dcrat | 45b39f54b75173309a4a8bc2a716e4e7331bee37df16da32f683f3ab3bdb6e71

Analysis

max time kernel
28s
max time network
137s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
02-02-2023 23:09

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

45b39f54b75173309a4a8bc2a716e4e7331bee37df16da32f683f3ab3bdb6e71.exe
Size

1.3MB
MD5

a022cca1050a171c89b30be03d8893a2
SHA1

8a01266ff80bb15466b1cbf929beee0919f5e362
SHA256

45b39f54b75173309a4a8bc2a716e4e7331bee37df16da32f683f3ab3bdb6e71
SHA512

d44900ddb4d0619add330bc7b4243893d01c80239158a5026b8248b19fadd01543b8d62737dc65102937900649cfa9b5ce6450fe30274511feb48305db34aa0f
SSDEEP

24576:U2G/nvxW3Ww0t6TnzGmVBDh4+aknuRRZJND0gFJ4rD/IjC:UbA30GnzV/q+DnsXg

Score

10^/10

dcrat infostealer rat

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat

Process spawned unexpected child process 33 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

Processes:

schtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exe

description	pid	pid_target	process
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	360	4244	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	220	4244	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5076	4244	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4520	4244	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2420	4244	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3344	4244	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4440	4244	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2188	4244	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	672	4244	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4268	4244	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4656	4244	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4260	4244	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3476	4244	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4660	4244	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3852	4244	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4364	4244	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2680	4244	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	516	4244	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1212	4244	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4336	4244	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1920	4244	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4228	4244	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1144	4244	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2144	4244	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2216	4244	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1764	4244	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1368	4244	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1504	4244	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3536	4244	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3488	4244	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3148	4244	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3976	4244	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3736	4244	schtasks.exe

DCRat payload 5 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

Processes:

resource	yara_rule
C:\providercommon\DllCommonsvc.exe	dcrat
C:\providercommon\DllCommonsvc.exe	dcrat
behavioral1/memory/3088-139-0x00000000004C0000-0x00000000005D0000-memory.dmp	dcrat
C:\Program Files (x86)\Google\Update\Install\WmiPrvSE.exe	dcrat
C:\Program Files (x86)\Google\Update\Install\WmiPrvSE.exe	dcrat

Checks computer location settings 2 TTPs 3 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

WScript.exeDllCommonsvc.exe45b39f54b75173309a4a8bc2a716e4e7331bee37df16da32f683f3ab3bdb6e71.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Control Panel\International\Geo\Nation	WScript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Control Panel\International\Geo\Nation	DllCommonsvc.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Control Panel\International\Geo\Nation	45b39f54b75173309a4a8bc2a716e4e7331bee37df16da32f683f3ab3bdb6e71.exe

Executes dropped EXE 1 IoCs

Processes:

DllCommonsvc.exe

pid process

3088 DllCommonsvc.exe
Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

Drops file in Program Files directory 12 IoCs

Processes:

DllCommonsvc.exe

description	ioc	process
File created	C:\Program Files (x86)\Google\Update\Install\WmiPrvSE.exe	DllCommonsvc.exe
File created	C:\Program Files (x86)\Google\Update\Install\24dbde2999530e	DllCommonsvc.exe
File created	C:\Program Files\Common Files\System\it-IT\ea9f0e6c9e2dcd	DllCommonsvc.exe
File created	C:\Program Files (x86)\Windows Media Player\fr-FR\6203df4a6bafc7	DllCommonsvc.exe
File created	C:\Program Files\Microsoft Office\5b884080fd4f94	DllCommonsvc.exe
File created	C:\Program Files (x86)\Windows Mail\9e8d7a4ca61bd9	DllCommonsvc.exe
File created	C:\Program Files (x86)\WindowsPowerShell\Configuration\winlogon.exe	DllCommonsvc.exe
File created	C:\Program Files (x86)\WindowsPowerShell\Configuration\cc11b995f2a76d	DllCommonsvc.exe
File created	C:\Program Files\Common Files\System\it-IT\taskhostw.exe	DllCommonsvc.exe
File created	C:\Program Files (x86)\Windows Media Player\fr-FR\lsass.exe	DllCommonsvc.exe
File created	C:\Program Files\Microsoft Office\fontdrvhost.exe	DllCommonsvc.exe
File created	C:\Program Files (x86)\Windows Mail\RuntimeBroker.exe	DllCommonsvc.exe

