dcrat | 1245c85d7191eb29065c9508161e81241c7017077f4e005971ea7bede6c6a5e4

Analysis

max time kernel
152s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
02-02-2023 13:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1245c85d7191eb29065c9508161e81241c7017077f4e005971ea7bede6c6a5e4.exe
Size

1.3MB
MD5

e4e52682f5dac3b7c0e008980eef9d55
SHA1

1b2dd7f3e1d8b88812699b5ce746f14125d5273d
SHA256

1245c85d7191eb29065c9508161e81241c7017077f4e005971ea7bede6c6a5e4
SHA512

e7d1a10e7526568dbc14c354152dc769060f0a59616da5998f830a9f90555b0035badff7d96f9bd5705b20a68bebb3f17b6bd4a3360dc5b25b37a6eea9e7f655
SSDEEP

24576:U2G/nvxW3Ww0t6TnzGmVBDh4+aknuRRZJND0gFJ4rD/IjC:UbA30GnzV/q+DnsXg

Score

10^/10

dcrat infostealer rat

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat

Process spawned unexpected child process 27 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

Processes:

schtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exe

description	pid	pid_target	process
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2776	568	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3392	568	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4496	568	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1372	568	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4380	568	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4704	568	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	408	568	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3816	568	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3892	568	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	260	568	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2608	568	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	224	568	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1512	568	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1688	568	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2056	568	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3464	568	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5044	568	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3080	568	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4800	568	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3128	568	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2024	568	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2352	568	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1908	568	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3336	568	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4136	568	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3156	568	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3796	568	schtasks.exe

DCRat payload 8 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

Processes:

resource	yara_rule
C:\providercommon\DllCommonsvc.exe	dcrat
C:\providercommon\DllCommonsvc.exe	dcrat
behavioral1/memory/2088-139-0x0000000000080000-0x0000000000190000-memory.dmp	dcrat
C:\Program Files (x86)\Windows Defender\es-ES\sihost.exe	dcrat
C:\Program Files (x86)\Windows Defender\es-ES\sihost.exe	dcrat
C:\Program Files (x86)\Windows Defender\es-ES\sihost.exe	dcrat
C:\Program Files (x86)\Windows Defender\es-ES\sihost.exe	dcrat
C:\Program Files (x86)\Windows Defender\es-ES\sihost.exe	dcrat

Executes dropped EXE 5 IoCs

Processes:

DllCommonsvc.exesihost.exesihost.exesihost.exesihost.exe

pid process

2088 DllCommonsvc.exe
4732 sihost.exe
1184 sihost.exe
940 sihost.exe
3064 sihost.exe

Checks computer location settings 2 TTPs 7 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

1245c85d7191eb29065c9508161e81241c7017077f4e005971ea7bede6c6a5e4.exeWScript.exeDllCommonsvc.exesihost.exesihost.exesihost.exesihost.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Control Panel\International\Geo\Nation	1245c85d7191eb29065c9508161e81241c7017077f4e005971ea7bede6c6a5e4.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Control Panel\International\Geo\Nation	WScript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Control Panel\International\Geo\Nation	DllCommonsvc.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Control Panel\International\Geo\Nation	sihost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Control Panel\International\Geo\Nation	sihost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Control Panel\International\Geo\Nation	sihost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Control Panel\International\Geo\Nation	sihost.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

Drops file in Program Files directory 3 IoCs

Processes:

DllCommonsvc.exe

description	ioc	process
File created	C:\Program Files (x86)\Windows Defender\es-ES\sihost.exe	DllCommonsvc.exe
File opened for modification	C:\Program Files (x86)\Windows Defender\es-ES\sihost.exe	DllCommonsvc.exe
File created	C:\Program Files (x86)\Windows Defender\es-ES\66fc9ff0ee96c2	DllCommonsvc.exe

Drops file in Windows directory 2 IoCs

Processes:

DllCommonsvc.exe

description	ioc	process
File created	C:\Windows\ModemLogs\OfficeClickToRun.exe	DllCommonsvc.exe
File created	C:\Windows\ModemLogs\e6c9b481da804f	DllCommonsvc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 27 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

