\serviced\WaaSMedicAgent.exe"
                                  13⤵
                                  • Executes dropped EXE
                                  • Checks computer location settings
                                  • Modifies registry class
                                  • Suspicious behavior: EnumeratesProcesses
                                  • Suspicious use of AdjustPrivilegeToken
                                  • Suspicious use of WriteProcessMemory
                                  PID:3760
                                  • C:\Windows\System32\cmd.exe
                                    "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\fBgHK1Vy37.bat"
                                    14⤵
                                    • Suspicious use of WriteProcessMemory
                                    PID:1444
                                    • C:\Windows\system32\w32tm.exe
                                      w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                                      15⤵
                                        PID:4660
                                      • C:\Windows\Containers\serviced\WaaSMedicAgent.exe
                                        "C:\Windows\Containers\serviced\WaaSMedicAgent.exe"
                                        15⤵
                                        • Executes dropped EXE
                                        • Checks computer location settings
                                        • Modifies registry class
                                        • Suspicious behavior: EnumeratesProcesses
                                        • Suspicious use of AdjustPrivilegeToken
                                        • Suspicious use of WriteProcessMemory
                                        PID:2600
                                        • C:\Windows\System32\cmd.exe
                                          "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\l7tVtcAquU.bat"
                                          16⤵
                                          • Suspicious use of WriteProcessMemory
                                          PID:1456
                                          • C:\Windows\system32\w32tm.exe
                                            w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                                            17⤵
                                              PID:4680
                                            • C:\Windows\Containers\serviced\WaaSMedicAgent.exe
                                              "C:\Windows\Containers\serviced\WaaSMedicAgent.exe"
                                              17⤵
                                              • Executes dropped EXE
                                              • Checks computer location settings
                                              • Modifies registry class
                                              • Suspicious behavior: EnumeratesProcesses
                                              • Suspicious use of AdjustPrivilegeToken
                                              PID:2740
                                              • C:\Windows\System32\cmd.exe
                                                "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\1kSioVLOLD.bat"
                                                18⤵
                                                  PID:1956
                                                  • C:\Windows\system32\w32tm.exe
                                                    w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                                                    19⤵
                                                      PID:3744
                                                    • C:\Windows\Containers\serviced\WaaSMedicAgent.exe
                                                      "C:\Windows\Containers\serviced\WaaSMedicAgent.exe"
                                                      19⤵
                                                      • Executes dropped EXE
                                                      • Checks computer location settings
                                                      • Modifies registry class
                                                      • Suspicious behavior: EnumeratesProcesses
                                                      • Suspicious use of AdjustPrivilegeToken
                                                      PID:2192
                                                      • C:\Windows\System32\cmd.exe
                                                        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\DhSpfyjZaR.bat"
                                                        20⤵
                                                          PID:4564
                                                          • C:\Windows\system32\w32tm.exe
                                                            w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                                                            21⤵
                                                              PID:4336
                                                            • C:\Windows\Containers\serviced\WaaSMedicAgent.exe
                                                              "C:\Windows\Containers\serviced\WaaSMedicAgent.exe"
                                                              21⤵
                                                              • Executes dropped EXE
                                                              • Checks computer location settings
                                                              • Modifies registry class
                                                              • Suspicious behavior: EnumeratesProcesses
                                                              • Suspicious use of AdjustPrivilegeToken
                                                              PID:848
                                                              • C:\Windows\System32\cmd.exe
                                                                "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\voEVGuhWUp.bat"
                                                                22⤵
                                                                  PID:1972
                                                                  • C:\Windows\system32\w32tm.exe
                                                                    w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                                                                    23⤵
                                                                      PID:3128
                                                                    • C:\Windows\Containers\serviced\WaaSMedicAgent.exe
                                                                      "C:\Windows\Containers\serviced\WaaSMedicAgent.exe"
                                                                      23⤵
                                                                      • Executes dropped EXE
                                                                      • Checks computer location settings
                                                                      • Modifies registry class
                                                                      • Suspicious behavior: EnumeratesProcesses
                                                                      • Suspicious use of AdjustPrivilegeToken
                                                                      PID:4388
                                                                      • C:\Windows\System32\cmd.exe
                                                                        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\7etkz3INVn.bat"
                                                                        24⤵
                                                                          PID:4280
                                                                          • C:\Windows\system32\w32tm.exe
                                                                            w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                                                                            25⤵
                                                                              PID:2000
                                                                            • C:\Windows\Containers\serviced\WaaSMedicAgent.exe
                                                                              "C:\Windows\Containers\serviced\WaaSMedicAgent.exe"
                                                                              25⤵
                                                                              • Executes dropped EXE
                                                                              • Checks computer location settings
                                                                              • Modifies registry class
                                                                              • Suspicious behavior: EnumeratesProcesses
                                                                              • Suspicious use of AdjustPrivilegeToken
                                                                              PID:1776
                                                                              • C:\Windows\System32\cmd.exe
                                                                                "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\voEVGuhWUp.bat"
                                                                                26⤵
                                                                                  PID:3712
                                                                                  • C:\Windows\system32\w32tm.exe
                                                                                    w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                                                                                    27⤵
                                                                                      PID:4888
                                • C:\Windows\system32\schtasks.exe
                                  schtasks.exe /create /tn "explorere" /sc MINUTE /mo 13 /tr "'C:\Windows\SysWOW64\sru\explorer.exe'" /f