Drops file in Windows directory 4 IoCs

Processes:

DllCommonsvc.exe

description	ioc	process
File created	C:\Windows\InputMethod\CHS\SppExtComObj.exe	DllCommonsvc.exe
File created	C:\Windows\InputMethod\CHS\e1ef82546f0b02	DllCommonsvc.exe
File created	C:\Windows\ja-JP\csrss.exe	DllCommonsvc.exe
File created	C:\Windows\ja-JP\886983d96e3d3e	DllCommonsvc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 33 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

Processes:

pid	process
5076	schtasks.exe
4268	schtasks.exe
4660	schtasks.exe
3536	schtasks.exe
3488	schtasks.exe
1368	schtasks.exe
3976	schtasks.exe
3476	schtasks.exe
3852	schtasks.exe
1212	schtasks.exe
1144	schtasks.exe
2216	schtasks.exe
360	schtasks.exe
2188	schtasks.exe
4260	schtasks.exe
516	schtasks.exe
3736	schtasks.exe
3344	schtasks.exe
1764	schtasks.exe
220	schtasks.exe
4520	schtasks.exe
3148	schtasks.exe
4440	schtasks.exe
672	schtasks.exe
2680	schtasks.exe
4336	schtasks.exe
4228	schtasks.exe
4656	schtasks.exe
2144	schtasks.exe
1504	schtasks.exe
2420	schtasks.exe
4364	schtasks.exe
1920	schtasks.exe

Modifies registry class 2 IoCs

Processes:

45b39f54b75173309a4a8bc2a716e4e7331bee37df16da32f683f3ab3bdb6e71.exeDllCommonsvc.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000_Classes\Local Settings	45b39f54b75173309a4a8bc2a716e4e7331bee37df16da32f683f3ab3bdb6e71.exe
Key created	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000_Classes\Local Settings	DllCommonsvc.exe

Suspicious behavior: EnumeratesProcesses 45 IoCs

Processes:

DllCommonsvc.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exe

pid	process
3088	DllCommonsvc.exe
3088	DllCommonsvc.exe
3088	DllCommonsvc.exe
3088	DllCommonsvc.exe
3088	DllCommonsvc.exe
3088	DllCommonsvc.exe
3088	DllCommonsvc.exe
3088	DllCommonsvc.exe
4724	powershell.exe
4724	powershell.exe
988	powershell.exe
988	powershell.exe
2292	powershell.exe
2292	powershell.exe
3560	powershell.exe
3560	powershell.exe
4236	powershell.exe
4236	powershell.exe
4924	powershell.exe
4924	powershell.exe
4456	powershell.exe
4456	powershell.exe
4124	powershell.exe
4124	powershell.exe
900	powershell.exe
900	powershell.exe
3116	powershell.exe
3116	powershell.exe
3916	powershell.exe
3916	powershell.exe
4492	powershell.exe
4492	powershell.exe
2292	powershell.exe
988	powershell.exe
4724	powershell.exe
4724	powershell.exe
3560	powershell.exe
4456	powershell.exe
4236	powershell.exe
4924	powershell.exe
4492	powershell.exe
900	powershell.exe
3116	powershell.exe
4124	powershell.exe
3916	powershell.exe

Suspicious use of AdjustPrivilegeToken 13 IoCs

Processes:

DllCommonsvc.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exe

description	pid	process
Token: SeDebugPrivilege	3088	DllCommonsvc.exe
Token: SeDebugPrivilege	4724	powershell.exe
Token: SeDebugPrivilege	988	powershell.exe
Token: SeDebugPrivilege	2292	powershell.exe
Token: SeDebugPrivilege	3560	powershell.exe
Token: SeDebugPrivilege	4236	powershell.exe
Token: SeDebugPrivilege	4924	powershell.exe
Token: SeDebugPrivilege	4456	powershell.exe
Token: SeDebugPrivilege	4124	powershell.exe
Token: SeDebugPrivilege	900	powershell.exe
Token: SeDebugPrivilege	3116	powershell.exe
Token: SeDebugPrivilege	3916	powershell.exe
Token: SeDebugPrivilege	4492	powershell.exe

Suspicious use of WriteProcessMemory 36 IoCs

Processes:

45b39f54b75173309a4a8bc2a716e4e7331bee37df16da32f683f3ab3bdb6e71.exeWScript.execmd.exeDllCommonsvc.execmd.exe

description	pid	process	target process
PID 4948 wrote to memory of 4568	4948	45b39f54b75173309a4a8bc2a716e4e7331bee37df16da32f683f3ab3bdb6e71.exe	WScript.exe
PID 4948 wrote to memory of 4568	4948	45b39f54b75173309a4a8bc2a716e4e7331bee37df16da32f683f3ab3bdb6e71.exe	WScript.exe
PID 4948 wrote to memory of 4568	4948	45b39f54b75173309a4a8bc2a716e4e7331bee37df16da32f683f3ab3bdb6e71.exe	WScript.exe
PID 4568 wrote to memory of 4092	4568	WScript.exe	cmd.exe
PID 4568 wrote to memory of 4092	4568	WScript.exe	cmd.exe
PID 4568 wrote to memory of 4092	4568	WScript.exe	cmd.exe
PID 4092 wrote to memory of 3088	4092	cmd.exe	DllCommonsvc.exe
PID 4092 wrote to memory of 3088	4092	cmd.exe	DllCommonsvc.exe
PID 3088 wrote to memory of 988	3088	DllCommonsvc.exe	powershell.exe
PID 3088 wrote to memory of 988	3088	DllCommonsvc.exe	powershell.exe
PID 3088 wrote to memory of 2292	3088	DllCommonsvc.exe	powershell.exe
PID 3088 wrote to memory of 2292	3088	DllCommonsvc.exe	powershell.exe
PID 3088 wrote to memory of 3560	3088	DllCommonsvc.exe	powershell.exe
PID 3088 wrote to memory of 3560	3088	DllCommonsvc.exe	powershell.exe
PID 3088 wrote to memory of 4724	3088	DllCommonsvc.exe	powershell.exe
PID 3088 wrote to memory of 4724	3088	DllCommonsvc.exe	powershell.exe
PID 3088 wrote to memory of 3116	3088	DllCommonsvc.exe	powershell.exe
PID 3088 wrote to memory of 3116	3088	DllCommonsvc.exe	powershell.exe
PID 3088 wrote to memory of 4124	3088	DllCommonsvc.exe	powershell.exe
PID 3088 wrote to memory of 4124	3088	DllCommonsvc.exe	powershell.exe
PID 3088 wrote to memory of 900	3088	DllCommonsvc.exe	powershell.exe
PID 3088 wrote to memory of 900	3088	DllCommonsvc.exe	powershell.exe
PID 3088 wrote to memory of 4236	3088	DllCommonsvc.exe	powershell.exe
PID 3088 wrote to memory of 4236	3088	DllCommonsvc.exe	powershell.exe
PID 3088 wrote to memory of 3916	3088	DllCommonsvc.exe	powershell.exe
PID 3088 wrote to memory of 3916	3088	DllCommonsvc.exe	powershell.exe
PID 3088 wrote to memory of 4456	3088	DllCommonsvc.exe	powershell.exe
PID 3088 wrote to memory of 4456	3088	DllCommonsvc.exe	powershell.exe
PID 3088 wrote to memory of 4492	3088	DllCommonsvc.exe	powershell.exe
PID 3088 wrote to memory of 4492	3088	DllCommonsvc.exe	powershell.exe
PID 3088 wrote to memory of 4924	3088	DllCommonsvc.exe	powershell.exe
PID 3088 wrote to memory of 4924	3088	DllCommonsvc.exe	powershell.exe
PID 3088 wrote to memory of 220	3088	DllCommonsvc.exe	cmd.exe
PID 3088 wrote to memory of 220	3088	DllCommonsvc.exe	cmd.exe
PID 220 wrote to memory of 3880	220	cmd.exe	w32tm.exe
PID 220 wrote to memory of 3880	220	cmd.exe	w32tm.exe