Processes:

pid	process
3336	schtasks.exe
4704	schtasks.exe
3128	schtasks.exe
3156	schtasks.exe
3892	schtasks.exe
4136	schtasks.exe
3464	schtasks.exe
1688	schtasks.exe
260	schtasks.exe
2608	schtasks.exe
2056	schtasks.exe
4800	schtasks.exe
1908	schtasks.exe
3796	schtasks.exe
2776	schtasks.exe
1372	schtasks.exe
3816	schtasks.exe
3080	schtasks.exe
3392	schtasks.exe
408	schtasks.exe
1512	schtasks.exe
5044	schtasks.exe
2352	schtasks.exe
4496	schtasks.exe
4380	schtasks.exe
224	schtasks.exe
2024	schtasks.exe

Modifies registry class 5 IoCs

Processes:

sihost.exesihost.exe1245c85d7191eb29065c9508161e81241c7017077f4e005971ea7bede6c6a5e4.exesihost.exesihost.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000_Classes\Local Settings	sihost.exe
Key created	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000_Classes\Local Settings	sihost.exe
Key created	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000_Classes\Local Settings	1245c85d7191eb29065c9508161e81241c7017077f4e005971ea7bede6c6a5e4.exe
Key created	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000_Classes\Local Settings	sihost.exe
Key created	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000_Classes\Local Settings	sihost.exe

Suspicious behavior: EnumeratesProcesses 49 IoCs

Processes:

DllCommonsvc.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exesihost.exesihost.exesihost.exesihost.exe

pid	process
2088	DllCommonsvc.exe
2088	DllCommonsvc.exe
2088	DllCommonsvc.exe
2088	DllCommonsvc.exe
2088	DllCommonsvc.exe
2088	DllCommonsvc.exe
2088	DllCommonsvc.exe
2088	DllCommonsvc.exe
2088	DllCommonsvc.exe
2088	DllCommonsvc.exe
2088	DllCommonsvc.exe
2088	DllCommonsvc.exe
2088	DllCommonsvc.exe
2088	DllCommonsvc.exe
3388	powershell.exe
3904	powershell.exe
4896	powershell.exe
4896	powershell.exe
3988	powershell.exe
3988	powershell.exe
4984	powershell.exe
4984	powershell.exe
1936	powershell.exe
1936	powershell.exe
4092	powershell.exe
4092	powershell.exe
4896	powershell.exe
4992	powershell.exe
4992	powershell.exe
4088	powershell.exe
4088	powershell.exe
2576	powershell.exe
2576	powershell.exe
4732	sihost.exe
4732	sihost.exe
3388	powershell.exe
3388	powershell.exe
3904	powershell.exe
3904	powershell.exe
3988	powershell.exe
4984	powershell.exe
4092	powershell.exe
1936	powershell.exe
4992	powershell.exe
4088	powershell.exe
2576	powershell.exe
1184	sihost.exe
940	sihost.exe
3064	sihost.exe

Suspicious use of AdjustPrivilegeToken 15 IoCs

Processes:

DllCommonsvc.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exesihost.exesihost.exesihost.exesihost.exe

description	pid	process
Token: SeDebugPrivilege	2088	DllCommonsvc.exe
Token: SeDebugPrivilege	3388	powershell.exe
Token: SeDebugPrivilege	3904	powershell.exe
Token: SeDebugPrivilege	4896	powershell.exe
Token: SeDebugPrivilege	3988	powershell.exe
Token: SeDebugPrivilege	4984	powershell.exe
Token: SeDebugPrivilege	1936	powershell.exe
Token: SeDebugPrivilege	4092	powershell.exe
Token: SeDebugPrivilege	4992	powershell.exe
Token: SeDebugPrivilege	4088	powershell.exe
Token: SeDebugPrivilege	2576	powershell.exe
Token: SeDebugPrivilege	4732	sihost.exe
Token: SeDebugPrivilege	1184	sihost.exe
Token: SeDebugPrivilege	940	sihost.exe
Token: SeDebugPrivilege	3064	sihost.exe

Suspicious use of WriteProcessMemory 52 IoCs

Processes:

