Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    147s
  • max time network
    152s
  • platform
    windows10-1703_x64
  • resource
    win10-20220812-en
  • resource tags

    arch:x64arch:x86image:win10-20220812-enlocale:en-usos:windows10-1703-x64system
  • submitted
    03/02/2023, 05:53

General

  • Target

    d3e9b89c58e22958b952317a4ccc0b27c372d3e66edafb693303d0f8a81116c8.exe

  • Size

    1.3MB

  • MD5

    6ae961c36c57e7c3d906b37dfb1360ca

  • SHA1

    3443f8a966a815597370ed34d781029619c4d241

  • SHA256

    d3e9b89c58e22958b952317a4ccc0b27c372d3e66edafb693303d0f8a81116c8

  • SHA512

    c72babc8eaf8ee66c42ba68e0b8e959ec9752e153359d5e3daa0b71e72429556207cdfb5489ce7d7def31c8aca0a33598111ddf5303961b67512ce0eb84f70ce

  • SSDEEP

    24576:U2G/nvxW3Ww0t6TnzGmVBDh4+aknuRRZJND0gFJ4rD/IjC:UbA30GnzV/q+DnsXg

Score
10/10

Malware Config

Signatures

  • DcRat

    DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

  • Process spawned unexpected child process 51 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • DCRat payload 6 IoCs

    Detects payload of DCRat, commonly dropped by NSIS installers.

