dcrat | 6ab12f059377cbc6d2d3ea4114162da25e04b0c00857fa0cb03b51fdcb6b8031

Analysis

max time kernel
133s
max time network
153s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
02/09/2023, 12:18

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

JC_c4e53624a2e54d34ea5ba4d8e9ecd2d9.exe
Size

1.1MB
MD5

c4e53624a2e54d34ea5ba4d8e9ecd2d9
SHA1

f1d25a67242f3190cd6f06b221b9256745fac934
SHA256

6ab12f059377cbc6d2d3ea4114162da25e04b0c00857fa0cb03b51fdcb6b8031
SHA512

917c56b6f74d41788fe5e532152ae01e8b00e137561e779da8fdab45fe031460cbbf9be4defc336439225c73c25d8561ae406e38b0e256fa8c0aa47717156320
SSDEEP

24576:T2G/nvxW3WjfHyncFJbd5r03lNiB0Zj/OKHzyMNeV7:TbA3GIcLbd5r+lJ6Gl0

Score

10^/10

dcrat warzonerat evasion infostealer persistence rat upx

Malware Config

Extracted

Family

warzonerat

89.23.101.93:5200

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat

Process spawned unexpected child process 9 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2504	2532	schtasks.exe	32
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2556	2532	schtasks.exe	32
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2420	2532	schtasks.exe	32
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2316	2532	schtasks.exe	32
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1676	2532	schtasks.exe	32
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2000	2532	schtasks.exe	32
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2700	2532	schtasks.exe	32
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2812	2532	schtasks.exe	32
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2704	2532	schtasks.exe	32

WarzoneRat, AveMaria
WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.
rat infostealer warzonerat

DCRat payload 9 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral1/files/0x002b000000016bfd-9.dat	dcrat
behavioral1/files/0x002b000000016bfd-12.dat	dcrat
behavioral1/files/0x002b000000016bfd-11.dat	dcrat
behavioral1/files/0x002b000000016bfd-10.dat	dcrat
behavioral1/memory/2640-13-0x00000000011C0000-0x00000000012A4000-memory.dmp	dcrat
behavioral1/files/0x0009000000016d10-21.dat	dcrat
behavioral1/memory/2364-45-0x00000000001C0000-0x00000000002A4000-memory.dmp	dcrat
behavioral1/files/0x0009000000016ce3-44.dat	dcrat
behavioral1/files/0x0009000000016ce3-43.dat	dcrat

Warzone RAT payload 9 IoCs

rat

resource	yara_rule
behavioral1/files/0x0004000000004ed7-129.dat	warzonerat
behavioral1/files/0x0004000000004ed7-127.dat	warzonerat
behavioral1/files/0x0004000000004ed7-130.dat	warzonerat
behavioral1/memory/1508-135-0x0000000002500000-0x0000000002540000-memory.dmp	warzonerat
behavioral1/memory/1508-136-0x0000000002500000-0x0000000002540000-memory.dmp	warzonerat
behavioral1/files/0x0006000000018679-149.dat	warzonerat
behavioral1/files/0x0006000000018679-145.dat	warzonerat
behavioral1/files/0x0006000000018679-143.dat	warzonerat
behavioral1/files/0x0006000000018679-150.dat	warzonerat

Downloads MZ/PE file

Modifies Windows Firewall 1 TTPs 1 IoCs

evasion

Windows Service

T1543.003

pid	Process
2112	netsh.exe

Sets DLL path for service in the registry 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\TermService\Parameters\ServiceDll = "%ProgramFiles%\\Microsoft DN1\\sqlmap.dll"	images.exe

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\programs.bat	images.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\programs.bat:start	images.exe

Executes dropped EXE 5 IoCs

pid	Process
2640	Bridgesession.exe
2364	lsass.exe
2696	images.exe
2352	images.exe
1532	448.exe

Loads dropped DLL 6 IoCs

pid	Process
2792	cmd.exe
2792	cmd.exe
2696	images.exe
2696	images.exe
2352	images.exe
3068	Process not Found

UPX packed file 5 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x000a000000018675-170.dat	upx
behavioral1/files/0x000a000000018675-173.dat	upx
behavioral1/files/0x000a000000018675-174.dat	upx
behavioral1/memory/1532-180-0x0000000000E10000-0x0000000000E3D000-memory.dmp	upx
behavioral1/memory/1532-181-0x0000000000E10000-0x0000000000E3D000-memory.dmp	upx

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Images = "C:\\Users\\Admin\\Documents\\images.exe"	images.exe

Modifies WinLogon 2 TTPs 4 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList	images.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts	images.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList\CIat.zd = "0"	images.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\AllowMultipleTSSessions = "1"	images.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\System32\rfxvmt.dll	images.exe