1245c85d7191eb29065c9508161e81241c7017077f4e005971ea7bede6c6a5e4.exeWScript.execmd.exeDllCommonsvc.exesihost.execmd.exesihost.execmd.exesihost.execmd.exesihost.execmd.exe

description	pid	process	target process
PID 4112 wrote to memory of 1360	4112	1245c85d7191eb29065c9508161e81241c7017077f4e005971ea7bede6c6a5e4.exe	WScript.exe
PID 4112 wrote to memory of 1360	4112	1245c85d7191eb29065c9508161e81241c7017077f4e005971ea7bede6c6a5e4.exe	WScript.exe
PID 4112 wrote to memory of 1360	4112	1245c85d7191eb29065c9508161e81241c7017077f4e005971ea7bede6c6a5e4.exe	WScript.exe
PID 1360 wrote to memory of 844	1360	WScript.exe	cmd.exe
PID 1360 wrote to memory of 844	1360	WScript.exe	cmd.exe
PID 1360 wrote to memory of 844	1360	WScript.exe	cmd.exe
PID 844 wrote to memory of 2088	844	cmd.exe	DllCommonsvc.exe
PID 844 wrote to memory of 2088	844	cmd.exe	DllCommonsvc.exe
PID 2088 wrote to memory of 3388	2088	DllCommonsvc.exe	powershell.exe
PID 2088 wrote to memory of 3388	2088	DllCommonsvc.exe	powershell.exe
PID 2088 wrote to memory of 3988	2088	DllCommonsvc.exe	powershell.exe
PID 2088 wrote to memory of 3988	2088	DllCommonsvc.exe	powershell.exe
PID 2088 wrote to memory of 3904	2088	DllCommonsvc.exe	powershell.exe
PID 2088 wrote to memory of 3904	2088	DllCommonsvc.exe	powershell.exe
PID 2088 wrote to memory of 4896	2088	DllCommonsvc.exe	powershell.exe
PID 2088 wrote to memory of 4896	2088	DllCommonsvc.exe	powershell.exe
PID 2088 wrote to memory of 1936	2088	DllCommonsvc.exe	powershell.exe
PID 2088 wrote to memory of 1936	2088	DllCommonsvc.exe	powershell.exe
PID 2088 wrote to memory of 4984	2088	DllCommonsvc.exe	powershell.exe
PID 2088 wrote to memory of 4984	2088	DllCommonsvc.exe	powershell.exe
PID 2088 wrote to memory of 4092	2088	DllCommonsvc.exe	powershell.exe
PID 2088 wrote to memory of 4092	2088	DllCommonsvc.exe	powershell.exe
PID 2088 wrote to memory of 4992	2088	DllCommonsvc.exe	powershell.exe
PID 2088 wrote to memory of 4992	2088	DllCommonsvc.exe	powershell.exe
PID 2088 wrote to memory of 4088	2088	DllCommonsvc.exe	powershell.exe
PID 2088 wrote to memory of 4088	2088	DllCommonsvc.exe	powershell.exe
PID 2088 wrote to memory of 2576	2088	DllCommonsvc.exe	powershell.exe
PID 2088 wrote to memory of 2576	2088	DllCommonsvc.exe	powershell.exe
PID 2088 wrote to memory of 4732	2088	DllCommonsvc.exe	sihost.exe
PID 2088 wrote to memory of 4732	2088	DllCommonsvc.exe	sihost.exe
PID 4732 wrote to memory of 540	4732	sihost.exe	cmd.exe
PID 4732 wrote to memory of 540	4732	sihost.exe	cmd.exe
PID 540 wrote to memory of 4988	540	cmd.exe	w32tm.exe
PID 540 wrote to memory of 4988	540	cmd.exe	w32tm.exe
PID 540 wrote to memory of 1184	540	cmd.exe	sihost.exe
PID 540 wrote to memory of 1184	540	cmd.exe	sihost.exe
PID 1184 wrote to memory of 1472	1184	sihost.exe	cmd.exe
PID 1184 wrote to memory of 1472	1184	sihost.exe	cmd.exe
PID 1472 wrote to memory of 1156	1472	cmd.exe	w32tm.exe
PID 1472 wrote to memory of 1156	1472	cmd.exe	w32tm.exe
PID 1472 wrote to memory of 940	1472	cmd.exe	sihost.exe
PID 1472 wrote to memory of 940	1472	cmd.exe	sihost.exe
PID 940 wrote to memory of 2872	940	sihost.exe	cmd.exe
PID 940 wrote to memory of 2872	940	sihost.exe	cmd.exe
PID 2872 wrote to memory of 3164	2872	cmd.exe	w32tm.exe
PID 2872 wrote to memory of 3164	2872	cmd.exe	w32tm.exe
PID 2872 wrote to memory of 3064	2872	cmd.exe	sihost.exe
PID 2872 wrote to memory of 3064	2872	cmd.exe	sihost.exe
PID 3064 wrote to memory of 4316	3064	sihost.exe	cmd.exe
PID 3064 wrote to memory of 4316	3064	sihost.exe	cmd.exe
PID 4316 wrote to memory of 3484	4316	cmd.exe	w32tm.exe
PID 4316 wrote to memory of 3484	4316	cmd.exe	w32tm.exe

