dcrat | 3a66ac13660930bf8737be0a5306e7c8dc8fb24ea61031d15924239338225ae3

Analysis

max time kernel
150s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
03/11/2022, 06:44

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3a66ac13660930bf8737be0a5306e7c8dc8fb24ea61031d15924239338225ae3.exe
Size

1.3MB
MD5

61d15654b44e1268f8793c4ef7a8e31a
SHA1

3fa4b1f49cb1f7fd392cbe80207a88c8008c674a
SHA256

3a66ac13660930bf8737be0a5306e7c8dc8fb24ea61031d15924239338225ae3
SHA512

d01709cc14849a70dbd530f54a2b737cd15033b30296396788c20d0c64bc1ff4bad966adc9f93e0ada386590ee14451d4f1aeef9a0fe8e1b26822fbc544afffc
SSDEEP

24576:U2G/nvxW3Ww0t6TnzGmVBDh4+aknuRRZJND0gFJ4rD/IjC:UbA30GnzV/q+DnsXg

Score

10^/10

dcrat infostealer rat

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat

Process spawned unexpected child process 6 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3112	3756	schtasks.exe	12
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4112	3756	schtasks.exe	12
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3396	3756	schtasks.exe	12
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	756	3756	schtasks.exe	12
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3000	3756	schtasks.exe	12
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4924	3756	schtasks.exe	12

DCRat payload 16 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral1/files/0x0002000000021b43-137.dat	dcrat
behavioral1/files/0x0002000000021b43-138.dat	dcrat
behavioral1/memory/3100-139-0x0000000000B30000-0x0000000000C40000-memory.dmp	dcrat
behavioral1/files/0x0006000000022e11-154.dat	dcrat
behavioral1/files/0x0006000000022e11-155.dat	dcrat
behavioral1/files/0x0006000000022e11-162.dat	dcrat
behavioral1/files/0x0006000000022e11-170.dat	dcrat
behavioral1/files/0x0006000000022e11-177.dat	dcrat
behavioral1/files/0x0006000000022e11-184.dat	dcrat
behavioral1/files/0x0006000000022e11-190.dat	dcrat
behavioral1/files/0x0006000000022e11-198.dat	dcrat
behavioral1/files/0x0006000000022e11-205.dat	dcrat
behavioral1/files/0x0006000000022e11-212.dat	dcrat
behavioral1/files/0x0006000000022e11-219.dat	dcrat
behavioral1/files/0x0006000000022e11-226.dat	dcrat
behavioral1/files/0x0006000000022e11-233.dat	dcrat

Executes dropped EXE 13 IoCs

pid	Process
3100	DllCommonsvc.exe
1216	winlogon.exe
3932	winlogon.exe
3928	winlogon.exe
3036	winlogon.exe
4420	winlogon.exe
4992	winlogon.exe
3732	winlogon.exe
2424	winlogon.exe
4188	winlogon.exe
4424	winlogon.exe
3084	winlogon.exe
1656	winlogon.exe

Checks computer location settings 2 TTPs 15 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation	WScript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation	DllCommonsvc.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation	winlogon.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation	winlogon.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation	winlogon.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation	winlogon.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation	3a66ac13660930bf8737be0a5306e7c8dc8fb24ea61031d15924239338225ae3.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation	winlogon.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation	winlogon.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation	winlogon.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation	winlogon.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation	winlogon.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation	winlogon.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation	winlogon.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation	winlogon.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

Drops file in Program Files directory 3 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\fr\fontdrvhost.exe	DllCommonsvc.exe
File opened for modification	C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\fr\fontdrvhost.exe	DllCommonsvc.exe
File created	C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\fr\5b884080fd4f94	DllCommonsvc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 6 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
3396	schtasks.exe
756	schtasks.exe
3000	schtasks.exe
4924	schtasks.exe
3112	schtasks.exe
4112	schtasks.exe

Modifies registry class 14 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings	DllCommonsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings	winlogon.exe
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings	winlogon.exe
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings	winlogon.exe
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings	winlogon.exe
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings	3a66ac13660930bf8737be0a5306e7c8dc8fb24ea61031d15924239338225ae3.exe
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings	winlogon.exe
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings	winlogon.exe
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings	winlogon.exe
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings	winlogon.exe
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings	winlogon.exe
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings	winlogon.exe
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings	winlogon.exe
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings	winlogon.exe