Drops file in Program Files directory 7 IoCs

description	ioc	Process
File created	C:\Program Files\Uninstall Information\6203df4a6bafc7	Bridgesession.exe
File created	C:\Program Files\Microsoft DN1\sqlmap.dll	images.exe
File created	C:\Program Files\Microsoft DN1\rdpwrap.ini	images.exe
File created	C:\Program Files (x86)\Windows NT\lsass.exe	Bridgesession.exe
File opened for modification	C:\Program Files (x86)\Windows NT\lsass.exe	Bridgesession.exe
File created	C:\Program Files (x86)\Windows NT\6203df4a6bafc7	Bridgesession.exe
File created	C:\Program Files\Uninstall Information\lsass.exe	Bridgesession.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File created	C:\Windows\images.exe	lsass.exe
File opened for modification	C:\Windows\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	powershell.exe
File opened for modification	C:\Windows\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	powershell.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 9 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
2420	schtasks.exe
2316	schtasks.exe
1676	schtasks.exe
2000	schtasks.exe
2700	schtasks.exe
2812	schtasks.exe
2504	schtasks.exe
2556	schtasks.exe
2704	schtasks.exe

NTFS ADS 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\Documents\Documents:ApplicationData	images.exe

Suspicious behavior: EnumeratesProcesses 27 IoCs

pid	Process
2640	Bridgesession.exe
2640	Bridgesession.exe
2640	Bridgesession.exe
1976	powershell.exe
1192	powershell.exe
2396	powershell.exe
1612	powershell.exe
2240	powershell.exe
2996	powershell.exe
1280	powershell.exe
1732	powershell.exe
1992	powershell.exe
1664	powershell.exe
2364	lsass.exe
2156	powershell.exe
1172	powershell.exe
2148	powershell.exe
2364	lsass.exe
2364	lsass.exe
2364	lsass.exe
2364	lsass.exe
2364	lsass.exe
2364	lsass.exe
2364	lsass.exe
2364	lsass.exe
1508	powershell.exe
2432	powershell.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2364	lsass.exe

Suspicious behavior: LoadsDriver 3 IoCs

pid	Process
3068	Process not Found
3068	Process not Found
3068	Process not Found

Suspicious use of AdjustPrivilegeToken 18 IoCs

description	pid	Process
Token: SeDebugPrivilege	2640	Bridgesession.exe
Token: SeDebugPrivilege	1976	powershell.exe
Token: SeDebugPrivilege	1192	powershell.exe
Token: SeDebugPrivilege	2396	powershell.exe
Token: SeDebugPrivilege	1612	powershell.exe
Token: SeDebugPrivilege	2240	powershell.exe
Token: SeDebugPrivilege	2996	powershell.exe
Token: SeDebugPrivilege	1280	powershell.exe
Token: SeDebugPrivilege	1732	powershell.exe
Token: SeDebugPrivilege	1992	powershell.exe
Token: SeDebugPrivilege	1664	powershell.exe
Token: SeDebugPrivilege	2364	lsass.exe
Token: SeDebugPrivilege	2156	powershell.exe
Token: SeDebugPrivilege	1172	powershell.exe
Token: SeDebugPrivilege	2148	powershell.exe
Token: SeDebugPrivilege	1508	powershell.exe
Token: SeDebugPrivilege	2432	powershell.exe
Token: SeDebugPrivilege	2352	images.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1724 wrote to memory of 1800	1724	JC_c4e53624a2e54d34ea5ba4d8e9ecd2d9.exe	28
PID 1724 wrote to memory of 1800	1724	JC_c4e53624a2e54d34ea5ba4d8e9ecd2d9.exe	28
PID 1724 wrote to memory of 1800	1724	JC_c4e53624a2e54d34ea5ba4d8e9ecd2d9.exe	28
PID 1724 wrote to memory of 1800	1724	JC_c4e53624a2e54d34ea5ba4d8e9ecd2d9.exe	28
PID 1800 wrote to memory of 2792	1800	WScript.exe	29
PID 1800 wrote to memory of 2792	1800	WScript.exe	29
PID 1800 wrote to memory of 2792	1800	WScript.exe	29
PID 1800 wrote to memory of 2792	1800	WScript.exe	29
PID 2792 wrote to memory of 2640	2792	cmd.exe	31
PID 2792 wrote to memory of 2640	2792	cmd.exe	31
PID 2792 wrote to memory of 2640	2792	cmd.exe	31
PID 2792 wrote to memory of 2640	2792	cmd.exe	31
PID 2640 wrote to memory of 2996	2640	Bridgesession.exe	42
PID 2640 wrote to memory of 2996	2640	Bridgesession.exe	42
PID 2640 wrote to memory of 2996	2640	Bridgesession.exe	42
PID 2640 wrote to memory of 2396	2640	Bridgesession.exe	43
PID 2640 wrote to memory of 2396	2640	Bridgesession.exe	43
PID 2640 wrote to memory of 2396	2640	Bridgesession.exe	43
PID 2640 wrote to memory of 1172	2640	Bridgesession.exe	44
PID 2640 wrote to memory of 1172	2640	Bridgesession.exe	44
PID 2640 wrote to memory of 1172	2640	Bridgesession.exe	44
PID 2640 wrote to memory of 1192	2640	Bridgesession.exe	45
PID 2640 wrote to memory of 1192	2640	Bridgesession.exe	45
PID 2640 wrote to memory of 1192	2640	Bridgesession.exe	45
PID 2640 wrote to memory of 2156	2640	Bridgesession.exe	46
PID 2640 wrote to memory of 2156	2640	Bridgesession.exe	46
PID 2640 wrote to memory of 2156	2640	Bridgesession.exe	46
PID 2640 wrote to memory of 1976	2640	Bridgesession.exe	51
PID 2640 wrote to memory of 1976	2640	Bridgesession.exe	51
PID 2640 wrote to memory of 1976	2640	Bridgesession.exe	51
PID 2640 wrote to memory of 2148	2640	Bridgesession.exe	49
PID 2640 wrote to memory of 2148	2640	Bridgesession.exe	49
PID 2640 wrote to memory of 2148	2640	Bridgesession.exe	49
PID 2640 wrote to memory of 1992	2640	Bridgesession.exe	48
PID 2640 wrote to memory of 1992	2640	Bridgesession.exe	48
PID 2640 wrote to memory of 1992	2640	Bridgesession.exe	48
PID 2640 wrote to memory of 2240	2640	Bridgesession.exe	50
PID 2640 wrote to memory of 2240	2640	Bridgesession.exe	50
PID 2640 wrote to memory of 2240	2640	Bridgesession.exe	50
PID 2640 wrote to memory of 1280	2640	Bridgesession.exe	52
PID 2640 wrote to memory of 1280	2640	Bridgesession.exe	52
PID 2640 wrote to memory of 1280	2640	Bridgesession.exe	52
PID 2640 wrote to memory of 1612	2640	Bridgesession.exe	53
PID 2640 wrote to memory of 1612	2640	Bridgesession.exe	53
PID 2640 wrote to memory of 1612	2640	Bridgesession.exe	53
PID 2640 wrote to memory of 1732	2640	Bridgesession.exe	56
PID 2640 wrote to memory of 1732	2640	Bridgesession.exe	56
PID 2640 wrote to memory of 1732	2640	Bridgesession.exe	56
PID 2640 wrote to memory of 1664	2640	Bridgesession.exe	54
PID 2640 wrote to memory of 1664	2640	Bridgesession.exe	54
PID 2640 wrote to memory of 1664	2640	Bridgesession.exe	54
PID 2640 wrote to memory of 2364	2640	Bridgesession.exe	68
PID 2640 wrote to memory of 2364	2640	Bridgesession.exe	68
PID 2640 wrote to memory of 2364	2640	Bridgesession.exe	68
PID 2364 wrote to memory of 2696	2364	lsass.exe	71
PID 2364 wrote to memory of 2696	2364	lsass.exe	71
PID 2364 wrote to memory of 2696	2364	lsass.exe	71
PID 2364 wrote to memory of 2696	2364	lsass.exe	71
PID 2696 wrote to memory of 1508	2696	images.exe	72
PID 2696 wrote to memory of 1508	2696	images.exe	72
PID 2696 wrote to memory of 1508	2696	images.exe	72
PID 2696 wrote to memory of 1508	2696	images.exe	72
PID 2696 wrote to memory of 2352	2696	images.exe	74
PID 2696 wrote to memory of 2352	2696	images.exe	74