C:\Users\Admin\AppData\Local\Temp\45b39f54b75173309a4a8bc2a716e4e7331bee37df16da32f683f3ab3bdb6e71.exe
"C:\Users\Admin\AppData\Local\Temp\45b39f54b75173309a4a8bc2a716e4e7331bee37df16da32f683f3ab3bdb6e71.exe"
1⤵
- Checks computer location settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4948
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\providercommon\yTUdeXjbLOhnrN32dgrxVg.vbe"
  2⤵
  - Checks computer location settings
  - Suspicious use of WriteProcessMemory
  PID:4568
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\providercommon\1zu9dW.bat" "
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4092
  - - C:\providercommon\DllCommonsvc.exe
      "C:\providercommon\DllCommonsvc.exe"
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Drops file in Program Files directory
      Drops file in Windows directory
      Modifies registry class
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:3088
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\DllCommonsvc.exe'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:988
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\odt\sppsvc.exe'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2292
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\WindowsPowerShell\Configuration\winlogon.exe'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4724
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\InputMethod\CHS\SppExtComObj.exe'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3116
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Common Files\System\it-IT\taskhostw.exe'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4124
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Windows Media Player\fr-FR\lsass.exe'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:900
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Public\Documents\My Music\StartMenuExperienceHost.exe'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4236
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Microsoft Office\fontdrvhost.exe'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3916
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\ja-JP\csrss.exe'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4924
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\All Users\Microsoft\Office\WaaSMedicAgent.exe'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4492
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Windows Mail\RuntimeBroker.exe'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4456
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Google\Update\Install\WmiPrvSE.exe'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3560
    - - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\4gxnF4du6m.bat"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:220
      - C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        6⤵
        
        PID:3880
      - C:\Program Files (x86)\Google\Update\Install\WmiPrvSE.exe
        
        "C:\Program Files (x86)\Google\Update\Install\WmiPrvSE.exe"
        6⤵
        
        PID:380
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\kNGCBu7dv8.bat"
        7⤵
        
        PID:4028
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        8⤵
        
        PID:3400

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 14 /tr "'C:\odt\sppsvc.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:360

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvc" /sc ONLOGON /tr "'C:\odt\sppsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:220

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 14 /tr "'C:\odt\sppsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:5076

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 13 /tr "'C:\Program Files (x86)\Google\Update\Install\WmiPrvSE.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4520

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSE" /sc ONLOGON /tr "'C:\Program Files (x86)\Google\Update\Install\WmiPrvSE.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2420

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 8 /tr "'C:\Program Files (x86)\Google\Update\Install\WmiPrvSE.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3344

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 7 /tr "'C:\Program Files (x86)\WindowsPowerShell\Configuration\winlogon.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4440

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogon" /sc ONLOGON /tr "'C:\Program Files (x86)\WindowsPowerShell\Configuration\winlogon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2188

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 11 /tr "'C:\Program Files (x86)\WindowsPowerShell\Configuration\winlogon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:672

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SppExtComObjS" /sc MINUTE /mo 8 /tr "'C:\Windows\InputMethod\CHS\SppExtComObj.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4268

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SppExtComObj" /sc ONLOGON /tr "'C:\Windows\InputMethod\CHS\SppExtComObj.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4656

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SppExtComObjS" /sc MINUTE /mo 13 /tr "'C:\Windows\InputMethod\CHS\SppExtComObj.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4260