Suspicious behavior: EnumeratesProcesses 19 IoCs

pid	Process
3100	DllCommonsvc.exe
1992	powershell.exe
4256	powershell.exe
4256	powershell.exe
2244	powershell.exe
2244	powershell.exe
1992	powershell.exe
1216	winlogon.exe
3932	winlogon.exe
3928	winlogon.exe
3036	winlogon.exe
4420	winlogon.exe
4992	winlogon.exe
3732	winlogon.exe
2424	winlogon.exe
4188	winlogon.exe
4424	winlogon.exe
3084	winlogon.exe
1656	winlogon.exe

Suspicious use of AdjustPrivilegeToken 16 IoCs

description	pid	Process
Token: SeDebugPrivilege	3100	DllCommonsvc.exe
Token: SeDebugPrivilege	1992	powershell.exe
Token: SeDebugPrivilege	4256	powershell.exe
Token: SeDebugPrivilege	2244	powershell.exe
Token: SeDebugPrivilege	1216	winlogon.exe
Token: SeDebugPrivilege	3932	winlogon.exe
Token: SeDebugPrivilege	3928	winlogon.exe
Token: SeDebugPrivilege	3036	winlogon.exe
Token: SeDebugPrivilege	4420	winlogon.exe
Token: SeDebugPrivilege	4992	winlogon.exe
Token: SeDebugPrivilege	3732	winlogon.exe
Token: SeDebugPrivilege	2424	winlogon.exe
Token: SeDebugPrivilege	4188	winlogon.exe
Token: SeDebugPrivilege	4424	winlogon.exe
Token: SeDebugPrivilege	3084	winlogon.exe
Token: SeDebugPrivilege	1656	winlogon.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5092 wrote to memory of 1868	5092	3a66ac13660930bf8737be0a5306e7c8dc8fb24ea61031d15924239338225ae3.exe	80
PID 5092 wrote to memory of 1868	5092	3a66ac13660930bf8737be0a5306e7c8dc8fb24ea61031d15924239338225ae3.exe	80
PID 5092 wrote to memory of 1868	5092	3a66ac13660930bf8737be0a5306e7c8dc8fb24ea61031d15924239338225ae3.exe	80
PID 1868 wrote to memory of 4268	1868	WScript.exe	84
PID 1868 wrote to memory of 4268	1868	WScript.exe	84
PID 1868 wrote to memory of 4268	1868	WScript.exe	84
PID 4268 wrote to memory of 3100	4268	cmd.exe	86
PID 4268 wrote to memory of 3100	4268	cmd.exe	86
PID 3100 wrote to memory of 2244	3100	DllCommonsvc.exe	93
PID 3100 wrote to memory of 2244	3100	DllCommonsvc.exe	93
PID 3100 wrote to memory of 1992	3100	DllCommonsvc.exe	94
PID 3100 wrote to memory of 1992	3100	DllCommonsvc.exe	94
PID 3100 wrote to memory of 4256	3100	DllCommonsvc.exe	96
PID 3100 wrote to memory of 4256	3100	DllCommonsvc.exe	96
PID 3100 wrote to memory of 3768	3100	DllCommonsvc.exe	99
PID 3100 wrote to memory of 3768	3100	DllCommonsvc.exe	99
PID 3768 wrote to memory of 4352	3768	cmd.exe	101
PID 3768 wrote to memory of 4352	3768	cmd.exe	101
PID 3768 wrote to memory of 1216	3768	cmd.exe	105
PID 3768 wrote to memory of 1216	3768	cmd.exe	105
PID 1216 wrote to memory of 4776	1216	winlogon.exe	106
PID 1216 wrote to memory of 4776	1216	winlogon.exe	106
PID 4776 wrote to memory of 2236	4776	cmd.exe	108
PID 4776 wrote to memory of 2236	4776	cmd.exe	108
PID 4776 wrote to memory of 3932	4776	cmd.exe	109
PID 4776 wrote to memory of 3932	4776	cmd.exe	109
PID 3932 wrote to memory of 3060	3932	winlogon.exe	111
PID 3932 wrote to memory of 3060	3932	winlogon.exe	111
PID 3060 wrote to memory of 2184	3060	cmd.exe	113
PID 3060 wrote to memory of 2184	3060	cmd.exe	113
PID 3060 wrote to memory of 3928	3060	cmd.exe	114
PID 3060 wrote to memory of 3928	3060	cmd.exe	114
PID 3928 wrote to memory of 5092	3928	winlogon.exe	115
PID 3928 wrote to memory of 5092	3928	winlogon.exe	115
PID 5092 wrote to memory of 4244	5092	cmd.exe	117
PID 5092 wrote to memory of 4244	5092	cmd.exe	117
PID 5092 wrote to memory of 3036	5092	cmd.exe	118
PID 5092 wrote to memory of 3036	5092	cmd.exe	118
PID 3036 wrote to memory of 4112	3036	winlogon.exe	119
PID 3036 wrote to memory of 4112	3036	winlogon.exe	119
PID 4112 wrote to memory of 4072	4112	cmd.exe	121
PID 4112 wrote to memory of 4072	4112	cmd.exe	121
PID 4112 wrote to memory of 4420	4112	cmd.exe	122
PID 4112 wrote to memory of 4420	4112	cmd.exe	122
PID 4420 wrote to memory of 1092	4420	winlogon.exe	123
PID 4420 wrote to memory of 1092	4420	winlogon.exe	123
PID 1092 wrote to memory of 3468	1092	cmd.exe	125
PID 1092 wrote to memory of 3468	1092	cmd.exe	125
PID 1092 wrote to memory of 4992	1092	cmd.exe	126
PID 1092 wrote to memory of 4992	1092	cmd.exe	126
PID 4992 wrote to memory of 224	4992	winlogon.exe	127
PID 4992 wrote to memory of 224	4992	winlogon.exe	127
PID 224 wrote to memory of 4656	224	cmd.exe	129
PID 224 wrote to memory of 4656	224	cmd.exe	129
PID 224 wrote to memory of 3732	224	cmd.exe	130
PID 224 wrote to memory of 3732	224	cmd.exe	130
PID 3732 wrote to memory of 2244	3732	winlogon.exe	131
PID 3732 wrote to memory of 2244	3732	winlogon.exe	131
PID 2244 wrote to memory of 1116	2244	cmd.exe	133
PID 2244 wrote to memory of 1116	2244	cmd.exe	133
PID 2244 wrote to memory of 2424	2244	cmd.exe	134
PID 2244 wrote to memory of 2424	2244	cmd.exe	134
PID 2424 wrote to memory of 4900	2424	winlogon.exe	135
PID 2424 wrote to memory of 4900	2424	winlogon.exe	135