C:\Users\Admin\AppData\Local\Temp\1245c85d7191eb29065c9508161e81241c7017077f4e005971ea7bede6c6a5e4.exe
"C:\Users\Admin\AppData\Local\Temp\1245c85d7191eb29065c9508161e81241c7017077f4e005971ea7bede6c6a5e4.exe"
1⤵
- Checks computer location settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4112

C:\Windows\SysWOW64\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\providercommon\yTUdeXjbLOhnrN32dgrxVg.vbe"
2⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:1360

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\providercommon\1zu9dW.bat" "
3⤵
- Suspicious use of WriteProcessMemory
PID:844

C:\providercommon\DllCommonsvc.exe
"C:\providercommon\DllCommonsvc.exe"
4⤵
- Executes dropped EXE
- Checks computer location settings
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2088

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\DllCommonsvc.exe'
5⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3388

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Windows Defender\es-ES\sihost.exe'
5⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3988

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\OneDrive\explorer.exe'
5⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3904

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell" -Command Add-MpPreference -ExclusionPath 'C:\odt\DllCommonsvc.exe'
5⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4896

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\dllhost.exe'
5⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1936

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\WindowsRE\fontdrvhost.exe'
5⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4984

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\ModemLogs\OfficeClickToRun.exe'
5⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4092

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Public\Desktop\sppsvc.exe'
5⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4992

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Default\Saved Games\fontdrvhost.exe'
5⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4088

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell" -Command Add-MpPreference -ExclusionPath 'C:\odt\csrss.exe'
5⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2576

C:\Program Files (x86)\Windows Defender\es-ES\sihost.exe
"C:\Program Files (x86)\Windows Defender\es-ES\sihost.exe"
5⤵
- Executes dropped EXE
- Checks computer location settings
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4732

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\xEvQv3iUx6.bat"
6⤵
- Suspicious use of WriteProcessMemory
PID:540

C:\Program Files (x86)\Windows Defender\es-ES\sihost.exe
"C:\Program Files (x86)\Windows Defender\es-ES\sihost.exe"
7⤵
- Executes dropped EXE
- Checks computer location settings
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1184

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\4stVUxPy0P.bat"
8⤵
- Suspicious use of WriteProcessMemory
PID:1472

C:\Windows\system32\w32tm.exe
w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
9⤵
PID:1156

C:\Program Files (x86)\Windows Defender\es-ES\sihost.exe
"C:\Program Files (x86)\Windows Defender\es-ES\sihost.exe"
9⤵
- Executes dropped EXE
- Checks computer location settings
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:940

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\NczlPfxoCy.bat"
10⤵
- Suspicious use of WriteProcessMemory
PID:2872

C:\Windows\system32\w32tm.exe
w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
11⤵
PID:3164

C:\Program Files (x86)\Windows Defender\es-ES\sihost.exe
"C:\Program Files (x86)\Windows Defender\es-ES\sihost.exe"
11⤵
- Executes dropped EXE
- Checks computer location settings
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3064

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\v9lJjcBPjH.bat"
12⤵
- Suspicious use of WriteProcessMemory
PID:4316

C:\Windows\system32\w32tm.exe
w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
13⤵
PID:3484

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sihosts" /sc MINUTE /mo 14 /tr "'C:\Program Files (x86)\Windows Defender\es-ES\sihost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2776

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sihost" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Defender\es-ES\sihost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3392

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sihosts" /sc MINUTE /mo 14 /tr "'C:\Program Files (x86)\Windows Defender\es-ES\sihost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4496

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 10 /tr "'C:\Users\Admin\OneDrive\explorer.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1372

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorer" /sc ONLOGON /tr "'C:\Users\Admin\OneDrive\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4380

