dcrat | b1304c0e84874b14b78436e3ca39321a10f1b6c67743a74eacd59e435be09292

Analysis

max time kernel
139s
max time network
126s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
30-01-2023 02:16

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

P3MKL.exe
Size

1.7MB
MD5

f812dea5ffd8ac4eb11cf366b7baccca
SHA1

f16dd261312b338f6a23b5a8a29ca649d9e36c4e
SHA256

b1304c0e84874b14b78436e3ca39321a10f1b6c67743a74eacd59e435be09292
SHA512

c22750b31fae4389e69d715d5ffbbb7e79c7d8294cc3ac9f40a6bdb1921517cb52eed4e8bad5535bf20d3527ba468a845e50f081ba9360f753969025c80d8237
SSDEEP

24576:t3QwuLyEbVoCtPreIjNLoN/VNGeSQDx1m17zezKOkCzeJGFUJ:tgwuuEpdDLNwVMeXDL0fdSzAG

Score

10^/10

dcrat infostealer rat

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat

Process spawned unexpected child process 45 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

Processes:

schtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exe

description	pid	pid_target	process
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	884	1732	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1468	1732	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1864	1732	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1100	1732	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	820	1732	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1744	1732	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1048	1732	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1920	1732	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1144	1732	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	916	1732	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1952	1732	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1668	1732	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1364	1732	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1768	1732	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	852	1732	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1740	1732	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1544	1732	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2024	1732	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1596	1732	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1608	1732	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	672	1732	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1712	1732	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1052	1732	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1536	1732	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	680	1732	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1244	1732	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1832	1732	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	440	1732	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	988	1732	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1772	1732	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1896	1732	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1192	1732	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	828	1732	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	948	1732	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2044	1732	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1468	1732	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	924	1732	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1940	1732	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1552	1732	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1952	1732	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	564	1732	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1580	1732	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	624	1732	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	740	1732	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1920	1732	schtasks.exe

DCRat payload 5 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

Processes:

resource	yara_rule
behavioral1/memory/1460-54-0x00000000011D0000-0x0000000001386000-memory.dmp	dcrat
C:\Recovery\31001cc2-2a3d-11ed-9244-9c23e66b04e4\System.exe	dcrat
C:\Recovery\31001cc2-2a3d-11ed-9244-9c23e66b04e4\System.exe	dcrat
behavioral1/memory/2268-113-0x0000000000350000-0x0000000000506000-memory.dmp	dcrat
C:\Recovery\31001cc2-2a3d-11ed-9244-9c23e66b04e4\System.exe	dcrat

Drops file in Drivers directory 1 IoCs

Processes:

P3MKL.exe

description ioc process

File opened for modification C:\Windows\System32\drivers\etc\hosts P3MKL.exe
Executes dropped EXE 2 IoCs

Processes:

System.exeSystem.exe

pid process

2268 System.exe
1668 System.exe

description	ioc	process
File opened for modification	C:\Windows\System32\drivers\etc\hosts	P3MKL.exe

pid	process
2268	System.exe
1668	System.exe

Drops file in Program Files directory 10 IoCs

Processes:

P3MKL.exe

description	ioc	process
File opened for modification	C:\Program Files (x86)\Common Files\Services\RCX76D4.tmp	P3MKL.exe
File opened for modification	C:\Program Files (x86)\Common Files\Services\RCX7A3F.tmp	P3MKL.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\logs\RCXD49D.tmp	P3MKL.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\logs\RCXD7F8.tmp	P3MKL.exe
File created	C:\Program Files (x86)\Common Files\Services\lsass.exe	P3MKL.exe
File created	C:\Program Files (x86)\Mozilla Maintenance Service\logs\System.exe	P3MKL.exe
File created	C:\Program Files (x86)\Mozilla Maintenance Service\logs\27d1bcfc3c54e0	P3MKL.exe
File opened for modification	C:\Program Files (x86)\Common Files\Services\lsass.exe	P3MKL.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\logs\System.exe	P3MKL.exe
File created	C:\Program Files (x86)\Common Files\Services\6203df4a6bafc7	P3MKL.exe

Drops file in Windows directory 5 IoCs

Processes:

P3MKL.exe

description	ioc	process
File created	C:\Windows\twain_32\spoolsv.exe	P3MKL.exe
File created	C:\Windows\twain_32\f3b6ecef712a24	P3MKL.exe
File opened for modification	C:\Windows\twain_32\RCX6B00.tmp	P3MKL.exe
File opened for modification	C:\Windows\twain_32\RCX6E5B.tmp	P3MKL.exe
File opened for modification	C:\Windows\twain_32\spoolsv.exe	P3MKL.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 45 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

Processes:

pid	process
820	schtasks.exe
1952	schtasks.exe
1544	schtasks.exe
2024	schtasks.exe
1940	schtasks.exe
1920	schtasks.exe
1144	schtasks.exe
1608	schtasks.exe
440	schtasks.exe
564	schtasks.exe
740	schtasks.exe
916	schtasks.exe
1768	schtasks.exe
852	schtasks.exe
1772	schtasks.exe
924	schtasks.exe
1552	schtasks.exe
884	schtasks.exe
672	schtasks.exe
1832	schtasks.exe
988	schtasks.exe
1468	schtasks.exe
1744	schtasks.exe
1668	schtasks.exe
1364	schtasks.exe
1536	schtasks.exe
680	schtasks.exe
1896	schtasks.exe
1192	schtasks.exe
2044	schtasks.exe
1580	schtasks.exe
624	schtasks.exe
1920	schtasks.exe
1468	schtasks.exe
1952	schtasks.exe
1100	schtasks.exe
1048	schtasks.exe
1740	schtasks.exe
1596	schtasks.exe
1244	schtasks.exe
828	schtasks.exe
948	schtasks.exe
1864	schtasks.exe
1712	schtasks.exe
1052	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