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\JC_c4e53624a2e54d34ea5ba4d8e9ecd2d9.exe
"C:\Users\Admin\AppData\Local\Temp\JC_c4e53624a2e54d34ea5ba4d8e9ecd2d9.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1724
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\HyperServerdll\41SiPxQwHDIEJ8nMwDP.vbe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1800
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c ""C:\HyperServerdll\YM6LZJUjrXrePPJitR4HQghNCxMq.bat" "
    3⤵
    - Loads dropped DLL
    - Suspicious use of WriteProcessMemory
    PID:2792
  - - C:\HyperServerdll\Bridgesession.exe
      "C:\HyperServerdll\Bridgesession.exe"
      4⤵
      Executes dropped EXE
      Drops file in Program Files directory
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:2640
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:/'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2996
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:/$Recycle.Bin/'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2396
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Documents and Settings/'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1172
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:/HyperServerdll/'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1192
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:/MSOCache/'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2156
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files (x86)/'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1992
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files/'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2148
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:/ProgramData/'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2240
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:/PerfLogs/'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1976
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Recovery/'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1280
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:/System Volume Information/'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1612
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Windows/'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1664
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Users/'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1732
    - - C:\Program Files\Uninstall Information\lsass.exe
        
        "C:\Program Files\Uninstall Information\lsass.exe"
        5⤵
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious behavior: EnumeratesProcesses
        Suspicious behavior: GetForegroundWindowSpam
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2364
      - C:\Windows\images.exe
        
        "C:\Windows\images.exe" chrome.exe
        6⤵
        Drops startup file
        Executes dropped EXE
        Loads dropped DLL
        Adds Run key to start application
        NTFS ADS
        Suspicious use of WriteProcessMemory
        
        PID:2696
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell Add-MpPreference -ExclusionPath C:\
        7⤵
        Drops file in Windows directory
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1508
        