                                  1⤵
                                  • Process spawned unexpected child process
                                  • Creates scheduled task(s)
                                  PID:3792
                                • C:\Windows\system32\schtasks.exe
                                  schtasks.exe /create /tn "explorer" /sc ONLOGON /tr "'C:\Windows\SysWOW64\sru\explorer.exe'" /rl HIGHEST /f
                                  1⤵
                                  • Process spawned unexpected child process
                                  • Creates scheduled task(s)
                                  PID:3716
                                • C:\Windows\system32\schtasks.exe
                                  schtasks.exe /create /tn "explorere" /sc MINUTE /mo 12 /tr "'C:\Windows\SysWOW64\sru\explorer.exe'" /rl HIGHEST /f
                                  1⤵
                                  • Process spawned unexpected child process
                                  • Creates scheduled task(s)
                                  PID:4308
                                • C:\Windows\system32\schtasks.exe
                                  schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 10 /tr "'C:\Recovery\WindowsRE\wininit.exe'" /f
                                  1⤵
                                  • Process spawned unexpected child process
                                  • Creates scheduled task(s)
                                  PID:5064
                                • C:\Windows\system32\schtasks.exe
                                  schtasks.exe /create /tn "wininit" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\wininit.exe'" /rl HIGHEST /f
                                  1⤵
                                  • Process spawned unexpected child process
                                  • Creates scheduled task(s)
                                  PID:772
                                • C:\Windows\system32\schtasks.exe
                                  schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 14 /tr "'C:\Recovery\WindowsRE\wininit.exe'" /rl HIGHEST /f
                                  1⤵
                                  • Process spawned unexpected child process
                                  • Creates scheduled task(s)
                                  PID:4944
                                • C:\Windows\system32\schtasks.exe
                                  schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 10 /tr "'C:\providercommon\RuntimeBroker.exe'" /f
                                  1⤵
                                  • Process spawned unexpected child process
                                  • Creates scheduled task(s)
                                  PID:4468
                                • C:\Windows\system32\schtasks.exe
                                  schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\providercommon\RuntimeBroker.exe'" /rl HIGHEST /f
                                  1⤵
                                  • Process spawned unexpected child process
                                  • Creates scheduled task(s)
                                  PID:4880
                                • C:\Windows\system32\schtasks.exe
                                  schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 10 /tr "'C:\providercommon\RuntimeBroker.exe'" /rl HIGHEST /f
                                  1⤵
                                  • Process spawned unexpected child process
                                  • Creates scheduled task(s)
                                  PID:1332
                                • C:\Windows\system32\schtasks.exe
                                  schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 5 /tr "'C:\Windows\ShellExperiences\dllhost.exe'" /f
                                  1⤵
                                  • Process spawned unexpected child process
                                  • Creates scheduled task(s)
                                  PID:3804
                                • C:\Windows\system32\schtasks.exe
                                  schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Windows\ShellExperiences\dllhost.exe'" /rl HIGHEST /f
                                  1⤵
                                  • Process spawned unexpected child process
                                  • Creates scheduled task(s)
                                  PID:5100
                                • C:\Windows\system32\schtasks.exe
                                  schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 7 /tr "'C:\Windows\ShellExperiences\dllhost.exe'" /rl HIGHEST /f
                                  1⤵
                                  • Process spawned unexpected child process
                                  • Creates scheduled task(s)
                                  PID:356
                                • C:\Windows\system32\schtasks.exe
                                  schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 10 /tr "'C:\Windows\AppReadiness\RuntimeBroker.exe'" /f
                                  1⤵
                                  • Process spawned unexpected child process
                                  • Creates scheduled task(s)
                                  PID:1272
                                  • C:\Windows\system32\w32tm.exe
                                    w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                                    2⤵
                                      PID:2432
                                  • C:\Windows\system32\schtasks.exe
                                    schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Windows\AppReadiness\RuntimeBroker.exe'" /rl HIGHEST /f
                                    1⤵
                                    • Process spawned unexpected child process
                                    • Creates scheduled task(s)
                                    PID:1292
                                  • C:\Windows\system32\schtasks.exe
                                    schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 12 /tr "'C:\Windows\AppReadiness\RuntimeBroker.exe'" /rl HIGHEST /f
                                    1⤵
                                    • Process spawned unexpected child process
                                    • Creates scheduled task(s)
                                    PID:3276
                                  • C:\Windows\system32\schtasks.exe
                                    schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 10 /tr "'C:\Program Files (x86)\Windows Mail\dllhost.exe'" /f
                                    1⤵
                                    • Process spawned unexpected child process
                                    • Creates scheduled task(s)
                                    PID:1092
                                  • C:\Windows\system32\schtasks.exe
                                    schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Mail\dllhost.exe'" /rl HIGHEST /f
                                    1⤵
                                    • Process spawned unexpected child process
                                    • Creates scheduled task(s)
                                    PID:1416
                                  • C:\Windows\system32\schtasks.exe
                                    schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 7 /tr "'C:\Program Files (x86)\Windows Mail\dllhost.exe'" /rl HIGHEST /f
                                    1⤵
                                    • Process spawned unexpected child process
                                    • Creates scheduled task(s)
                                    PID:2900
                                  • C:\Windows\system32\schtasks.exe
                                    schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 11 /tr "'C:\Windows\addins\conhost.exe'" /f
                                    1⤵
                                    • Process spawned unexpected child process
                                    • Creates scheduled task(s)
                                    PID:3588
                                  • C:\Windows\system32\schtasks.exe
                                    schtasks.exe /create /tn "conhost" /sc ONLOGON /tr "'C:\Windows\addins\conhost.exe'" /rl HIGHEST /f
                                    1⤵
                                    • Process spawned unexpected child process
                                    • Creates scheduled task(s)
                                    PID:2828
                                  • C:\Windows\system32\schtasks.exe
                                    schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 13 /tr "'C:\Windows\addins\conhost.exe'" /rl HIGHEST /f
                                    1⤵
                                    • Process spawned unexpected child process
                                    • Creates scheduled task(s)
                                    PID:4280
                                  • C:\Windows\system32\schtasks.exe
                                    schtasks.exe /create /tn "WaaSMedicAgentW" /sc MINUTE /mo 11 /tr "'C:\Windows\Containers\serviced\WaaSMedicAgent.exe'" /f
                                    1⤵
                                    • Process spawned unexpected child process
                                    • Creates scheduled task(s)
                                    PID:4848
                                  • C:\Windows\system32\schtasks.exe
                                    schtasks.exe /create /tn "WaaSMedicAgent" /sc ONLOGON /tr "'C:\Windows\Containers\serviced\WaaSMedicAgent.exe'" /rl HIGHEST /f
                                    1⤵
                                    • Process spawned unexpected child process
                                    • Creates scheduled task(s)
                                    PID:4284
                                  • C:\Windows\system32\schtasks.exe
                                    schtasks.exe /create /tn "WaaSMedicAgentW" /sc MINUTE /mo 12 /tr "'C:\Windows\Containers\serviced\WaaSMedicAgent.exe'" /rl HIGHEST /f
                                    1⤵
                                    • Process spawned unexpected child process
                                    • Creates scheduled task(s)
                                    PID:2772

