dcrat | 7839eb36f7eed422a53caef155ec171e4e75c2c8cf918432dcc933dda4241bcd

Analysis

max time kernel
150s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
02-02-2023 12:53

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5a85456927d17627968250e487d8f714.exe
Size

1.3MB
MD5

5a85456927d17627968250e487d8f714
SHA1

21f6936933c7651e37c56f5986c889c33872af5c
SHA256

7839eb36f7eed422a53caef155ec171e4e75c2c8cf918432dcc933dda4241bcd
SHA512

cbce7dd84496805dfce1574f330450d5f32dd8966cec8a172b77281f58f0c55caa2f00db8ff2e5f48447eb2a5396c514379f67689a129d176c9ad4bfd91ce1c5
SSDEEP

24576:U2G/nvxW3Ww0t6TnzGmVBDh4+aknuRRZJND0gFJ4rD/IjC:UbA30GnzV/q+DnsXg

Score

10^/10

dcrat infostealer rat

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat

Process spawned unexpected child process 39 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

Processes:

schtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exe

description	pid	pid_target	process
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5088	4528	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4356	4528	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3896	4528	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3816	4528	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5016	4528	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5116	4528	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3620	4528	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4568	4528	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4708	4528	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4704	4528	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5008	4528	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	392	4528	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4232	4528	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3460	4528	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3936	4528	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3232	4528	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4040	4528	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2168	4528	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2780	4528	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2160	4528	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3752	4528	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4956	4528	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2968	4528	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3904	4528	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3032	4528	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3808	4528	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4672	4528	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4340	4528	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4728	4528	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3444	4528	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4400	4528	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	452	4528	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3692	4528	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1340	4528	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1984	4528	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3892	4528	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2240	4528	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4992	4528	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4828	4528	schtasks.exe

DCRat payload 13 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

Processes:

resource	yara_rule
C:\providercommon\DllCommonsvc.exe	dcrat
C:\providercommon\DllCommonsvc.exe	dcrat
behavioral2/memory/4480-139-0x00000000001A0000-0x00000000002B0000-memory.dmp	dcrat
C:\Recovery\WindowsRE\csrss.exe	dcrat
C:\Recovery\WindowsRE\csrss.exe	dcrat
C:\Recovery\WindowsRE\csrss.exe	dcrat
C:\Recovery\WindowsRE\csrss.exe	dcrat
C:\Recovery\WindowsRE\csrss.exe	dcrat
C:\Recovery\WindowsRE\csrss.exe	dcrat
C:\Recovery\WindowsRE\csrss.exe	dcrat
C:\Recovery\WindowsRE\csrss.exe	dcrat
C:\Recovery\WindowsRE\csrss.exe	dcrat
C:\Recovery\WindowsRE\csrss.exe	dcrat

Executes dropped EXE 10 IoCs

Processes:

DllCommonsvc.execsrss.execsrss.execsrss.execsrss.execsrss.execsrss.execsrss.execsrss.execsrss.exe

pid process

4480 DllCommonsvc.exe
3040 csrss.exe
4284 csrss.exe
1312 csrss.exe
4820 csrss.exe
1028 csrss.exe
772 csrss.exe
624 csrss.exe
4992 csrss.exe
4356 csrss.exe

Checks computer location settings 2 TTPs 12 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

csrss.exe5a85456927d17627968250e487d8f714.exeWScript.exeDllCommonsvc.execsrss.execsrss.execsrss.execsrss.execsrss.execsrss.execsrss.execsrss.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Control Panel\International\Geo\Nation	csrss.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Control Panel\International\Geo\Nation	5a85456927d17627968250e487d8f714.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Control Panel\International\Geo\Nation	WScript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Control Panel\International\Geo\Nation	DllCommonsvc.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Control Panel\International\Geo\Nation	csrss.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Control Panel\International\Geo\Nation	csrss.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Control Panel\International\Geo\Nation	csrss.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Control Panel\International\Geo\Nation	csrss.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Control Panel\International\Geo\Nation	csrss.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Control Panel\International\Geo\Nation	csrss.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Control Panel\International\Geo\Nation	csrss.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Control Panel\International\Geo\Nation	csrss.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

Drops file in Program Files directory 6 IoCs

Processes:

DllCommonsvc.exe

description	ioc	process
File created	C:\Program Files (x86)\Windows Portable Devices\69ddcba757bf72	DllCommonsvc.exe
File created	C:\Program Files\Mozilla Firefox\uninstall\SppExtComObj.exe	DllCommonsvc.exe
File created	C:\Program Files\Mozilla Firefox\uninstall\e1ef82546f0b02	DllCommonsvc.exe
File created	C:\Program Files\Uninstall Information\explorer.exe	DllCommonsvc.exe
File created	C:\Program Files\Uninstall Information\7a0fd90576e088	DllCommonsvc.exe
File created	C:\Program Files (x86)\Windows Portable Devices\smss.exe	DllCommonsvc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 39 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

Processes:

pid	process
3816	schtasks.exe
5016	schtasks.exe
392	schtasks.exe
4232	schtasks.exe
3936	schtasks.exe
4040	schtasks.exe
3904	schtasks.exe
3896	schtasks.exe
2240	schtasks.exe
3444	schtasks.exe
2968	schtasks.exe
3032	schtasks.exe
3232	schtasks.exe
4568	schtasks.exe
2160	schtasks.exe
4956	schtasks.exe
5088	schtasks.exe
3620	schtasks.exe
4708	schtasks.exe
2780	schtasks.exe
4728	schtasks.exe
4828	schtasks.exe
5116	schtasks.exe
452	schtasks.exe
4356	schtasks.exe
5008	schtasks.exe
3460	schtasks.exe
2168	schtasks.exe
3808	schtasks.exe
4672	schtasks.exe
1340	schtasks.exe
1984	schtasks.exe
4704	schtasks.exe
4992	schtasks.exe
4340	schtasks.exe
4400	schtasks.exe
3692	schtasks.exe
3892	schtasks.exe
3752	schtasks.exe

