dcrat | a754e3d045adbd88b59a7b80ea127636f710c4183001cce2b7614611b7c141e4

Analysis

max time kernel
150s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
23-03-2023 14:40

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a754e3d045adbd88b59a7b80ea127636f710c4183001cce2b7614611b7c141e4.exe
Size

194KB
MD5

de2cc5ab0c1b901b1d57a0e10c0185be
SHA1

f7d3144acc8e7473b8fb0c93cdc69632ea2de3ac
SHA256

a754e3d045adbd88b59a7b80ea127636f710c4183001cce2b7614611b7c141e4
SHA512

492fea5d91d8121432779fb4e01c6a5371b9fbe6675ecc9a32e416c583107e60ea160eeaa010cc83e7ace640ed7e31172ab1f4a3217526412cc9810960510be7
SSDEEP

3072:lSbONVWNIbrL8vTk1Wi5XiKR0Cf6MzjN+C1HQJISv5f9juaQE4nL:lSbFcrL8o1fikjNzQJn51juaQE

Score

10^/10

dcrat redline smokeloader 2023 2061513232 @fbskupbro backdoor infostealer persistence rat spyware trojan

Malware Config

Extracted

Family

smokeloader

Botnet

2023

Extracted

Family

smokeloader

Version

2022

http://c3g6gx853u6j.xyz/

http://04yh16065cdi.xyz/

http://33qd2w560vnx.xyz/

http://neriir0f76gr.com/

http://b4y08hrp3jdb.com/

http://swp6fbywla09.com/

http://7iqt53dr345u.com/

http://mj4aj8r55mho.com/

http://ne4ym7bjn1ts.com/

rc4.i32

Extracted

Family

redline

Botnet

2061513232

animalstyle.top:40309

Attributes

auth_value
06a7f7ef22670041a9614bb874d7e5fb

Extracted

Family

redline

Botnet

@FBSKUPBRO

185.215.113.69:15544

Attributes

auth_value
5ebb0a18eb4f39a4158a145905cba2a4

Signatures

DcRat 15 IoCs

DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

rat infostealer dcrat

Processes:

schtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exea754e3d045adbd88b59a7b80ea127636f710c4183001cce2b7614611b7c141e4.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exe

pid	process
4792	schtasks.exe
4848	schtasks.exe
4184	schtasks.exe
2536	schtasks.exe
4080	schtasks.exe
1664	schtasks.exe
2980	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	a754e3d045adbd88b59a7b80ea127636f710c4183001cce2b7614611b7c141e4.exe
1692	schtasks.exe
4980	schtasks.exe
3924	schtasks.exe
3004	schtasks.exe
2744	schtasks.exe
1164	schtasks.exe
2624	schtasks.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 2 IoCs

Processes:

resource	yara_rule
behavioral2/memory/4952-175-0x0000000000400000-0x0000000000428000-memory.dmp	family_redline
behavioral2/memory/4956-181-0x00000000057F0000-0x0000000005800000-memory.dmp	family_redline

SmokeLoader
Modular backdoor trojan in use since 2014.
trojan backdoor smokeloader
Downloads MZ/PE file
Executes dropped EXE 5 IoCs

Processes:

158.exeB94E.exeSystem.exeUpdate.exedllhost.exe

pid process

3716 158.exe
3924 B94E.exe
1324 System.exe
868 Update.exe
2228 dllhost.exe
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081

pid	process
3716	158.exe
3924	B94E.exe
1324	System.exe
868	Update.exe
2228	dllhost.exe

Adds Run key to start application 2 TTPs 12 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

dllhost.exeUpdate.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\AntiMalwareServiceExecutable = "C:\\ProgramData\\Microsoft\\Windows Defender\\Platform\\4.18.2111.5-0\\MsMpEng.exe"	dllhost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\runtime_3 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Microsoft\\config\\runtime.exe"	Update.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dllhost = "C:\\ProgramData\\Dllhost\\dllhost.exe"	dllhost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SecurityHealthSystray = "C:\\Windows\\System32\\SecurityHealthSystray.exe"	dllhost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WindowsDefender = "C:\\Program Files\\Windows Defender\\MpCmdRun.exe"	dllhost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MicrosoftEdgeUpd = "C:\\Program Files\\WindowsApps\\Microsoft.x64__8wekyb3gfdfdgd8bbwe/file.exe"	dllhost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OneDriveService = "C:\\Program Files\\WindowsApps\\Microsoft.x64__8wekyb3gfdfdgd8bbwe/file.exe"	dllhost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\NvStray = "C:\\Program Files\\WindowsApps\\Microsoft.x64__8wekyb3gfdfdgd8bbwe / file.exe"	dllhost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\runtime_1 = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\config\\runtime.exe"	Update.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\runtime_2 = "C:\\Users\\Admin\\AppData\\Local\\Microsoft\\config\\runtime.exe"	Update.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Cortana = "C:\\Program Files\\WindowsApps\\Microsoft.x64__8wekyb3gfdfdgd8bbwe\\Cortana.exe"	dllhost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WmiPrvSE = "C:\\Windows\\System32\\wbem\\WmiPrvSE.exe"	dllhost.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

Suspicious use of SetThreadContext 2 IoCs

Processes:

158.exeB94E.exe

description	pid	process	target process
PID 3716 set thread context of 3216	3716	158.exe	AppLaunch.exe
PID 3924 set thread context of 4952	3924	B94E.exe	AppLaunch.exe

Program crash 2 IoCs

Processes:

WerFault.exeWerFault.exe

pid pid_target process target process

1780 3716 WerFault.exe 158.exe
3488 3924 WerFault.exe B94E.exe

pid	pid_target	process	target process
1780	3716	WerFault.exe	158.exe
3488	3924	WerFault.exe	B94E.exe