P3MKL.exe

pid	process
1460	P3MKL.exe
1460	P3MKL.exe
1460	P3MKL.exe
1460	P3MKL.exe
1460	P3MKL.exe
1460	P3MKL.exe
1460	P3MKL.exe
1460	P3MKL.exe
1460	P3MKL.exe
1460	P3MKL.exe
1460	P3MKL.exe
1460	P3MKL.exe
1460	P3MKL.exe
1460	P3MKL.exe
1460	P3MKL.exe
1460	P3MKL.exe
1460	P3MKL.exe
1460	P3MKL.exe
1460	P3MKL.exe
1460	P3MKL.exe
1460	P3MKL.exe
1460	P3MKL.exe
1460	P3MKL.exe
1460	P3MKL.exe
1460	P3MKL.exe
1460	P3MKL.exe
1460	P3MKL.exe
1460	P3MKL.exe
1460	P3MKL.exe
1460	P3MKL.exe
1460	P3MKL.exe
1460	P3MKL.exe
1460	P3MKL.exe
1460	P3MKL.exe
1460	P3MKL.exe
1460	P3MKL.exe
1460	P3MKL.exe
1460	P3MKL.exe
1460	P3MKL.exe
1460	P3MKL.exe
1460	P3MKL.exe
1460	P3MKL.exe
1460	P3MKL.exe
1460	P3MKL.exe
1460	P3MKL.exe
1460	P3MKL.exe
1460	P3MKL.exe
1460	P3MKL.exe
1460	P3MKL.exe
1460	P3MKL.exe
1460	P3MKL.exe
1460	P3MKL.exe
1460	P3MKL.exe
1460	P3MKL.exe
1460	P3MKL.exe
1460	P3MKL.exe
1460	P3MKL.exe
1460	P3MKL.exe
1460	P3MKL.exe
1460	P3MKL.exe
1460	P3MKL.exe
1460	P3MKL.exe
1460	P3MKL.exe
1460	P3MKL.exe

Suspicious use of AdjustPrivilegeToken 14 IoCs

Processes:

P3MKL.exeSystem.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exeSystem.exe

description	pid	process
Token: SeDebugPrivilege	1460	P3MKL.exe
Token: SeDebugPrivilege	2268	System.exe
Token: SeDebugPrivilege	1596	powershell.exe
Token: SeDebugPrivilege	1052	powershell.exe
Token: SeDebugPrivilege	748	powershell.exe
Token: SeDebugPrivilege	1640	powershell.exe
Token: SeDebugPrivilege	1524	powershell.exe
Token: SeDebugPrivilege	440	powershell.exe
Token: SeDebugPrivilege	828	powershell.exe
Token: SeDebugPrivilege	672	powershell.exe
Token: SeDebugPrivilege	1536	powershell.exe
Token: SeDebugPrivilege	884	powershell.exe
Token: SeDebugPrivilege	988	powershell.exe
Token: SeDebugPrivilege	1668	System.exe

Suspicious use of WriteProcessMemory 54 IoCs

Processes:

P3MKL.execmd.exeSystem.exeWScript.exe

description	pid	process	target process
PID 1460 wrote to memory of 748	1460	P3MKL.exe	powershell.exe
PID 1460 wrote to memory of 748	1460	P3MKL.exe	powershell.exe
PID 1460 wrote to memory of 748	1460	P3MKL.exe	powershell.exe
PID 1460 wrote to memory of 884	1460	P3MKL.exe	powershell.exe
PID 1460 wrote to memory of 884	1460	P3MKL.exe	powershell.exe
PID 1460 wrote to memory of 884	1460	P3MKL.exe	powershell.exe
PID 1460 wrote to memory of 1052	1460	P3MKL.exe	powershell.exe
PID 1460 wrote to memory of 1052	1460	P3MKL.exe	powershell.exe
PID 1460 wrote to memory of 1052	1460	P3MKL.exe	powershell.exe
PID 1460 wrote to memory of 1596	1460	P3MKL.exe	powershell.exe
PID 1460 wrote to memory of 1596	1460	P3MKL.exe	powershell.exe
PID 1460 wrote to memory of 1596	1460	P3MKL.exe	powershell.exe
PID 1460 wrote to memory of 672	1460	P3MKL.exe	powershell.exe
PID 1460 wrote to memory of 672	1460	P3MKL.exe	powershell.exe
PID 1460 wrote to memory of 672	1460	P3MKL.exe	powershell.exe
PID 1460 wrote to memory of 988	1460	P3MKL.exe	powershell.exe
PID 1460 wrote to memory of 988	1460	P3MKL.exe	powershell.exe
PID 1460 wrote to memory of 988	1460	P3MKL.exe	powershell.exe
PID 1460 wrote to memory of 1536	1460	P3MKL.exe	powershell.exe
PID 1460 wrote to memory of 1536	1460	P3MKL.exe	powershell.exe
PID 1460 wrote to memory of 1536	1460	P3MKL.exe	powershell.exe
PID 1460 wrote to memory of 1640	1460	P3MKL.exe	powershell.exe
PID 1460 wrote to memory of 1640	1460	P3MKL.exe	powershell.exe
PID 1460 wrote to memory of 1640	1460	P3MKL.exe	powershell.exe
PID 1460 wrote to memory of 1720	1460	P3MKL.exe	powershell.exe
PID 1460 wrote to memory of 1720	1460	P3MKL.exe	powershell.exe
PID 1460 wrote to memory of 1720	1460	P3MKL.exe	powershell.exe
PID 1460 wrote to memory of 828	1460	P3MKL.exe	powershell.exe
PID 1460 wrote to memory of 828	1460	P3MKL.exe	powershell.exe
PID 1460 wrote to memory of 828	1460	P3MKL.exe	powershell.exe
PID 1460 wrote to memory of 440	1460	P3MKL.exe	powershell.exe
PID 1460 wrote to memory of 440	1460	P3MKL.exe	powershell.exe
PID 1460 wrote to memory of 440	1460	P3MKL.exe	powershell.exe
PID 1460 wrote to memory of 1524	1460	P3MKL.exe	powershell.exe
PID 1460 wrote to memory of 1524	1460	P3MKL.exe	powershell.exe
PID 1460 wrote to memory of 1524	1460	P3MKL.exe	powershell.exe
PID 1460 wrote to memory of 2164	1460	P3MKL.exe	cmd.exe
PID 1460 wrote to memory of 2164	1460	P3MKL.exe	cmd.exe
PID 1460 wrote to memory of 2164	1460	P3MKL.exe	cmd.exe
PID 2164 wrote to memory of 2228	2164	cmd.exe	w32tm.exe
PID 2164 wrote to memory of 2228	2164	cmd.exe	w32tm.exe
PID 2164 wrote to memory of 2228	2164	cmd.exe	w32tm.exe
PID 2164 wrote to memory of 2268	2164	cmd.exe	System.exe
PID 2164 wrote to memory of 2268	2164	cmd.exe	System.exe
PID 2164 wrote to memory of 2268	2164	cmd.exe	System.exe
PID 2268 wrote to memory of 2396	2268	System.exe	WScript.exe
PID 2268 wrote to memory of 2396	2268	System.exe	WScript.exe
PID 2268 wrote to memory of 2396	2268	System.exe	WScript.exe
PID 2268 wrote to memory of 2432	2268	System.exe	WScript.exe
PID 2268 wrote to memory of 2432	2268	System.exe	WScript.exe
PID 2268 wrote to memory of 2432	2268	System.exe	WScript.exe
PID 2396 wrote to memory of 1668	2396	WScript.exe	System.exe
PID 2396 wrote to memory of 1668	2396	WScript.exe	System.exe
PID 2396 wrote to memory of 1668	2396	WScript.exe	System.exe

C:\Users\Admin\AppData\Local\Temp\P3MKL.exe
"C:\Users\Admin\AppData\Local\Temp\P3MKL.exe"
1⤵
- Drops file in Drivers directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1460

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell" -Command Add-MpPreference -ExclusionPath 'C:/'
2⤵
- Suspicious use of AdjustPrivilegeToken
PID:748

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell" -Command Add-MpPreference -ExclusionPath 'C:/$Recycle.Bin/'
2⤵
- Suspicious use of AdjustPrivilegeToken
PID:884

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell" -Command Add-MpPreference -ExclusionPath 'C:/Documents and Settings/'
2⤵
- Suspicious use of AdjustPrivilegeToken
PID:1052

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell" -Command Add-MpPreference -ExclusionPath 'C:/MSOCache/'
2⤵
- Suspicious use of AdjustPrivilegeToken
PID:1596

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell" -Command Add-MpPreference -ExclusionPath 'C:/PerfLogs/'
2⤵
- Suspicious use of AdjustPrivilegeToken
PID:672

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files/'
2⤵
- Suspicious use of AdjustPrivilegeToken
PID:988

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files (x86)/'
2⤵
- Suspicious use of AdjustPrivilegeToken
PID:1536

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell" -Command Add-MpPreference -ExclusionPath 'C:/ProgramData/'
2⤵
- Suspicious use of AdjustPrivilegeToken
PID:1640

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell" -Command Add-MpPreference -ExclusionPath 'C:/Recovery/'
2⤵
PID:1720

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell" -Command Add-MpPreference -ExclusionPath 'C:/System Volume Information/'
2⤵
- Suspicious use of AdjustPrivilegeToken
PID:828

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell" -Command Add-MpPreference -ExclusionPath 'C:/Users/'
2⤵
- Suspicious use of AdjustPrivilegeToken
PID:440

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell" -Command Add-MpPreference -ExclusionPath 'C:/Windows/'
2⤵
- Suspicious use of AdjustPrivilegeToken
PID:1524

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\aRYsLhXnEv.bat"
2⤵
- Suspicious use of WriteProcessMemory
PID:2164

C:\Windows\system32\w32tm.exe
w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
3⤵
PID:2228