                                  Network

                                  MITRE ATT&CK Enterprise v6

                                  Replay Monitor

                                  Loading Replay Monitor...

                                  Downloads

                                  • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\WaaSMedicAgent.exe.log

                                    Filesize

                                    1KB

                                    MD5

                                    baf55b95da4a601229647f25dad12878

                                    SHA1

                                    abc16954ebfd213733c4493fc1910164d825cac8

                                    SHA256

                                    ee954c5d8156fd8890e582c716e5758ed9b33721258f10e758bdc31ccbcb1924

                                    SHA512

                                    24f502fedb1a305d0d7b08857ffc1db9b2359ff34e06d5748ecc84e35c985f29a20d9f0a533bea32d234ab37097ec0481620c63b14ac89b280e75e14d19fd545

                                  • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

                                    Filesize

                                    2KB

                                    MD5

                                    d85ba6ff808d9e5444a4b369f5bc2730

                                    SHA1

                                    31aa9d96590fff6981b315e0b391b575e4c0804a

                                    SHA256

                                    84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

                                    SHA512

                                    8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

                                  • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                    Filesize

                                    944B

                                    MD5

                                    5f0ddc7f3691c81ee14d17b419ba220d

                                    SHA1

                                    f0ef5fde8bab9d17c0b47137e014c91be888ee53

                                    SHA256

                                    a31805264b8b13ce4145f272cb2830728c186c46e314b48514d636866217add5

                                    SHA512

                                    2ce7c2a0833f581297c13dd88ccfcd36bf129d2b5d7718c52b1d67c97cbd8fc93abc085a040229a0fd712e880c690de7f6b996b0b47c46a091fabb7931be58d3

                                  • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                    Filesize