  • Executes dropped EXE 3 IoCs
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs
  • Drops file in Program Files directory 22 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Creates scheduled task(s) 1 TTPs 51 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Modifies registry class 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 54 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\d3e9b89c58e22958b952317a4ccc0b27c372d3e66edafb693303d0f8a81116c8.exe
    "C:\Users\Admin\AppData\Local\Temp\d3e9b89c58e22958b952317a4ccc0b27c372d3e66edafb693303d0f8a81116c8.exe"
    1⤵
    • Modifies registry class
    • Suspicious use of WriteProcessMemory
    PID:2460
    • C:\Windows\SysWOW64\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\providercommon\yTUdeXjbLOhnrN32dgrxVg.vbe"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:2892
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /c ""C:\providercommon\1zu9dW.bat" "
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:3184
        • C:\providercommon\DllCommonsvc.exe
          "C:\providercommon\DllCommonsvc.exe"
          4⤵
          • Executes dropped EXE
          • Drops file in Program Files directory
          • Modifies registry class
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:5036
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\DllCommonsvc.exe'
            5⤵
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:2484
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Windows Security\BrowserCore\en-US\ShellExperienceHost.exe'
            5⤵
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:1044
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Google\Update\Install\OfficeClickToRun.exe'
            5⤵
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:1860
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\ShellExperienceHost.exe'
            5⤵
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:2280
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Windows Security\BrowserCore\en-US\csrss.exe'
            5⤵
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:1848
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\ShellExperienceHost.exe'
            5⤵
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:1700
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\odt\dwm.exe'
            5⤵
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:3692
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\spoolsv.exe'
            5⤵
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:3968
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Windows Sidebar\RuntimeBroker.exe'
            5⤵
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:4872
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\de\explorer.exe'
            5⤵
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:4656
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Windows Sidebar\Gadgets\OfficeClickToRun.exe'
            5⤵
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:4400
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\WindowsRE\sppsvc.exe'
            5⤵
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:2096
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\WindowsRE\OfficeClickToRun.exe'
            5⤵
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:4148
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\7-Zip\Lang\DllCommonsvc.exe'
            5⤵
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:4812
          • C:\Windows\System32\cmd.exe
            "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\eMIZxK0WIh.bat"
            5⤵
            • Suspicious use of WriteProcessMemory
            PID:3176
            • C:\Windows\system32\w32tm.exe
              w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
              6⤵
                PID:4600
              • C:\providercommon\DllCommonsvc.exe
                "C:\providercommon\DllCommonsvc.exe"
                6⤵
                • Executes dropped EXE
                • Drops file in Program Files directory
                • Suspicious use of WriteProcessMemory
                PID:2504
                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\DllCommonsvc.exe'
                  7⤵
                    PID:5032
                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                    "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Windows Portable Devices\conhost.exe'
                    7⤵
                      PID:3164
                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                      "powershell" -Command Add-MpPreference -ExclusionPath 'C:\odt\powershell.exe'
                      7⤵
                        PID:2628
                      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Windows Security\winlogon.exe'
                        7⤵
                          PID:4088
                        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                          "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Windows Portable Devices\explorer.exe'
                          7⤵
                            PID:3304
                          • C:\Program Files (x86)\Windows Portable Devices\explorer.exe
                            "C:\Program Files (x86)\Windows Portable Devices\explorer.exe"
                            7⤵
                            • Executes dropped EXE
                            • Suspicious behavior: GetForegroundWindowSpam
                            PID:1844
              • C:\Windows\system32\schtasks.exe
                schtasks.exe /create /tn "OfficeClickToRunO" /sc MINUTE /mo 12 /tr "'C:\Program Files (x86)\Google\Update\Install\OfficeClickToRun.exe'" /f
                1⤵
                • Process spawned unexpected child process
                • Creates scheduled task(s)
                PID:416
              • C:\Windows\system32\schtasks.exe
                schtasks.exe /create /tn "OfficeClickToRun" /sc ONLOGON /tr "'C:\Program Files (x86)\Google\Update\Install\OfficeClickToRun.exe'" /rl HIGHEST /f
                1⤵
                • Process spawned unexpected child process
                • Creates scheduled task(s)
                PID:4960
              • C:\Windows\system32\schtasks.exe
                schtasks.exe /create /tn "OfficeClickToRunO" /sc MINUTE /mo 14 /tr "'C:\Program Files (x86)\Google\Update\Install\OfficeClickToRun.exe'" /rl HIGHEST /f
                1⤵
                • Process spawned unexpected child process
                • Creates scheduled task(s)
                PID:4944
              • C:\Windows\system32\schtasks.exe
                schtasks.exe /create /tn "ShellExperienceHostS" /sc MINUTE /mo 6 /tr "'C:\Program Files\Windows Security\BrowserCore\en-US\ShellExperienceHost.exe'" /f
                1⤵
                • Process spawned unexpected child process
                • Creates scheduled task(s)
                PID:4888
              • C:\Windows\system32\schtasks.exe
                schtasks.exe /create /tn "ShellExperienceHost" /sc ONLOGON /tr "'C:\Program Files\Windows Security\BrowserCore\en-US\ShellExperienceHost.exe'" /rl HIGHEST /f
                1⤵
                • Process spawned unexpected child process
                • Creates scheduled task(s)
                PID:4864
              • C:\Windows\system32\schtasks.exe
                schtasks.exe /create /tn "ShellExperienceHostS" /sc MINUTE /mo 12 /tr "'C:\Program Files\Windows Security\BrowserCore\en-US\ShellExperienceHost.exe'" /rl HIGHEST /f
                1⤵
                • Process spawned unexpected child process
                • Creates scheduled task(s)
                PID:4924
              • C:\Windows\system32\schtasks.exe
                schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 9 /tr "'C:\Program Files\Windows Security\BrowserCore\en-US\csrss.exe'" /f
                1⤵
                • Process spawned unexpected child process
                • Creates scheduled task(s)
                PID:4940
              • C:\Windows\system32\schtasks.exe
                schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Program Files\Windows Security\BrowserCore\en-US\csrss.exe'" /rl HIGHEST /f
                1⤵
                • Process spawned unexpected child process
                • Creates scheduled task(s)
                PID:744
              • C:\Windows\system32\schtasks.exe
                schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 6 /tr "'C:\Program Files\Windows Security\BrowserCore\en-US\csrss.exe'" /rl HIGHEST /f
                1⤵
                • Process spawned unexpected child process
                • Creates scheduled task(s)
                PID:916
              • C:\Windows\system32\schtasks.exe
                schtasks.exe /create /tn "ShellExperienceHostS" /sc MINUTE /mo 13 /tr "'C:\providercommon\ShellExperienceHost.exe'" /f
                1⤵
                • Process spawned unexpected child process
                • Creates scheduled task(s)
                PID:772
              • C:\Windows\system32\schtasks.exe
                schtasks.exe /create /tn "ShellExperienceHost" /sc ONLOGON /tr "'C:\providercommon\ShellExperienceHost.exe'" /rl HIGHEST /f
                1⤵
                • Process spawned unexpected child process
                • Creates scheduled task(s)
                PID:740
              • C:\Windows\system32\schtasks.exe
                schtasks.exe /create /tn "ShellExperienceHostS" /sc MINUTE /mo 7 /tr "'C:\providercommon\ShellExperienceHost.exe'" /rl HIGHEST /f
                1⤵
                • Process spawned unexpected child process
                • Creates scheduled task(s)
                PID:864
              • C:\Windows\system32\schtasks.exe
                schtasks.exe /create /tn "ShellExperienceHostS" /sc MINUTE /mo 6 /tr "'C:\providercommon\ShellExperienceHost.exe'" /f
                1⤵
                • Process spawned unexpected child process
                • Creates scheduled task(s)
                PID:1920
              • C:\Windows\system32\schtasks.exe
                schtasks.exe /create /tn "ShellExperienceHost" /sc ONLOGON /tr "'C:\providercommon\ShellExperienceHost.exe'" /rl HIGHEST /f
                1⤵
                • Process spawned unexpected child process
                • Creates scheduled task(s)
                PID:1440
              • C:\Windows\system32\schtasks.exe
                schtasks.exe /create /tn "ShellExperienceHostS" /sc MINUTE /mo 11 /tr "'C:\providercommon\ShellExperienceHost.exe'" /rl HIGHEST /f
                1⤵
                • Process spawned unexpected child process
                • Creates scheduled task(s)
                PID:1444
              • C:\Windows\system32\schtasks.exe
                schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 8 /tr "'C:\odt\dwm.exe'" /f
                1⤵
                • Process spawned unexpected child process
                • Creates scheduled task(s)
                PID:1940
              • C:\Windows\system32\schtasks.exe
                schtasks.exe /create /tn "dwm" /sc ONLOGON /tr "'C:\odt\dwm.exe'" /rl HIGHEST /f
                1⤵
                • Process spawned unexpected child process
                • Creates scheduled task(s)
                PID:1872