C:\Users\Admin\AppData\Local\Temp\3a66ac13660930bf8737be0a5306e7c8dc8fb24ea61031d15924239338225ae3.exe
"C:\Users\Admin\AppData\Local\Temp\3a66ac13660930bf8737be0a5306e7c8dc8fb24ea61031d15924239338225ae3.exe"
1⤵
- Checks computer location settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:5092
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\providercommon\yTUdeXjbLOhnrN32dgrxVg.vbe"
  2⤵
  - Checks computer location settings
  - Suspicious use of WriteProcessMemory
  PID:1868
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\providercommon\1zu9dW.bat" "
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4268
  - - C:\providercommon\DllCommonsvc.exe
      "C:\providercommon\DllCommonsvc.exe"
      4⤵
      Executes dropped EXE
      Checks computer location settings
      Drops file in Program Files directory
      Modifies registry class
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:3100
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\DllCommonsvc.exe'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2244
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\fr\fontdrvhost.exe'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1992
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\winlogon.exe'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4256
    - - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\qkGQTc9WKx.bat"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:3768
      - C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        6⤵
        
        PID:4352
      - C:\providercommon\winlogon.exe
        
        "C:\providercommon\winlogon.exe"
        6⤵
        Executes dropped EXE
        Checks computer location settings
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1216
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\HAJBVlyJNQ.bat"
        7⤵
        Suspicious use of WriteProcessMemory
        
        PID:4776
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        8⤵
        
        PID:2236
        
        C:\providercommon\winlogon.exe
        
        "C:\providercommon\winlogon.exe"
        8⤵
        Executes dropped EXE
        Checks computer location settings
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3932
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\yXZnhMCmO6.bat"
        9⤵
        Suspicious use of WriteProcessMemory
        
        PID:3060
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        10⤵
        
        PID:2184
        
        C:\providercommon\winlogon.exe
        
        "C:\providercommon\winlogon.exe"
        10⤵
        Executes dropped EXE
        Checks computer location settings
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3928
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\GQn77QEoUi.bat"
        11⤵
        Suspicious use of WriteProcessMemory
        