                                    944B

                                    MD5

                                    ecceac16628651c18879d836acfcb062

                                    SHA1

                                    420502b3e5220a01586c59504e94aa1ee11982c9

                                    SHA256

                                    58238de09a8817ed9f894ed8e5bf06a897fd08e0b0bd77e508d37b2598edd2a9

                                    SHA512

                                    be3c7cb529cafb00f58790a6f8b35c4ff6db9f7f43a507d2218fd80cebc88413e46f71b1bc35b8afcc36b68f9409c946470d1e74a4fe225400eeb6f3f898f5b3

                                  • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                    Filesize

                                    944B

                                    MD5

                                    ecceac16628651c18879d836acfcb062

                                    SHA1

                                    420502b3e5220a01586c59504e94aa1ee11982c9

                                    SHA256

                                    58238de09a8817ed9f894ed8e5bf06a897fd08e0b0bd77e508d37b2598edd2a9

                                    SHA512

                                    be3c7cb529cafb00f58790a6f8b35c4ff6db9f7f43a507d2218fd80cebc88413e46f71b1bc35b8afcc36b68f9409c946470d1e74a4fe225400eeb6f3f898f5b3

                                  • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                    Filesize

                                    944B

                                    MD5

                                    ecceac16628651c18879d836acfcb062

                                    SHA1

                                    420502b3e5220a01586c59504e94aa1ee11982c9

                                    SHA256

                                    58238de09a8817ed9f894ed8e5bf06a897fd08e0b0bd77e508d37b2598edd2a9

                                    SHA512

                                    be3c7cb529cafb00f58790a6f8b35c4ff6db9f7f43a507d2218fd80cebc88413e46f71b1bc35b8afcc36b68f9409c946470d1e74a4fe225400eeb6f3f898f5b3

                                  • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                    Filesize

                                    944B

                                    MD5

                                    ecceac16628651c18879d836acfcb062

                                    SHA1

                                    420502b3e5220a01586c59504e94aa1ee11982c9

                                    SHA256

                                    58238de09a8817ed9f894ed8e5bf06a897fd08e0b0bd77e508d37b2598edd2a9

                                    SHA512

                                    be3c7cb529cafb00f58790a6f8b35c4ff6db9f7f43a507d2218fd80cebc88413e46f71b1bc35b8afcc36b68f9409c946470d1e74a4fe225400eeb6f3f898f5b3

                                  • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                    Filesize

                                    944B

                                    MD5

                                    aaaac7c68d2b7997ed502c26fd9f65c2

                                    SHA1

                                    7c5a3731300d672bf53c43e2f9e951c745f7fbdf

                                    SHA256

                                    8724dc2c3c8e8f17aeefae44a23741b1ea3b43c490fbc52fd61575ffe1cd82bb

                                    SHA512

                                    c526febd9430413b48bed976edd9a795793ad1f06c8ff4f6b768b4ad63f4d2f06b9da72d4fcfa7cb9530a64e2dc3554f5ad97fd0ab60129701d175f2724ef1ac

                                  • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                    Filesize

                                    944B

                                    MD5

                                    aaaac7c68d2b7997ed502c26fd9f65c2

                                    SHA1

                                    7c5a3731300d672bf53c43e2f9e951c745f7fbdf

                                    SHA256

                                    8724dc2c3c8e8f17aeefae44a23741b1ea3b43c490fbc52fd61575ffe1cd82bb

                                    SHA512

                                    c526febd9430413b48bed976edd9a795793ad1f06c8ff4f6b768b4ad63f4d2f06b9da72d4fcfa7cb9530a64e2dc3554f5ad97fd0ab60129701d175f2724ef1ac

                                  • C:\Users\Admin\AppData\Local\Temp\1kSioVLOLD.bat

                                    Filesize

                                    214B

                                    MD5

                                    de483b14346ae5f77726803114e4a2b4

                                    SHA1

                                    bb57bb08bba8a4a9e6f85ce09679192a306269ba

                                    SHA256

                                    daa957b16c7b5e6ace0d8dc47077ab59112c50d62292bbdfbf4b32b5f695665d

                                    SHA512

                                    0c73cc5da1bef4ca3dc7deeaaab5b95fc5fd44488ce3ae2835861ae9aa7655b1c0ae0a44627935af145c7e61d9836c672cd2be5a67044fba320ecc034a27a61e

                                  • C:\Users\Admin\AppData\Local\Temp\5irhJyFUC1.bat

                                    Filesize

                                    214B

                                    MD5

                                    1bc6cc28da6a1c6195460ea8e2f85cf5

                                    SHA1

                                    17c413d27b395d2a141f05c065240fe15d831c44

                                    SHA256

                                    d63247609a68a39b9ea9f08c7d98c737cbe425b0f9b7d86a2a78e4acbf649bf1

                                    SHA512

                                    310b23f7cc4b60855ec3580d43b37f2f4951c15485021a0fd21dbbbb6057caa752fa7089f8702adcb06a74a22bdd0305396e7b9b9cb1a20986fa7bf7f369b2ef