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

a754e3d045adbd88b59a7b80ea127636f710c4183001cce2b7614611b7c141e4.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	a754e3d045adbd88b59a7b80ea127636f710c4183001cce2b7614611b7c141e4.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	a754e3d045adbd88b59a7b80ea127636f710c4183001cce2b7614611b7c141e4.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	a754e3d045adbd88b59a7b80ea127636f710c4183001cce2b7614611b7c141e4.exe

Creates scheduled task(s) 1 TTPs 14 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

Processes:

schtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exe

pid	process
2744	schtasks.exe
3924	schtasks.exe
3004	schtasks.exe
4980	schtasks.exe
4792	schtasks.exe
4080	schtasks.exe
2624	schtasks.exe
2980	schtasks.exe
2536	schtasks.exe
1164	schtasks.exe
4848	schtasks.exe
1692	schtasks.exe
1664	schtasks.exe
4184	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

a754e3d045adbd88b59a7b80ea127636f710c4183001cce2b7614611b7c141e4.exe

pid	process
1592	a754e3d045adbd88b59a7b80ea127636f710c4183001cce2b7614611b7c141e4.exe
1592	a754e3d045adbd88b59a7b80ea127636f710c4183001cce2b7614611b7c141e4.exe
3160
3160
3160
3160
3160
3160
3160
3160
3160
3160
3160
3160
3160
3160
3160
3160
3160
3160
3160
3160
3160
3160
3160
3160
3160
3160
3160
3160
3160
3160
3160
3160
3160
3160
3160
3160
3160
3160
3160
3160
3160
3160
3160
3160
3160
3160
3160
3160
3160
3160
3160
3160
3160
3160
3160
3160
3160
3160
3160
3160
3160
3160

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

pid process

3160

pid	process
3160

Suspicious behavior: MapViewOfSection 19 IoCs

Processes:

a754e3d045adbd88b59a7b80ea127636f710c4183001cce2b7614611b7c141e4.exe

pid	process
1592	a754e3d045adbd88b59a7b80ea127636f710c4183001cce2b7614611b7c141e4.exe
3160
3160
3160
3160
3160
3160
3160
3160
3160
3160
3160
3160
3160
3160
3160
3160
3160
3160

Suspicious use of AdjustPrivilegeToken 46 IoCs

Processes:

AppLaunch.exeAppLaunch.exeSystem.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exedllhost.exe

description	pid	process
Token: SeShutdownPrivilege	3160
Token: SeCreatePagefilePrivilege	3160
Token: SeShutdownPrivilege	3160
Token: SeCreatePagefilePrivilege	3160
Token: SeShutdownPrivilege	3160
Token: SeCreatePagefilePrivilege	3160
Token: SeShutdownPrivilege	3160
Token: SeCreatePagefilePrivilege	3160
Token: SeShutdownPrivilege	3160
Token: SeCreatePagefilePrivilege	3160
Token: SeShutdownPrivilege	3160
Token: SeCreatePagefilePrivilege	3160
Token: SeDebugPrivilege	3216	AppLaunch.exe
Token: SeShutdownPrivilege	3160
Token: SeCreatePagefilePrivilege	3160
Token: SeShutdownPrivilege	3160
Token: SeCreatePagefilePrivilege	3160
Token: SeShutdownPrivilege	3160
Token: SeCreatePagefilePrivilege	3160
Token: SeShutdownPrivilege	3160
Token: SeCreatePagefilePrivilege	3160
Token: SeShutdownPrivilege	3160
Token: SeCreatePagefilePrivilege	3160
Token: SeShutdownPrivilege	3160
Token: SeCreatePagefilePrivilege	3160
Token: SeShutdownPrivilege	3160
Token: SeCreatePagefilePrivilege	3160
Token: SeDebugPrivilege	4952	AppLaunch.exe
Token: SeShutdownPrivilege	3160
Token: SeCreatePagefilePrivilege	3160
Token: SeDebugPrivilege	1324	System.exe
Token: SeDebugPrivilege	4936	powershell.exe
Token: SeShutdownPrivilege	3160
Token: SeCreatePagefilePrivilege	3160
Token: SeDebugPrivilege	2692	powershell.exe
Token: SeDebugPrivilege	2848	powershell.exe
Token: SeShutdownPrivilege	3160
Token: SeCreatePagefilePrivilege	3160
Token: SeDebugPrivilege	2536	powershell.exe
Token: SeShutdownPrivilege	3160
Token: SeCreatePagefilePrivilege	3160
Token: SeDebugPrivilege	4516	powershell.exe
Token: SeDebugPrivilege	1712	powershell.exe
Token: SeDebugPrivilege	2228	dllhost.exe
Token: SeShutdownPrivilege	3160
Token: SeCreatePagefilePrivilege	3160