        PID:5092
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        12⤵
        
        PID:4244
        
        C:\providercommon\winlogon.exe
        
        "C:\providercommon\winlogon.exe"
        12⤵
        Executes dropped EXE
        Checks computer location settings
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3036
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\OI2OM6vZgr.bat"
        13⤵
        Suspicious use of WriteProcessMemory
        
        PID:4112
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        14⤵
        
        PID:4072
        
        C:\providercommon\winlogon.exe
        
        "C:\providercommon\winlogon.exe"
        14⤵
        Executes dropped EXE
        Checks computer location settings
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4420
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\oqEnL4f5pl.bat"
        15⤵
        Suspicious use of WriteProcessMemory
        
        PID:1092
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        16⤵
        
        PID:3468
        
        C:\providercommon\winlogon.exe
        
        "C:\providercommon\winlogon.exe"
        16⤵
        Executes dropped EXE
        Checks computer location settings
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4992
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\grdey4A1QM.bat"
        17⤵
        Suspicious use of WriteProcessMemory
        
        PID:224
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        18⤵
        
        PID:4656
        
        C:\providercommon\winlogon.exe
        
        "C:\providercommon\winlogon.exe"
        18⤵
        Executes dropped EXE
        Checks computer location settings
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3732
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\7aJ3FmDw0K.bat"
        19⤵
        Suspicious use of WriteProcessMemory
        
        PID:2244
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        20⤵
        
        PID:1116
        
        C:\providercommon\winlogon.exe
        
        "C:\providercommon\winlogon.exe"
        20⤵
        Executes dropped EXE
        Checks computer location settings
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2424
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\IMpAoVHioU.bat"
        21⤵
        
        PID:4900
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        22⤵
        
        PID:4640
        
        C:\providercommon\winlogon.exe
        
        "C:\providercommon\winlogon.exe"
        22⤵
        Executes dropped EXE
        Checks computer location settings
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4188
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\RE4R3BzSze.bat"
        23⤵
        
        PID:4480
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        24⤵
        
        PID:3716
        
        C:\providercommon\winlogon.exe
        
        "C:\providercommon\winlogon.exe"
        24⤵
        Executes dropped EXE
        Checks computer location settings
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4424
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\vbXk1H8t4K.bat"
        25⤵
        
        PID:2736
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        26⤵
        
        PID:3812
        
        C:\providercommon\winlogon.exe
        
        "C:\providercommon\winlogon.exe"
        26⤵
        Executes dropped EXE
        Checks computer location settings
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3084
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\YzNOjOTGFC.bat"
        27⤵
        
        PID:1644
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        28⤵
        
        PID:1460
        
        C:\providercommon\winlogon.exe
        
        "C:\providercommon\winlogon.exe"
        28⤵
        Executes dropped EXE
        Checks computer location settings
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1656
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\wUBsuxMZs4.bat"
        29⤵
        
        PID:4044
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        30⤵
        
        PID:5084

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 12 /tr "'C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\fr\fontdrvhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3112

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\fr\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4112

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 14 /tr "'C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\fr\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3396

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 14 /tr "'C:\providercommon\winlogon.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:756

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogon" /sc ONLOGON /tr "'C:\providercommon\winlogon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3000

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 11 /tr "'C:\providercommon\winlogon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4924

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Web Service

T1102

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
d85ba6ff808d9e5444a4b369f5bc2730

SHA1
31aa9d96590fff6981b315e0b391b575e4c0804a

SHA256
84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

SHA512
8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\winlogon.exe.log

Filesize
1KB

MD5
baf55b95da4a601229647f25dad12878

SHA1
abc16954ebfd213733c4493fc1910164d825cac8

SHA256
ee954c5d8156fd8890e582c716e5758ed9b33721258f10e758bdc31ccbcb1924

SHA512
24f502fedb1a305d0d7b08857ffc1db9b2359ff34e06d5748ecc84e35c985f29a20d9f0a533bea32d234ab37097ec0481620c63b14ac89b280e75e14d19fd545

Download Submit
C:\Users\Admin\AppData\Local\Temp\7aJ3FmDw0K.bat

Filesize
195B

MD5
96345eb18d299cc00147052cc47aa8a4

SHA1
919c0b6060ab3e6f8f43354296f44755e62a41ce

SHA256
44b647a3b16b37e81afef1280df20d8c45c38c9fc08e073263f64f6217d110c0

SHA512
a930ca4974699d64bc21fe197d8675325785e78058cb2c3aa4d7f528a9b65e688cca40cff6a84de651762a0123ab53cd1707ef6fa8be4ecb93ec4a2c4550ec7c