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostwt" /sc MINUTE /mo 11 /tr "'C:\Program Files\Common Files\System\it-IT\taskhostw.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3476

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostw" /sc ONLOGON /tr "'C:\Program Files\Common Files\System\it-IT\taskhostw.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4660

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostwt" /sc MINUTE /mo 7 /tr "'C:\Program Files\Common Files\System\it-IT\taskhostw.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3852

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 8 /tr "'C:\Program Files (x86)\Windows Media Player\fr-FR\lsass.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4364

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsass" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Media Player\fr-FR\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2680

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 7 /tr "'C:\Program Files (x86)\Windows Media Player\fr-FR\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:516

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "StartMenuExperienceHostS" /sc MINUTE /mo 7 /tr "'C:\Users\Public\Documents\My Music\StartMenuExperienceHost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1212

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "StartMenuExperienceHost" /sc ONLOGON /tr "'C:\Users\Public\Documents\My Music\StartMenuExperienceHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4336

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "StartMenuExperienceHostS" /sc MINUTE /mo 11 /tr "'C:\Users\Public\Documents\My Music\StartMenuExperienceHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1920

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 5 /tr "'C:\Program Files\Microsoft Office\fontdrvhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4228

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\Program Files\Microsoft Office\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1144

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 7 /tr "'C:\Program Files\Microsoft Office\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2144

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 5 /tr "'C:\Program Files (x86)\Windows Mail\RuntimeBroker.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2216

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Mail\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1764

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 7 /tr "'C:\Program Files (x86)\Windows Mail\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1368

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WaaSMedicAgentW" /sc MINUTE /mo 5 /tr "'C:\Users\All Users\Microsoft\Office\WaaSMedicAgent.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1504

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WaaSMedicAgent" /sc ONLOGON /tr "'C:\Users\All Users\Microsoft\Office\WaaSMedicAgent.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3536

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WaaSMedicAgentW" /sc MINUTE /mo 7 /tr "'C:\Users\All Users\Microsoft\Office\WaaSMedicAgent.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3488

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 10 /tr "'C:\Windows\ja-JP\csrss.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3148

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Windows\ja-JP\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3976

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 14 /tr "'C:\Windows\ja-JP\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3736

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Web Service

T1102

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Google\Update\Install\WmiPrvSE.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\Program Files (x86)\Google\Update\Install\WmiPrvSE.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
d85ba6ff808d9e5444a4b369f5bc2730

SHA1
31aa9d96590fff6981b315e0b391b575e4c0804a

SHA256
84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

SHA512
8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
17fbfbe3f04595e251287a6bfcdc35de

SHA1
b576aabfd5e6d5799d487011506ed1ae70688987

SHA256
2e61ae727ca01496c9418a65777d6d7e05a85cbdb6b3a19516857442e5bd2da0

SHA512
449c68512d90a17f598e9dacfd6230e6e97bc6bfaaf2b06f3b91b370ece92e2322b81ee3721e288880fa1f05470156e519256e3f03d786c3b28a39788f5e0ad6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
22fbec4acba323d04079a263526cef3c

SHA1
eb8dd0042c6a3f20087a7d2391eaf48121f98740

SHA256
020e5d769893724f075e10b01c59bf2424214cefe6aafbab6f44bc700f525c40

SHA512
fb61d737de8cbed6b7d8b5a35911c46ef26a2927a52ed7add9d594cf19dcab1b9978b61912c6f3fe4f29228f4454fb022fb2e167788c727dc6503c1fcd42159e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
22fbec4acba323d04079a263526cef3c

SHA1
eb8dd0042c6a3f20087a7d2391eaf48121f98740

SHA256
020e5d769893724f075e10b01c59bf2424214cefe6aafbab6f44bc700f525c40

SHA512
fb61d737de8cbed6b7d8b5a35911c46ef26a2927a52ed7add9d594cf19dcab1b9978b61912c6f3fe4f29228f4454fb022fb2e167788c727dc6503c1fcd42159e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
22fbec4acba323d04079a263526cef3c