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

158.exeB94E.exeAppLaunch.exeUpdate.exeSystem.execmd.exe

description	pid	process	target process
PID 3160 wrote to memory of 3716	3160		158.exe
PID 3160 wrote to memory of 3716	3160		158.exe
PID 3160 wrote to memory of 3716	3160		158.exe
PID 3716 wrote to memory of 3216	3716	158.exe	AppLaunch.exe
PID 3716 wrote to memory of 3216	3716	158.exe	AppLaunch.exe
PID 3716 wrote to memory of 3216	3716	158.exe	AppLaunch.exe
PID 3716 wrote to memory of 3216	3716	158.exe	AppLaunch.exe
PID 3716 wrote to memory of 3216	3716	158.exe	AppLaunch.exe
PID 3160 wrote to memory of 3924	3160		B94E.exe
PID 3160 wrote to memory of 3924	3160		B94E.exe
PID 3160 wrote to memory of 3924	3160		B94E.exe
PID 3160 wrote to memory of 4956	3160		explorer.exe
PID 3160 wrote to memory of 4956	3160		explorer.exe
PID 3160 wrote to memory of 4956	3160		explorer.exe
PID 3160 wrote to memory of 4956	3160		explorer.exe
PID 3924 wrote to memory of 4952	3924	B94E.exe	AppLaunch.exe
PID 3924 wrote to memory of 4952	3924	B94E.exe	AppLaunch.exe
PID 3924 wrote to memory of 4952	3924	B94E.exe	AppLaunch.exe
PID 3924 wrote to memory of 4952	3924	B94E.exe	AppLaunch.exe
PID 3924 wrote to memory of 4952	3924	B94E.exe	AppLaunch.exe
PID 3160 wrote to memory of 1596	3160		explorer.exe
PID 3160 wrote to memory of 1596	3160		explorer.exe
PID 3160 wrote to memory of 1596	3160		explorer.exe
PID 3160 wrote to memory of 4664	3160		explorer.exe
PID 3160 wrote to memory of 4664	3160		explorer.exe
PID 3160 wrote to memory of 4664	3160		explorer.exe
PID 3160 wrote to memory of 4664	3160		explorer.exe
PID 3160 wrote to memory of 4624	3160		explorer.exe
PID 3160 wrote to memory of 4624	3160		explorer.exe
PID 3160 wrote to memory of 4624	3160		explorer.exe
PID 3160 wrote to memory of 1716	3160		explorer.exe
PID 3160 wrote to memory of 1716	3160		explorer.exe
PID 3160 wrote to memory of 1716	3160		explorer.exe
PID 3160 wrote to memory of 1716	3160		explorer.exe
PID 3160 wrote to memory of 32	3160		explorer.exe
PID 3160 wrote to memory of 32	3160		explorer.exe
PID 3160 wrote to memory of 32	3160		explorer.exe
PID 3160 wrote to memory of 32	3160		explorer.exe
PID 3160 wrote to memory of 1724	3160		explorer.exe
PID 3160 wrote to memory of 1724	3160		explorer.exe
PID 3160 wrote to memory of 1724	3160		explorer.exe
PID 3160 wrote to memory of 1724	3160		explorer.exe
PID 3160 wrote to memory of 2424	3160		explorer.exe
PID 3160 wrote to memory of 2424	3160		explorer.exe
PID 3160 wrote to memory of 2424	3160		explorer.exe
PID 3160 wrote to memory of 4464	3160		explorer.exe
PID 3160 wrote to memory of 4464	3160		explorer.exe
PID 3160 wrote to memory of 4464	3160		explorer.exe
PID 3160 wrote to memory of 4464	3160		explorer.exe
PID 4952 wrote to memory of 1324	4952	AppLaunch.exe	System.exe
PID 4952 wrote to memory of 1324	4952	AppLaunch.exe	System.exe
PID 4952 wrote to memory of 1324	4952	AppLaunch.exe	System.exe
PID 4952 wrote to memory of 868	4952	AppLaunch.exe	Update.exe
PID 4952 wrote to memory of 868	4952	AppLaunch.exe	Update.exe
PID 868 wrote to memory of 4936	868	Update.exe	powershell.exe
PID 868 wrote to memory of 4936	868	Update.exe	powershell.exe
PID 1324 wrote to memory of 4332	1324	System.exe	cmd.exe
PID 1324 wrote to memory of 4332	1324	System.exe	cmd.exe
PID 1324 wrote to memory of 4332	1324	System.exe	cmd.exe
PID 4332 wrote to memory of 60	4332	cmd.exe	chcp.com
PID 4332 wrote to memory of 60	4332	cmd.exe	chcp.com
PID 4332 wrote to memory of 60	4332	cmd.exe	chcp.com
PID 4332 wrote to memory of 2692	4332	cmd.exe	powershell.exe
PID 4332 wrote to memory of 2692	4332	cmd.exe	powershell.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\a754e3d045adbd88b59a7b80ea127636f710c4183001cce2b7614611b7c141e4.exe
"C:\Users\Admin\AppData\Local\Temp\a754e3d045adbd88b59a7b80ea127636f710c4183001cce2b7614611b7c141e4.exe"
1⤵
- DcRat
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:1592

C:\Users\Admin\AppData\Local\Temp\158.exe
C:\Users\Admin\AppData\Local\Temp\158.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3716
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
  "C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\AppLaunch.exe"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:3216
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3716 -s 404
  2⤵
  - Program crash
  PID:1780

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 3716 -ip 3716
1⤵
PID:1576

C:\Users\Admin\AppData\Local\Temp\B94E.exe
C:\Users\Admin\AppData\Local\Temp\B94E.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3924
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
  "C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\AppLaunch.exe"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4952
- - C:\Users\Admin\AppData\Local\Temp\System.exe
    "C:\Users\Admin\AppData\Local\Temp\System.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:1324
  - - C:\Windows\SysWOW64\cmd.exe
      "cmd.exe" /C chcp 1251 & powershell -Command Add-MpPreference -ExclusionPath "$ENV:USERPROFILE\Desktop" & powershell -Command Add-MpPreference -ExclusionPath "C:\ProgramData\Dllhost" & powershell -Command Add-MpPreference -ExclusionPath "C:\ProgramData\SystemData"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:4332
    - - C:\Windows\SysWOW64\chcp.com
        
        chcp 1251
        5⤵
        
        PID:60
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command Add-MpPreference -ExclusionPath "$ENV:USERPROFILE\Desktop"
        5⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:2692
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command Add-MpPreference -ExclusionPath "C:\ProgramData\Dllhost"
        5⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:4516
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command Add-MpPreference -ExclusionPath "C:\ProgramData\SystemData"
        5⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:1712
  - - C:\ProgramData\Dllhost\dllhost.exe
      "C:\ProgramData\Dllhost\dllhost.exe"
      4⤵
      Executes dropped EXE
      Adds Run key to start application
      Suspicious use of AdjustPrivilegeToken
      PID:2228
    - - C:\Windows\SysWOW64\cmd.exe
        
        "cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "SecurityHealthSystray" /TR "C:\ProgramData\Dllhost\dllhost.exe"
        5⤵
        
        PID:1144
      - C:\Windows\SysWOW64\schtasks.exe
        
        SCHTASKS /CREATE /SC HOURLY /TN "SecurityHealthSystray" /TR "C:\ProgramData\Dllhost\dllhost.exe"
        6⤵
        DcRat
        Creates scheduled task(s)
        