Download Submit
C:\Users\Admin\AppData\Local\Temp\GQn77QEoUi.bat

Filesize
195B

MD5
ca769ec4b6ac1acad5015a5c134026a7

SHA1
f59bb8eb20c4a1924ef6ae91c475278a03b24271

SHA256
e26b6606018b7ed7da8d4790fa63e646e5b6f7277285bbf3779cd876912f1909

SHA512
05fb090dca3280c9c280f16e512086bcf74b81ed3806ca2f53c29e74301fef414eb2eff6d7191c9b021a06bb0cc05671acc8fad567edb3b903bc3060f5476208

Download Submit
C:\Users\Admin\AppData\Local\Temp\HAJBVlyJNQ.bat

Filesize
195B

MD5
dd3383db932257c18795d411db93353c

SHA1
1fcdd4479d2b58d63f0bb0661e7f3f55c38e967c

SHA256
20b9b815b153f14bda679e905c854d6a05db719058205bf79b600d59d0388fd8

SHA512
4e139909a3dff317761f93e335cc576076d152d37b011d6f20508ee3ef7a5ca9184c2df282036268c1ac37a28a6cdac1c9eefbf898522139666c47c5b1b06eda

Download Submit
C:\Users\Admin\AppData\Local\Temp\IMpAoVHioU.bat

Filesize
195B

MD5
0d184a7d8e46652c8fd294fbc3f01fe1

SHA1
7e822ea1e7b55ab9529cfd305dddcfa1024e20c1

SHA256
eb1a293058396907d77ca756120dc0ecfc9c9c0592e6701dda6e4ad1ed933679

SHA512
a3d9100080063d705776fccccd66af8469fb65559e6520c2cf244907d72bc9aa186ee77f2076c4ff63073ed411cc6c0b26b5535e2f0d29a3ef318bd583013a76

Download Submit
C:\Users\Admin\AppData\Local\Temp\OI2OM6vZgr.bat

Filesize
195B

MD5
4689b67f170eafbd7330ae23b1238c10

SHA1
8ca9574574b35d9723dccf6ebdcc790e8aca045e

SHA256
c2ff69f0d73074e6434f48855189ca9c278cabfed7a1400c3562112c89737159

SHA512
a9a067ac1a15264c1845e63f3ac25ba15742bfa1992b984035b4b2568b1e9965726e99fd4b356a036d0fa2cf446d044720c8af833e7383ba8eb4c2dabbc10b75

Download Submit
C:\Users\Admin\AppData\Local\Temp\RE4R3BzSze.bat

Filesize
195B

MD5
093530be3cc576e854cde1fca04502d1

SHA1
b7644127d29429e71bc5ab541fab3f81a0372485

SHA256
aa1ded9997a4d6630f5773222b4300ab6ffa1345961a33812bb0e221f5b345e2

SHA512
d11967f7c9a5c2f27c7f707d71dc7337653c342a34997e933a992ac06caf0670173e76cd54f82afbfd76a09623e426b6a32645a19e68b7647a39a5139dc5b8a1

Download Submit
C:\Users\Admin\AppData\Local\Temp\YzNOjOTGFC.bat

Filesize
195B

MD5
99d334b71c2c01b21def789dcace2327

SHA1
e50fe4621cf3cadffe4be42190e6b30848e289d8

SHA256
07795f5d1250b6e5296fad1bdd6989a4eae469ce6a54a9f519a365962aaf839a

SHA512
71ff1059a76d0d5c963c096ee7690ffb5cb9d13ea2f3bc4c1c7bd90d24195513a3ebffd52496f609761489a60acdcdb7f7edc891f0d3e30e09286f4073aa1f16

Download Submit
C:\Users\Admin\AppData\Local\Temp\grdey4A1QM.bat

Filesize
195B

MD5
1abbf94fb63d036076f527d39594bfbe

SHA1
0ea1f7599db64ad021c8be5c82e21f4eb3c8e43e

SHA256
120bf70dad85ef2465763d64eee0920834042bb6cdb66e7750eb7cb3c3df98f1

SHA512
ddb84bcc4e73a71d6d79b6dab5522c540c00774f75214042040a4508d5b4bd03d759efbf5de51df0782209ed3dafacf59db2a04309d792445e0efd6b9a559b80