Modifies registry class 10 IoCs

Processes:

csrss.execsrss.execsrss.exe5a85456927d17627968250e487d8f714.execsrss.execsrss.execsrss.execsrss.execsrss.execsrss.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000_Classes\Local Settings	csrss.exe
Key created	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000_Classes\Local Settings	csrss.exe
Key created	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000_Classes\Local Settings	csrss.exe
Key created	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000_Classes\Local Settings	5a85456927d17627968250e487d8f714.exe
Key created	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000_Classes\Local Settings	csrss.exe
Key created	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000_Classes\Local Settings	csrss.exe
Key created	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000_Classes\Local Settings	csrss.exe
Key created	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000_Classes\Local Settings	csrss.exe
Key created	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000_Classes\Local Settings	csrss.exe
Key created	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000_Classes\Local Settings	csrss.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

DllCommonsvc.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.execsrss.execsrss.execsrss.execsrss.execsrss.execsrss.execsrss.execsrss.exe

pid	process
4480	DllCommonsvc.exe
4480	DllCommonsvc.exe
4480	DllCommonsvc.exe
4480	DllCommonsvc.exe
4480	DllCommonsvc.exe
4480	DllCommonsvc.exe
4480	DllCommonsvc.exe
3328	powershell.exe
4380	powershell.exe
3328	powershell.exe
4380	powershell.exe
680	powershell.exe
680	powershell.exe
1156	powershell.exe
1156	powershell.exe
2248	powershell.exe
2248	powershell.exe
4900	powershell.exe
4900	powershell.exe
1000	powershell.exe
1000	powershell.exe
4172	powershell.exe
4172	powershell.exe
4216	powershell.exe
4216	powershell.exe
4224	powershell.exe
4224	powershell.exe
2000	powershell.exe
2000	powershell.exe
3528	powershell.exe
3528	powershell.exe
1004	powershell.exe
1004	powershell.exe
2656	powershell.exe
2656	powershell.exe
1004	powershell.exe
3040	csrss.exe
3040	csrss.exe
3328	powershell.exe
3328	powershell.exe
680	powershell.exe
680	powershell.exe
4380	powershell.exe
4380	powershell.exe
1156	powershell.exe
1156	powershell.exe
4900	powershell.exe
4900	powershell.exe
2248	powershell.exe
2248	powershell.exe
1000	powershell.exe
4172	powershell.exe
4216	powershell.exe
4224	powershell.exe
2000	powershell.exe
3528	powershell.exe
2656	powershell.exe
4284	csrss.exe
1312	csrss.exe
4820	csrss.exe
1028	csrss.exe
772	csrss.exe
624	csrss.exe
4992	csrss.exe

Suspicious use of AdjustPrivilegeToken 24 IoCs

Processes:

description	pid	process
Token: SeDebugPrivilege	4480	DllCommonsvc.exe
Token: SeDebugPrivilege	4380	powershell.exe
Token: SeDebugPrivilege	3328	powershell.exe
Token: SeDebugPrivilege	680	powershell.exe
Token: SeDebugPrivilege	1156	powershell.exe
Token: SeDebugPrivilege	2248	powershell.exe
Token: SeDebugPrivilege	4900	powershell.exe
Token: SeDebugPrivilege	1000	powershell.exe
Token: SeDebugPrivilege	4172	powershell.exe
Token: SeDebugPrivilege	4216	powershell.exe
Token: SeDebugPrivilege	4224	powershell.exe
Token: SeDebugPrivilege	2000	powershell.exe
Token: SeDebugPrivilege	3528	powershell.exe
Token: SeDebugPrivilege	1004	powershell.exe
Token: SeDebugPrivilege	2656	powershell.exe
Token: SeDebugPrivilege	3040	csrss.exe
Token: SeDebugPrivilege	4284	csrss.exe
Token: SeDebugPrivilege	1312	csrss.exe
Token: SeDebugPrivilege	4820	csrss.exe
Token: SeDebugPrivilege	1028	csrss.exe
Token: SeDebugPrivilege	772	csrss.exe
Token: SeDebugPrivilege	624	csrss.exe
Token: SeDebugPrivilege	4992	csrss.exe
Token: SeDebugPrivilege	4356	csrss.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

5a85456927d17627968250e487d8f714.exeWScript.execmd.exeDllCommonsvc.execsrss.execmd.execsrss.execmd.execsrss.execmd.execsrss.execmd.execsrss.exe