        PID:3924
    - - C:\Windows\SysWOW64\cmd.exe
        
        "cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "WmiPrvSE" /TR "C:\ProgramData\Dllhost\dllhost.exe"
        5⤵
        
        PID:4860
      - C:\Windows\SysWOW64\schtasks.exe
        
        SCHTASKS /CREATE /SC HOURLY /TN "WmiPrvSE" /TR "C:\ProgramData\Dllhost\dllhost.exe"
        6⤵
        DcRat
        Creates scheduled task(s)
        
        PID:2980
    - - C:\Windows\SysWOW64\cmd.exe
        
        "cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "OneDriveService" /TR "C:\ProgramData\Dllhost\dllhost.exe"
        5⤵
        
        PID:1060
      - C:\Windows\SysWOW64\schtasks.exe
        
        SCHTASKS /CREATE /SC HOURLY /TN "OneDriveService" /TR "C:\ProgramData\Dllhost\dllhost.exe"
        6⤵
        DcRat
        Creates scheduled task(s)
        
        PID:4792
    - - C:\Windows\SysWOW64\cmd.exe
        
        "cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "WindowsDefenderServices\WindowsDefenderServicesService_bk2435" /TR "C:\ProgramData\Dllhost\dllhost.exe"
        5⤵
        
        PID:4944
      - C:\Windows\SysWOW64\schtasks.exe
        
        SCHTASKS /CREATE /SC HOURLY /TN "WindowsDefenderServices\WindowsDefenderServicesService_bk2435" /TR "C:\ProgramData\Dllhost\dllhost.exe"
        6⤵
        DcRat
        Creates scheduled task(s)
        
        PID:2744
    - - C:\Windows\SysWOW64\cmd.exe
        
        "cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "SettingSysHost\SettingSysHostService_bk1652" /TR "C:\ProgramData\Dllhost\dllhost.exe"
        5⤵
        
        PID:216
      - C:\Windows\SysWOW64\schtasks.exe
        
        SCHTASKS /CREATE /SC HOURLY /TN "SettingSysHost\SettingSysHostService_bk1652" /TR "C:\ProgramData\Dllhost\dllhost.exe"
        6⤵
        DcRat
        Creates scheduled task(s)
        
        PID:2536
    - - C:\Windows\SysWOW64\cmd.exe
        
        "cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "MicrosoftUpdateServices\MicrosoftUpdateServicesService_bk8032" /TR "C:\ProgramData\Dllhost\dllhost.exe"
        5⤵
        
        PID:1968
    - - C:\Windows\SysWOW64\cmd.exe
        
        "cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "AntiMalwareSericeExecutable\AntiMalwareSericeExecutableService_bk6784" /TR "C:\ProgramData\Dllhost\dllhost.exe"
        5⤵
        
        PID:3964
      - C:\Windows\SysWOW64\schtasks.exe
        
        SCHTASKS /CREATE /SC HOURLY /TN "AntiMalwareSericeExecutable\AntiMalwareSericeExecutableService_bk6784" /TR "C:\ProgramData\Dllhost\dllhost.exe"
        6⤵
        DcRat
        Creates scheduled task(s)
        
        PID:4184
    - - C:\Windows\SysWOW64\cmd.exe
        
        "cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "NvStray" /TR "C:\ProgramData\Dllhost\dllhost.exe"
        5⤵
        
        PID:2060
      - C:\Windows\SysWOW64\schtasks.exe
        
        SCHTASKS /CREATE /SC HOURLY /TN "NvStray" /TR "C:\ProgramData\Dllhost\dllhost.exe"
        6⤵
        DcRat
        Creates scheduled task(s)
        
        PID:2624
    - - C:\Windows\SysWOW64\cmd.exe
        
        "cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "MicrosoftEdgeUpd" /TR "C:\ProgramData\Dllhost\dllhost.exe"
        5⤵
        
        PID:4936
      - C:\Windows\SysWOW64\schtasks.exe
        
        SCHTASKS /CREATE /SC HOURLY /TN "MicrosoftEdgeUpd" /TR "C:\ProgramData\Dllhost\dllhost.exe"
        6⤵
        DcRat
        Creates scheduled task(s)
        
        PID:3004
    - - C:\Windows\SysWOW64\cmd.exe
        
        "cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "dllhost" /TR "C:\ProgramData\Dllhost\dllhost.exe"
        5⤵
        
        PID:2124
      - C:\Windows\SysWOW64\schtasks.exe
        
        SCHTASKS /CREATE /SC HOURLY /TN "dllhost" /TR "C:\ProgramData\Dllhost\dllhost.exe"
        6⤵
        DcRat
        Creates scheduled task(s)
        
        PID:4980
    - - C:\Windows\SysWOW64\cmd.exe
        
        "cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "AntiMalwareServiceExecutable" /TR "C:\ProgramData\Dllhost\dllhost.exe"
        5⤵
        
        PID:2280
      - C:\Windows\SysWOW64\schtasks.exe
        
        SCHTASKS /CREATE /SC HOURLY /TN "AntiMalwareServiceExecutable" /TR "C:\ProgramData\Dllhost\dllhost.exe"
        6⤵
        DcRat
        Creates scheduled task(s)
        
        PID:1664
    - - C:\Windows\SysWOW64\cmd.exe
        
        "cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "WindowsDefender" /TR "C:\ProgramData\Dllhost\dllhost.exe"
        5⤵
        
        PID:4700
      - C:\Windows\SysWOW64\schtasks.exe
        
        SCHTASKS /CREATE /SC HOURLY /TN "WindowsDefender" /TR "C:\ProgramData\Dllhost\dllhost.exe"
        6⤵
        DcRat
        Creates scheduled task(s)
        
        PID:4080
    - - C:\Windows\SysWOW64\cmd.exe
        
        "cmd.exe" /c chcp 1251 & C:\ProgramData\Dllhost\winlogson.exe -c config.json
        5⤵
        