                                  • C:\Users\Admin\AppData\Local\Temp\7etkz3INVn.bat

                                    Filesize

                                    214B

                                    MD5

                                    c552bcffe85a8ae6d3131e21104bf749

                                    SHA1

                                    fb929a635c1853f696b93d3aa3ad0ccf4036d69f

                                    SHA256

                                    16ee4500ae0cbc0333d29ff63b5bdcf608b928e47a5b5242705eba29e971c73d

                                    SHA512

                                    b3d451bb6acfc221d005daa195eb2555895d4c3e03af2898d9da2af8630a88bf7df15575266b5f3dd0a71d0eb04cfdf4a69c6e4262bc7af5d8ea93cfc449b16a

                                  • C:\Users\Admin\AppData\Local\Temp\DhSpfyjZaR.bat

                                    Filesize

                                    214B

                                    MD5

                                    eb2b78533bf255c12fe77cc803358c7a

                                    SHA1

                                    573401d3c48724ffb32776304b6af581e0607afb

                                    SHA256

                                    8abcce3f48fdec8a517c284a8c5f5aabb6fd0f784ecb39e8fe0bcf34c605bfd6

                                    SHA512

                                    7748586914bdecdaf8f449d12ff29542ff9b63482d20752a54ba01f0104f8cc3e611afc79359e15d0f67d4dde7a06c342972fd12fb525f02d251b26e6e787fa5

                                  • C:\Users\Admin\AppData\Local\Temp\KVYyjDtEXm.bat

                                    Filesize

                                    214B

                                    MD5

                                    aca3c1aef5e6cd043b9be6dacda5e60e

                                    SHA1

                                    b168d4589ac20404e581a347de46c5506eb27289

                                    SHA256

                                    854034fb028109fb6641a09e09c397ca127cbdf8158b1e840504f8d8b8b123bd

                                    SHA512

                                    980deef553e3e1e3246b353862a568d9184afc31f553ea69ad9085f2a8c6322e943447b6cbb1d9871a84a8133dd98151c78f7ed61eaa0837d6c8f0694a52a9df

                                  • C:\Users\Admin\AppData\Local\Temp\fBgHK1Vy37.bat

                                    Filesize

                                    214B

                                    MD5

                                    bf7c09e8f409ba2e56b89f4bc62f08e5

                                    SHA1

                                    f03aca14b840949c0299e0e5630f8bf0ad0d0e12

                                    SHA256

                                    ee917e73bf035673b267280e0c724ea4fa55ed17ad68cae3a0b361cf6f9d9b56

                                    SHA512

                                    2594a0b3c3315fe53b29ae99abddbbc78a78dc340f462ef53676adc2c9029bcff9a232055ad2f3407856ba36d72bcdf036cfd4ff34e5514c39c06922b37234e3

                                  • C:\Users\Admin\AppData\Local\Temp\hGpPWS23Hw.bat

                                    Filesize

                                    214B

                                    MD5

                                    460d0a3d86aab7c066467037dd4de409

                                    SHA1

                                    12ea7758a9f978d70a4e3e45e1f48d33d5eadb08

                                    SHA256

                                    380c4bf8070b14139b0fec576baf3a4701255a650203359f2967511120d1beb5

                                    SHA512

                                    96df441cac8233f2d94bad42f67ca269e2be5e2490350dc0e15b0c09937f303a86b31d2e705b8833a78df62c8a6eb284d2a87b9eeab0225343e6cade03c702ac

                                  • C:\Users\Admin\AppData\Local\Temp\hGpPWS23Hw.bat

                                    Filesize

                                    214B

                                    MD5

                                    460d0a3d86aab7c066467037dd4de409

                                    SHA1

                                    12ea7758a9f978d70a4e3e45e1f48d33d5eadb08

                                    SHA256

                                    380c4bf8070b14139b0fec576baf3a4701255a650203359f2967511120d1beb5

                                    SHA512

                                    96df441cac8233f2d94bad42f67ca269e2be5e2490350dc0e15b0c09937f303a86b31d2e705b8833a78df62c8a6eb284d2a87b9eeab0225343e6cade03c702ac

                                  • C:\Users\Admin\AppData\Local\Temp\l7tVtcAquU.bat

                                    Filesize

                                    214B

                                    MD5

                                    7a6ff3f2a3c96ab4c80fc98903e59b51

                                    SHA1

                                    ad7a20e541f8ce3bf231e8cd3eea9e319b3a6283

                                    SHA256

                                    fcc44326b2222887210f364c50e6aa656e7d9fdc7da1dcd496edf1d1db149ffb

                                    SHA512

                                    efd50a6a2dcd6ac03cc9102ee9f9ed66044f45fbca1eedd5ace379821d3c45619101fda684d487551162bfd1c951b6fb5b03a9c68dc708d2924bc817f466d9a8