description	pid	process	target process
PID 4860 wrote to memory of 1536	4860	5a85456927d17627968250e487d8f714.exe	WScript.exe
PID 4860 wrote to memory of 1536	4860	5a85456927d17627968250e487d8f714.exe	WScript.exe
PID 4860 wrote to memory of 1536	4860	5a85456927d17627968250e487d8f714.exe	WScript.exe
PID 1536 wrote to memory of 1160	1536	WScript.exe	cmd.exe
PID 1536 wrote to memory of 1160	1536	WScript.exe	cmd.exe
PID 1536 wrote to memory of 1160	1536	WScript.exe	cmd.exe
PID 1160 wrote to memory of 4480	1160	cmd.exe	DllCommonsvc.exe
PID 1160 wrote to memory of 4480	1160	cmd.exe	DllCommonsvc.exe
PID 4480 wrote to memory of 3328	4480	DllCommonsvc.exe	powershell.exe
PID 4480 wrote to memory of 3328	4480	DllCommonsvc.exe	powershell.exe
PID 4480 wrote to memory of 4380	4480	DllCommonsvc.exe	powershell.exe
PID 4480 wrote to memory of 4380	4480	DllCommonsvc.exe	powershell.exe
PID 4480 wrote to memory of 680	4480	DllCommonsvc.exe	powershell.exe
PID 4480 wrote to memory of 680	4480	DllCommonsvc.exe	powershell.exe
PID 4480 wrote to memory of 2248	4480	DllCommonsvc.exe	powershell.exe
PID 4480 wrote to memory of 2248	4480	DllCommonsvc.exe	powershell.exe
PID 4480 wrote to memory of 1156	4480	DllCommonsvc.exe	powershell.exe
PID 4480 wrote to memory of 1156	4480	DllCommonsvc.exe	powershell.exe
PID 4480 wrote to memory of 4900	4480	DllCommonsvc.exe	powershell.exe
PID 4480 wrote to memory of 4900	4480	DllCommonsvc.exe	powershell.exe
PID 4480 wrote to memory of 1000	4480	DllCommonsvc.exe	powershell.exe
PID 4480 wrote to memory of 1000	4480	DllCommonsvc.exe	powershell.exe
PID 4480 wrote to memory of 4172	4480	DllCommonsvc.exe	powershell.exe
PID 4480 wrote to memory of 4172	4480	DllCommonsvc.exe	powershell.exe
PID 4480 wrote to memory of 4216	4480	DllCommonsvc.exe	powershell.exe
PID 4480 wrote to memory of 4216	4480	DllCommonsvc.exe	powershell.exe
PID 4480 wrote to memory of 4224	4480	DllCommonsvc.exe	powershell.exe
PID 4480 wrote to memory of 4224	4480	DllCommonsvc.exe	powershell.exe
PID 4480 wrote to memory of 2000	4480	DllCommonsvc.exe	powershell.exe
PID 4480 wrote to memory of 2000	4480	DllCommonsvc.exe	powershell.exe
PID 4480 wrote to memory of 3528	4480	DllCommonsvc.exe	powershell.exe
PID 4480 wrote to memory of 3528	4480	DllCommonsvc.exe	powershell.exe
PID 4480 wrote to memory of 1004	4480	DllCommonsvc.exe	powershell.exe
PID 4480 wrote to memory of 1004	4480	DllCommonsvc.exe	powershell.exe
PID 4480 wrote to memory of 2656	4480	DllCommonsvc.exe	powershell.exe
PID 4480 wrote to memory of 2656	4480	DllCommonsvc.exe	powershell.exe
PID 4480 wrote to memory of 3040	4480	DllCommonsvc.exe	csrss.exe
PID 4480 wrote to memory of 3040	4480	DllCommonsvc.exe	csrss.exe
PID 3040 wrote to memory of 1984	3040	csrss.exe	cmd.exe
PID 3040 wrote to memory of 1984	3040	csrss.exe	cmd.exe
PID 1984 wrote to memory of 4164	1984	cmd.exe	w32tm.exe
PID 1984 wrote to memory of 4164	1984	cmd.exe	w32tm.exe
PID 1984 wrote to memory of 4284	1984	cmd.exe	csrss.exe
PID 1984 wrote to memory of 4284	1984	cmd.exe	csrss.exe
PID 4284 wrote to memory of 5068	4284	csrss.exe	cmd.exe
PID 4284 wrote to memory of 5068	4284	csrss.exe	cmd.exe
PID 5068 wrote to memory of 912	5068	cmd.exe	w32tm.exe
PID 5068 wrote to memory of 912	5068	cmd.exe	w32tm.exe
PID 5068 wrote to memory of 1312	5068	cmd.exe	csrss.exe
PID 5068 wrote to memory of 1312	5068	cmd.exe	csrss.exe
PID 1312 wrote to memory of 4144	1312	csrss.exe	cmd.exe
PID 1312 wrote to memory of 4144	1312	csrss.exe	cmd.exe
PID 4144 wrote to memory of 1020	4144	cmd.exe	w32tm.exe
PID 4144 wrote to memory of 1020	4144	cmd.exe	w32tm.exe
PID 4144 wrote to memory of 4820	4144	cmd.exe	csrss.exe
PID 4144 wrote to memory of 4820	4144	cmd.exe	csrss.exe
PID 4820 wrote to memory of 2648	4820	csrss.exe	cmd.exe
PID 4820 wrote to memory of 2648	4820	csrss.exe	cmd.exe
PID 2648 wrote to memory of 4008	2648	cmd.exe	w32tm.exe
PID 2648 wrote to memory of 4008	2648	cmd.exe	w32tm.exe
PID 2648 wrote to memory of 1028	2648	cmd.exe	csrss.exe
PID 2648 wrote to memory of 1028	2648	cmd.exe	csrss.exe
PID 1028 wrote to memory of 4964	1028	csrss.exe	cmd.exe
PID 1028 wrote to memory of 4964	1028	csrss.exe	cmd.exe

C:\Users\Admin\AppData\Local\Temp\5a85456927d17627968250e487d8f714.exe
"C:\Users\Admin\AppData\Local\Temp\5a85456927d17627968250e487d8f714.exe"
1⤵
- Checks computer location settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4860

C:\Windows\SysWOW64\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\providercommon\yTUdeXjbLOhnrN32dgrxVg.vbe"
2⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:1536

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\providercommon\1zu9dW.bat" "
3⤵
- Suspicious use of WriteProcessMemory
PID:1160

C:\providercommon\DllCommonsvc.exe
"C:\providercommon\DllCommonsvc.exe"
4⤵
- Executes dropped EXE
- Checks computer location settings
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4480

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\DllCommonsvc.exe'
5⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3328

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\WindowsRE\conhost.exe'
5⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4380

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell" -Command Add-MpPreference -ExclusionPath 'C:\odt\DllCommonsvc.exe'
5⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2248

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\sppsvc.exe'
5⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:680

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\Favorites\Links\fontdrvhost.exe'
5⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1000

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\WindowsRE\csrss.exe'
5⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4172

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\sppsvc.exe'
5⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2000

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Mozilla Firefox\uninstall\SppExtComObj.exe'
5⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1004

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Uninstall Information\explorer.exe'
5⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2656

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Windows Portable Devices\smss.exe'
5⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3528

C:\Recovery\WindowsRE\csrss.exe
"C:\Recovery\WindowsRE\csrss.exe"
5⤵
- Executes dropped EXE
- Checks computer location settings
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3040

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\6raUEgr1vJ.bat"
6⤵
- Suspicious use of WriteProcessMemory
PID:1984

C:\Recovery\WindowsRE\csrss.exe
"C:\Recovery\WindowsRE\csrss.exe"
7⤵
- Executes dropped EXE
- Checks computer location settings
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4284