        PID:4584
      - C:\Windows\SysWOW64\chcp.com
        
        chcp 1251
        6⤵
        
        PID:2560
- - C:\Users\Admin\AppData\Local\Temp\Update.exe
    "C:\Users\Admin\AppData\Local\Temp\Update.exe"
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Suspicious use of WriteProcessMemory
    PID:868
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell "" "SCHTASKS.exe /Create /SC MINUTE /ED 12/12/2030 /TN runtime_1 /TR C:\Users\Admin\AppData\Roaming\Microsoft\config\runtime.exe"
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:4936
    - - C:\Windows\system32\schtasks.exe
        
        "C:\Windows\system32\schtasks.exe" /Create /SC MINUTE /ED 12/12/2030 /TN runtime_1 /TR C:\Users\Admin\AppData\Roaming\Microsoft\config\runtime.exe
        5⤵
        DcRat
        Creates scheduled task(s)
        
        PID:1164
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell "" "SCHTASKS.exe /Create /SC MINUTE /ED 12/12/2030 /TN runtime_2 /TR C:\Users\Admin\AppData\Local\Microsoft\config\runtime.exe"
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:2848
    - - C:\Windows\system32\schtasks.exe
        
        "C:\Windows\system32\schtasks.exe" /Create /SC MINUTE /ED 12/12/2030 /TN runtime_2 /TR C:\Users\Admin\AppData\Local\Microsoft\config\runtime.exe
        5⤵
        DcRat
        Creates scheduled task(s)
        
        PID:4848
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell "" "SCHTASKS.exe /Create /SC MINUTE /ED 12/12/2030 /TN runtime_3 /TR C:\Users\Admin\AppData\Local\Temp\Microsoft\config\runtime.exe"
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:2536
    - - C:\Windows\system32\schtasks.exe
        
        "C:\Windows\system32\schtasks.exe" /Create /SC MINUTE /ED 12/12/2030 /TN runtime_3 /TR C:\Users\Admin\AppData\Local\Temp\Microsoft\config\runtime.exe
        5⤵
        DcRat
        Creates scheduled task(s)
        
        PID:1692
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3924 -s 140
  2⤵
  - Program crash
  PID:3488

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
1⤵
PID:4956

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 396 -p 3924 -ip 3924
1⤵
PID:2032

C:\Windows\explorer.exe
C:\Windows\explorer.exe
1⤵
PID:1596

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
1⤵
PID:4664

C:\Windows\explorer.exe
C:\Windows\explorer.exe
1⤵
PID:4624

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
1⤵
PID:1716

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
1⤵
PID:32

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
1⤵
PID:1724

C:\Windows\explorer.exe
C:\Windows\explorer.exe
1⤵
PID:2424

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
1⤵
PID:4464

C:\Users\Admin\AppData\Local\Microsoft\config\runtime.exe
C:\Users\Admin\AppData\Local\Microsoft\config\runtime.exe
1⤵
PID:2052

C:\Users\Admin\AppData\Roaming\Microsoft\config\runtime.exe
C:\Users\Admin\AppData\Roaming\Microsoft\config\runtime.exe
1⤵
PID:2756

C:\Users\Admin\AppData\Local\Temp\Microsoft\config\runtime.exe
C:\Users\Admin\AppData\Local\Temp\Microsoft\config\runtime.exe
1⤵
PID:2236

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Registry Run Keys / Startup Folder

T1060

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Modify Registry

T1112

Web Service

T1102

Credential Access

Credentials in Files

T1081

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Dllhost\dllhost.exe

Filesize
24KB

MD5
acf4152befc5768daaf11c92fd3899b0

SHA1
f8a210a2a00876f15008f275063988e5cf534722

SHA256
64c80419e5ca81a5bfee32e223b5676aac6d47c4aa8168ceae6247f766c291d6

SHA512
15bdde54be38e7ed0828f238bd2f0bcdc1a73671118225b731760fe4beb568a72570bad9b1a97a237291b394f1d3155aa6fcac209f6ae0a3db6608e0036c56d1

Download Submit
C:\ProgramData\Dllhost\dllhost.exe

Filesize
24KB

MD5
acf4152befc5768daaf11c92fd3899b0

SHA1
f8a210a2a00876f15008f275063988e5cf534722

SHA256
64c80419e5ca81a5bfee32e223b5676aac6d47c4aa8168ceae6247f766c291d6

SHA512
15bdde54be38e7ed0828f238bd2f0bcdc1a73671118225b731760fe4beb568a72570bad9b1a97a237291b394f1d3155aa6fcac209f6ae0a3db6608e0036c56d1

Download Submit
C:\ProgramData\SystemFiles\sys_rh.bin

Filesize
1KB

MD5
617911c853b655131d09bb349a158cfe

SHA1
ca2675ad13ff73275d6edb0ac000bbce1e3e3aa2

SHA256
fa0bfb9161888ac59126e63c27badf810b8fd5fd4d1fe41d5c37f5f549fe58e7

SHA512
b87df65fa6a2200f78ed49f79cd7df04a738f0d6535b70401e7e7c9c01fdf20e85890c2423a02483dcc56a57b91c8d4dbb7eea3bfcd62fad4606dd88b2cf6f74

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
d85ba6ff808d9e5444a4b369f5bc2730

SHA1
31aa9d96590fff6981b315e0b391b575e4c0804a

SHA256
84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

SHA512
8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\AppLaunch.exe.log

Filesize
2KB

MD5
51c4eaf7e24cb6fac3c0055d2a6b38d9

SHA1
719c51e2ca9c4a8e8b3f424f516d01205aa1928e

SHA256
3e87ea4d3e6dd879e5cd808b1745857774948e2cc457e24de850a5ca5f3d8a5b

SHA512
171119f9a703b65e26b89ae0f6e90324641b68dd7db2c1c64b3eba442fa1714d5ab992768e864107951cc1e495fd7815758dd1964397faeeb43b816240ee58d9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
968cb9309758126772781b83adb8a28f