C:\Recovery\31001cc2-2a3d-11ed-9244-9c23e66b04e4\System.exe
"C:\Recovery\31001cc2-2a3d-11ed-9244-9c23e66b04e4\System.exe"
3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2268

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\c132c403-f226-4527-b7ac-0da340213588.vbs"
4⤵
- Suspicious use of WriteProcessMemory
PID:2396

C:\Recovery\31001cc2-2a3d-11ed-9244-9c23e66b04e4\System.exe
C:\Recovery\31001cc2-2a3d-11ed-9244-9c23e66b04e4\System.exe
5⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1668

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\306d538d-49fd-491a-aea8-717e400ee88b.vbs"
4⤵
PID:2432

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 12 /tr "'C:\Users\Default User\winlogon.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:884

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogon" /sc ONLOGON /tr "'C:\Users\Default User\winlogon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1468

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 11 /tr "'C:\Users\Default User\winlogon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1864

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 9 /tr "'C:\Users\All Users\Documents\csrss.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1100

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Users\All Users\Documents\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:820

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 10 /tr "'C:\Users\All Users\Documents\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1744

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 11 /tr "'C:\Recovery\31001cc2-2a3d-11ed-9244-9c23e66b04e4\System.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1048

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "System" /sc ONLOGON /tr "'C:\Recovery\31001cc2-2a3d-11ed-9244-9c23e66b04e4\System.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1920

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 6 /tr "'C:\Recovery\31001cc2-2a3d-11ed-9244-9c23e66b04e4\System.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1144

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 8 /tr "'C:\Users\All Users\Microsoft\MSDN\8.0\explorer.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:916

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorer" /sc ONLOGON /tr "'C:\Users\All Users\Microsoft\MSDN\8.0\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1952

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 14 /tr "'C:\Users\All Users\Microsoft\MSDN\8.0\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1668

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 11 /tr "'C:\Users\Default\Application Data\dwm.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1364

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwm" /sc ONLOGON /tr "'C:\Users\Default\Application Data\dwm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1768

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 8 /tr "'C:\Users\Default\Application Data\dwm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:852

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 14 /tr "'C:\Windows\twain_32\spoolsv.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1740

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsv" /sc ONLOGON /tr "'C:\Windows\twain_32\spoolsv.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1544

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 12 /tr "'C:\Windows\twain_32\spoolsv.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2024

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 12 /tr "'C:\Program Files (x86)\Common Files\Services\lsass.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1596

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsass" /sc ONLOGON /tr "'C:\Program Files (x86)\Common Files\Services\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1608

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 7 /tr "'C:\Program Files (x86)\Common Files\Services\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:672

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 6 /tr "'C:\Recovery\31001cc2-2a3d-11ed-9244-9c23e66b04e4\spoolsv.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1712

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsv" /sc ONLOGON /tr "'C:\Recovery\31001cc2-2a3d-11ed-9244-9c23e66b04e4\spoolsv.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1052

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 13 /tr "'C:\Recovery\31001cc2-2a3d-11ed-9244-9c23e66b04e4\spoolsv.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1536

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "P3MKLP" /sc MINUTE /mo 8 /tr "'C:\MSOCache\All Users\{90140000-0116-0409-1000-0000000FF1CE}-C\P3MKL.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:680

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "P3MKL" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-0116-0409-1000-0000000FF1CE}-C\P3MKL.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1244

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "P3MKLP" /sc MINUTE /mo 8 /tr "'C:\MSOCache\All Users\{90140000-0116-0409-1000-0000000FF1CE}-C\P3MKL.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1832

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 7 /tr "'C:\Users\Admin\Searches\winlogon.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:440

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogon" /sc ONLOGON /tr "'C:\Users\Admin\Searches\winlogon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:988

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 12 /tr "'C:\Users\Admin\Searches\winlogon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1772

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 8 /tr "'C:\Users\Admin\Searches\Idle.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1896

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Idle" /sc ONLOGON /tr "'C:\Users\Admin\Searches\Idle.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1192

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 7 /tr "'C:\Users\Admin\Searches\Idle.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:828

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 10 /tr "'C:\Users\Admin\Cookies\System.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:948

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "System" /sc ONLOGON /tr "'C:\Users\Admin\Cookies\System.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2044

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 12 /tr "'C:\Users\Admin\Cookies\System.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1468

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "P3MKLP" /sc MINUTE /mo 10 /tr "'C:\Users\All Users\P3MKL.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:924

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "P3MKL" /sc ONLOGON /tr "'C:\Users\All Users\P3MKL.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1940

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "P3MKLP" /sc MINUTE /mo 8 /tr "'C:\Users\All Users\P3MKL.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1552

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 12 /tr "'C:\Users\Admin\lsass.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1952

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsass" /sc ONLOGON /tr "'C:\Users\Admin\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:564

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 8 /tr "'C:\Users\Admin\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1580

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 9 /tr "'C:\Program Files (x86)\Mozilla Maintenance Service\logs\System.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:624

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "System" /sc ONLOGON /tr "'C:\Program Files (x86)\Mozilla Maintenance Service\logs\System.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:740

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 6 /tr "'C:\Program Files (x86)\Mozilla Maintenance Service\logs\System.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1920