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\dXV640YnNf.bat"
8⤵
- Suspicious use of WriteProcessMemory
PID:5068

C:\Windows\system32\w32tm.exe
w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
9⤵
PID:912

C:\Recovery\WindowsRE\csrss.exe
"C:\Recovery\WindowsRE\csrss.exe"
9⤵
- Executes dropped EXE
- Checks computer location settings
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1312

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\bbT3NvUu3s.bat"
10⤵
- Suspicious use of WriteProcessMemory
PID:4144

C:\Windows\system32\w32tm.exe
w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
11⤵
PID:1020

C:\Recovery\WindowsRE\csrss.exe
"C:\Recovery\WindowsRE\csrss.exe"
11⤵
- Executes dropped EXE
- Checks computer location settings
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4820

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\kQw8FYVnXF.bat"
12⤵
- Suspicious use of WriteProcessMemory
PID:2648

C:\Windows\system32\w32tm.exe
w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
13⤵
PID:4008

C:\Recovery\WindowsRE\csrss.exe
"C:\Recovery\WindowsRE\csrss.exe"
13⤵
- Executes dropped EXE
- Checks computer location settings
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1028

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\04VLARgLyy.bat"
14⤵
PID:4964

C:\Windows\system32\w32tm.exe
w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
15⤵
PID:1088

C:\Recovery\WindowsRE\csrss.exe
"C:\Recovery\WindowsRE\csrss.exe"
15⤵
- Executes dropped EXE
- Checks computer location settings
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:772

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\iVu5YTRuDT.bat"
16⤵
PID:3664

C:\Windows\system32\w32tm.exe
w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
17⤵
PID:868

C:\Recovery\WindowsRE\csrss.exe
"C:\Recovery\WindowsRE\csrss.exe"
17⤵
- Executes dropped EXE
- Checks computer location settings
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:624

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\aWJwCUxpp4.bat"
18⤵
PID:2992

C:\Windows\system32\w32tm.exe
w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
19⤵
PID:2772

C:\Recovery\WindowsRE\csrss.exe
"C:\Recovery\WindowsRE\csrss.exe"
19⤵
- Executes dropped EXE
- Checks computer location settings
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4992

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\wHaMzi6eYE.bat"
20⤵
PID:2760

C:\Windows\system32\w32tm.exe
w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
21⤵
PID:748

C:\Recovery\WindowsRE\csrss.exe
"C:\Recovery\WindowsRE\csrss.exe"
21⤵
- Executes dropped EXE
- Checks computer location settings
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:4356

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\x8TIUMdSeB.bat"
22⤵
PID:3852

C:\Windows\system32\w32tm.exe
w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
23⤵
PID:3824

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\sihost.exe'
5⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4224

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\WaaSMedicAgent.exe'
5⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4216

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\csrss.exe'
5⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4900

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\WindowsRE\Idle.exe'
5⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1156

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 6 /tr "'C:\Recovery\WindowsRE\conhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:5088

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhost" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\conhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4356

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 7 /tr "'C:\Recovery\WindowsRE\conhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3896

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 12 /tr "'C:\providercommon\sppsvc.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3816

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvc" /sc ONLOGON /tr "'C:\providercommon\sppsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:5016

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 12 /tr "'C:\providercommon\sppsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:5116

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "DllCommonsvcD" /sc MINUTE /mo 14 /tr "'C:\odt\DllCommonsvc.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3620

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "DllCommonsvc" /sc ONLOGON /tr "'C:\odt\DllCommonsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4568

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "DllCommonsvcD" /sc MINUTE /mo 13 /tr "'C:\odt\DllCommonsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4708

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 9 /tr "'C:\Recovery\WindowsRE\Idle.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4704

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Idle" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\Idle.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:5008

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 10 /tr "'C:\Recovery\WindowsRE\Idle.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:392

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 13 /tr "'C:\providercommon\csrss.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4232

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\providercommon\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3460

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 13 /tr "'C:\providercommon\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3936

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 10 /tr "'C:\Users\Admin\Favorites\Links\fontdrvhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3232

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\Users\Admin\Favorites\Links\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4040

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 7 /tr "'C:\Users\Admin\Favorites\Links\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2168

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 6 /tr "'C:\Recovery\WindowsRE\csrss.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2780

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2160

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 6 /tr "'C:\Recovery\WindowsRE\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3752

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WaaSMedicAgentW" /sc MINUTE /mo 7 /tr "'C:\providercommon\WaaSMedicAgent.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4956

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WaaSMedicAgent" /sc ONLOGON /tr "'C:\providercommon\WaaSMedicAgent.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2968

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WaaSMedicAgentW" /sc MINUTE /mo 10 /tr "'C:\providercommon\WaaSMedicAgent.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3904

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sihosts" /sc MINUTE /mo 9 /tr "'C:\providercommon\sihost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3032

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sihost" /sc ONLOGON /tr "'C:\providercommon\sihost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3808

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sihosts" /sc MINUTE /mo 14 /tr "'C:\providercommon\sihost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4672

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 7 /tr "'C:\providercommon\sppsvc.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4340

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvc" /sc ONLOGON /tr "'C:\providercommon\sppsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4728

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 6 /tr "'C:\providercommon\sppsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3444

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 10 /tr "'C:\Program Files (x86)\Windows Portable Devices\smss.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4400

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smss" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Portable Devices\smss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:452

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 11 /tr "'C:\Program Files (x86)\Windows Portable Devices\smss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3692

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SppExtComObjS" /sc MINUTE /mo 12 /tr "'C:\Program Files\Mozilla Firefox\uninstall\SppExtComObj.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1340

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SppExtComObj" /sc ONLOGON /tr "'C:\Program Files\Mozilla Firefox\uninstall\SppExtComObj.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1984

C:\Windows\system32\w32tm.exe
w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
2⤵
PID:4164

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SppExtComObjS" /sc MINUTE /mo 14 /tr "'C:\Program Files\Mozilla Firefox\uninstall\SppExtComObj.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3892