SHA1
8da30e71accf186b2ba11da1797cf67f8f78b47c

SHA256
92099c10776bb7e3f2a8d1b82d4d40d0c4627e4f1bf754a6e58dfd2c2e97042a

SHA512
4bd50732f8af4d688d95999bddfd296115d7033ddc38f86c9fb1f47fde202bffa27e9088bebcaa3064ca946af2f5c1ca6cbde49d0907f0005c7ab42874515dd3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
64B

MD5
5caad758326454b5788ec35315c4c304

SHA1
3aef8dba8042662a7fcf97e51047dc636b4d4724

SHA256
83e613b6dc8d70e3bb67c58535e014f58f3e8b2921e93b55137d799fc8c56391

SHA512
4e0d443cf81e2f49829b0a458a08294bf1bdc0e38d3a938fb8274eeb637d9a688b14c7999dd6b86a31fcec839a9e8c1a9611ed0bbae8bd59caa9dba1e8253693

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
64B

MD5
446dd1cf97eaba21cf14d03aebc79f27

SHA1
36e4cc7367e0c7b40f4a8ace272941ea46373799

SHA256
a7de5177c68a64bd48b36d49e2853799f4ebcfa8e4761f7cc472f333dc5f65cf

SHA512
a6d754709f30b122112ae30e5ab22486393c5021d33da4d1304c061863d2e1e79e8aeb029cae61261bb77d0e7becd53a7b0106d6ea4368b4c302464e3d941cf7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
18KB

MD5
b5b728671695221d8eb016b11244e389

SHA1
dd2cff5ee17fdfc3653f0765eda8ee77f44c48c4

SHA256
bf5be271c806b9f720a3cebcefc09b7643e00b074b055d3bff84c6e9e63f84a6

SHA512
05b8b19fbc19a0cefedad4673e3efd343e645d2c0ab159b156421a17eea15d0c3446e4b740469ac0440805f633824ff8953bd74c6769c6f9a48ff28395a0e154

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
18KB

MD5
b5b728671695221d8eb016b11244e389

SHA1
dd2cff5ee17fdfc3653f0765eda8ee77f44c48c4

SHA256
bf5be271c806b9f720a3cebcefc09b7643e00b074b055d3bff84c6e9e63f84a6

SHA512
05b8b19fbc19a0cefedad4673e3efd343e645d2c0ab159b156421a17eea15d0c3446e4b740469ac0440805f633824ff8953bd74c6769c6f9a48ff28395a0e154

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
18KB

MD5
48cf1ab895a12e729b00f7512280878a

SHA1
03791c1ad4d1f8260c954df97df1b82add3eed2a

SHA256
e6493129ed506ddf1d7b22aadc7c2e082ce7dde916ce3df93adb7a7b522f0f5a

SHA512
9245a4118a9b3ec05861b853ed9765ce6e1a0db184293af20d6c7a36a38e436fab32e425e41b8f288735ad147a5394a5ae08f9f1cb97d0ef4a1091e020b3868e

Download Submit
C:\Users\Admin\AppData\Local\Temp\158.exe

Filesize
335KB

MD5
ff6265692f1173d7073113f23a9c33f6

SHA1
8259c87f7b855afb69bed0da1c2dd4de5fe2883c

SHA256
db531c7ac2e97117d6c5ed5770ae90edf18ac15eaf0219f18320e7a6a5d684f1

SHA512
81ccf0f2b5ee4bce014a4e3058ae276ad03fd89080970038dc4e1d9d1488eb870066f3fabd3560b8adaae32e38b6d2d277a4d436a887fd55df85891904500f2e

Download Submit
C:\Users\Admin\AppData\Local\Temp\158.exe

Filesize
335KB

MD5
ff6265692f1173d7073113f23a9c33f6

SHA1
8259c87f7b855afb69bed0da1c2dd4de5fe2883c

SHA256
db531c7ac2e97117d6c5ed5770ae90edf18ac15eaf0219f18320e7a6a5d684f1

SHA512
81ccf0f2b5ee4bce014a4e3058ae276ad03fd89080970038dc4e1d9d1488eb870066f3fabd3560b8adaae32e38b6d2d277a4d436a887fd55df85891904500f2e

Download Submit
C:\Users\Admin\AppData\Local\Temp\B94E.exe

Filesize
217KB

MD5
9067c10a831e723a9c4e75dc79459821

SHA1
7f657ed71aa681e623888868e7948860828f2558

SHA256
62322f950072e7a62431223394c315e38b9f3f8ae49cc302678d8afbdbbbdecb

SHA512
7aaf4e7aeaa1b3848c1d8a198a19046577e0fcc8115f427dca70c1c89ab1dd095fbc779c045c0ed1ca56eb701c9897cfd6de3a48d8e22505e374a178d9ef2bc8

Download Submit
C:\Users\Admin\AppData\Local\Temp\B94E.exe

Filesize
217KB

MD5
9067c10a831e723a9c4e75dc79459821

SHA1
7f657ed71aa681e623888868e7948860828f2558

SHA256
62322f950072e7a62431223394c315e38b9f3f8ae49cc302678d8afbdbbbdecb

SHA512
7aaf4e7aeaa1b3848c1d8a198a19046577e0fcc8115f427dca70c1c89ab1dd095fbc779c045c0ed1ca56eb701c9897cfd6de3a48d8e22505e374a178d9ef2bc8

Download Submit
C:\Users\Admin\AppData\Local\Temp\System.exe

Filesize
63KB

MD5
ab33e40afd34244182b338a1debf502d

SHA1
6757562f3ec6e66099b25b5644f03735d70119c2

SHA256
8299aebbf8e97fa008fe851a4ea69f84503c667fb5757e840b3fe3dc7fafb358

SHA512
ad0b552e1833ad16b0ee7f0cd86cb80bfe75df068132d2a6b06fabc7e98dce27fe0bfce2709bc308d6db612db886241844719a6c9b7661d69b3275d7b63a46d4