SHA1
eb8dd0042c6a3f20087a7d2391eaf48121f98740

SHA256
020e5d769893724f075e10b01c59bf2424214cefe6aafbab6f44bc700f525c40

SHA512
fb61d737de8cbed6b7d8b5a35911c46ef26a2927a52ed7add9d594cf19dcab1b9978b61912c6f3fe4f29228f4454fb022fb2e167788c727dc6503c1fcd42159e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
60804e808a88131a5452fed692914a8e

SHA1
fdb74669923b31d573787fe024dbd701fa21bb5b

SHA256
064fdd6e9e6e7f51da354604a56f66217f1edfc12d9bbbaf869a628915a86a61

SHA512
d4f2791433c0bacd8cad57b40fab4a807db4dd74f7c5357d2bce9aaa6544f97667497307d1e0704b98e2c99a94775fbb6ea676685a01578e4d0304f541c9854a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
ecceac16628651c18879d836acfcb062

SHA1
420502b3e5220a01586c59504e94aa1ee11982c9

SHA256
58238de09a8817ed9f894ed8e5bf06a897fd08e0b0bd77e508d37b2598edd2a9

SHA512
be3c7cb529cafb00f58790a6f8b35c4ff6db9f7f43a507d2218fd80cebc88413e46f71b1bc35b8afcc36b68f9409c946470d1e74a4fe225400eeb6f3f898f5b3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
17fbfbe3f04595e251287a6bfcdc35de

SHA1
b576aabfd5e6d5799d487011506ed1ae70688987

SHA256
2e61ae727ca01496c9418a65777d6d7e05a85cbdb6b3a19516857442e5bd2da0

SHA512
449c68512d90a17f598e9dacfd6230e6e97bc6bfaaf2b06f3b91b370ece92e2322b81ee3721e288880fa1f05470156e519256e3f03d786c3b28a39788f5e0ad6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
17fbfbe3f04595e251287a6bfcdc35de

SHA1
b576aabfd5e6d5799d487011506ed1ae70688987

SHA256
2e61ae727ca01496c9418a65777d6d7e05a85cbdb6b3a19516857442e5bd2da0

SHA512
449c68512d90a17f598e9dacfd6230e6e97bc6bfaaf2b06f3b91b370ece92e2322b81ee3721e288880fa1f05470156e519256e3f03d786c3b28a39788f5e0ad6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
17fbfbe3f04595e251287a6bfcdc35de

SHA1
b576aabfd5e6d5799d487011506ed1ae70688987

SHA256
2e61ae727ca01496c9418a65777d6d7e05a85cbdb6b3a19516857442e5bd2da0

SHA512
449c68512d90a17f598e9dacfd6230e6e97bc6bfaaf2b06f3b91b370ece92e2322b81ee3721e288880fa1f05470156e519256e3f03d786c3b28a39788f5e0ad6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
17fbfbe3f04595e251287a6bfcdc35de

SHA1
b576aabfd5e6d5799d487011506ed1ae70688987

SHA256
2e61ae727ca01496c9418a65777d6d7e05a85cbdb6b3a19516857442e5bd2da0

SHA512
449c68512d90a17f598e9dacfd6230e6e97bc6bfaaf2b06f3b91b370ece92e2322b81ee3721e288880fa1f05470156e519256e3f03d786c3b28a39788f5e0ad6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
101c3b86ef1c02c62b7d862c2a47363b

SHA1
3c5e8d309610e5ba41b6b9788bfb826e45864b46

SHA256
9174446e5bf6366c610c790d5176cf11a65574345cc15ca7ded7247daf4d233c

SHA512
d199aa9fbfefea6a27e1c6414b17c1e03c39840047f03c71788f83d37f30651df49dc865c0c38214bab7923bcd2e57e064817b9f1453818c2e7a29d3686d2d60