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 12 /tr "'C:\Program Files\Uninstall Information\explorer.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2240

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorer" /sc ONLOGON /tr "'C:\Program Files\Uninstall Information\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4992

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 9 /tr "'C:\Program Files\Uninstall Information\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4828

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Web Service

T1102

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Recovery\WindowsRE\csrss.exe
Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\Recovery\WindowsRE\csrss.exe
Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\Recovery\WindowsRE\csrss.exe
Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\Recovery\WindowsRE\csrss.exe
Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\Recovery\WindowsRE\csrss.exe
Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\Recovery\WindowsRE\csrss.exe
Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\Recovery\WindowsRE\csrss.exe
Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\Recovery\WindowsRE\csrss.exe
Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\Recovery\WindowsRE\csrss.exe
Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\Recovery\WindowsRE\csrss.exe
Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\csrss.exe.log
Filesize
1KB

MD5
baf55b95da4a601229647f25dad12878

SHA1
abc16954ebfd213733c4493fc1910164d825cac8

SHA256
ee954c5d8156fd8890e582c716e5758ed9b33721258f10e758bdc31ccbcb1924

SHA512
24f502fedb1a305d0d7b08857ffc1db9b2359ff34e06d5748ecc84e35c985f29a20d9f0a533bea32d234ab37097ec0481620c63b14ac89b280e75e14d19fd545

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Filesize
2KB

MD5
d85ba6ff808d9e5444a4b369f5bc2730

SHA1
31aa9d96590fff6981b315e0b391b575e4c0804a

SHA256
84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

SHA512
8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
944B

MD5
77d622bb1a5b250869a3238b9bc1402b

SHA1
d47f4003c2554b9dfc4c16f22460b331886b191b

SHA256
f97ff12a8abf4bf88bb6497bd2ac2da12628c8847a8ba5a9026bdbb76507cdfb

SHA512
d6789b5499f23c9035375a102271e17a8a82e57d6f5312fa24242e08a83efdeb8becb7622f55c4cf1b89c7d864b445df11f4d994cf7e2f87a900535bcca12fd9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
944B

MD5
77d622bb1a5b250869a3238b9bc1402b

SHA1
d47f4003c2554b9dfc4c16f22460b331886b191b

SHA256
f97ff12a8abf4bf88bb6497bd2ac2da12628c8847a8ba5a9026bdbb76507cdfb

SHA512
d6789b5499f23c9035375a102271e17a8a82e57d6f5312fa24242e08a83efdeb8becb7622f55c4cf1b89c7d864b445df11f4d994cf7e2f87a900535bcca12fd9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
944B

MD5
77d622bb1a5b250869a3238b9bc1402b

SHA1
d47f4003c2554b9dfc4c16f22460b331886b191b

SHA256
f97ff12a8abf4bf88bb6497bd2ac2da12628c8847a8ba5a9026bdbb76507cdfb

SHA512
d6789b5499f23c9035375a102271e17a8a82e57d6f5312fa24242e08a83efdeb8becb7622f55c4cf1b89c7d864b445df11f4d994cf7e2f87a900535bcca12fd9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
944B

MD5
a8e8360d573a4ff072dcc6f09d992c88

SHA1
3446774433ceaf0b400073914facab11b98b6807

SHA256
bf5e284e8f95122bf75ead61c7e2b40f55c96742b05330b5b1cb7915991df13b

SHA512
4ee5167643d82082f57c42616007ef9be57f43f9731921bdf7bca611a914724ad94072d3c8f5b130fa54129e5328ccdebf37ba74339c37deb53e79df5cdf0dbe

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
944B

MD5
a8e8360d573a4ff072dcc6f09d992c88

SHA1
3446774433ceaf0b400073914facab11b98b6807

SHA256
bf5e284e8f95122bf75ead61c7e2b40f55c96742b05330b5b1cb7915991df13b

SHA512
4ee5167643d82082f57c42616007ef9be57f43f9731921bdf7bca611a914724ad94072d3c8f5b130fa54129e5328ccdebf37ba74339c37deb53e79df5cdf0dbe

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
944B

MD5
a8e8360d573a4ff072dcc6f09d992c88

SHA1
3446774433ceaf0b400073914facab11b98b6807

SHA256
bf5e284e8f95122bf75ead61c7e2b40f55c96742b05330b5b1cb7915991df13b

SHA512
4ee5167643d82082f57c42616007ef9be57f43f9731921bdf7bca611a914724ad94072d3c8f5b130fa54129e5328ccdebf37ba74339c37deb53e79df5cdf0dbe

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
944B

MD5
e243a38635ff9a06c87c2a61a2200656

SHA1
ecd95ed5bf1a9fbe96a8448fc2814a0210fa2afc

SHA256
af5782703f3f2d5a29fb313dae6680a64134db26064d4a321a3f23b75f6ca00f

SHA512
4418957a1b10eee44cf270c81816ae707352411c4f5ac14b6b61ab537c91480e24e0a0a2c276a6291081b4984c123cf673a45dcedb0ceeef682054ba0fc19cb4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
944B

MD5
e243a38635ff9a06c87c2a61a2200656

SHA1
ecd95ed5bf1a9fbe96a8448fc2814a0210fa2afc

SHA256
af5782703f3f2d5a29fb313dae6680a64134db26064d4a321a3f23b75f6ca00f

SHA512
4418957a1b10eee44cf270c81816ae707352411c4f5ac14b6b61ab537c91480e24e0a0a2c276a6291081b4984c123cf673a45dcedb0ceeef682054ba0fc19cb4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
944B

MD5
5f0ddc7f3691c81ee14d17b419ba220d

SHA1
f0ef5fde8bab9d17c0b47137e014c91be888ee53

SHA256
a31805264b8b13ce4145f272cb2830728c186c46e314b48514d636866217add5

SHA512
2ce7c2a0833f581297c13dd88ccfcd36bf129d2b5d7718c52b1d67c97cbd8fc93abc085a040229a0fd712e880c690de7f6b996b0b47c46a091fabb7931be58d3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
944B