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Recovery\31001cc2-2a3d-11ed-9244-9c23e66b04e4\System.exe
Filesize
1.7MB

MD5
6959850b5982790d2be43c5c393f6a7b

SHA1
ab2cb21da70f043883fa5d74f579ba89c2386761

SHA256
43291eb27eaec7d67a0eef5dc238652c72b72284ef74e3040471454e8f6d7085

SHA512
6191aff3d1dc94dd2124cb0ce1851f4743322eac57153354fb4170eb6c825cdc74dcfe41f571dd571426226e08c011a5542aa005ae8729788323fcd165645d90

Download Submit
C:\Recovery\31001cc2-2a3d-11ed-9244-9c23e66b04e4\System.exe
Filesize
1.7MB

MD5
6959850b5982790d2be43c5c393f6a7b

SHA1
ab2cb21da70f043883fa5d74f579ba89c2386761

SHA256
43291eb27eaec7d67a0eef5dc238652c72b72284ef74e3040471454e8f6d7085

SHA512
6191aff3d1dc94dd2124cb0ce1851f4743322eac57153354fb4170eb6c825cdc74dcfe41f571dd571426226e08c011a5542aa005ae8729788323fcd165645d90

Download Submit
C:\Recovery\31001cc2-2a3d-11ed-9244-9c23e66b04e4\System.exe
Filesize
1.7MB

MD5
6959850b5982790d2be43c5c393f6a7b

SHA1
ab2cb21da70f043883fa5d74f579ba89c2386761

SHA256
43291eb27eaec7d67a0eef5dc238652c72b72284ef74e3040471454e8f6d7085

SHA512
6191aff3d1dc94dd2124cb0ce1851f4743322eac57153354fb4170eb6c825cdc74dcfe41f571dd571426226e08c011a5542aa005ae8729788323fcd165645d90

Download Submit
C:\Users\Admin\AppData\Local\Temp\306d538d-49fd-491a-aea8-717e400ee88b.vbs
Filesize
511B

MD5
72ecb90c9018212460d4070aafde0325

SHA1
c91832eedd93c1cf38c3084d9f3c14bbf069efd6

SHA256
c551fe16e066cc0a1aeaacbb3e6bb098e2a7bde46ad703993f391eee6cb95a3a

SHA512
29d3649f4dfef2e356c266169cc46545bf296fdba2769603684663d50a11ee499cde68c8e4b6c7d873248dc6f4d51113f5542053015307bd7c1a9c776c84fc09

Download Submit
C:\Users\Admin\AppData\Local\Temp\aRYsLhXnEv.bat
Filesize
224B

MD5
ae36ddb1c251b0297ee2b8852d02c457

SHA1
14893b71404a92cea24f26f4d0696f7258c9e804

SHA256
4abd56629fc609f761f7e1c6d48eb4dc5153621e407e34d89aa7870d2dd0b8b6

SHA512
61b050636988ae1b465d65094b40bfa74d0d0392edc92caa2c17291b9888017a75d93b2fa55f521e9fbb49aa1815880dab9668f1859199c600f428b87905eba5

Download Submit
C:\Users\Admin\AppData\Local\Temp\c132c403-f226-4527-b7ac-0da340213588.vbs
Filesize
735B

MD5
17f0a1f649f367db6def22020a53785b

SHA1
4c71d5ee1c382416ffeb65c6132d899d88f8a02c

SHA256
4801148d286695c832ad1bded36985f2dd2e6532bef85d22926b8da58b914d0b

SHA512
9d60546917073be89541b104be638a20b4f2a7b24f54383eddaf86f5d2f309b15fb396970f82f01732bf39661b994e1725f5e21915684c8cd982b8a1d7867b25

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms
Filesize
7KB

MD5
c259475a5d4e0b6e99098b982b2e9fd0

SHA1
4b48f6e6732e6b149e2bf39d7c2c656c53653434

SHA256
ee9e32cd8244673a9d4460a565abd58418e24b6790411c430b17e5221a82309f

SHA512
d009bf72b096faf767e29c421af345473f5ca549da76d9161380800f5f7b9ef26e8d85db678d0b806a05a9e8b73f43bf3a8a9d283bd0c1352327ce6d606f9939

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms
Filesize
7KB

MD5
c259475a5d4e0b6e99098b982b2e9fd0

SHA1
4b48f6e6732e6b149e2bf39d7c2c656c53653434

SHA256
ee9e32cd8244673a9d4460a565abd58418e24b6790411c430b17e5221a82309f

SHA512
d009bf72b096faf767e29c421af345473f5ca549da76d9161380800f5f7b9ef26e8d85db678d0b806a05a9e8b73f43bf3a8a9d283bd0c1352327ce6d606f9939

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms
Filesize
7KB

MD5
c259475a5d4e0b6e99098b982b2e9fd0

SHA1
4b48f6e6732e6b149e2bf39d7c2c656c53653434

SHA256
ee9e32cd8244673a9d4460a565abd58418e24b6790411c430b17e5221a82309f

SHA512
d009bf72b096faf767e29c421af345473f5ca549da76d9161380800f5f7b9ef26e8d85db678d0b806a05a9e8b73f43bf3a8a9d283bd0c1352327ce6d606f9939