              • C:\Windows\system32\schtasks.exe
                schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 8 /tr "'C:\odt\dwm.exe'" /rl HIGHEST /f
                1⤵
                • Process spawned unexpected child process
                • Creates scheduled task(s)
                PID:1172
              • C:\Windows\system32\schtasks.exe
                schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 7 /tr "'C:\providercommon\spoolsv.exe'" /f
                1⤵
                • Process spawned unexpected child process
                • Creates scheduled task(s)
                PID:1160
              • C:\Windows\system32\schtasks.exe
                schtasks.exe /create /tn "spoolsv" /sc ONLOGON /tr "'C:\providercommon\spoolsv.exe'" /rl HIGHEST /f
                1⤵
                • Process spawned unexpected child process
                • Creates scheduled task(s)
                PID:1120
              • C:\Windows\system32\schtasks.exe
                schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 12 /tr "'C:\providercommon\spoolsv.exe'" /rl HIGHEST /f
                1⤵
                • Process spawned unexpected child process
                • Creates scheduled task(s)
                PID:2840
              • C:\Windows\system32\schtasks.exe
                schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 11 /tr "'C:\Program Files (x86)\Windows Sidebar\RuntimeBroker.exe'" /f
                1⤵
                • Process spawned unexpected child process
                • Creates scheduled task(s)
                PID:4708
              • C:\Windows\system32\schtasks.exe
                schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Sidebar\RuntimeBroker.exe'" /rl HIGHEST /f
                1⤵
                • Process spawned unexpected child process
                • Creates scheduled task(s)
                PID:1220
              • C:\Windows\system32\schtasks.exe
                schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 11 /tr "'C:\Program Files (x86)\Windows Sidebar\RuntimeBroker.exe'" /rl HIGHEST /f
                1⤵
                • Process spawned unexpected child process
                • Creates scheduled task(s)
                PID:160
              • C:\Windows\system32\schtasks.exe
                schtasks.exe /create /tn "explorere" /sc MINUTE /mo 8 /tr "'C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\de\explorer.exe'" /f
                1⤵
                • Process spawned unexpected child process
                • Creates scheduled task(s)
                PID:3368
              • C:\Windows\system32\schtasks.exe
                schtasks.exe /create /tn "explorer" /sc ONLOGON /tr "'C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\de\explorer.exe'" /rl HIGHEST /f
                1⤵
                • Process spawned unexpected child process
                • Creates scheduled task(s)
                PID:3380
              • C:\Windows\system32\schtasks.exe
                schtasks.exe /create /tn "explorere" /sc MINUTE /mo 7 /tr "'C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\de\explorer.exe'" /rl HIGHEST /f
                1⤵
                • Process spawned unexpected child process
                • Creates scheduled task(s)
                PID:3308
              • C:\Windows\system32\schtasks.exe
                schtasks.exe /create /tn "OfficeClickToRunO" /sc MINUTE /mo 10 /tr "'C:\Program Files (x86)\Windows Sidebar\Gadgets\OfficeClickToRun.exe'" /f
                1⤵
                • Process spawned unexpected child process
                • Creates scheduled task(s)
                PID:3300
              • C:\Windows\system32\schtasks.exe
                schtasks.exe /create /tn "OfficeClickToRun" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Sidebar\Gadgets\OfficeClickToRun.exe'" /rl HIGHEST /f
                1⤵
                • Process spawned unexpected child process
                • Creates scheduled task(s)
                PID:3320
              • C:\Windows\system32\schtasks.exe
                schtasks.exe /create /tn "OfficeClickToRunO" /sc MINUTE /mo 13 /tr "'C:\Program Files (x86)\Windows Sidebar\Gadgets\OfficeClickToRun.exe'" /rl HIGHEST /f
                1⤵
                • Process spawned unexpected child process
                • Creates scheduled task(s)
                PID:204
              • C:\Windows\system32\schtasks.exe
                schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 12 /tr "'C:\Recovery\WindowsRE\sppsvc.exe'" /f
                1⤵
                • Process spawned unexpected child process
                • Creates scheduled task(s)
                PID:304
              • C:\Windows\system32\schtasks.exe
                schtasks.exe /create /tn "sppsvc" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\sppsvc.exe'" /rl HIGHEST /f
                1⤵
                • Process spawned unexpected child process
                • Creates scheduled task(s)
                PID:652
              • C:\Windows\system32\schtasks.exe
                schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 11 /tr "'C:\Recovery\WindowsRE\sppsvc.exe'" /rl HIGHEST /f
                1⤵
                • Process spawned unexpected child process
                • Creates scheduled task(s)
                PID:2156
              • C:\Windows\system32\schtasks.exe
                schtasks.exe /create /tn "OfficeClickToRunO" /sc MINUTE /mo 11 /tr "'C:\Recovery\WindowsRE\OfficeClickToRun.exe'" /f
                1⤵
                • Process spawned unexpected child process
                • Creates scheduled task(s)
                PID:2436
              • C:\Windows\system32\schtasks.exe
                schtasks.exe /create /tn "OfficeClickToRun" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\OfficeClickToRun.exe'" /rl HIGHEST /f
                1⤵
                • Process spawned unexpected child process
                • Creates scheduled task(s)
                PID:2268
              • C:\Windows\system32\schtasks.exe
                schtasks.exe /create /tn "OfficeClickToRunO" /sc MINUTE /mo 10 /tr "'C:\Recovery\WindowsRE\OfficeClickToRun.exe'" /rl HIGHEST /f
                1⤵
                • Process spawned unexpected child process
                • Creates scheduled task(s)
                PID:2184
              • C:\Windows\system32\schtasks.exe
                schtasks.exe /create /tn "DllCommonsvcD" /sc MINUTE /mo 11 /tr "'C:\Program Files\7-Zip\Lang\DllCommonsvc.exe'" /f
                1⤵
                • Process spawned unexpected child process
                • Creates scheduled task(s)
                PID:2348
              • C:\Windows\system32\schtasks.exe
                schtasks.exe /create /tn "DllCommonsvc" /sc ONLOGON /tr "'C:\Program Files\7-Zip\Lang\DllCommonsvc.exe'" /rl HIGHEST /f
                1⤵
                • Process spawned unexpected child process
                • Creates scheduled task(s)
                PID:500
              • C:\Windows\system32\schtasks.exe
                schtasks.exe /create /tn "DllCommonsvcD" /sc MINUTE /mo 9 /tr "'C:\Program Files\7-Zip\Lang\DllCommonsvc.exe'" /rl HIGHEST /f
                1⤵
                • Process spawned unexpected child process
                • Creates scheduled task(s)
                PID:2628
              • C:\Windows\system32\schtasks.exe
                schtasks.exe /create /tn "powershellp" /sc MINUTE /mo 8 /tr "'C:\odt\powershell.exe'" /f
                1⤵
                • Process spawned unexpected child process
                • Creates scheduled task(s)
                PID:2276
              • C:\Windows\system32\schtasks.exe
                schtasks.exe /create /tn "powershell" /sc ONLOGON /tr "'C:\odt\powershell.exe'" /rl HIGHEST /f
                1⤵
                • Process spawned unexpected child process
                • Creates scheduled task(s)
                PID:2464
              • C:\Windows\system32\schtasks.exe
                schtasks.exe /create /tn "powershellp" /sc MINUTE /mo 9 /tr "'C:\odt\powershell.exe'" /rl HIGHEST /f
                1⤵
                • Process spawned unexpected child process
                • Creates scheduled task(s)
                PID:5032
              • C:\Windows\system32\schtasks.exe
                schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 11 /tr "'C:\Program Files (x86)\Windows Portable Devices\conhost.exe'" /f
                1⤵
                • Process spawned unexpected child process
                • Creates scheduled task(s)
                PID:1844
              • C:\Windows\system32\schtasks.exe
                schtasks.exe /create /tn "conhost" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Portable Devices\conhost.exe'" /rl HIGHEST /f
                1⤵
                • Process spawned unexpected child process
                • Creates scheduled task(s)
                PID:4952
              • C:\Windows\system32\schtasks.exe
                schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 13 /tr "'C:\Program Files (x86)\Windows Portable Devices\conhost.exe'" /rl HIGHEST /f
                1⤵
                • Process spawned unexpected child process
                • Creates scheduled task(s)
                PID:3164
              • C:\Windows\system32\schtasks.exe
                schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 6 /tr "'C:\Program Files\Windows Security\winlogon.exe'" /f
                1⤵
                • Process spawned unexpected child process
                • Creates scheduled task(s)
                PID:656
              • C:\Windows\system32\schtasks.exe
                schtasks.exe /create /tn "winlogon" /sc ONLOGON /tr "'C:\Program Files\Windows Security\winlogon.exe'" /rl HIGHEST /f
                1⤵
                • Process spawned unexpected child process
                • Creates scheduled task(s)
                PID:3240
              • C:\Windows\system32\schtasks.exe
                schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 10 /tr "'C:\Program Files\Windows Security\winlogon.exe'" /rl HIGHEST /f
                1⤵
                • Process spawned unexpected child process
                • Creates scheduled task(s)
                PID:1664
              • C:\Windows\system32\schtasks.exe
                schtasks.exe /create /tn "explorere" /sc MINUTE /mo 7 /tr "'C:\Program Files (x86)\Windows Portable Devices\explorer.exe'" /f
                1⤵
                • Process spawned unexpected child process
                • Creates scheduled task(s)
                PID:1596
              • C:\Windows\system32\schtasks.exe
                schtasks.exe /create /tn "explorer" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Portable Devices\explorer.exe'" /rl HIGHEST /f
                1⤵
                • Process spawned unexpected child process
                • Creates scheduled task(s)
                PID:216
              • C:\Windows\system32\schtasks.exe
                schtasks.exe /create /tn "explorere" /sc MINUTE /mo 5 /tr "'C:\Program Files (x86)\Windows Portable Devices\explorer.exe'" /rl HIGHEST /f
                1⤵
                • Process spawned unexpected child process
                • Creates scheduled task(s)
                PID:3308