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 8 /tr "'C:\Users\Admin\OneDrive\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4704

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "DllCommonsvcD" /sc MINUTE /mo 13 /tr "'C:\odt\DllCommonsvc.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:408

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "DllCommonsvc" /sc ONLOGON /tr "'C:\odt\DllCommonsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3816

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "DllCommonsvcD" /sc MINUTE /mo 5 /tr "'C:\odt\DllCommonsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3892

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 11 /tr "'C:\providercommon\dllhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:260

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\providercommon\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2608

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 6 /tr "'C:\providercommon\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:224

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 8 /tr "'C:\Recovery\WindowsRE\fontdrvhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1512

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1688

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 7 /tr "'C:\Recovery\WindowsRE\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2056

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OfficeClickToRunO" /sc MINUTE /mo 11 /tr "'C:\Windows\ModemLogs\OfficeClickToRun.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3464

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OfficeClickToRun" /sc ONLOGON /tr "'C:\Windows\ModemLogs\OfficeClickToRun.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:5044

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OfficeClickToRunO" /sc MINUTE /mo 12 /tr "'C:\Windows\ModemLogs\OfficeClickToRun.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3080

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 10 /tr "'C:\Users\Public\Desktop\sppsvc.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4800

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvc" /sc ONLOGON /tr "'C:\Users\Public\Desktop\sppsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3128

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 8 /tr "'C:\Users\Public\Desktop\sppsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2024

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 14 /tr "'C:\Users\Default\Saved Games\fontdrvhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2352

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\Users\Default\Saved Games\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1908

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 12 /tr "'C:\Users\Default\Saved Games\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3336

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 12 /tr "'C:\odt\csrss.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4136

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\odt\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3156

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 14 /tr "'C:\odt\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3796

C:\Windows\system32\w32tm.exe
w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
1⤵
PID:4988

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Web Service

T1102

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Windows Defender\es-ES\sihost.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\Program Files (x86)\Windows Defender\es-ES\sihost.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\Program Files (x86)\Windows Defender\es-ES\sihost.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\Program Files (x86)\Windows Defender\es-ES\sihost.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\Program Files (x86)\Windows Defender\es-ES\sihost.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
d85ba6ff808d9e5444a4b369f5bc2730

SHA1
31aa9d96590fff6981b315e0b391b575e4c0804a

SHA256
84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

SHA512
8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\sihost.exe.log

Filesize
1KB

MD5
baf55b95da4a601229647f25dad12878

SHA1
abc16954ebfd213733c4493fc1910164d825cac8

SHA256
ee954c5d8156fd8890e582c716e5758ed9b33721258f10e758bdc31ccbcb1924

SHA512
24f502fedb1a305d0d7b08857ffc1db9b2359ff34e06d5748ecc84e35c985f29a20d9f0a533bea32d234ab37097ec0481620c63b14ac89b280e75e14d19fd545

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
cadef9abd087803c630df65264a6c81c

SHA1
babbf3636c347c8727c35f3eef2ee643dbcc4bd2

SHA256
cce65b73cdfe9304bcd5207913e8b60fb69faa20cd3b684f2b0343b755b99438

SHA512
7278aa87124abb382d9024a645e881e7b7cf1b84e8894943b36e018dbf0399e6858392f77980b599fa5488e2e21bf757a0702fe6419417edac93b68e0c2ec085

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
cadef9abd087803c630df65264a6c81c

SHA1
babbf3636c347c8727c35f3eef2ee643dbcc4bd2

SHA256
cce65b73cdfe9304bcd5207913e8b60fb69faa20cd3b684f2b0343b755b99438

SHA512
7278aa87124abb382d9024a645e881e7b7cf1b84e8894943b36e018dbf0399e6858392f77980b599fa5488e2e21bf757a0702fe6419417edac93b68e0c2ec085

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
28d4235aa2e6d782751f980ceb6e5021

SHA1
f5d82d56acd642b9fc4b963f684fd6b78f25a140

SHA256
8c66720f953e82cfbd8f00543c42c0cf77c3d97787ec09cb3e1e2ba5819bd638

SHA512
dba1bd6600f5affcfdc33a59e7ac853ee5fdfafb8d1407a1768728bd4f66ef6b49437214716b7e33e3de91d7ce95709050a3dab4354dd62acaf1de28107017a2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
28d4235aa2e6d782751f980ceb6e5021