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms
Filesize
7KB

MD5
c259475a5d4e0b6e99098b982b2e9fd0

SHA1
4b48f6e6732e6b149e2bf39d7c2c656c53653434

SHA256
ee9e32cd8244673a9d4460a565abd58418e24b6790411c430b17e5221a82309f

SHA512
d009bf72b096faf767e29c421af345473f5ca549da76d9161380800f5f7b9ef26e8d85db678d0b806a05a9e8b73f43bf3a8a9d283bd0c1352327ce6d606f9939

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms
Filesize
7KB

MD5
c259475a5d4e0b6e99098b982b2e9fd0

SHA1
4b48f6e6732e6b149e2bf39d7c2c656c53653434

SHA256
ee9e32cd8244673a9d4460a565abd58418e24b6790411c430b17e5221a82309f

SHA512
d009bf72b096faf767e29c421af345473f5ca549da76d9161380800f5f7b9ef26e8d85db678d0b806a05a9e8b73f43bf3a8a9d283bd0c1352327ce6d606f9939

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms
Filesize
7KB

MD5
c259475a5d4e0b6e99098b982b2e9fd0

SHA1
4b48f6e6732e6b149e2bf39d7c2c656c53653434

SHA256
ee9e32cd8244673a9d4460a565abd58418e24b6790411c430b17e5221a82309f

SHA512
d009bf72b096faf767e29c421af345473f5ca549da76d9161380800f5f7b9ef26e8d85db678d0b806a05a9e8b73f43bf3a8a9d283bd0c1352327ce6d606f9939

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms
Filesize
7KB

MD5
c259475a5d4e0b6e99098b982b2e9fd0

SHA1
4b48f6e6732e6b149e2bf39d7c2c656c53653434

SHA256
ee9e32cd8244673a9d4460a565abd58418e24b6790411c430b17e5221a82309f

SHA512
d009bf72b096faf767e29c421af345473f5ca549da76d9161380800f5f7b9ef26e8d85db678d0b806a05a9e8b73f43bf3a8a9d283bd0c1352327ce6d606f9939

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms
Filesize
7KB

MD5
c259475a5d4e0b6e99098b982b2e9fd0

SHA1
4b48f6e6732e6b149e2bf39d7c2c656c53653434

SHA256
ee9e32cd8244673a9d4460a565abd58418e24b6790411c430b17e5221a82309f

SHA512
d009bf72b096faf767e29c421af345473f5ca549da76d9161380800f5f7b9ef26e8d85db678d0b806a05a9e8b73f43bf3a8a9d283bd0c1352327ce6d606f9939

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms
Filesize
7KB

MD5
c259475a5d4e0b6e99098b982b2e9fd0

SHA1
4b48f6e6732e6b149e2bf39d7c2c656c53653434

SHA256
ee9e32cd8244673a9d4460a565abd58418e24b6790411c430b17e5221a82309f

SHA512
d009bf72b096faf767e29c421af345473f5ca549da76d9161380800f5f7b9ef26e8d85db678d0b806a05a9e8b73f43bf3a8a9d283bd0c1352327ce6d606f9939