              Network

              MITRE ATT&CK Enterprise v6

              Replay Monitor

              Loading Replay Monitor...

              Downloads

              • C:\Program Files (x86)\Windows Portable Devices\explorer.exe

                Filesize

                1.0MB

                MD5

                bd31e94b4143c4ce49c17d3af46bcad0

                SHA1

                f8c51ff3ff909531d9469d4ba1bbabae101853ff

                SHA256

                b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

                SHA512

                f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

              • C:\Program Files (x86)\Windows Portable Devices\explorer.exe

                Filesize

                1.0MB

                MD5

                bd31e94b4143c4ce49c17d3af46bcad0

                SHA1

                f8c51ff3ff909531d9469d4ba1bbabae101853ff

                SHA256

                b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

                SHA512

                f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

              • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\DllCommonsvc.exe.log

                Filesize

                1KB

                MD5

                b4268d8ae66fdd920476b97a1776bf85

                SHA1

                f920de54f7467f0970eccc053d3c6c8dd181d49a

                SHA256

                61d17affcc8d91ecb1858e710c455186f9d0ccfc4d8ae17a1145d87bc7317879

                SHA512

                03b6b90641837f9efb6065698602220d6c5ad263d51d7b7714747c2a3c3c618bd3d94add206b034d6fa2b8e43cbd1ac4a1741cfa1c2b1c1fc8589ae0b0c89516

              • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

                Filesize

                3KB

                MD5

                ad5cd538ca58cb28ede39c108acb5785

                SHA1

                1ae910026f3dbe90ed025e9e96ead2b5399be877

                SHA256

                c9e6cb04d6c893458d5a7e12eb575cf97c3172f5e312b1f63a667cbbc5f0c033

                SHA512

                c066c5d9b276a68fa636647bb29aea05bfa2292217bc77f5324d9c1d93117772ee8277e1f7cff91ec8d6b7c05ca078f929cecfdbb09582522a9067f54740af13

              • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                Filesize

                1KB

                MD5

                e3968206aaf6b07ecc91fb5ac5b26f8c

                SHA1

                87f51b27eb0735eb1239cf4d924363570b674952

                SHA256

                eb67a2c20e9c48bd269ed3c37cc8ce800ac05335f724538021ad385c232bd831

                SHA512

                a2a5259ed13494524a0d31fe791f97bc97cba9763043e6a8fd90342612351310abc7c4ee452babfa5c3e43458e8147bcb42313f1a7714feb8481b490b6dc52ca

              • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                Filesize

                1KB

                MD5

                4aa494eb499312832c246d1cd0b2a0e9

                SHA1

                420b55f7f96f3282a7915460561baa84fb38502d

                SHA256

                017be768926b5dadf47e366a37d5e54775ea2925719886c0f6b3750ae08e0d98

                SHA512

                3f4848150434a1954614b5ac0d9aeafa3552e9f0f85b3447ee54a3f4d1cce263d337b3cc38d4ec3f693cddd698cba52e8d9ba9cb6ee844283b826c2acf4f7bdc

              • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                Filesize

                1KB

                MD5

                5e47de7f0ad5948c4b40670148331dba

                SHA1

                b833183616eb0d8920cff93f7494fd411d15a99b

                SHA256

                40369ed311a9ac4de065fbc49eb1ffd1d4e4cf9126b752c1df0bb411baf3be6b

                SHA512

                87ac2acd8cd7c3bb17af3c1841863ab6a7f0fe871f5f77afac8beba0af35c9ab0ac2b57ee4c86744a0431a8aeac07b67349544b6f5643a165d8d70e8071b7f68

              • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                Filesize

                1KB

                MD5

                8f8e416ff9287ded65d72fbe4f02a757

                SHA1

                3efe0a018826256da0413d884779f7c8be6586d5

                SHA256

                c122846a0ec1803a44f9e1bb7242735ebb1f3671a756321c779f6a5af37c561a

                SHA512

                786a885403edec90540d0c30a8357428bf2acffe9941eff57eb3d2f0ad369e08fe66f5e6b3cfe7a0650cbdaa56899aab2bb8a3d65421936b12935f716a701b1d

              • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                Filesize

                1KB

                MD5

                8f8e416ff9287ded65d72fbe4f02a757

                SHA1

                3efe0a018826256da0413d884779f7c8be6586d5

                SHA256

                c122846a0ec1803a44f9e1bb7242735ebb1f3671a756321c779f6a5af37c561a

                SHA512

                786a885403edec90540d0c30a8357428bf2acffe9941eff57eb3d2f0ad369e08fe66f5e6b3cfe7a0650cbdaa56899aab2bb8a3d65421936b12935f716a701b1d

              • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                Filesize

                1KB

                MD5

                9b82828754911916cccc06ee59152e7e

                SHA1

                5657ab668b5c5f6bae47e2650052049792c23cd7

                SHA256

                561f1f114cab20290c672cc0a2802871fefdcb65a5dca3d772f6ccffa6b188cf

                SHA512

                a12b0e0e9c47055f81ea5a711e67197f5ec48cc91139dc0a473aff5282418b705d229de8564afd850913513e97b9ab0856557bacc918c101f72b8247b2135d0b

              • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                Filesize

                1KB

                MD5

                63c0fbc225aadfdf3264c3b6474b4386

                SHA1

                bacb98795e52d8592b4f27171c74f9d725f49b06

                SHA256

                9e5485c5d06d12a8fe257b60fde21d07bf9e3c9c37aa2be9cbcce8f7994df72c

                SHA512

                1b07f149d2f3aaeb429b5f644ecc30e254bc76c378b1b6c98805d8fc1c1c58764cdda85a59df6517b018a7dca9f5b7a4531266c3352b7efe0b98588933287ded

              • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                Filesize

                1KB

                MD5

                dafd01f8c9efe0efa2bb982831fcecf2

                SHA1

                ba4cc106cb161d45f2f222c389470303128c2516

                SHA256

                d7142683702ce0a43ea1d39276dd2c56715dfc3786d5450bf8a80ce2e8a93c03

                SHA512

                684bdd2ec65cfc9f3d23e7d104761e2f01c690e920730e63e309a8962620b8cfd87be0189691a8f55bf5c40cf671938036dba9b893850a6a62ab624935fca161

              • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                Filesize

                1KB

                MD5

                dafd01f8c9efe0efa2bb982831fcecf2

                SHA1

                ba4cc106cb161d45f2f222c389470303128c2516

                SHA256

                d7142683702ce0a43ea1d39276dd2c56715dfc3786d5450bf8a80ce2e8a93c03

                SHA512

                684bdd2ec65cfc9f3d23e7d104761e2f01c690e920730e63e309a8962620b8cfd87be0189691a8f55bf5c40cf671938036dba9b893850a6a62ab624935fca161

              • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                Filesize

                1KB

                MD5

                dafd01f8c9efe0efa2bb982831fcecf2

                SHA1

                ba4cc106cb161d45f2f222c389470303128c2516

                SHA256

                d7142683702ce0a43ea1d39276dd2c56715dfc3786d5450bf8a80ce2e8a93c03

                SHA512

                684bdd2ec65cfc9f3d23e7d104761e2f01c690e920730e63e309a8962620b8cfd87be0189691a8f55bf5c40cf671938036dba9b893850a6a62ab624935fca161

              • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                Filesize

                1KB

                MD5

                6ea240d81d08346e06085d6388c82824

                SHA1

                f1a9d5bb224b0659b43b13d320e601165bbe522d

                SHA256

                6881c3c8e8256709b1eaf6c886d5c01ce9b9fc039e7f690f511883ae5c41838d

                SHA512

                32622c48ac6612eff2152dd33b6f648cced0de9e83369e31dbe493f91f4a1e64bf37803b5aa31b4ab1f1739153d8279f256253d51a1137e20ff49e453bab4c6e

              • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                Filesize

                1KB

                MD5

                6ea240d81d08346e06085d6388c82824

                SHA1

                f1a9d5bb224b0659b43b13d320e601165bbe522d

                SHA256

                6881c3c8e8256709b1eaf6c886d5c01ce9b9fc039e7f690f511883ae5c41838d

                SHA512

                32622c48ac6612eff2152dd33b6f648cced0de9e83369e31dbe493f91f4a1e64bf37803b5aa31b4ab1f1739153d8279f256253d51a1137e20ff49e453bab4c6e

              • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                Filesize

                1KB

                MD5

                17c21bc218d2cf0fb90852d9e517a790

                SHA1

                b23b25aa6184aeb757881bdb5a6125c8bd690dfd

                SHA256

                7aa98797c3d38d7f3fff47ff16dd0d9df3452b91a1c883ae9960c7a0ec7e0b54

                SHA512

                7dd11f1472e11f1c36644fa66470fe9d626344960e6e99bdf8ff805e1f989e6ac4dcb211b6e0646aff7a3285b3b3bda9a3b0729fc1a558404340db894c430a21

              • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                Filesize

                1KB

                MD5

                8f6c2ef3a8ef7e3713daca26bfe0ac3a

                SHA1

                2157f51a889900fcc9ad99ba7ed897772d40cb99

                SHA256

                02eccbd3d2481edcef8173085b2e6c78afa1d64a30765c13135c8a751a3fdfc2

                SHA512

                9f6580447bb5ef85138faf226fea7168cf7048ac23e433c6f6b5a313e99c2491fb59fa405603b2a83684db728d75724d7ceb8a2728a047805799acf8d34b0e89

              • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                Filesize

                1KB

                MD5

                d91fd932e40960d07ddf2528462ef5ea

                SHA1

                706d81d7316a487f830e06ea87bd1f43ac31b2d9

                SHA256

                587704549e25bd70e020efe7a4539aa64ab71d83b45061e53669afb8b5c979f6

                SHA512

                aa54d5d24ec0d3519acdcb78c90d5e8c3cb86001dd8e0db79b03be8f9708b69fef4514a18608f3709f8247d335479d641263888558748993b19f4defdfe4878b

              • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                Filesize

                1KB

                MD5

                d91fd932e40960d07ddf2528462ef5ea

                SHA1

                706d81d7316a487f830e06ea87bd1f43ac31b2d9

                SHA256

                587704549e25bd70e020efe7a4539aa64ab71d83b45061e53669afb8b5c979f6

                SHA512

                aa54d5d24ec0d3519acdcb78c90d5e8c3cb86001dd8e0db79b03be8f9708b69fef4514a18608f3709f8247d335479d641263888558748993b19f4defdfe4878b

              • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                Filesize

                1KB

                MD5

                6bd13f1b81866f785e24f97fbf01599a

                SHA1

                1c91dbff7bba8669c2e76056f3edd462d1f3b7bd

                SHA256

                3d55a2a16fcf3f294006829274130e46bd79dd9ce0ae4a25d9cb6d921bce68ee

                SHA512

                471f51a8f66898cb10ebd86d5390ef9a0bdad03b9030fa2ae5b3922d60f722cebef2ba9106569aab9c8533e8f4c9b7e1cced49cb7debdc9ab634516ba03616d7

              • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                Filesize

                1KB

                MD5

                980ec58975c13611d5457d8eeaf4ea44

                SHA1

                a767ba361b332d06a8d606f45a86b007bfef09a2

                SHA256

                2add9ee0590171413ccb3e41c74eac7b450a0a25c8d232b049fb462ad29c5e31

                SHA512

                d2ec55296a4ba17f44c8dc1471bc1bba2074a4c131c9760fbf6de40616ab0beccb5a9ab4eaffa5e3a53d0d5f425a12ef7291658d22788dbd7777566528a320d4

              • C:\Users\Admin\AppData\Local\Temp\eMIZxK0WIh.bat

                Filesize

                199B

                MD5

                003f9f5f0505acb9ad97d1f51b965d5d

                SHA1

                88e904cbaa10d38b431e5fed1ab708fe0d651636

                SHA256

                d69d65b5b269b9750a2dc3e107f4880153019a7f333bcb8c24c777f2fcac6a39

                SHA512

                a8525a84e7aeb1ea6b3cfb0269e2d47c16ed38d62ec89664f5fef7a0ff921da2428f9b10f44a0a093cacbb256dc582fe0339f2a2710903a36c5c4d005332eaad