        C:\Users\Admin\Documents\images.exe
        
        "C:\Users\Admin\Documents\images.exe"
        7⤵
        Sets DLL path for service in the registry
        Executes dropped EXE
        Loads dropped DLL
        Modifies WinLogon
        Drops file in System32 directory
        Drops file in Program Files directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:2352
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell Add-MpPreference -ExclusionPath C:\
        8⤵
        Drops file in Windows directory
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2432
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe"
        8⤵
        
        PID:2764
        
        C:\Users\Admin\AppData\Local\Temp\448.exe
        
        "C:\Users\Admin\AppData\Local\Temp\448.exe"
        8⤵
        Executes dropped EXE
        
        PID:1532
        
        C:\Windows\SysWOW64\netsh.exe
        
        netsh advfirewall firewall add rule name="3389" dir=in action=allow protocol=TCP localport=3389
        9⤵
        Modifies Windows Firewall
        
        PID:2112

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 14 /tr "'C:\Program Files (x86)\Windows NT\lsass.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2504

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsass" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows NT\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2556

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 14 /tr "'C:\Program Files (x86)\Windows NT\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2420

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 6 /tr "'C:\Program Files\Uninstall Information\lsass.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2316

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsass" /sc ONLOGON /tr "'C:\Program Files\Uninstall Information\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1676

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 14 /tr "'C:\Program Files\Uninstall Information\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2000

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "audiodga" /sc MINUTE /mo 9 /tr "'C:\Recovery\96f6acc2-489a-11ee-b3cc-62b3d3f2749b\audiodg.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2700

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "audiodg" /sc ONLOGON /tr "'C:\Recovery\96f6acc2-489a-11ee-b3cc-62b3d3f2749b\audiodg.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2812

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "audiodga" /sc MINUTE /mo 6 /tr "'C:\Recovery\96f6acc2-489a-11ee-b3cc-62b3d3f2749b\audiodg.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2704

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\HyperServerdll\41SiPxQwHDIEJ8nMwDP.vbe

Filesize
219B

MD5
4ea99bc54af313741b84d15cbd22d4f6

SHA1
3025a0afd6ea5b31792a258c5a97f4a423774d44

SHA256
c191b320f2d52190e0b3989bd97bda20718dfd740cbb4ef98e2fb0ebf7c14c0d

SHA512
1e6ae7ce7be4c06c5f92da4efbc5613d03608ef7c3788ced10f57ca60a195906253cfddd866c652d7ea8ccc31695246d5be2e8fda09ba739f2cadb49c338af8a

Download Submit
C:\HyperServerdll\Bridgesession.exe

Filesize
881KB

MD5
969ed2c9a371e36fdff27a2b24489006

SHA1
689efd222d5e0c77a562e88b0a19d4e85917fd99

SHA256
459f82dbd4763d24b38ecd2f8ca72de1518cdaf7ad8bbb186841770e0a176ac9

SHA512
a77fc4a9ace9bb0d165e3a14cbb8ff1b89c03d54a37f3021584502d013439cf43430900df58a08475a405df52238b492a67094d8e7424c38573d61ac898be471

Download Submit
C:\HyperServerdll\Bridgesession.exe

Filesize
881KB

MD5
969ed2c9a371e36fdff27a2b24489006

SHA1
689efd222d5e0c77a562e88b0a19d4e85917fd99

SHA256
459f82dbd4763d24b38ecd2f8ca72de1518cdaf7ad8bbb186841770e0a176ac9

SHA512
a77fc4a9ace9bb0d165e3a14cbb8ff1b89c03d54a37f3021584502d013439cf43430900df58a08475a405df52238b492a67094d8e7424c38573d61ac898be471

Download Submit
C:\HyperServerdll\YM6LZJUjrXrePPJitR4HQghNCxMq.bat

Filesize
37B

MD5
081b5134b6f1fa3f7d869873c1a9c999

SHA1
f586476e92c0620cd65da1a7b2640f288ea8b2b8

SHA256
80cb5a9319f2905dd9e4ddfe80537d83778257db49ec05e1d7d2c4fbde352f87

SHA512
c7b0af31cfb13fff070fc0adf67402577a174a6853c29d40392fcf5c622bb34a2302fbd750ed6508385e397bbb820fb9ef569cb260e5a24c87cbfc90280669c9

Download Submit
C:\Program Files\Uninstall Information\lsass.exe

Filesize
881KB

MD5
969ed2c9a371e36fdff27a2b24489006

SHA1
689efd222d5e0c77a562e88b0a19d4e85917fd99

SHA256
459f82dbd4763d24b38ecd2f8ca72de1518cdaf7ad8bbb186841770e0a176ac9

SHA512
a77fc4a9ace9bb0d165e3a14cbb8ff1b89c03d54a37f3021584502d013439cf43430900df58a08475a405df52238b492a67094d8e7424c38573d61ac898be471

Download Submit
C:\Program Files\Uninstall Information\lsass.exe

Filesize
881KB

MD5
969ed2c9a371e36fdff27a2b24489006

SHA1
689efd222d5e0c77a562e88b0a19d4e85917fd99

SHA256
459f82dbd4763d24b38ecd2f8ca72de1518cdaf7ad8bbb186841770e0a176ac9

SHA512
a77fc4a9ace9bb0d165e3a14cbb8ff1b89c03d54a37f3021584502d013439cf43430900df58a08475a405df52238b492a67094d8e7424c38573d61ac898be471