MD5
5f0ddc7f3691c81ee14d17b419ba220d

SHA1
f0ef5fde8bab9d17c0b47137e014c91be888ee53

SHA256
a31805264b8b13ce4145f272cb2830728c186c46e314b48514d636866217add5

SHA512
2ce7c2a0833f581297c13dd88ccfcd36bf129d2b5d7718c52b1d67c97cbd8fc93abc085a040229a0fd712e880c690de7f6b996b0b47c46a091fabb7931be58d3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
944B

MD5
ecceac16628651c18879d836acfcb062

SHA1
420502b3e5220a01586c59504e94aa1ee11982c9

SHA256
58238de09a8817ed9f894ed8e5bf06a897fd08e0b0bd77e508d37b2598edd2a9

SHA512
be3c7cb529cafb00f58790a6f8b35c4ff6db9f7f43a507d2218fd80cebc88413e46f71b1bc35b8afcc36b68f9409c946470d1e74a4fe225400eeb6f3f898f5b3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
944B

MD5
3a6bad9528f8e23fb5c77fbd81fa28e8

SHA1
f127317c3bc6407f536c0f0600dcbcf1aabfba36

SHA256
986366767de5873f1b170a63f2a33ce05132d1afd90c8f5017afbca8ef1beb05

SHA512
846002154a0ece6f3e9feda6f115d3161dc21b3789525dd62ae1d9188495171293efdbe7be4710666dd8a15e66b557315b5a02918a741ed1d5f3ff0c515b98e2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
944B

MD5
3a6bad9528f8e23fb5c77fbd81fa28e8

SHA1
f127317c3bc6407f536c0f0600dcbcf1aabfba36

SHA256
986366767de5873f1b170a63f2a33ce05132d1afd90c8f5017afbca8ef1beb05

SHA512
846002154a0ece6f3e9feda6f115d3161dc21b3789525dd62ae1d9188495171293efdbe7be4710666dd8a15e66b557315b5a02918a741ed1d5f3ff0c515b98e2

Download Submit
C:\Users\Admin\AppData\Local\Temp\04VLARgLyy.bat
Filesize
196B

MD5
bb468d2a16f05fd9fdc39dbfecdc7a82

SHA1
7c28c291c6a152450c9fea60c65ad04dba78e08e

SHA256
8b7a24a04b1af6220f3509f85708622b30b1d7c24748ef900463d0be4de30478

SHA512
ace8e293e4b98222dccb046e9b9771ff8ac474df6a671ffc04eed2c86b0abfc61b6fa77b773e696142edd187f103a7b35f3b9b10fd210f10fa9caada0014d71e

Download Submit
C:\Users\Admin\AppData\Local\Temp\6raUEgr1vJ.bat
Filesize
196B

MD5
a6f256e8b8db5d61568824445562f95e

SHA1
c29b2100fda815765e317d29bbab25908a2348de

SHA256
edb7d8f79492df068a2ad71a37a7610e0f7a7315a93880eb38d8e0dbeb61c80a

SHA512
ea9cb3ac38c8dd8dce41cd38277c0cd23022341404dffcb534505bc1415e5b011e4e9cfb0f2178fec86097a86bcf795f0f806abdddb94cceac2aed0e3542c50d

Download Submit
C:\Users\Admin\AppData\Local\Temp\aWJwCUxpp4.bat
Filesize
196B

MD5
87d278ecd5acbe0b6e5c67007c38ef6d

SHA1
0ff8f584be306c970332e36fe04217f26835c0c9

SHA256
b608db13a2881beb8758592eea42de1e833760d93d4d4a23b0f8219cec6016c1

SHA512
b96f8907c412eda7128dea636f123c1b6dc6f72c6a72223ee72c5e1279a776d8877eb97fae48cede6d66eecd0c2a4c6aba516ce28b106fe9c13c914b34f0a5dc

Download Submit
C:\Users\Admin\AppData\Local\Temp\bbT3NvUu3s.bat
Filesize
196B

MD5
899cd10743aa794126c6516ddd2a59eb

SHA1
5f105e2813780acd05628b3d60455080625ca972

SHA256
1062de2481f820318f1277efe207b8f08d2792077844ad5f8af26e6174d439be

SHA512
7f7fc50df509f38d9acd8521ea5f9f042e6e80161936c02379c17cc79c3401648044a73cdb964c92b6f2049cf0988f0c3ddb479ddc8472b19b6fa8a7f9dd7cf5

Download Submit
C:\Users\Admin\AppData\Local\Temp\dXV640YnNf.bat
Filesize
196B

MD5
9e35ad8e5d811fd10aff7f22d1d40ae5

SHA1
2b57fed858257338e1861b36ce68bf5ebf5918a1

SHA256
7913215c287163d45b3bcec0770bc27736dbfbd9d473cb124d7222321b517d10

SHA512
269518436e0e8afa019bd73e31626b50a7a572264028d521ec7b30305fee518e3069e217349df10a0a123fa9de4a07c9973b00793d6e087d4ccc9329de18f4d1

Download Submit
C:\Users\Admin\AppData\Local\Temp\iVu5YTRuDT.bat
Filesize
196B

MD5
6ab84b358b056a7e595abd8324e60781

SHA1
08089ddead59922175f2b72ee99d9f9ad58751de

SHA256
2d82a6eb1d05b8c4c414be5b60848dc8409d37b8354668c011334de964e07fb6

SHA512
4c40cfdd768a95b0f4b738a9d2b65bd287003dbd968acc0f735e02755299b0b76fab61de8575c16f26eaee9f562621a768a35e2c5d95d024b62bb42b041b59ef

Download Submit
C:\Users\Admin\AppData\Local\Temp\kQw8FYVnXF.bat
Filesize
196B

MD5
78501e41c4dbaf215ace33dd8355076a

SHA1
0c89f3c62ac470b8dd4ec505e67558f7fb2d5749

SHA256
4eb934844a87fef6661c44c77880a93c391f68fdfc22458c1f15a7d854add6e7

SHA512
2d290d4ac90b46c794d8234f253649c3e589ad8cf0da2f6e03ae5ca136b1664e2979c67c1a4709a63fc0b3008c6629e6ee97319e25b8bb1b7a557e0daac30d9b