              • C:\providercommon\1zu9dW.bat

                Filesize

                36B

                MD5

                6783c3ee07c7d151ceac57f1f9c8bed7

                SHA1

                17468f98f95bf504cc1f83c49e49a78526b3ea03

                SHA256

                8ab782f0f327a2021530e7230d3aee8abbecb7eed59482a3a46e78b9e3862322

                SHA512

                c6012d4bfac1ed14d0fd9f0eabd0e1c3d647b343db292a907b246271d52a4b7469c809db43910ddba2e8c5045f9cb3d24d0af62d363281e6cb8b39ee94a183e8

              • C:\providercommon\DllCommonsvc.exe

                Filesize

                1.0MB

                MD5

                bd31e94b4143c4ce49c17d3af46bcad0

                SHA1

                f8c51ff3ff909531d9469d4ba1bbabae101853ff

                SHA256

                b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

                SHA512

                f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

              • C:\providercommon\DllCommonsvc.exe

                Filesize

                1.0MB

                MD5

                bd31e94b4143c4ce49c17d3af46bcad0

                SHA1

                f8c51ff3ff909531d9469d4ba1bbabae101853ff

                SHA256

                b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

                SHA512

                f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

              • C:\providercommon\DllCommonsvc.exe

                Filesize

                1.0MB

                MD5

                bd31e94b4143c4ce49c17d3af46bcad0

                SHA1

                f8c51ff3ff909531d9469d4ba1bbabae101853ff

                SHA256

                b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

                SHA512

                f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

              • C:\providercommon\yTUdeXjbLOhnrN32dgrxVg.vbe

                Filesize

                197B

                MD5

                8088241160261560a02c84025d107592

                SHA1

                083121f7027557570994c9fc211df61730455bb5

                SHA256

                2072cc9a4a3b84d4c5178ab41c5588eea7d0103e3928e34d64f17bf97f3d1cc1

                SHA512

                20d9369dd359315848ea30144383a0bb479d86059fdbc3b3256ac84f998193512feb3b1799ab663619920c99fe7e0ebba33ada31a3855094b956fcd351c90478