Download Submit
C:\Recovery\96f6acc2-489a-11ee-b3cc-62b3d3f2749b\audiodg.exe

Filesize
881KB

MD5
969ed2c9a371e36fdff27a2b24489006

SHA1
689efd222d5e0c77a562e88b0a19d4e85917fd99

SHA256
459f82dbd4763d24b38ecd2f8ca72de1518cdaf7ad8bbb186841770e0a176ac9

SHA512
a77fc4a9ace9bb0d165e3a14cbb8ff1b89c03d54a37f3021584502d013439cf43430900df58a08475a405df52238b492a67094d8e7424c38573d61ac898be471

Download Submit
C:\Users\Admin\AppData\Local\Temp\448.exe

Filesize
70KB

MD5
ca96229390a0e6a53e8f2125f2c01114

SHA1
a54b1081cf58724f8cb292b4d165dfee2fb1c9f6

SHA256
0df3d05900e7b530f6c2a281d43c47839f2cf2a5d386553c8dc46e463a635a2c

SHA512
e93445bce6c8b6f51890309577a0ea9369860d2e6bf8cc0ca708879a77bb176d27c5f559bbdb7deb4b719aee0fc48d9068c293559f7629baf4ec3515898102ef

Download Submit
C:\Users\Admin\AppData\Local\Temp\448.exe

Filesize
70KB

MD5
ca96229390a0e6a53e8f2125f2c01114

SHA1
a54b1081cf58724f8cb292b4d165dfee2fb1c9f6

SHA256
0df3d05900e7b530f6c2a281d43c47839f2cf2a5d386553c8dc46e463a635a2c

SHA512
e93445bce6c8b6f51890309577a0ea9369860d2e6bf8cc0ca708879a77bb176d27c5f559bbdb7deb4b719aee0fc48d9068c293559f7629baf4ec3515898102ef

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
7KB

MD5
be7ca3af426b9c407c1e5fbcfd8bf1c8

SHA1
de4310f19500f83e37f4cf64b1300f25a230bea9

SHA256
97cdcf733c9c32d32e8f8fd18125d94fafbe79a47ef5777d9446dc8a7c331e19

SHA512
36d872fc8a41e4e2c12af9f421ff947588b9d23d9f7e15001d02d4a7c501595ff5c22fbd475d4065a5ea7431305e344ba959153a5b83ca03252313c9e0795995

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
7KB

MD5
be7ca3af426b9c407c1e5fbcfd8bf1c8

SHA1
de4310f19500f83e37f4cf64b1300f25a230bea9

SHA256
97cdcf733c9c32d32e8f8fd18125d94fafbe79a47ef5777d9446dc8a7c331e19

SHA512
36d872fc8a41e4e2c12af9f421ff947588b9d23d9f7e15001d02d4a7c501595ff5c22fbd475d4065a5ea7431305e344ba959153a5b83ca03252313c9e0795995

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
7KB

MD5
be7ca3af426b9c407c1e5fbcfd8bf1c8

SHA1
de4310f19500f83e37f4cf64b1300f25a230bea9

SHA256
97cdcf733c9c32d32e8f8fd18125d94fafbe79a47ef5777d9446dc8a7c331e19

SHA512
36d872fc8a41e4e2c12af9f421ff947588b9d23d9f7e15001d02d4a7c501595ff5c22fbd475d4065a5ea7431305e344ba959153a5b83ca03252313c9e0795995

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
7KB

MD5
be7ca3af426b9c407c1e5fbcfd8bf1c8

SHA1
de4310f19500f83e37f4cf64b1300f25a230bea9

SHA256
97cdcf733c9c32d32e8f8fd18125d94fafbe79a47ef5777d9446dc8a7c331e19

SHA512
36d872fc8a41e4e2c12af9f421ff947588b9d23d9f7e15001d02d4a7c501595ff5c22fbd475d4065a5ea7431305e344ba959153a5b83ca03252313c9e0795995

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
7KB

MD5
be7ca3af426b9c407c1e5fbcfd8bf1c8

SHA1
de4310f19500f83e37f4cf64b1300f25a230bea9

SHA256
97cdcf733c9c32d32e8f8fd18125d94fafbe79a47ef5777d9446dc8a7c331e19

SHA512
36d872fc8a41e4e2c12af9f421ff947588b9d23d9f7e15001d02d4a7c501595ff5c22fbd475d4065a5ea7431305e344ba959153a5b83ca03252313c9e0795995

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ZTNTBZZA8DGJ6PRL5TLU.temp

Filesize
7KB

MD5
be7ca3af426b9c407c1e5fbcfd8bf1c8

SHA1
de4310f19500f83e37f4cf64b1300f25a230bea9

SHA256
97cdcf733c9c32d32e8f8fd18125d94fafbe79a47ef5777d9446dc8a7c331e19

SHA512
36d872fc8a41e4e2c12af9f421ff947588b9d23d9f7e15001d02d4a7c501595ff5c22fbd475d4065a5ea7431305e344ba959153a5b83ca03252313c9e0795995