Download Submit
C:\Users\Admin\AppData\Local\Temp\oqEnL4f5pl.bat

Filesize
195B

MD5
d00087f1bbf44c1716b4ecc0824be09c

SHA1
6f78b0d26ebe0722925507b3e052139400483e98

SHA256
1bdf25eab51ef99c422e2d77d2e0b9dc550e5912a3019c5d2c77579684dbe59a

SHA512
de673e15aecab81a84ae2e98d1b6ce36d20c6d090784e08672ecdf8a2ad3f3652ed5065e42ea14b9c108d7f4ae920b2c359ef6f39507c28beaab0cd1285b9859

Download Submit
C:\Users\Admin\AppData\Local\Temp\qkGQTc9WKx.bat

Filesize
195B

MD5
64a42fc18d896209d12ac825fe8d0071

SHA1
86201b08643cebf0eef33a6865d16321d4498654

SHA256
1b5d167be9ec771dcbef371d65cf155df432e61a074b1c95d74a6c9fe88488bf

SHA512
c4084d6dac4a03eb8b9b2b14a48e4fca923cb6b7c71e5053c87091eff93e7240accce73b3b72fd5cb4943f41df6ff7f1fc8cc07f47bc31c698e3d2f5319d84ff

Download Submit
C:\Users\Admin\AppData\Local\Temp\vbXk1H8t4K.bat

Filesize
195B

MD5
390f5627558eb1d52e74113f2c776d34

SHA1
ab9d00d8ff1c6297e78770fe748d53dc2a07f710

SHA256
5e859fbbd836c8f00e8d45dadfef0b10b3c73f726d92660bc23eecc4861e28db

SHA512
bafe5e1a5cc1f3952ec152af97d6ee6261a47b32b2ea855a560f2cc1c0489732bfbe2d0cd9ba7208d8e94f7150288b026e27070b32f43c2130e0e122c6b08e12

Download Submit
C:\Users\Admin\AppData\Local\Temp\wUBsuxMZs4.bat

Filesize
195B

MD5
4c1fbc92507ee9bc79b8ce9e5b24d794

SHA1
d7bc45647e05eb2c896bb2359b359bef6c5cf138

SHA256
18e1beb0d455ef4e72788e0ad2121ec952fea93e5bb320878ae462b319a14158

SHA512
1c83c1ec93291891958e1881e23cb66814d292bde4adee124272b3f202f364a99f7ae1a85aebcc839881ada7051fe0182e4703329a3b19101aca848d377cb2ff

Download Submit
C:\Users\Admin\AppData\Local\Temp\yXZnhMCmO6.bat

Filesize
195B

MD5
67353e7d63dfcdb99ddd289a76070eeb

SHA1
156685777fe0eb261ddc7d80a93a168473865ee5

SHA256
cba2424c364cc63338b82fa863d47ce36561a0625f688e08b588de1de6fb8ca1

SHA512
941cc2852f29287c794960ff7cfa07ee5731ba34573b17f4f02c907c39fa076931bdc874f349de55819009ebfa7c0ca3768f2a29cec15d8c308f52f4b064a8f4

Download Submit
C:\providercommon\1zu9dW.bat

Filesize
36B

MD5
6783c3ee07c7d151ceac57f1f9c8bed7

SHA1
17468f98f95bf504cc1f83c49e49a78526b3ea03

SHA256
8ab782f0f327a2021530e7230d3aee8abbecb7eed59482a3a46e78b9e3862322

SHA512
c6012d4bfac1ed14d0fd9f0eabd0e1c3d647b343db292a907b246271d52a4b7469c809db43910ddba2e8c5045f9cb3d24d0af62d363281e6cb8b39ee94a183e8

Download Submit
C:\providercommon\DllCommonsvc.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\providercommon\DllCommonsvc.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\providercommon\winlogon.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\providercommon\winlogon.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\providercommon\winlogon.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\providercommon\winlogon.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\providercommon\winlogon.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\providercommon\winlogon.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\providercommon\winlogon.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\providercommon\winlogon.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\providercommon\winlogon.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\providercommon\winlogon.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\providercommon\winlogon.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\providercommon\winlogon.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\providercommon\winlogon.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\providercommon\yTUdeXjbLOhnrN32dgrxVg.vbe