              • memory/1044-363-0x0000024570180000-0x00000245701F6000-memory.dmp

                Filesize

                472KB

              • memory/1844-788-0x0000000002200000-0x0000000002212000-memory.dmp

                Filesize

                72KB

              • memory/1860-355-0x00000197713E0000-0x0000019771402000-memory.dmp

                Filesize

                136KB

              • memory/2460-149-0x0000000077470000-0x00000000775FE000-memory.dmp

                Filesize

                1.6MB

              • memory/2460-148-0x0000000077470000-0x00000000775FE000-memory.dmp

                Filesize

                1.6MB

              • memory/2460-158-0x0000000077470000-0x00000000775FE000-memory.dmp

                Filesize

                1.6MB

              • memory/2460-159-0x0000000077470000-0x00000000775FE000-memory.dmp

                Filesize

                1.6MB

              • memory/2460-160-0x0000000077470000-0x00000000775FE000-memory.dmp

                Filesize

                1.6MB

              • memory/2460-161-0x0000000077470000-0x00000000775FE000-memory.dmp

                Filesize

                1.6MB

              • memory/2460-162-0x0000000077470000-0x00000000775FE000-memory.dmp

                Filesize

                1.6MB

              • memory/2460-163-0x0000000077470000-0x00000000775FE000-memory.dmp

                Filesize

                1.6MB

              • memory/2460-164-0x0000000077470000-0x00000000775FE000-memory.dmp

                Filesize

                1.6MB

              • memory/2460-165-0x0000000077470000-0x00000000775FE000-memory.dmp

                Filesize

                1.6MB

              • memory/2460-166-0x0000000077470000-0x00000000775FE000-memory.dmp

                Filesize

                1.6MB

              • memory/2460-167-0x0000000077470000-0x00000000775FE000-memory.dmp

                Filesize

                1.6MB

              • memory/2460-168-0x0000000077470000-0x00000000775FE000-memory.dmp

                Filesize

                1.6MB

              • memory/2460-169-0x0000000077470000-0x00000000775FE000-memory.dmp

                Filesize

                1.6MB

              • memory/2460-170-0x0000000077470000-0x00000000775FE000-memory.dmp

                Filesize

                1.6MB

              • memory/2460-171-0x0000000077470000-0x00000000775FE000-memory.dmp

                Filesize

                1.6MB

              • memory/2460-172-0x0000000077470000-0x00000000775FE000-memory.dmp

                Filesize

                1.6MB

              • memory/2460-173-0x0000000077470000-0x00000000775FE000-memory.dmp

                Filesize

                1.6MB

              • memory/2460-174-0x0000000077470000-0x00000000775FE000-memory.dmp

                Filesize

                1.6MB

              • memory/2460-175-0x0000000077470000-0x00000000775FE000-memory.dmp

                Filesize

                1.6MB

              • memory/2460-176-0x0000000077470000-0x00000000775FE000-memory.dmp

                Filesize

                1.6MB

              • memory/2460-177-0x0000000077470000-0x00000000775FE000-memory.dmp

                Filesize

                1.6MB

              • memory/2460-178-0x0000000077470000-0x00000000775FE000-memory.dmp

                Filesize

                1.6MB

              • memory/2460-179-0x0000000077470000-0x00000000775FE000-memory.dmp

                Filesize

                1.6MB

              • memory/2460-117-0x0000000077470000-0x00000000775FE000-memory.dmp

                Filesize

                1.6MB

              • memory/2460-118-0x0000000077470000-0x00000000775FE000-memory.dmp

                Filesize

                1.6MB

              • memory/2460-119-0x0000000077470000-0x00000000775FE000-memory.dmp

                Filesize

                1.6MB

              • memory/2460-156-0x0000000077470000-0x00000000775FE000-memory.dmp

                Filesize

                1.6MB

              • memory/2460-155-0x0000000077470000-0x00000000775FE000-memory.dmp

                Filesize

                1.6MB

              • memory/2460-121-0x0000000077470000-0x00000000775FE000-memory.dmp

                Filesize

                1.6MB

              • memory/2460-122-0x0000000077470000-0x00000000775FE000-memory.dmp

                Filesize

                1.6MB

              • memory/2460-154-0x0000000077470000-0x00000000775FE000-memory.dmp

                Filesize

                1.6MB

              • memory/2460-153-0x0000000077470000-0x00000000775FE000-memory.dmp

                Filesize

                1.6MB

              • memory/2460-124-0x0000000077470000-0x00000000775FE000-memory.dmp

                Filesize

                1.6MB

              • memory/2460-125-0x0000000077470000-0x00000000775FE000-memory.dmp

                Filesize

                1.6MB

              • memory/2460-126-0x0000000077470000-0x00000000775FE000-memory.dmp

                Filesize

                1.6MB

              • memory/2460-127-0x0000000077470000-0x00000000775FE000-memory.dmp

                Filesize

                1.6MB

              • memory/2460-129-0x0000000077470000-0x00000000775FE000-memory.dmp

                Filesize

                1.6MB

              • memory/2460-152-0x0000000077470000-0x00000000775FE000-memory.dmp

                Filesize

                1.6MB

              • memory/2460-128-0x0000000077470000-0x00000000775FE000-memory.dmp

                Filesize

                1.6MB

              • memory/2460-151-0x0000000077470000-0x00000000775FE000-memory.dmp

                Filesize

                1.6MB

              • memory/2460-150-0x0000000077470000-0x00000000775FE000-memory.dmp

                Filesize

                1.6MB

              • memory/2460-116-0x0000000077470000-0x00000000775FE000-memory.dmp

                Filesize

                1.6MB

              • memory/2460-130-0x0000000077470000-0x00000000775FE000-memory.dmp

                Filesize

                1.6MB

              • memory/2460-157-0x0000000077470000-0x00000000775FE000-memory.dmp

                Filesize

                1.6MB

              • memory/2460-131-0x0000000077470000-0x00000000775FE000-memory.dmp

                Filesize

                1.6MB

              • memory/2460-132-0x0000000077470000-0x00000000775FE000-memory.dmp

                Filesize

                1.6MB

              • memory/2460-133-0x0000000077470000-0x00000000775FE000-memory.dmp

                Filesize

                1.6MB

              • memory/2460-134-0x0000000077470000-0x00000000775FE000-memory.dmp

                Filesize

                1.6MB

              • memory/2460-135-0x0000000077470000-0x00000000775FE000-memory.dmp

                Filesize

                1.6MB

              • memory/2460-147-0x0000000077470000-0x00000000775FE000-memory.dmp

                Filesize

                1.6MB

              • memory/2460-136-0x0000000077470000-0x00000000775FE000-memory.dmp

                Filesize

                1.6MB

              • memory/2460-137-0x0000000077470000-0x00000000775FE000-memory.dmp

                Filesize

                1.6MB

              • memory/2460-146-0x0000000077470000-0x00000000775FE000-memory.dmp

                Filesize

                1.6MB

              • memory/2460-144-0x0000000077470000-0x00000000775FE000-memory.dmp

                Filesize

                1.6MB

              • memory/2460-145-0x0000000077470000-0x00000000775FE000-memory.dmp

                Filesize

                1.6MB

              • memory/2460-138-0x0000000077470000-0x00000000775FE000-memory.dmp

                Filesize

                1.6MB

              • memory/2460-139-0x0000000077470000-0x00000000775FE000-memory.dmp

                Filesize

                1.6MB

              • memory/2460-143-0x0000000077470000-0x00000000775FE000-memory.dmp

                Filesize

                1.6MB

              • memory/2460-142-0x0000000077470000-0x00000000775FE000-memory.dmp

                Filesize

                1.6MB

              • memory/2460-140-0x0000000077470000-0x00000000775FE000-memory.dmp

                Filesize

                1.6MB

              • memory/2460-141-0x0000000077470000-0x00000000775FE000-memory.dmp

                Filesize

                1.6MB

              • memory/2892-181-0x0000000077470000-0x00000000775FE000-memory.dmp

                Filesize

                1.6MB

              • memory/2892-182-0x0000000077470000-0x00000000775FE000-memory.dmp

                Filesize

                1.6MB

              • memory/5036-285-0x0000000001730000-0x000000000173C000-memory.dmp

                Filesize

                48KB

              • memory/5036-284-0x00000000017B0000-0x00000000017BC000-memory.dmp

                Filesize

                48KB

              • memory/5036-283-0x0000000001720000-0x0000000001732000-memory.dmp

                Filesize

                72KB

              • memory/5036-282-0x0000000000ED0000-0x0000000000FE0000-memory.dmp

                Filesize

                1.1MB

              • memory/5036-286-0x00000000017A0000-0x00000000017AC000-memory.dmp

                Filesize

                48KB