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms

Filesize
7KB

MD5
fd9cc7a708b22cfca8131a19aba28a19

SHA1
8a09da6db51bdf39d3c98278417458e96ddb5e2a

SHA256
6bcf29a4aaba50cec3aa35c6b79be23dd0ce5087c1f5c79947b69a7f64d58dfa

SHA512
ef466f960af8a94712b794c2ff7e425c02ccfdcf006f97ff6fa401889be2e2383710d3d1f5c7726bc80224db41f32838c8974caa5ba496e3f00941d67368851e

Download Submit
C:\Users\Admin\Documents\images.exe

Filesize
141KB

MD5
7bd00d190acedcc64aeefd1ddf94cb1d

SHA1
4d02ec8882c24eb5e51c07ce12abcaa4bd610c27

SHA256
3a549857526733dea4da5c4916d7c0015d8172ad8d845acc160d6b12be418b9a

SHA512
4ea818d410bfd7898b1f2ea384882b0e35a8cc72cc3b65ce88016b7e076798229a8c55284622921408279112c17ca30b1a92c8a0fbf2e6332dcec2252de967c9

Download Submit
C:\Users\Admin\Documents\images.exe

Filesize
141KB

MD5
7bd00d190acedcc64aeefd1ddf94cb1d

SHA1
4d02ec8882c24eb5e51c07ce12abcaa4bd610c27

SHA256
3a549857526733dea4da5c4916d7c0015d8172ad8d845acc160d6b12be418b9a

SHA512
4ea818d410bfd7898b1f2ea384882b0e35a8cc72cc3b65ce88016b7e076798229a8c55284622921408279112c17ca30b1a92c8a0fbf2e6332dcec2252de967c9

Download Submit
C:\Windows\images.exe

Filesize
141KB

MD5
7bd00d190acedcc64aeefd1ddf94cb1d

SHA1
4d02ec8882c24eb5e51c07ce12abcaa4bd610c27

SHA256
3a549857526733dea4da5c4916d7c0015d8172ad8d845acc160d6b12be418b9a

SHA512
4ea818d410bfd7898b1f2ea384882b0e35a8cc72cc3b65ce88016b7e076798229a8c55284622921408279112c17ca30b1a92c8a0fbf2e6332dcec2252de967c9

Download Submit
C:\Windows\images.exe

Filesize
141KB

MD5
7bd00d190acedcc64aeefd1ddf94cb1d

SHA1
4d02ec8882c24eb5e51c07ce12abcaa4bd610c27

SHA256
3a549857526733dea4da5c4916d7c0015d8172ad8d845acc160d6b12be418b9a

SHA512
4ea818d410bfd7898b1f2ea384882b0e35a8cc72cc3b65ce88016b7e076798229a8c55284622921408279112c17ca30b1a92c8a0fbf2e6332dcec2252de967c9

Download Submit
C:\Windows\images.exe

Filesize
141KB

MD5
7bd00d190acedcc64aeefd1ddf94cb1d

SHA1
4d02ec8882c24eb5e51c07ce12abcaa4bd610c27

SHA256
3a549857526733dea4da5c4916d7c0015d8172ad8d845acc160d6b12be418b9a

SHA512
4ea818d410bfd7898b1f2ea384882b0e35a8cc72cc3b65ce88016b7e076798229a8c55284622921408279112c17ca30b1a92c8a0fbf2e6332dcec2252de967c9

Download Submit
\HyperServerdll\Bridgesession.exe

Filesize
881KB

MD5
969ed2c9a371e36fdff27a2b24489006

SHA1
689efd222d5e0c77a562e88b0a19d4e85917fd99

SHA256
459f82dbd4763d24b38ecd2f8ca72de1518cdaf7ad8bbb186841770e0a176ac9

SHA512
a77fc4a9ace9bb0d165e3a14cbb8ff1b89c03d54a37f3021584502d013439cf43430900df58a08475a405df52238b492a67094d8e7424c38573d61ac898be471

Download Submit
\HyperServerdll\Bridgesession.exe

Filesize
881KB

MD5
969ed2c9a371e36fdff27a2b24489006

SHA1
689efd222d5e0c77a562e88b0a19d4e85917fd99

SHA256
459f82dbd4763d24b38ecd2f8ca72de1518cdaf7ad8bbb186841770e0a176ac9

SHA512
a77fc4a9ace9bb0d165e3a14cbb8ff1b89c03d54a37f3021584502d013439cf43430900df58a08475a405df52238b492a67094d8e7424c38573d61ac898be471

Download Submit
\Program Files\Microsoft DN1\sqlmap.dll

Filesize
114KB

MD5
461ade40b800ae80a40985594e1ac236

SHA1
b3892eef846c044a2b0785d54a432b3e93a968c8

SHA256
798af20db39280f90a1d35f2ac2c1d62124d1f5218a2a0fa29d87a13340bd3e4

SHA512
421f9060c4b61fa6f4074508602a2639209032fd5df5bfc702a159e3bad5479684ccb3f6e02f3e38fb8db53839cf3f41fe58a3acad6ec1199a48dc333b2d8a26