Filesize
197B

MD5
8088241160261560a02c84025d107592

SHA1
083121f7027557570994c9fc211df61730455bb5

SHA256
2072cc9a4a3b84d4c5178ab41c5588eea7d0103e3928e34d64f17bf97f3d1cc1

SHA512
20d9369dd359315848ea30144383a0bb479d86059fdbc3b3256ac84f998193512feb3b1799ab663619920c99fe7e0ebba33ada31a3855094b956fcd351c90478

Download Submit
memory/1216-160-0x00007FFD89280000-0x00007FFD89D41000-memory.dmp

Filesize
10.8MB

Download
memory/1216-156-0x00007FFD89280000-0x00007FFD89D41000-memory.dmp

Filesize
10.8MB

Download
memory/1656-238-0x00007FFD89330000-0x00007FFD89DF1000-memory.dmp

Filesize
10.8MB

Download
memory/1656-234-0x00007FFD89330000-0x00007FFD89DF1000-memory.dmp

Filesize
10.8MB

Download
memory/1992-151-0x00007FFD89390000-0x00007FFD89E51000-memory.dmp

Filesize
10.8MB

Download
memory/1992-144-0x00000282E0B90000-0x00000282E0BB2000-memory.dmp

Filesize
136KB

Download
memory/2244-150-0x00007FFD89390000-0x00007FFD89E51000-memory.dmp

Filesize
10.8MB

Download
memory/2424-210-0x00007FFD89330000-0x00007FFD89DF1000-memory.dmp

Filesize
10.8MB

Download
memory/2424-206-0x00007FFD89330000-0x00007FFD89DF1000-memory.dmp

Filesize
10.8MB

Download
memory/3036-178-0x00007FFD89280000-0x00007FFD89D41000-memory.dmp

Filesize
10.8MB

Download
memory/3036-182-0x00007FFD89280000-0x00007FFD89D41000-memory.dmp

Filesize
10.8MB

Download
memory/3084-231-0x00007FFD89330000-0x00007FFD89DF1000-memory.dmp

Filesize
10.8MB

Download
memory/3084-227-0x00007FFD89330000-0x00007FFD89DF1000-memory.dmp

Filesize
10.8MB

Download
memory/3100-140-0x00007FFD89390000-0x00007FFD89E51000-memory.dmp

Filesize
10.8MB

Download
memory/3100-146-0x00007FFD89390000-0x00007FFD89E51000-memory.dmp

Filesize
10.8MB

Download
memory/3100-139-0x0000000000B30000-0x0000000000C40000-memory.dmp

Filesize
1.1MB

Download
memory/3732-199-0x00007FFD89330000-0x00007FFD89DF1000-memory.dmp

Filesize
10.8MB

Download
memory/3732-203-0x00007FFD89330000-0x00007FFD89DF1000-memory.dmp

Filesize
10.8MB

Download
memory/3928-175-0x00007FFD89280000-0x00007FFD89D41000-memory.dmp

Filesize
10.8MB

Download
memory/3928-171-0x00007FFD89280000-0x00007FFD89D41000-memory.dmp

Filesize
10.8MB

Download
memory/3932-168-0x00007FFD89280000-0x00007FFD89D41000-memory.dmp

Filesize
10.8MB

Download
memory/3932-164-0x00007FFD89280000-0x00007FFD89D41000-memory.dmp

Filesize
10.8MB

Download
memory/4188-217-0x00007FFD89330000-0x00007FFD89DF1000-memory.dmp

Filesize
10.8MB

Download
memory/4188-213-0x00007FFD89330000-0x00007FFD89DF1000-memory.dmp

Filesize
10.8MB

Download
memory/4256-152-0x00007FFD89390000-0x00007FFD89E51000-memory.dmp

Filesize
10.8MB

Download
memory/4420-192-0x00007FFD89280000-0x00007FFD89D41000-memory.dmp

Filesize
10.8MB

Download
memory/4420-185-0x00007FFD89280000-0x00007FFD89D41000-memory.dmp

Filesize
10.8MB

Download
memory/4424-224-0x00007FFD89330000-0x00007FFD89DF1000-memory.dmp

Filesize
10.8MB

Download
memory/4424-220-0x00007FFD89330000-0x00007FFD89DF1000-memory.dmp

Filesize
10.8MB

Download
memory/4992-191-0x00007FFD89280000-0x00007FFD89D41000-memory.dmp

Filesize
10.8MB

Download
memory/4992-196-0x00007FFD89280000-0x00007FFD89D41000-memory.dmp

Filesize
10.8MB

Download