                                  • C:\Users\Admin\AppData\Local\Temp\voEVGuhWUp.bat

                                    Filesize

                                    214B

                                    MD5

                                    31aa2b8b1d93eb975078befea3affbca

                                    SHA1

                                    7f348cf8f6ed9973157cb7064cea4be51eb2c44e

                                    SHA256

                                    e60b6b2595d23ff6d7d26e86c5134aef75c3ddf44b74d382e5a498ef8b88f8ae

                                    SHA512

                                    067f3d303762d49bcd62034ff82279857cd3f817c899266a56e411f29a39886e3efb83916cdfdab26790be3054f204af83a5c2cdca40709d35888451b82c0e77

                                  • C:\Users\Admin\AppData\Local\Temp\voEVGuhWUp.bat

                                    Filesize

                                    214B

                                    MD5

                                    31aa2b8b1d93eb975078befea3affbca

                                    SHA1

                                    7f348cf8f6ed9973157cb7064cea4be51eb2c44e

                                    SHA256

                                    e60b6b2595d23ff6d7d26e86c5134aef75c3ddf44b74d382e5a498ef8b88f8ae

                                    SHA512

                                    067f3d303762d49bcd62034ff82279857cd3f817c899266a56e411f29a39886e3efb83916cdfdab26790be3054f204af83a5c2cdca40709d35888451b82c0e77