Download Submit
C:\Users\Admin\AppData\Local\Temp\wHaMzi6eYE.bat
Filesize
196B

MD5
38bf7f40582a9a6e97ec08e0aeb64b35

SHA1
4b2904be1dab23606a8f51591b0d53175dd7d4b0

SHA256
638f57d94e020481325a232ef852c5badfbdac05daf851e5fdb692cfcf784fc9

SHA512
1b8cfdfac4adf7fd706e9105d7f156ba3a823c9563749335fbdb03a699496f34cd08afd2ab78abfe6935be8de60a9b91d8aeef421ddaaab000a4547912909e0e

Download Submit
C:\Users\Admin\AppData\Local\Temp\x8TIUMdSeB.bat
Filesize
196B

MD5
81cf75a6d14d1d3c6424dbbadf338988

SHA1
6bf59988130d819890ec03156edf0838f86f1baa

SHA256
45c176f92b9ec8b7a40d6c53604c227e0dbbe0714379c815965aeb66c10bb4ed

SHA512
a4a7deecb6b37bf82c49497b933c237b94a2122722b55219200605daf87f6dc057d36e6934dfe398af0a1f1d788313f88df2c60d95b05ecc1c604315bb86ec62

Download Submit
C:\providercommon\1zu9dW.bat
Filesize
36B

MD5
6783c3ee07c7d151ceac57f1f9c8bed7

SHA1
17468f98f95bf504cc1f83c49e49a78526b3ea03

SHA256
8ab782f0f327a2021530e7230d3aee8abbecb7eed59482a3a46e78b9e3862322

SHA512
c6012d4bfac1ed14d0fd9f0eabd0e1c3d647b343db292a907b246271d52a4b7469c809db43910ddba2e8c5045f9cb3d24d0af62d363281e6cb8b39ee94a183e8

Download Submit
C:\providercommon\DllCommonsvc.exe
Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\providercommon\DllCommonsvc.exe
Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\providercommon\yTUdeXjbLOhnrN32dgrxVg.vbe
Filesize
197B

MD5
8088241160261560a02c84025d107592

SHA1
083121f7027557570994c9fc211df61730455bb5

SHA256
2072cc9a4a3b84d4c5178ab41c5588eea7d0103e3928e34d64f17bf97f3d1cc1

SHA512
20d9369dd359315848ea30144383a0bb479d86059fdbc3b3256ac84f998193512feb3b1799ab663619920c99fe7e0ebba33ada31a3855094b956fcd351c90478