Download Submit
\Users\Admin\AppData\Local\Temp\448.exe

Filesize
70KB

MD5
ca96229390a0e6a53e8f2125f2c01114

SHA1
a54b1081cf58724f8cb292b4d165dfee2fb1c9f6

SHA256
0df3d05900e7b530f6c2a281d43c47839f2cf2a5d386553c8dc46e463a635a2c

SHA512
e93445bce6c8b6f51890309577a0ea9369860d2e6bf8cc0ca708879a77bb176d27c5f559bbdb7deb4b719aee0fc48d9068c293559f7629baf4ec3515898102ef

Download Submit
\Users\Admin\Documents\images.exe

Filesize
141KB

MD5
7bd00d190acedcc64aeefd1ddf94cb1d

SHA1
4d02ec8882c24eb5e51c07ce12abcaa4bd610c27

SHA256
3a549857526733dea4da5c4916d7c0015d8172ad8d845acc160d6b12be418b9a

SHA512
4ea818d410bfd7898b1f2ea384882b0e35a8cc72cc3b65ce88016b7e076798229a8c55284622921408279112c17ca30b1a92c8a0fbf2e6332dcec2252de967c9

Download Submit
\Users\Admin\Documents\images.exe

Filesize
141KB

MD5
7bd00d190acedcc64aeefd1ddf94cb1d

SHA1
4d02ec8882c24eb5e51c07ce12abcaa4bd610c27

SHA256
3a549857526733dea4da5c4916d7c0015d8172ad8d845acc160d6b12be418b9a

SHA512
4ea818d410bfd7898b1f2ea384882b0e35a8cc72cc3b65ce88016b7e076798229a8c55284622921408279112c17ca30b1a92c8a0fbf2e6332dcec2252de967c9