Download Submit
C:\Users\Admin\AppData\Local\Temp\System.exe

Filesize
63KB

MD5
ab33e40afd34244182b338a1debf502d

SHA1
6757562f3ec6e66099b25b5644f03735d70119c2

SHA256
8299aebbf8e97fa008fe851a4ea69f84503c667fb5757e840b3fe3dc7fafb358

SHA512
ad0b552e1833ad16b0ee7f0cd86cb80bfe75df068132d2a6b06fabc7e98dce27fe0bfce2709bc308d6db612db886241844719a6c9b7661d69b3275d7b63a46d4

Download Submit
C:\Users\Admin\AppData\Local\Temp\System.exe

Filesize
63KB

MD5
ab33e40afd34244182b338a1debf502d

SHA1
6757562f3ec6e66099b25b5644f03735d70119c2

SHA256
8299aebbf8e97fa008fe851a4ea69f84503c667fb5757e840b3fe3dc7fafb358

SHA512
ad0b552e1833ad16b0ee7f0cd86cb80bfe75df068132d2a6b06fabc7e98dce27fe0bfce2709bc308d6db612db886241844719a6c9b7661d69b3275d7b63a46d4

Download Submit
C:\Users\Admin\AppData\Local\Temp\Update.exe

Filesize
5.4MB

MD5
e0d2634fe2b085685f0b71e66ac91ec9

SHA1
c03d6b2218ffff1957a91f64d15ee1cbb57726fd

SHA256
24c485ecb00d9d6ed8c12fb7a3162169cb1b666ab9a90eb3c1bcdf8dd8c40df4

SHA512
48e72eccb385e282b419fe7116d6a0c7c0a6cd5ca482e57ae7b1b52440e347833d0aa9c15097bdeec8074b9a60d90843a5d4f20e4ce9d0595f3dc0a38b6fdde8

Download Submit
C:\Users\Admin\AppData\Local\Temp\Update.exe

Filesize
5.4MB

MD5
e0d2634fe2b085685f0b71e66ac91ec9

SHA1
c03d6b2218ffff1957a91f64d15ee1cbb57726fd

SHA256
24c485ecb00d9d6ed8c12fb7a3162169cb1b666ab9a90eb3c1bcdf8dd8c40df4

SHA512
48e72eccb385e282b419fe7116d6a0c7c0a6cd5ca482e57ae7b1b52440e347833d0aa9c15097bdeec8074b9a60d90843a5d4f20e4ce9d0595f3dc0a38b6fdde8

Download Submit
C:\Users\Admin\AppData\Local\Temp\Update.exe

Filesize
5.4MB

MD5
e0d2634fe2b085685f0b71e66ac91ec9

SHA1
c03d6b2218ffff1957a91f64d15ee1cbb57726fd

SHA256
24c485ecb00d9d6ed8c12fb7a3162169cb1b666ab9a90eb3c1bcdf8dd8c40df4

SHA512
48e72eccb385e282b419fe7116d6a0c7c0a6cd5ca482e57ae7b1b52440e347833d0aa9c15097bdeec8074b9a60d90843a5d4f20e4ce9d0595f3dc0a38b6fdde8

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_o2is1ahu.ams.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
memory/32-197-0x0000000000410000-0x0000000000437000-memory.dmp