Download Submit
memory/440-121-0x000007FEEB940000-0x000007FEEC363000-memory.dmp

Filesize
10.1MB

Download
memory/440-136-0x0000000002644000-0x0000000002647000-memory.dmp

Filesize
12KB

Download
memory/440-146-0x000007FEEA550000-0x000007FEEB0AD000-memory.dmp

Filesize
11.4MB

Download
memory/440-158-0x000000001B830000-0x000000001BB2F000-memory.dmp

Filesize
3.0MB

Download
memory/440-168-0x000000000264B000-0x000000000266A000-memory.dmp

Filesize
124KB

Download
memory/440-191-0x000000000264B000-0x000000000266A000-memory.dmp

Filesize
124KB

Download
memory/440-181-0x0000000002644000-0x0000000002647000-memory.dmp

Filesize
12KB

Download
memory/440-90-0x0000000000000000-mapping.dmp

Download
memory/672-167-0x000000000261B000-0x000000000263A000-memory.dmp

Filesize
124KB

Download
memory/672-154-0x000000001B820000-0x000000001BB1F000-memory.dmp

Filesize
3.0MB

Download
memory/672-139-0x0000000002614000-0x0000000002617000-memory.dmp

Filesize
12KB

Download
memory/672-122-0x000007FEEB940000-0x000007FEEC363000-memory.dmp

Filesize
10.1MB

Download
memory/672-150-0x000007FEEA550000-0x000007FEEB0AD000-memory.dmp

Filesize
11.4MB

Download
memory/672-188-0x000000000261B000-0x000000000263A000-memory.dmp

Filesize
124KB

Download
memory/672-179-0x0000000002614000-0x0000000002617000-memory.dmp

Filesize
12KB

Download
memory/672-75-0x0000000000000000-mapping.dmp

Download
memory/748-151-0x000000001B7A0000-0x000000001BA9F000-memory.dmp

Filesize
3.0MB

Download
memory/748-86-0x000007FEEB940000-0x000007FEEC363000-memory.dmp

Filesize
10.1MB

Download
memory/748-172-0x00000000027DB000-0x00000000027FA000-memory.dmp

Filesize
124KB

Download
memory/748-189-0x00000000027DB000-0x00000000027FA000-memory.dmp

Filesize
124KB

Download
memory/748-71-0x0000000000000000-mapping.dmp

Download
memory/748-178-0x00000000027D4000-0x00000000027D7000-memory.dmp

Filesize
12KB

Download
memory/748-143-0x000007FEEA550000-0x000007FEEB0AD000-memory.dmp

Filesize
11.4MB

Download
memory/748-77-0x000007FEFBC31000-0x000007FEFBC33000-memory.dmp

Filesize
8KB

Download
memory/748-138-0x00000000027D4000-0x00000000027D7000-memory.dmp

Filesize
12KB

Download
memory/828-148-0x000007FEEA550000-0x000007FEEB0AD000-memory.dmp

Filesize
11.4MB

Download
memory/828-180-0x0000000002754000-0x0000000002757000-memory.dmp

Filesize
12KB

Download
memory/828-128-0x000007FEEB940000-0x000007FEEC363000-memory.dmp

Filesize
10.1MB

Download
memory/828-190-0x000000000275B000-0x000000000277A000-memory.dmp

Filesize
124KB

Download
memory/828-134-0x0000000002754000-0x0000000002757000-memory.dmp

Filesize
12KB

Download
memory/828-85-0x0000000000000000-mapping.dmp

Download
memory/828-153-0x000000001B880000-0x000000001BB7F000-memory.dmp

Filesize
3.0MB

Download
memory/828-166-0x000000000275B000-0x000000000277A000-memory.dmp

Filesize
124KB

Download
memory/884-144-0x000007FEEA550000-0x000007FEEB0AD000-memory.dmp

Filesize
11.4MB

Download
memory/884-174-0x000000000278B000-0x00000000027AA000-memory.dmp

Filesize
124KB

Download
memory/884-173-0x0000000002784000-0x0000000002787000-memory.dmp

Filesize
12KB

Download
memory/884-162-0x000000000278B000-0x00000000027AA000-memory.dmp

Filesize
124KB

Download
memory/884-131-0x0000000002784000-0x0000000002787000-memory.dmp

Filesize
12KB

Download
memory/884-161-0x000000001B740000-0x000000001BA3F000-memory.dmp

Filesize
3.0MB

Download
memory/884-97-0x000007FEEB940000-0x000007FEEC363000-memory.dmp

Filesize
10.1MB

Download
memory/884-72-0x0000000000000000-mapping.dmp

Download
memory/988-149-0x000007FEEA550000-0x000007FEEB0AD000-memory.dmp

Filesize
11.4MB

Download
memory/988-125-0x000007FEEB940000-0x000007FEEC363000-memory.dmp

Filesize
10.1MB

Download
memory/988-155-0x000000001B780000-0x000000001BA7F000-memory.dmp

Filesize
3.0MB

Download
memory/988-76-0x0000000000000000-mapping.dmp

Download
memory/988-171-0x00000000025BB000-0x00000000025DA000-memory.dmp

Filesize
124KB

Download
memory/988-135-0x00000000025B4000-0x00000000025B7000-memory.dmp

Filesize
12KB

Download
memory/988-193-0x00000000025BB000-0x00000000025DA000-memory.dmp

Filesize
124KB

Download
memory/988-183-0x00000000025B4000-0x00000000025B7000-memory.dmp

Filesize
12KB

Download
memory/1052-192-0x000000000249B000-0x00000000024BA000-memory.dmp

Filesize
124KB

Download
memory/1052-129-0x0000000002494000-0x0000000002497000-memory.dmp

Filesize
12KB

Download
memory/1052-182-0x0000000002494000-0x0000000002497000-memory.dmp

Filesize
12KB

Download
memory/1052-73-0x0000000000000000-mapping.dmp

Download
memory/1052-170-0x000000000249B000-0x00000000024BA000-memory.dmp

Filesize
124KB

Download
memory/1052-159-0x000000001B910000-0x000000001BC0F000-memory.dmp

Filesize
3.0MB

Download
memory/1052-127-0x000007FEEA550000-0x000007FEEB0AD000-memory.dmp

Filesize
11.4MB

Download
memory/1052-116-0x000007FEEB940000-0x000007FEEC363000-memory.dmp

Filesize
10.1MB

Download