Download Submit
memory/1172-107-0x0000000002AC0000-0x0000000002B40000-memory.dmp

Filesize
512KB

Download
memory/1172-114-0x0000000002ACB000-0x0000000002B32000-memory.dmp

Filesize
412KB

Download
memory/1172-103-0x000007FEED3C0000-0x000007FEEDD5D000-memory.dmp

Filesize
9.6MB

Download
memory/1172-111-0x000007FEED3C0000-0x000007FEEDD5D000-memory.dmp

Filesize
9.6MB

Download
memory/1172-112-0x0000000002AC0000-0x0000000002B40000-memory.dmp

Filesize
512KB

Download
memory/1172-110-0x000007FEED3C0000-0x000007FEEDD5D000-memory.dmp

Filesize
9.6MB

Download
memory/1192-78-0x0000000001FDB000-0x0000000002042000-memory.dmp

Filesize
412KB

Download
memory/1192-49-0x0000000001FD0000-0x0000000002050000-memory.dmp

Filesize
512KB

Download
memory/1192-86-0x000007FEED3C0000-0x000007FEEDD5D000-memory.dmp

Filesize
9.6MB

Download
memory/1280-84-0x000007FEED3C0000-0x000007FEEDD5D000-memory.dmp

Filesize
9.6MB

Download
memory/1280-104-0x000000000288B000-0x00000000028F2000-memory.dmp

Filesize
412KB

Download
memory/1280-98-0x0000000002884000-0x0000000002887000-memory.dmp

Filesize
12KB

Download
memory/1508-133-0x0000000073AB0000-0x000000007405B000-memory.dmp

Filesize
5.7MB

Download
memory/1508-135-0x0000000002500000-0x0000000002540000-memory.dmp

Filesize
256KB

Download
memory/1508-134-0x0000000073AB0000-0x000000007405B000-memory.dmp

Filesize
5.7MB

Download
memory/1508-136-0x0000000002500000-0x0000000002540000-memory.dmp

Filesize
256KB

Download
memory/1508-137-0x0000000002500000-0x0000000002540000-memory.dmp

Filesize
256KB

Download
memory/1508-138-0x0000000073AB0000-0x000000007405B000-memory.dmp

Filesize
5.7MB

Download
memory/1532-180-0x0000000000E10000-0x0000000000E3D000-memory.dmp

Filesize
180KB

Download
memory/1532-181-0x0000000000E10000-0x0000000000E3D000-memory.dmp

Filesize
180KB

Download
memory/1612-90-0x00000000027B4000-0x00000000027B7000-memory.dmp

Filesize
12KB

Download
memory/1612-97-0x00000000027BB000-0x0000000002822000-memory.dmp

Filesize
412KB

Download
memory/1612-82-0x000007FEED3C0000-0x000007FEEDD5D000-memory.dmp

Filesize
9.6MB

Download
memory/1664-105-0x0000000002584000-0x0000000002587000-memory.dmp

Filesize
12KB

Download
memory/1664-102-0x000007FEED3C0000-0x000007FEEDD5D000-memory.dmp

Filesize
9.6MB

Download
memory/1664-108-0x000000000258B000-0x00000000025F2000-memory.dmp

Filesize
412KB

Download
memory/1732-106-0x0000000002824000-0x0000000002827000-memory.dmp

Filesize
12KB

Download
memory/1732-109-0x000000000282B000-0x0000000002892000-memory.dmp

Filesize
412KB

Download
memory/1732-95-0x000007FEED3C0000-0x000007FEEDD5D000-memory.dmp

Filesize
9.6MB

Download
memory/1976-81-0x000007FEED3C0000-0x000007FEEDD5D000-memory.dmp

Filesize
9.6MB

Download
memory/1976-46-0x0000000002360000-0x0000000002368000-memory.dmp

Filesize
32KB

Download
memory/1976-89-0x00000000028B4000-0x00000000028B7000-memory.dmp

Filesize
12KB

Download
memory/1976-96-0x00000000028BB000-0x0000000002922000-memory.dmp

Filesize
412KB

Download
memory/1992-93-0x000000000294B000-0x00000000029B2000-memory.dmp

Filesize
412KB

Download
memory/1992-87-0x0000000002944000-0x0000000002947000-memory.dmp

Filesize
12KB

Download
memory/1992-79-0x000007FEED3C0000-0x000007FEEDD5D000-memory.dmp

Filesize
9.6MB

Download
memory/2148-113-0x0000000002930000-0x00000000029B0000-memory.dmp

Filesize
512KB

Download
memory/2148-115-0x0000000002930000-0x00000000029B0000-memory.dmp

Filesize
512KB

Download
memory/2148-117-0x000007FEED3C0000-0x000007FEEDD5D000-memory.dmp

Filesize
9.6MB

Download
memory/2156-120-0x0000000002B24000-0x0000000002B27000-memory.dmp

Filesize
12KB

Download
memory/2156-116-0x000007FEED3C0000-0x000007FEEDD5D000-memory.dmp

Filesize
9.6MB

Download
memory/2156-121-0x0000000002B20000-0x0000000002BA0000-memory.dmp

Filesize
512KB

Download
memory/2240-42-0x000000001B2E0000-0x000000001B5C2000-memory.dmp

Filesize
2.9MB

Download
memory/2240-83-0x000007FEED3C0000-0x000007FEEDD5D000-memory.dmp

Filesize
9.6MB

Download
memory/2240-91-0x0000000002764000-0x0000000002767000-memory.dmp

Filesize
12KB

Download
memory/2240-88-0x0000000002760000-0x00000000027E0000-memory.dmp

Filesize
512KB

Download
memory/2240-99-0x000000000276B000-0x00000000027D2000-memory.dmp

Filesize
412KB

Download
memory/2364-122-0x000007FEF5320000-0x000007FEF5D0C000-memory.dmp

Filesize
9.9MB

Download
memory/2364-119-0x000000001ADB0000-0x000000001AE30000-memory.dmp

Filesize
512KB

Download
memory/2364-118-0x000007FEF5320000-0x000007FEF5D0C000-memory.dmp

Filesize
9.9MB

Download
memory/2364-45-0x00000000001C0000-0x00000000002A4000-memory.dmp

Filesize
912KB

Download
memory/2396-85-0x000007FEED3C0000-0x000007FEEDD5D000-memory.dmp

Filesize
9.6MB

Download
memory/2396-92-0x0000000002864000-0x0000000002867000-memory.dmp

Filesize
12KB

Download
memory/2396-100-0x000000000286B000-0x00000000028D2000-memory.dmp

Filesize
412KB

Download
memory/2432-158-0x0000000002720000-0x0000000002760000-memory.dmp

Filesize
256KB

Download
memory/2432-159-0x0000000002720000-0x0000000002760000-memory.dmp

Filesize
256KB

Download
memory/2432-156-0x0000000073010000-0x00000000735BB000-memory.dmp

Filesize
5.7MB

Download
memory/2432-157-0x0000000073010000-0x00000000735BB000-memory.dmp

Filesize
5.7MB

Download
memory/2640-14-0x000007FEF5320000-0x000007FEF5D0C000-memory.dmp

Filesize
9.9MB

Download
memory/2640-16-0x0000000000140000-0x000000000014C000-memory.dmp

Filesize
48KB

Download
memory/2640-15-0x000000001B0E0000-0x000000001B160000-memory.dmp

Filesize
512KB

Download
memory/2640-58-0x000007FEF5320000-0x000007FEF5D0C000-memory.dmp

Filesize
9.9MB

Download
memory/2640-13-0x00000000011C0000-0x00000000012A4000-memory.dmp

Filesize
912KB

Download
memory/2764-161-0x0000000000120000-0x0000000000121000-memory.dmp

Filesize
4KB

Download
memory/2764-163-0x0000000000120000-0x0000000000121000-memory.dmp

Filesize
4KB

Download
memory/2996-80-0x000007FEED3C0000-0x000007FEEDD5D000-memory.dmp

Filesize
9.6MB

Download
memory/2996-94-0x0000000002894000-0x0000000002897000-memory.dmp

Filesize
12KB

Download
memory/2996-101-0x000000000289B000-0x0000000002902000-memory.dmp

Filesize
412KB

Download