                                  • C:\Windows\Containers\serviced\WaaSMedicAgent.exe

                                    Filesize

                                    1.0MB

                                    MD5

                                    bd31e94b4143c4ce49c17d3af46bcad0

                                    SHA1

                                    f8c51ff3ff909531d9469d4ba1bbabae101853ff

                                    SHA256

                                    b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

                                    SHA512

                                    f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

                                  • C:\Windows\Containers\serviced\WaaSMedicAgent.exe

                                    Filesize

                                    1.0MB

                                    MD5

                                    bd31e94b4143c4ce49c17d3af46bcad0

                                    SHA1

                                    f8c51ff3ff909531d9469d4ba1bbabae101853ff

                                    SHA256

                                    b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

                                    SHA512

                                    f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

                                  • C:\Windows\Containers\serviced\WaaSMedicAgent.exe

                                    Filesize

                                    1.0MB

                                    MD5

                                    bd31e94b4143c4ce49c17d3af46bcad0

                                    SHA1

                                    f8c51ff3ff909531d9469d4ba1bbabae101853ff

                                    SHA256

                                    b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

                                    SHA512

                                    f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

                                  • C:\Windows\Containers\serviced\WaaSMedicAgent.exe

                                    Filesize

                                    1.0MB

                                    MD5

                                    bd31e94b4143c4ce49c17d3af46bcad0

                                    SHA1

                                    f8c51ff3ff909531d9469d4ba1bbabae101853ff

                                    SHA256

                                    b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

                                    SHA512

                                    f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

                                  • C:\Windows\Containers\serviced\WaaSMedicAgent.exe

                                    Filesize

                                    1.0MB

                                    MD5

                                    bd31e94b4143c4ce49c17d3af46bcad0

                                    SHA1

                                    f8c51ff3ff909531d9469d4ba1bbabae101853ff

                                    SHA256

                                    b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

                                    SHA512

                                    f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

                                  • C:\Windows\Containers\serviced\WaaSMedicAgent.exe

                                    Filesize

                                    1.0MB

                                    MD5

                                    bd31e94b4143c4ce49c17d3af46bcad0

                                    SHA1

                                    f8c51ff3ff909531d9469d4ba1bbabae101853ff

                                    SHA256

                                    b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

                                    SHA512

                                    f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

                                  • C:\Windows\Containers\serviced\WaaSMedicAgent.exe

                                    Filesize

                                    1.0MB

                                    MD5

                                    bd31e94b4143c4ce49c17d3af46bcad0

                                    SHA1

                                    f8c51ff3ff909531d9469d4ba1bbabae101853ff

                                    SHA256

                                    b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

                                    SHA512

                                    f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

                                  • C:\Windows\Containers\serviced\WaaSMedicAgent.exe

                                    Filesize

                                    1.0MB

                                    MD5

                                    bd31e94b4143c4ce49c17d3af46bcad0

                                    SHA1

                                    f8c51ff3ff909531d9469d4ba1bbabae101853ff

                                    SHA256

                                    b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

                                    SHA512

                                    f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

                                  • C:\Windows\Containers\serviced\WaaSMedicAgent.exe

                                    Filesize

                                    1.0MB

                                    MD5

                                    bd31e94b4143c4ce49c17d3af46bcad0

                                    SHA1

                                    f8c51ff3ff909531d9469d4ba1bbabae101853ff

                                    SHA256

                                    b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

                                    SHA512

                                    f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

                                  • C:\Windows\Containers\serviced\WaaSMedicAgent.exe

                                    Filesize

                                    1.0MB

                                    MD5

                                    bd31e94b4143c4ce49c17d3af46bcad0

                                    SHA1

                                    f8c51ff3ff909531d9469d4ba1bbabae101853ff

                                    SHA256

                                    b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

                                    SHA512

                                    f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

                                  • C:\Windows\Containers\serviced\WaaSMedicAgent.exe

                                    Filesize

                                    1.0MB

                                    MD5

                                    bd31e94b4143c4ce49c17d3af46bcad0

                                    SHA1

                                    f8c51ff3ff909531d9469d4ba1bbabae101853ff

                                    SHA256

                                    b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

                                    SHA512

                                    f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

                                  • C:\Windows\Containers\serviced\WaaSMedicAgent.exe

                                    Filesize

                                    1.0MB

                                    MD5

                                    bd31e94b4143c4ce49c17d3af46bcad0

                                    SHA1

                                    f8c51ff3ff909531d9469d4ba1bbabae101853ff

                                    SHA256

                                    b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

                                    SHA512

                                    f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

                                  • C:\providercommon\1zu9dW.bat

                                    Filesize

                                    36B

                                    MD5

                                    6783c3ee07c7d151ceac57f1f9c8bed7

                                    SHA1

                                    17468f98f95bf504cc1f83c49e49a78526b3ea03

                                    SHA256

                                    8ab782f0f327a2021530e7230d3aee8abbecb7eed59482a3a46e78b9e3862322

                                    SHA512

                                    c6012d4bfac1ed14d0fd9f0eabd0e1c3d647b343db292a907b246271d52a4b7469c809db43910ddba2e8c5045f9cb3d24d0af62d363281e6cb8b39ee94a183e8

                                  • C:\providercommon\DllCommonsvc.exe

                                    Filesize

                                    1.0MB

                                    MD5

                                    bd31e94b4143c4ce49c17d3af46bcad0

                                    SHA1

                                    f8c51ff3ff909531d9469d4ba1bbabae101853ff

                                    SHA256

                                    b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

                                    SHA512

                                    f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

                                  • C:\providercommon\DllCommonsvc.exe

                                    Filesize

                                    1.0MB

                                    MD5

                                    bd31e94b4143c4ce49c17d3af46bcad0

                                    SHA1

                                    f8c51ff3ff909531d9469d4ba1bbabae101853ff

                                    SHA256

                                    b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

                                    SHA512

                                    f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

                                  • C:\providercommon\yTUdeXjbLOhnrN32dgrxVg.vbe

                                    Filesize

                                    197B

                                    MD5

                                    8088241160261560a02c84025d107592

                                    SHA1

                                    083121f7027557570994c9fc211df61730455bb5

                                    SHA256

                                    2072cc9a4a3b84d4c5178ab41c5588eea7d0103e3928e34d64f17bf97f3d1cc1

                                    SHA512

                                    20d9369dd359315848ea30144383a0bb479d86059fdbc3b3256ac84f998193512feb3b1799ab663619920c99fe7e0ebba33ada31a3855094b956fcd351c90478