memory/1460-60-0x00000000007A0000-0x00000000007B0000-memory.dmp

Filesize
64KB

Download
memory/1460-64-0x0000000000BE0000-0x0000000000BEC000-memory.dmp

Filesize
48KB

Download
memory/1460-55-0x0000000000350000-0x000000000036C000-memory.dmp

Filesize
112KB

Download
memory/1460-65-0x0000000001180000-0x000000000118A000-memory.dmp

Filesize
40KB

Download
memory/1460-54-0x00000000011D0000-0x0000000001386000-memory.dmp

Filesize
1.7MB

Download
memory/1460-58-0x0000000000760000-0x0000000000776000-memory.dmp

Filesize
88KB

Download
memory/1460-61-0x0000000000790000-0x000000000079C000-memory.dmp

Filesize
48KB

Download
memory/1460-70-0x000000001AF66000-0x000000001AF85000-memory.dmp

Filesize
124KB

Download
memory/1460-57-0x0000000000540000-0x0000000000550000-memory.dmp

Filesize
64KB

Download
memory/1460-69-0x000000001AF66000-0x000000001AF85000-memory.dmp

Filesize
124KB

Download
memory/1460-56-0x0000000000530000-0x0000000000538000-memory.dmp

Filesize
32KB

Download
memory/1460-62-0x0000000000950000-0x0000000000958000-memory.dmp

Filesize
32KB

Download
memory/1460-68-0x00000000011B0000-0x00000000011BC000-memory.dmp

Filesize
48KB

Download
memory/1460-66-0x0000000001190000-0x0000000001198000-memory.dmp

Filesize
32KB

Download
memory/1460-59-0x0000000000780000-0x0000000000792000-memory.dmp

Filesize
72KB

Download
memory/1460-109-0x000000001AF66000-0x000000001AF85000-memory.dmp

Filesize
124KB

Download
memory/1460-63-0x0000000000BD0000-0x0000000000BDC000-memory.dmp

Filesize
48KB

Download
memory/1460-67-0x00000000011A0000-0x00000000011AC000-memory.dmp

Filesize
48KB

Download
memory/1524-140-0x00000000028E4000-0x00000000028E7000-memory.dmp

Filesize
12KB

Download
memory/1524-165-0x00000000028EB000-0x000000000290A000-memory.dmp

Filesize
124KB

Download
memory/1524-187-0x00000000028EB000-0x000000000290A000-memory.dmp

Filesize
124KB

Download
memory/1524-124-0x000007FEEB940000-0x000007FEEC363000-memory.dmp

Filesize
10.1MB

Download
memory/1524-147-0x000007FEEA550000-0x000007FEEB0AD000-memory.dmp

Filesize
11.4MB

Download
memory/1524-177-0x00000000028E4000-0x00000000028E7000-memory.dmp

Filesize
12KB

Download
memory/1524-95-0x0000000000000000-mapping.dmp

Download
memory/1524-157-0x000000001B8F0000-0x000000001BBEF000-memory.dmp

Filesize
3.0MB

Download
memory/1536-126-0x000007FEEB940000-0x000007FEEC363000-memory.dmp

Filesize
10.1MB

Download
memory/1536-169-0x00000000027FB000-0x000000000281A000-memory.dmp

Filesize
124KB

Download
memory/1536-78-0x0000000000000000-mapping.dmp

Download
memory/1536-137-0x00000000027F4000-0x00000000027F7000-memory.dmp

Filesize
12KB

Download
memory/1536-145-0x000007FEEA550000-0x000007FEEB0AD000-memory.dmp

Filesize
11.4MB

Download
memory/1536-160-0x000000001B7E0000-0x000000001BADF000-memory.dmp

Filesize
3.0MB

Download
memory/1536-184-0x00000000027F4000-0x00000000027F7000-memory.dmp

Filesize
12KB

Download
memory/1596-156-0x000000001B860000-0x000000001BB5F000-memory.dmp

Filesize
3.0MB

Download
memory/1596-130-0x000007FEEA550000-0x000007FEEB0AD000-memory.dmp

Filesize
11.4MB

Download
memory/1596-74-0x0000000000000000-mapping.dmp

Download
memory/1596-163-0x000000000299B000-0x00000000029BA000-memory.dmp

Filesize
124KB

Download
memory/1596-118-0x000007FEEB940000-0x000007FEEC363000-memory.dmp

Filesize
10.1MB

Download
memory/1596-175-0x0000000002994000-0x0000000002997000-memory.dmp

Filesize
12KB

Download
memory/1596-133-0x0000000002994000-0x0000000002997000-memory.dmp

Filesize
12KB

Download
memory/1596-185-0x000000000299B000-0x00000000029BA000-memory.dmp

Filesize
124KB

Download
memory/1640-176-0x0000000002404000-0x0000000002407000-memory.dmp

Filesize
12KB

Download
memory/1640-186-0x000000000240B000-0x000000000242A000-memory.dmp

Filesize
124KB

Download
memory/1640-164-0x000000000240B000-0x000000000242A000-memory.dmp

Filesize
124KB

Download
memory/1640-123-0x000007FEEB940000-0x000007FEEC363000-memory.dmp

Filesize
10.1MB

Download
memory/1640-79-0x0000000000000000-mapping.dmp

Download
memory/1640-142-0x000007FEEA550000-0x000007FEEB0AD000-memory.dmp

Filesize
11.4MB

Download
memory/1640-152-0x000000001B7F0000-0x000000001BAEF000-memory.dmp

Filesize
3.0MB

Download
memory/1640-132-0x0000000002404000-0x0000000002407000-memory.dmp

Filesize
12KB

Download
memory/1668-196-0x0000000000000000-mapping.dmp

Download
memory/1720-82-0x0000000000000000-mapping.dmp

Download
memory/2164-105-0x0000000000000000-mapping.dmp

Download
memory/2228-108-0x0000000000000000-mapping.dmp

Download
memory/2268-141-0x000000001B226000-0x000000001B245000-memory.dmp

Filesize
124KB

Download
memory/2268-111-0x0000000000000000-mapping.dmp

Download
memory/2268-113-0x0000000000350000-0x0000000000506000-memory.dmp

Filesize
1.7MB

Download
memory/2268-114-0x000000001B226000-0x000000001B245000-memory.dmp

Filesize
124KB

Download
memory/2396-115-0x0000000000000000-mapping.dmp

Download
memory/2432-117-0x0000000000000000-mapping.dmp

Download