Filesize
156KB

Download
memory/32-228-0x0000000000410000-0x0000000000437000-memory.dmp

Filesize
156KB

Download
memory/32-198-0x0000000000800000-0x0000000000809000-memory.dmp

Filesize
36KB

Download
memory/32-196-0x0000000000800000-0x0000000000809000-memory.dmp

Filesize
36KB

Download
memory/1324-226-0x0000000000070000-0x0000000000086000-memory.dmp

Filesize
88KB

Download
memory/1324-227-0x0000000004A60000-0x0000000004A6A000-memory.dmp

Filesize
40KB

Download
memory/1324-229-0x0000000004A10000-0x0000000004A20000-memory.dmp

Filesize
64KB

Download
memory/1592-136-0x0000000000400000-0x000000000055F000-memory.dmp

Filesize
1.4MB

Download
memory/1592-134-0x0000000002150000-0x0000000002159000-memory.dmp

Filesize
36KB

Download
memory/1596-185-0x0000000005530000-0x0000000005540000-memory.dmp

Filesize
64KB

Download
memory/1596-183-0x0000000001280000-0x000000000128F000-memory.dmp

Filesize
60KB

Download
memory/1596-210-0x0000000005530000-0x0000000005540000-memory.dmp

Filesize
64KB

Download
memory/1596-186-0x0000000001280000-0x000000000128F000-memory.dmp

Filesize
60KB

Download
memory/1716-195-0x0000000000410000-0x0000000000437000-memory.dmp

Filesize
156KB

Download
memory/1716-193-0x0000000000410000-0x0000000000437000-memory.dmp

Filesize
156KB

Download
memory/1716-194-0x0000000000C90000-0x0000000000C9C000-memory.dmp

Filesize
48KB

Download
memory/1724-233-0x0000000000800000-0x0000000000809000-memory.dmp

Filesize
36KB

Download
memory/1724-199-0x00000000003C0000-0x00000000003CB000-memory.dmp

Filesize
44KB

Download
memory/1724-200-0x0000000000800000-0x0000000000809000-memory.dmp

Filesize
36KB

Download
memory/1724-201-0x00000000003C0000-0x00000000003CB000-memory.dmp

Filesize
44KB

Download
memory/2424-203-0x00000000003C0000-0x00000000003CB000-memory.dmp

Filesize
44KB

Download
memory/2424-204-0x0000000000D30000-0x0000000000D3D000-memory.dmp

Filesize
52KB

Download
memory/2424-239-0x00000000003C0000-0x00000000003CB000-memory.dmp

Filesize
44KB

Download
memory/2424-202-0x0000000000D30000-0x0000000000D3D000-memory.dmp

Filesize
52KB

Download
memory/2692-311-0x0000000007B00000-0x000000000817A000-memory.dmp

Filesize
6.5MB

Download
memory/2692-255-0x00000000052D0000-0x00000000058F8000-memory.dmp

Filesize
6.2MB

Download
memory/2692-314-0x000000007FCD0000-0x000000007FCE0000-memory.dmp

Filesize
64KB

Download
memory/2692-313-0x0000000007500000-0x000000000750A000-memory.dmp

Filesize
40KB

Download
memory/2692-312-0x00000000074A0000-0x00000000074BA000-memory.dmp

Filesize
104KB

Download
memory/2692-283-0x0000000006160000-0x000000000617E000-memory.dmp

Filesize
120KB

Download
memory/2692-310-0x0000000006710000-0x000000000672E000-memory.dmp

Filesize
120KB

Download
memory/2692-315-0x0000000007730000-0x00000000077C6000-memory.dmp

Filesize
600KB

Download
memory/2692-300-0x0000000073BF0000-0x0000000073C3C000-memory.dmp

Filesize
304KB

Download
memory/2692-299-0x0000000006730000-0x0000000006762000-memory.dmp

Filesize
200KB

Download
memory/2692-281-0x0000000002B50000-0x0000000002B60000-memory.dmp

Filesize
64KB

Download
memory/2692-260-0x0000000005A10000-0x0000000005A76000-memory.dmp

Filesize
408KB

Download
memory/2692-258-0x0000000005970000-0x0000000005992000-memory.dmp

Filesize
136KB

Download
memory/2692-320-0x00000000076C0000-0x00000000076CE000-memory.dmp

Filesize
56KB

Download
memory/2692-322-0x0000000007710000-0x000000000772A000-memory.dmp

Filesize
104KB

Download
memory/2692-252-0x0000000002B60000-0x0000000002B96000-memory.dmp

Filesize
216KB

Download
memory/2692-298-0x0000000002B50000-0x0000000002B60000-memory.dmp

Filesize
64KB

Download
memory/2848-276-0x000001DACE4E0000-0x000001DACE4F0000-memory.dmp

Filesize
64KB

Download
memory/2848-280-0x000001DACE4E0000-0x000001DACE4F0000-memory.dmp

Filesize
64KB

Download
memory/3160-135-0x0000000000E50000-0x0000000000E66000-memory.dmp

Filesize
88KB

Download
memory/3216-165-0x00000000067A0000-0x0000000006962000-memory.dmp

Filesize
1.8MB

Download
memory/3216-158-0x0000000005480000-0x00000000054BC000-memory.dmp

Filesize
240KB

Download
memory/3216-163-0x00000000064B0000-0x0000000006526000-memory.dmp

Filesize
472KB

Download
memory/3216-150-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/3216-162-0x00000000069E0000-0x0000000006F84000-memory.dmp

Filesize
5.6MB

Download
memory/3216-161-0x0000000006390000-0x0000000006422000-memory.dmp

Filesize
584KB

Download
memory/3216-166-0x00000000074C0000-0x00000000079EC000-memory.dmp

Filesize
5.2MB

Download
memory/3216-164-0x0000000006430000-0x000000000644E000-memory.dmp

Filesize
120KB

Download
memory/3216-159-0x00000000057F0000-0x0000000005800000-memory.dmp

Filesize
64KB

Download
memory/3216-155-0x00000000059D0000-0x0000000005FE8000-memory.dmp

Filesize
6.1MB

Download
memory/3216-156-0x0000000005420000-0x0000000005432000-memory.dmp

Filesize
72KB

Download
memory/3216-160-0x0000000005800000-0x0000000005866000-memory.dmp

Filesize
408KB

Download
memory/3216-157-0x0000000005550000-0x000000000565A000-memory.dmp

Filesize
1.0MB

Download
memory/3216-167-0x0000000007090000-0x00000000070E0000-memory.dmp

Filesize
320KB

Download
memory/4464-205-0x0000000000850000-0x000000000085B000-memory.dmp

Filesize
44KB

Download
memory/4464-206-0x0000000000D30000-0x0000000000D3D000-memory.dmp

Filesize
52KB

Download
memory/4464-207-0x0000000000850000-0x000000000085B000-memory.dmp

Filesize
44KB

Download
memory/4624-212-0x00000000012C0000-0x00000000012C9000-memory.dmp

Filesize
36KB

Download
memory/4624-190-0x0000000000C90000-0x0000000000C9C000-memory.dmp

Filesize
48KB

Download
memory/4624-191-0x00000000012C0000-0x00000000012C9000-memory.dmp

Filesize
36KB

Download
memory/4624-192-0x0000000000C90000-0x0000000000C9C000-memory.dmp

Filesize
48KB

Download
memory/4664-187-0x00000000012C0000-0x00000000012C9000-memory.dmp

Filesize
36KB

Download
memory/4664-211-0x0000000001280000-0x000000000128F000-memory.dmp

Filesize
60KB

Download
memory/4664-189-0x00000000012C0000-0x00000000012C9000-memory.dmp

Filesize
36KB

Download
memory/4664-188-0x0000000001280000-0x000000000128F000-memory.dmp

Filesize
60KB

Download
memory/4936-242-0x0000015349640000-0x0000015349662000-memory.dmp

Filesize
136KB

Download
memory/4952-209-0x0000000005530000-0x0000000005540000-memory.dmp

Filesize
64KB

Download
memory/4952-184-0x0000000005530000-0x0000000005540000-memory.dmp

Filesize
64KB

Download
memory/4952-175-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/4956-208-0x00000000057F0000-0x0000000005800000-memory.dmp

Filesize
64KB

Download
memory/4956-182-0x0000000001250000-0x000000000125B000-memory.dmp

Filesize
44KB

Download
memory/4956-181-0x00000000057F0000-0x0000000005800000-memory.dmp

Filesize
64KB

Download
memory/4956-174-0x0000000001250000-0x000000000125B000-memory.dmp

Filesize
44KB

Download