Download Submit
memory/624-250-0x00007FF852630000-0x00007FF8530F1000-memory.dmp

Filesize
10.8MB

Download
memory/624-246-0x00007FF852630000-0x00007FF8530F1000-memory.dmp

Filesize
10.8MB

Download
memory/624-244-0x0000000000000000-mapping.dmp

Download
memory/680-153-0x00007FF852630000-0x00007FF8530F1000-memory.dmp

Filesize
10.8MB

Download
memory/680-182-0x00007FF852630000-0x00007FF8530F1000-memory.dmp

Filesize
10.8MB

Download
memory/680-143-0x0000000000000000-mapping.dmp

Download
memory/748-256-0x0000000000000000-mapping.dmp

Download
memory/772-243-0x00007FF852630000-0x00007FF8530F1000-memory.dmp

Filesize
10.8MB

Download
memory/772-236-0x0000000000000000-mapping.dmp

Download
memory/772-239-0x00007FF852630000-0x00007FF8530F1000-memory.dmp

Filesize
10.8MB

Download
memory/772-238-0x00007FF852630000-0x00007FF8530F1000-memory.dmp

Filesize
10.8MB

Download
memory/868-242-0x0000000000000000-mapping.dmp

Download
memory/912-213-0x0000000000000000-mapping.dmp

Download
memory/1000-159-0x00007FF852630000-0x00007FF8530F1000-memory.dmp

Filesize
10.8MB

Download
memory/1000-191-0x00007FF852630000-0x00007FF8530F1000-memory.dmp

Filesize
10.8MB

Download
memory/1000-147-0x0000000000000000-mapping.dmp

Download
memory/1004-175-0x00007FF852630000-0x00007FF8530F1000-memory.dmp

Filesize
10.8MB

Download
memory/1004-155-0x0000000000000000-mapping.dmp

Download
memory/1004-167-0x00007FF852630000-0x00007FF8530F1000-memory.dmp

Filesize
10.8MB

Download
memory/1020-220-0x0000000000000000-mapping.dmp

Download
memory/1028-231-0x00007FF852630000-0x00007FF8530F1000-memory.dmp

Filesize
10.8MB

Download
memory/1028-229-0x0000000000000000-mapping.dmp

Download
memory/1028-235-0x00007FF852630000-0x00007FF8530F1000-memory.dmp

Filesize
10.8MB

Download
memory/1088-234-0x0000000000000000-mapping.dmp

Download
memory/1156-145-0x0000000000000000-mapping.dmp

Download
memory/1156-186-0x00007FF852630000-0x00007FF8530F1000-memory.dmp

Filesize
10.8MB

Download
memory/1156-156-0x00007FF852630000-0x00007FF8530F1000-memory.dmp

Filesize
10.8MB

Download
memory/1160-135-0x0000000000000000-mapping.dmp

Download
memory/1312-221-0x00007FF852630000-0x00007FF8530F1000-memory.dmp

Filesize
10.8MB

Download
memory/1312-217-0x00007FF852630000-0x00007FF8530F1000-memory.dmp

Filesize
10.8MB

Download
memory/1312-215-0x0000000000000000-mapping.dmp

Download
memory/1536-132-0x0000000000000000-mapping.dmp

Download
memory/1984-203-0x0000000000000000-mapping.dmp

Download
memory/2000-173-0x00007FF852630000-0x00007FF8530F1000-memory.dmp

Filesize
10.8MB

Download
memory/2000-198-0x00007FF852630000-0x00007FF8530F1000-memory.dmp

Filesize
10.8MB

Download
memory/2000-152-0x0000000000000000-mapping.dmp

Download
memory/2248-170-0x00007FF852630000-0x00007FF8530F1000-memory.dmp

Filesize
10.8MB

Download
memory/2248-188-0x00007FF852630000-0x00007FF8530F1000-memory.dmp

Filesize
10.8MB

Download
memory/2248-144-0x0000000000000000-mapping.dmp

Download
memory/2648-225-0x0000000000000000-mapping.dmp

Download
memory/2656-200-0x00007FF852630000-0x00007FF8530F1000-memory.dmp

Filesize
10.8MB

Download
memory/2656-168-0x00007FF852630000-0x00007FF8530F1000-memory.dmp

Filesize
10.8MB

Download
memory/2656-158-0x0000000000000000-mapping.dmp

Download
memory/2760-254-0x0000000000000000-mapping.dmp

Download
memory/2772-249-0x0000000000000000-mapping.dmp

Download
memory/2992-247-0x0000000000000000-mapping.dmp

Download
memory/3040-174-0x00007FF852630000-0x00007FF8530F1000-memory.dmp

Filesize
10.8MB

Download
memory/3040-206-0x00007FF852630000-0x00007FF8530F1000-memory.dmp

Filesize
10.8MB

Download
memory/3040-161-0x0000000000000000-mapping.dmp

Download
memory/3328-181-0x00007FF852630000-0x00007FF8530F1000-memory.dmp

Filesize
10.8MB

Download
memory/3328-169-0x00007FF852630000-0x00007FF8530F1000-memory.dmp

Filesize
10.8MB

Download
memory/3328-141-0x0000000000000000-mapping.dmp

Download
memory/3328-157-0x000001C4E6C00000-0x000001C4E6C22000-memory.dmp

Filesize
136KB

Download
memory/3528-166-0x00007FF852630000-0x00007FF8530F1000-memory.dmp

Filesize
10.8MB

Download
memory/3528-196-0x00007FF852630000-0x00007FF8530F1000-memory.dmp

Filesize
10.8MB

Download
memory/3528-154-0x0000000000000000-mapping.dmp

Download
memory/3664-240-0x0000000000000000-mapping.dmp

Download
memory/3824-263-0x0000000000000000-mapping.dmp

Download
memory/3852-261-0x0000000000000000-mapping.dmp

Download
memory/4008-227-0x0000000000000000-mapping.dmp

Download
memory/4144-218-0x0000000000000000-mapping.dmp

Download
memory/4164-205-0x0000000000000000-mapping.dmp

Download
memory/4172-192-0x00007FF852630000-0x00007FF8530F1000-memory.dmp

Filesize
10.8MB

Download
memory/4172-172-0x00007FF852630000-0x00007FF8530F1000-memory.dmp

Filesize
10.8MB

Download
memory/4172-148-0x0000000000000000-mapping.dmp

Download
memory/4216-194-0x00007FF852630000-0x00007FF8530F1000-memory.dmp

Filesize
10.8MB

Download
memory/4216-149-0x0000000000000000-mapping.dmp

Download
memory/4216-164-0x00007FF852630000-0x00007FF8530F1000-memory.dmp

Filesize
10.8MB

Download
memory/4224-202-0x00007FF852630000-0x00007FF8530F1000-memory.dmp

Filesize
10.8MB

Download
memory/4224-151-0x0000000000000000-mapping.dmp

Download
memory/4224-160-0x00007FF852630000-0x00007FF8530F1000-memory.dmp

Filesize
10.8MB

Download
memory/4284-210-0x00007FF852630000-0x00007FF8530F1000-memory.dmp

Filesize
10.8MB

Download
memory/4284-207-0x0000000000000000-mapping.dmp

Download
memory/4284-214-0x00007FF852630000-0x00007FF8530F1000-memory.dmp

Filesize
10.8MB

Download
memory/4356-260-0x00007FF852630000-0x00007FF8530F1000-memory.dmp

Filesize
10.8MB

Download
memory/4356-258-0x0000000000000000-mapping.dmp

Download
memory/4356-264-0x00007FF852630000-0x00007FF8530F1000-memory.dmp

Filesize
10.8MB

Download
memory/4380-150-0x00007FF852630000-0x00007FF8530F1000-memory.dmp

Filesize
10.8MB

Download
memory/4380-142-0x0000000000000000-mapping.dmp

Download
memory/4380-179-0x00007FF852630000-0x00007FF8530F1000-memory.dmp

Filesize
10.8MB

Download
memory/4480-140-0x00007FF852630000-0x00007FF8530F1000-memory.dmp

Filesize
10.8MB

Download
memory/4480-165-0x00007FF852630000-0x00007FF8530F1000-memory.dmp

Filesize
10.8MB

Download
memory/4480-136-0x0000000000000000-mapping.dmp

Download
memory/4480-139-0x00000000001A0000-0x00000000002B0000-memory.dmp

Filesize
1.1MB

Download
memory/4820-224-0x00007FF852630000-0x00007FF8530F1000-memory.dmp

Filesize
10.8MB

Download
memory/4820-222-0x0000000000000000-mapping.dmp

Download
memory/4820-228-0x00007FF852630000-0x00007FF8530F1000-memory.dmp

Filesize
10.8MB

Download
memory/4900-171-0x00007FF852630000-0x00007FF8530F1000-memory.dmp

Filesize
10.8MB

Download
memory/4900-187-0x00007FF852630000-0x00007FF8530F1000-memory.dmp

Filesize
10.8MB

Download
memory/4900-146-0x0000000000000000-mapping.dmp

Download
memory/4964-232-0x0000000000000000-mapping.dmp

Download
memory/4992-257-0x00007FF852630000-0x00007FF8530F1000-memory.dmp

Filesize
10.8MB

Download
memory/4992-253-0x00007FF852630000-0x00007FF8530F1000-memory.dmp

Filesize
10.8MB

Download
memory/4992-251-0x0000000000000000-mapping.dmp

Download
memory/5068-211-0x0000000000000000-mapping.dmp

Download