SHA1
f5d82d56acd642b9fc4b963f684fd6b78f25a140

SHA256
8c66720f953e82cfbd8f00543c42c0cf77c3d97787ec09cb3e1e2ba5819bd638

SHA512
dba1bd6600f5affcfdc33a59e7ac853ee5fdfafb8d1407a1768728bd4f66ef6b49437214716b7e33e3de91d7ce95709050a3dab4354dd62acaf1de28107017a2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
28d4235aa2e6d782751f980ceb6e5021

SHA1
f5d82d56acd642b9fc4b963f684fd6b78f25a140

SHA256
8c66720f953e82cfbd8f00543c42c0cf77c3d97787ec09cb3e1e2ba5819bd638

SHA512
dba1bd6600f5affcfdc33a59e7ac853ee5fdfafb8d1407a1768728bd4f66ef6b49437214716b7e33e3de91d7ce95709050a3dab4354dd62acaf1de28107017a2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
6d42b6da621e8df5674e26b799c8e2aa

SHA1
ab3ce1327ea1eeedb987ec823d5e0cb146bafa48

SHA256
5ab6a1726f425c6d0158f55eb8d81754ddedd51e651aa0a899a29b7a58619c4c

SHA512
53faffbda8a835bc1143e894c118c15901a5fd09cfc2224dd2f754c06dc794897315049a579b9a8382d4564f071576045aaaf824019b7139d939152dca38ce29

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
bd5940f08d0be56e65e5f2aaf47c538e

SHA1
d7e31b87866e5e383ab5499da64aba50f03e8443

SHA256
2d2f364c75bd2897504249f42cdf1d19374f5230aad68fa9154ea3d03e3031a6

SHA512
c34d10c7e07da44a180fae9889b61f08903aa84e8ddfa80c31c272b1ef9d491b8cec6b8a4c836c3cb1583fe8f4955c6a8db872515de3a9e10eae09610c959406

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
bd5940f08d0be56e65e5f2aaf47c538e

SHA1
d7e31b87866e5e383ab5499da64aba50f03e8443

SHA256
2d2f364c75bd2897504249f42cdf1d19374f5230aad68fa9154ea3d03e3031a6

SHA512
c34d10c7e07da44a180fae9889b61f08903aa84e8ddfa80c31c272b1ef9d491b8cec6b8a4c836c3cb1583fe8f4955c6a8db872515de3a9e10eae09610c959406

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
d28a889fd956d5cb3accfbaf1143eb6f

SHA1
157ba54b365341f8ff06707d996b3635da8446f7

SHA256
21e5d7ccf80a293e6ba30ed728846ca19c929c52b96e2c8d34e27cd2234f1d45

SHA512
0b6d88deb9be85722e6a78d5886d49f2caf407a59e128d2b4ed74c1356f9928c40048a62731959f2460e9ff9d9feee311043d2a37abe3bb92c2b76a44281478c

Download Submit
C:\Users\Admin\AppData\Local\Temp\4stVUxPy0P.bat

Filesize
221B

MD5
53129546f76512d5da634c1195930954

SHA1
8d534b61258ea73ba3a61671c9f20ad9321fca6b

SHA256
d1334060f0841e4f8673fd5a3dc3b502e0858e6128e3412f6236beadaee3958e

SHA512
e118c06a29e021ccbf9f2904247601c038873ef4fca600e070a01a045191fcd2444320b470b874ddd4e048b6767464d242223a906e15fc88943c5663547b9fc1

Download Submit
C:\Users\Admin\AppData\Local\Temp\NczlPfxoCy.bat

Filesize
221B

MD5
706f00278c81af7e5b88839e71a3a930

SHA1
a635ac5f977818730f890d5fda6333234c694e7d

SHA256
a5a570e97196b07a34700624e7ba518b2f8c6704c5e3deab5623ecc138a64723

SHA512
c14f67426047d9870445881a873d390b2a0cfca14e289c1d908a71a14d21d5b02c27945984c0e082e880c0d85a08d832ffafee171c49019a11ddaafc22f2241d