Download Submit
C:\Users\Admin\AppData\Local\Temp\4gxnF4du6m.bat

Filesize
222B

MD5
e94dcf7d49cf70df16ca7d619717c72d

SHA1
1875350bd5dfad48c5752bb04c5a5ac425bf1f5d

SHA256
13ee91f059b0150239af1c5e4f3030fd6ad459680fe7715baee24b1962b0594f

SHA512
af9743f4a43ac7ed5cc44f2bb3d4cf4f9703469803986cd78956bf0b3bbdaa96f433620e9eba8c51132d6c22d1871502530765b40c7bfafa4ebca194cffa550b

Download Submit
C:\Users\Admin\AppData\Local\Temp\kNGCBu7dv8.bat

Filesize
222B

MD5
2c35efcdbdbeb000da8f5c887b24bb85

SHA1
d84eec2d053b5e3bf7276dcc93a421897f1a639e

SHA256
79260d8eab5de2a41115cadc5ba8c482cea551e66fe498d7c896a1cbb9ff2bb7

SHA512
d6b2d2383786ea7e065cc07b8840dc0f998377ded65de16b77130133c8129aa186166de71edd04d486889bf0eb1a74a64245215581eda8eab20e0546f1434120

Download Submit
C:\providercommon\1zu9dW.bat

Filesize
36B

MD5
6783c3ee07c7d151ceac57f1f9c8bed7

SHA1
17468f98f95bf504cc1f83c49e49a78526b3ea03

SHA256
8ab782f0f327a2021530e7230d3aee8abbecb7eed59482a3a46e78b9e3862322

SHA512
c6012d4bfac1ed14d0fd9f0eabd0e1c3d647b343db292a907b246271d52a4b7469c809db43910ddba2e8c5045f9cb3d24d0af62d363281e6cb8b39ee94a183e8

Download Submit
C:\providercommon\DllCommonsvc.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\providercommon\DllCommonsvc.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\providercommon\yTUdeXjbLOhnrN32dgrxVg.vbe

Filesize
197B

MD5
8088241160261560a02c84025d107592

SHA1
083121f7027557570994c9fc211df61730455bb5

SHA256
2072cc9a4a3b84d4c5178ab41c5588eea7d0103e3928e34d64f17bf97f3d1cc1

SHA512
20d9369dd359315848ea30144383a0bb479d86059fdbc3b3256ac84f998193512feb3b1799ab663619920c99fe7e0ebba33ada31a3855094b956fcd351c90478

