zgrat | c252cbd5898c1d562170a12c1e2262ad101616ec0583cb647c01a5e3d1568fef

Analysis

max time kernel
150s
max time network
153s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
12-05-2024 17:18

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

BlastedCracked.exe
Size

3.6MB
MD5

efa8a9b8529959e7384cce67f59420d8
SHA1

54159f633070d03a71ed6d5e1d9e40f2893510fe
SHA256

c252cbd5898c1d562170a12c1e2262ad101616ec0583cb647c01a5e3d1568fef
SHA512

7a97920a93a05d076ea6ddade8dbe82553b69d89c0a3d86fb11627193753bf12a85975ff01ccf84bcb9b030a38d4e0d7c3957d08a2ad11831601e80f24fd5aef
SSDEEP

98304:1syC4u5x0b8dF6eaeSjBeKxATO7IiiOra+Hc8:7C4u5x0wn6eaeSdyTO4Ora+Hc8

Score

10^/10

zgrat persistence rat

Malware Config

Signatures

Detect ZGRat V1 8 IoCs

resource	yara_rule
behavioral1/files/0x000b000000015f7a-5.dat	family_zgrat_v1
behavioral1/files/0x0008000000016c51-40.dat	family_zgrat_v1
behavioral1/memory/2636-44-0x00000000011F0000-0x000000000157E000-memory.dmp	family_zgrat_v1
behavioral1/memory/1920-119-0x0000000001090000-0x000000000141E000-memory.dmp	family_zgrat_v1
behavioral1/memory/1904-177-0x0000000001210000-0x000000000159E000-memory.dmp	family_zgrat_v1
behavioral1/memory/2900-290-0x0000000000360000-0x00000000006EE000-memory.dmp	family_zgrat_v1
behavioral1/memory/1972-320-0x00000000001D0000-0x000000000055E000-memory.dmp	family_zgrat_v1
behavioral1/memory/2004-349-0x0000000000F80000-0x000000000130E000-memory.dmp	family_zgrat_v1

Modifies WinLogon for persistence 2 TTPs 6 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\ProviderSession\\BlastedCrack.exe\""	surrogatesessionsvc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\ProviderSession\\BlastedCrack.exe\", \"C:\\MSOCache\\All Users\\{90140000-0117-0409-0000-0000000FF1CE}-C\\Access.en-us\\conhost.exe\""	surrogatesessionsvc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\ProviderSession\\BlastedCrack.exe\", \"C:\\MSOCache\\All Users\\{90140000-0117-0409-0000-0000000FF1CE}-C\\Access.en-us\\conhost.exe\", \"C:\\Users\\All Users\\Templates\\dwm.exe\""	surrogatesessionsvc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\ProviderSession\\BlastedCrack.exe\", \"C:\\MSOCache\\All Users\\{90140000-0117-0409-0000-0000000FF1CE}-C\\Access.en-us\\conhost.exe\", \"C:\\Users\\All Users\\Templates\\dwm.exe\", \"C:\\Program Files\\Windows Sidebar\\Gadgets\\smss.exe\""	surrogatesessionsvc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\ProviderSession\\BlastedCrack.exe\", \"C:\\MSOCache\\All Users\\{90140000-0117-0409-0000-0000000FF1CE}-C\\Access.en-us\\conhost.exe\", \"C:\\Users\\All Users\\Templates\\dwm.exe\", \"C:\\Program Files\\Windows Sidebar\\Gadgets\\smss.exe\", \"C:\\Program Files (x86)\\Common Files\\Services\\services.exe\""	surrogatesessionsvc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\ProviderSession\\BlastedCrack.exe\", \"C:\\MSOCache\\All Users\\{90140000-0117-0409-0000-0000000FF1CE}-C\\Access.en-us\\conhost.exe\", \"C:\\Users\\All Users\\Templates\\dwm.exe\", \"C:\\Program Files\\Windows Sidebar\\Gadgets\\smss.exe\", \"C:\\Program Files (x86)\\Common Files\\Services\\services.exe\", \"C:\\ProviderSession\\surrogatesessionsvc.exe\""	surrogatesessionsvc.exe