                                  • memory/848-243-0x00007FFBFE530000-0x00007FFBFEFF1000-memory.dmp

                                    Filesize

                                    10.8MB

                                  • memory/848-239-0x00007FFBFE530000-0x00007FFBFEFF1000-memory.dmp

                                    Filesize

                                    10.8MB

                                  • memory/1340-180-0x00007FFBFE530000-0x00007FFBFEFF1000-memory.dmp

                                    Filesize

                                    10.8MB

                                  • memory/1340-161-0x00007FFBFE530000-0x00007FFBFEFF1000-memory.dmp

                                    Filesize

                                    10.8MB

                                  • memory/1516-162-0x00007FFBFE530000-0x00007FFBFEFF1000-memory.dmp

                                    Filesize

                                    10.8MB

                                  • memory/1516-176-0x00007FFBFE530000-0x00007FFBFEFF1000-memory.dmp

                                    Filesize

                                    10.8MB

                                  • memory/1636-208-0x00007FFBFE530000-0x00007FFBFEFF1000-memory.dmp

                                    Filesize

                                    10.8MB

                                  • memory/1636-204-0x00007FFBFE530000-0x00007FFBFEFF1000-memory.dmp

                                    Filesize

                                    10.8MB

                                  • memory/1776-254-0x00007FFBFE530000-0x00007FFBFEFF1000-memory.dmp

                                    Filesize

                                    10.8MB

                                  • memory/1776-258-0x00007FFBFE530000-0x00007FFBFEFF1000-memory.dmp

                                    Filesize

                                    10.8MB

                                  • memory/1936-155-0x00007FFBFE530000-0x00007FFBFEFF1000-memory.dmp

                                    Filesize

                                    10.8MB

                                  • memory/1936-174-0x00007FFBFE530000-0x00007FFBFEFF1000-memory.dmp

                                    Filesize

                                    10.8MB

                                  • memory/2080-156-0x00007FFBFE530000-0x00007FFBFEFF1000-memory.dmp

                                    Filesize

                                    10.8MB

                                  • memory/2080-140-0x0000000000B50000-0x0000000000C60000-memory.dmp

                                    Filesize

                                    1.1MB

                                  • memory/2080-141-0x00007FFBFE530000-0x00007FFBFEFF1000-memory.dmp

                                    Filesize

                                    10.8MB

                                  • memory/2176-175-0x00007FFBFE530000-0x00007FFBFEFF1000-memory.dmp

                                    Filesize

                                    10.8MB

                                  • memory/2176-157-0x00007FFBFE530000-0x00007FFBFEFF1000-memory.dmp

                                    Filesize

                                    10.8MB

                                  • memory/2192-232-0x00007FFBFE530000-0x00007FFBFEFF1000-memory.dmp

                                    Filesize

                                    10.8MB

                                  • memory/2192-236-0x00007FFBFE530000-0x00007FFBFEFF1000-memory.dmp

                                    Filesize

                                    10.8MB

                                  • memory/2216-165-0x00007FFBFE530000-0x00007FFBFEFF1000-memory.dmp

                                    Filesize

                                    10.8MB

                                  • memory/2216-186-0x00007FFBFE530000-0x00007FFBFEFF1000-memory.dmp

                                    Filesize

                                    10.8MB

                                  • memory/2504-154-0x00000186FD850000-0x00000186FD872000-memory.dmp

                                    Filesize

                                    136KB

                                  • memory/2504-158-0x00007FFBFE530000-0x00007FFBFEFF1000-memory.dmp

                                    Filesize

                                    10.8MB

                                  • memory/2504-168-0x00007FFBFE530000-0x00007FFBFEFF1000-memory.dmp

                                    Filesize

                                    10.8MB

                                  • memory/2600-222-0x00007FFBFE530000-0x00007FFBFEFF1000-memory.dmp

                                    Filesize

                                    10.8MB

                                  • memory/2600-218-0x00007FFBFE530000-0x00007FFBFEFF1000-memory.dmp

                                    Filesize

                                    10.8MB

                                  • memory/2740-225-0x00007FFBFE530000-0x00007FFBFEFF1000-memory.dmp

                                    Filesize

                                    10.8MB

                                  • memory/2740-229-0x00007FFBFE530000-0x00007FFBFEFF1000-memory.dmp

                                    Filesize

                                    10.8MB

                                  • memory/3760-211-0x00007FFBFE530000-0x00007FFBFEFF1000-memory.dmp

                                    Filesize

                                    10.8MB

                                  • memory/3760-215-0x00007FFBFE530000-0x00007FFBFEFF1000-memory.dmp

                                    Filesize

                                    10.8MB

                                  • memory/4184-194-0x00007FFBFE530000-0x00007FFBFEFF1000-memory.dmp

                                    Filesize

                                    10.8MB

                                  • memory/4184-190-0x00007FFBFE530000-0x00007FFBFEFF1000-memory.dmp

                                    Filesize

                                    10.8MB

                                  • memory/4388-251-0x00007FFBFE530000-0x00007FFBFEFF1000-memory.dmp

                                    Filesize

                                    10.8MB

                                  • memory/4388-247-0x00007FFBFE530000-0x00007FFBFEFF1000-memory.dmp

                                    Filesize

                                    10.8MB

                                  • memory/4388-246-0x00007FFBFE530000-0x00007FFBFEFF1000-memory.dmp

                                    Filesize

                                    10.8MB

                                  • memory/4500-163-0x00007FFBFE530000-0x00007FFBFEFF1000-memory.dmp

                                    Filesize

                                    10.8MB

                                  • memory/4500-178-0x00007FFBFE530000-0x00007FFBFEFF1000-memory.dmp

                                    Filesize

                                    10.8MB

                                  • memory/4612-159-0x00007FFBFE530000-0x00007FFBFEFF1000-memory.dmp

                                    Filesize

                                    10.8MB

                                  • memory/4612-171-0x00007FFBFE530000-0x00007FFBFEFF1000-memory.dmp

                                    Filesize

                                    10.8MB

                                  • memory/4680-177-0x00007FFBFE530000-0x00007FFBFEFF1000-memory.dmp

                                    Filesize

                                    10.8MB

                                  • memory/4680-160-0x00007FFBFE530000-0x00007FFBFEFF1000-memory.dmp

                                    Filesize

                                    10.8MB

                                  • memory/4744-197-0x00007FFBFE530000-0x00007FFBFEFF1000-memory.dmp

                                    Filesize

                                    10.8MB

                                  • memory/4744-201-0x00007FFBFE530000-0x00007FFBFEFF1000-memory.dmp

                                    Filesize

                                    10.8MB

                                  • memory/5044-182-0x00007FFBFE530000-0x00007FFBFEFF1000-memory.dmp

                                    Filesize

                                    10.8MB

                                  • memory/5044-164-0x00007FFBFE530000-0x00007FFBFEFF1000-memory.dmp

                                    Filesize

                                    10.8MB