Download Submit
memory/220-154-0x0000000000000000-mapping.dmp

Download
memory/380-197-0x00007FFBCDF00000-0x00007FFBCE9C1000-memory.dmp

Filesize
10.8MB

Download
memory/380-194-0x0000000000000000-mapping.dmp

Download
memory/380-201-0x00007FFBCDF00000-0x00007FFBCE9C1000-memory.dmp

Filesize
10.8MB

Download
memory/900-147-0x0000000000000000-mapping.dmp

Download
memory/900-162-0x00007FFBCDF00000-0x00007FFBCE9C1000-memory.dmp

Filesize
10.8MB

Download
memory/900-190-0x00007FFBCDF00000-0x00007FFBCE9C1000-memory.dmp

Filesize
10.8MB

Download
memory/988-155-0x00007FFBCDF00000-0x00007FFBCE9C1000-memory.dmp

Filesize
10.8MB

Download
memory/988-141-0x0000000000000000-mapping.dmp

Download
memory/988-175-0x00007FFBCDF00000-0x00007FFBCE9C1000-memory.dmp

Filesize
10.8MB

Download
memory/2292-156-0x00007FFBCDF00000-0x00007FFBCE9C1000-memory.dmp

Filesize
10.8MB

Download
memory/2292-142-0x0000000000000000-mapping.dmp

Download
memory/2292-173-0x00007FFBCDF00000-0x00007FFBCE9C1000-memory.dmp

Filesize
10.8MB

Download
memory/3088-157-0x00007FFBCDF00000-0x00007FFBCE9C1000-memory.dmp

Filesize
10.8MB

Download
memory/3088-136-0x0000000000000000-mapping.dmp

Download
memory/3088-139-0x00000000004C0000-0x00000000005D0000-memory.dmp

Filesize
1.1MB

Download
memory/3088-140-0x00007FFBCDF00000-0x00007FFBCE9C1000-memory.dmp

Filesize
10.8MB

Download
memory/3116-192-0x00007FFBCDF00000-0x00007FFBCE9C1000-memory.dmp

Filesize
10.8MB

Download
memory/3116-160-0x00007FFBCDF00000-0x00007FFBCE9C1000-memory.dmp

Filesize
10.8MB

Download
memory/3116-145-0x0000000000000000-mapping.dmp

Download
memory/3400-200-0x0000000000000000-mapping.dmp

Download
memory/3560-159-0x00007FFBCDF00000-0x00007FFBCE9C1000-memory.dmp

Filesize
10.8MB

Download
memory/3560-143-0x0000000000000000-mapping.dmp

Download
memory/3560-179-0x00007FFBCDF00000-0x00007FFBCE9C1000-memory.dmp

Filesize
10.8MB

Download
memory/3880-169-0x0000000000000000-mapping.dmp

Download
memory/3916-149-0x0000000000000000-mapping.dmp

Download
memory/3916-165-0x00007FFBCDF00000-0x00007FFBCE9C1000-memory.dmp

Filesize
10.8MB

Download
memory/3916-189-0x00007FFBCDF00000-0x00007FFBCE9C1000-memory.dmp

Filesize
10.8MB

Download
memory/4028-198-0x0000000000000000-mapping.dmp

Download
memory/4092-135-0x0000000000000000-mapping.dmp

Download
memory/4124-146-0x0000000000000000-mapping.dmp

Download
memory/4124-193-0x00007FFBCDF00000-0x00007FFBCE9C1000-memory.dmp

Filesize
10.8MB

Download
memory/4124-161-0x00007FFBCDF00000-0x00007FFBCE9C1000-memory.dmp

Filesize
10.8MB

Download
memory/4236-184-0x00007FFBCDF00000-0x00007FFBCE9C1000-memory.dmp

Filesize
10.8MB

Download
memory/4236-148-0x0000000000000000-mapping.dmp

Download
memory/4236-164-0x00007FFBCDF00000-0x00007FFBCE9C1000-memory.dmp

Filesize
10.8MB

Download
memory/4456-178-0x00007FFBCDF00000-0x00007FFBCE9C1000-memory.dmp

Filesize
10.8MB

Download
memory/4456-150-0x0000000000000000-mapping.dmp

Download
memory/4456-166-0x00007FFBCDF00000-0x00007FFBCE9C1000-memory.dmp

Filesize
10.8MB

Download
memory/4492-185-0x00007FFBCDF00000-0x00007FFBCE9C1000-memory.dmp

Filesize
10.8MB

Download
memory/4492-151-0x0000000000000000-mapping.dmp

Download
memory/4492-167-0x00007FFBCDF00000-0x00007FFBCE9C1000-memory.dmp

Filesize
10.8MB

Download
memory/4568-132-0x0000000000000000-mapping.dmp

Download
memory/4724-158-0x00007FFBCDF00000-0x00007FFBCE9C1000-memory.dmp

Filesize
10.8MB

Download
memory/4724-153-0x0000026F6C980000-0x0000026F6C9A2000-memory.dmp

Filesize
136KB

Download
memory/4724-144-0x0000000000000000-mapping.dmp

Download
memory/4724-177-0x00007FFBCDF00000-0x00007FFBCE9C1000-memory.dmp

Filesize
10.8MB

Download
memory/4924-183-0x00007FFBCDF00000-0x00007FFBCE9C1000-memory.dmp

Filesize
10.8MB

Download
memory/4924-168-0x00007FFBCDF00000-0x00007FFBCE9C1000-memory.dmp

Filesize
10.8MB

Download
memory/4924-152-0x0000000000000000-mapping.dmp

Download