Download Submit
C:\Users\Admin\AppData\Local\Temp\v9lJjcBPjH.bat

Filesize
221B

MD5
e9a21e69be4c0e8cffb2e949f0ce5787

SHA1
b882c7837dff85fea0e83be653d3c8b4fdcaf739

SHA256
b703b74f2e787a2ca5a99d8093288f1f3cc0cb6ca89544564c6f71493a73e861

SHA512
6a015dd72c1ccfad058602631dbde50a984c2a35be48e5738e8071ff40306c3b1269c545534c4fc5c673445258395b10b7efc7f2513565a4496598bce7c36389

Download Submit
C:\Users\Admin\AppData\Local\Temp\xEvQv3iUx6.bat

Filesize
221B

MD5
2e32c4c8e9821b5cd24d0d15cfdf70ac

SHA1
fa24b58edbd6dafbe2f4452c97d59b631ee62196

SHA256
fd5d1f12689f68b60ddac9ef93f063bf6f9fd28a3294d38f09245531f94156b4

SHA512
9c3e576f1bb060227d887ae168a02f2073f96d7697936775071ebe20b71280ebe7a6663e14b89e99318e10cc38735ffb913395158cc336d8d9d0ce226ed35c61

Download Submit
C:\providercommon\1zu9dW.bat

Filesize
36B

MD5
6783c3ee07c7d151ceac57f1f9c8bed7

SHA1
17468f98f95bf504cc1f83c49e49a78526b3ea03

SHA256
8ab782f0f327a2021530e7230d3aee8abbecb7eed59482a3a46e78b9e3862322

SHA512
c6012d4bfac1ed14d0fd9f0eabd0e1c3d647b343db292a907b246271d52a4b7469c809db43910ddba2e8c5045f9cb3d24d0af62d363281e6cb8b39ee94a183e8

Download Submit
C:\providercommon\DllCommonsvc.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\providercommon\DllCommonsvc.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\providercommon\yTUdeXjbLOhnrN32dgrxVg.vbe

Filesize
197B

MD5
8088241160261560a02c84025d107592

SHA1
083121f7027557570994c9fc211df61730455bb5

SHA256
2072cc9a4a3b84d4c5178ab41c5588eea7d0103e3928e34d64f17bf97f3d1cc1

SHA512
20d9369dd359315848ea30144383a0bb479d86059fdbc3b3256ac84f998193512feb3b1799ab663619920c99fe7e0ebba33ada31a3855094b956fcd351c90478

Download Submit
memory/540-186-0x0000000000000000-mapping.dmp

Download
memory/844-135-0x0000000000000000-mapping.dmp

Download
memory/940-201-0x00007FFD3A5B0000-0x00007FFD3B071000-memory.dmp

Filesize
10.8MB

Download
memory/940-199-0x0000000000000000-mapping.dmp

Download
memory/940-205-0x00007FFD3A5B0000-0x00007FFD3B071000-memory.dmp

Filesize
10.8MB

Download
memory/1156-197-0x0000000000000000-mapping.dmp

Download
memory/1184-194-0x00007FFD3A5B0000-0x00007FFD3B071000-memory.dmp

Filesize
10.8MB

Download
memory/1184-191-0x0000000000000000-mapping.dmp

Download
memory/1184-198-0x00007FFD3A5B0000-0x00007FFD3B071000-memory.dmp

Filesize
10.8MB

Download
memory/1360-132-0x0000000000000000-mapping.dmp

Download
memory/1472-195-0x0000000000000000-mapping.dmp

Download
memory/1936-160-0x00007FFD3A5B0000-0x00007FFD3B071000-memory.dmp

Filesize
10.8MB

Download
memory/1936-179-0x00007FFD3A5B0000-0x00007FFD3B071000-memory.dmp

Filesize
10.8MB

Download
memory/1936-145-0x0000000000000000-mapping.dmp

Download
memory/2088-139-0x0000000000080000-0x0000000000190000-memory.dmp

Filesize
1.1MB

Download
memory/2088-140-0x00007FFD3A5B0000-0x00007FFD3B071000-memory.dmp

Filesize
10.8MB

Download
memory/2088-136-0x0000000000000000-mapping.dmp

Download
memory/2088-158-0x00007FFD3A5B0000-0x00007FFD3B071000-memory.dmp

Filesize
10.8MB

Download
memory/2576-183-0x00007FFD3A5B0000-0x00007FFD3B071000-memory.dmp

Filesize
10.8MB

Download
memory/2576-151-0x0000000000000000-mapping.dmp

Download
memory/2576-164-0x00007FFD3A5B0000-0x00007FFD3B071000-memory.dmp

Filesize
10.8MB

Download
memory/2872-202-0x0000000000000000-mapping.dmp

Download
memory/3064-208-0x00007FFD3A5B0000-0x00007FFD3B071000-memory.dmp

Filesize
10.8MB

Download
memory/3064-213-0x00007FFD3A5B0000-0x00007FFD3B071000-memory.dmp

Filesize
10.8MB

Download
memory/3064-206-0x0000000000000000-mapping.dmp

Download
memory/3064-209-0x00007FFD3A5B0000-0x00007FFD3B071000-memory.dmp

Filesize
10.8MB

Download
memory/3164-204-0x0000000000000000-mapping.dmp

Download
memory/3388-170-0x00007FFD3A5B0000-0x00007FFD3B071000-memory.dmp

Filesize
10.8MB

Download
memory/3388-141-0x0000000000000000-mapping.dmp

Download
memory/3388-149-0x00000245D4A50000-0x00000245D4A72000-memory.dmp

Filesize
136KB

Download
memory/3388-152-0x00007FFD3A5B0000-0x00007FFD3B071000-memory.dmp

Filesize
10.8MB

Download
memory/3484-212-0x0000000000000000-mapping.dmp

Download
memory/3904-157-0x00007FFD3A5B0000-0x00007FFD3B071000-memory.dmp

Filesize
10.8MB

Download
memory/3904-176-0x00007FFD3A5B0000-0x00007FFD3B071000-memory.dmp

Filesize
10.8MB

Download
memory/3904-143-0x0000000000000000-mapping.dmp

Download
memory/3988-177-0x00007FFD3A5B0000-0x00007FFD3B071000-memory.dmp

Filesize
10.8MB

Download
memory/3988-142-0x0000000000000000-mapping.dmp

Download
memory/3988-154-0x00007FFD3A5B0000-0x00007FFD3B071000-memory.dmp

Filesize
10.8MB

Download
memory/4088-185-0x00007FFD3A5B0000-0x00007FFD3B071000-memory.dmp

Filesize
10.8MB

Download
memory/4088-150-0x0000000000000000-mapping.dmp

Download
memory/4088-162-0x00007FFD3A5B0000-0x00007FFD3B071000-memory.dmp

Filesize
10.8MB

Download
memory/4092-161-0x00007FFD3A5B0000-0x00007FFD3B071000-memory.dmp

Filesize
10.8MB

Download
memory/4092-172-0x00007FFD3A5B0000-0x00007FFD3B071000-memory.dmp

Filesize
10.8MB

Download
memory/4092-147-0x0000000000000000-mapping.dmp

Download
memory/4316-210-0x0000000000000000-mapping.dmp

Download
memory/4732-163-0x00007FFD3A5B0000-0x00007FFD3B071000-memory.dmp

Filesize
10.8MB

Download
memory/4732-190-0x00007FFD3A5B0000-0x00007FFD3B071000-memory.dmp

Filesize
10.8MB

Download
memory/4732-153-0x0000000000000000-mapping.dmp

Download
memory/4896-159-0x00007FFD3A5B0000-0x00007FFD3B071000-memory.dmp

Filesize
10.8MB

Download
memory/4896-167-0x00007FFD3A5B0000-0x00007FFD3B071000-memory.dmp

Filesize
10.8MB

Download
memory/4896-144-0x0000000000000000-mapping.dmp

Download
memory/4984-189-0x00007FFD3A5B0000-0x00007FFD3B071000-memory.dmp

Filesize
10.8MB

Download
memory/4984-165-0x00007FFD3A5B0000-0x00007FFD3B071000-memory.dmp

Filesize
10.8MB

Download
memory/4984-146-0x0000000000000000-mapping.dmp

Download
memory/4988-188-0x0000000000000000-mapping.dmp

Download
memory/4992-166-0x00007FFD3A5B0000-0x00007FFD3B071000-memory.dmp

Filesize
10.8MB

Download
memory/4992-148-0x0000000000000000-mapping.dmp

Download
memory/4992-181-0x00007FFD3A5B0000-0x00007FFD3B071000-memory.dmp

Filesize
10.8MB

Download