Process spawned unexpected child process 18 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	916	3048	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	776	3048	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1660	3048	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1976	3048	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	324	3048	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	792	3048	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	280	3048	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1476	3048	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1492	3048	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1924	3048	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1140	3048	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1044	3048	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2220	3048	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1992	3048	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1612	3048	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	992	3048	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	652	3048	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1996	3048	schtasks.exe	34

ZGRat
ZGRat is remote access trojan written in C#.
rat zgrat

Executes dropped EXE 12 IoCs

pid	Process
1712	Cracker.exe
2576	BlastedCrack.exe
2636	surrogatesessionsvc.exe
1920	smss.exe
2876	smss.exe
1904	smss.exe
1676	smss.exe
716	smss.exe
2148	smss.exe
2900	smss.exe
1972	smss.exe
2004	smss.exe

Loads dropped DLL 9 IoCs

pid	Process
2104	BlastedCracked.exe
2104	BlastedCracked.exe
2104	BlastedCracked.exe
2104	BlastedCracked.exe
2104	BlastedCracked.exe
2104	BlastedCracked.exe
2104	BlastedCracked.exe
2512	cmd.exe
2512	cmd.exe

Adds Run key to start application 2 TTPs 12 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\BlastedCrack = "\"C:\\ProviderSession\\BlastedCrack.exe\""	surrogatesessionsvc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\BlastedCrack = "\"C:\\ProviderSession\\BlastedCrack.exe\""	surrogatesessionsvc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dwm = "\"C:\\Users\\All Users\\Templates\\dwm.exe\""	surrogatesessionsvc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\services = "\"C:\\Program Files (x86)\\Common Files\\Services\\services.exe\""	surrogatesessionsvc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\services = "\"C:\\Program Files (x86)\\Common Files\\Services\\services.exe\""	surrogatesessionsvc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\surrogatesessionsvc = "\"C:\\ProviderSession\\surrogatesessionsvc.exe\""	surrogatesessionsvc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\conhost = "\"C:\\MSOCache\\All Users\\{90140000-0117-0409-0000-0000000FF1CE}-C\\Access.en-us\\conhost.exe\""	surrogatesessionsvc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\conhost = "\"C:\\MSOCache\\All Users\\{90140000-0117-0409-0000-0000000FF1CE}-C\\Access.en-us\\conhost.exe\""	surrogatesessionsvc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\dwm = "\"C:\\Users\\All Users\\Templates\\dwm.exe\""	surrogatesessionsvc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\smss = "\"C:\\Program Files\\Windows Sidebar\\Gadgets\\smss.exe\""	surrogatesessionsvc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\smss = "\"C:\\Program Files\\Windows Sidebar\\Gadgets\\smss.exe\""	surrogatesessionsvc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\surrogatesessionsvc = "\"C:\\ProviderSession\\surrogatesessionsvc.exe\""	surrogatesessionsvc.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	\??\c:\Windows\System32\CSC21E48722A13E4EEA9BB6EB392AB2A78D.TMP	csc.exe
File created	\??\c:\Windows\System32\slsogk.exe	csc.exe

Drops file in Program Files directory 5 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Common Files\Services\services.exe	surrogatesessionsvc.exe
File opened for modification	C:\Program Files (x86)\Common Files\Services\services.exe	surrogatesessionsvc.exe
File created	C:\Program Files (x86)\Common Files\Services\c5b4cb5e9653cc	surrogatesessionsvc.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\smss.exe	surrogatesessionsvc.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\69ddcba757bf72	surrogatesessionsvc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 18 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
1976	schtasks.exe
1476	schtasks.exe
1492	schtasks.exe
1044	schtasks.exe
2220	schtasks.exe
792	schtasks.exe
280	schtasks.exe
992	schtasks.exe
652	schtasks.exe
916	schtasks.exe
776	schtasks.exe
1924	schtasks.exe
1140	schtasks.exe
1992	schtasks.exe
1612	schtasks.exe
1996	schtasks.exe
1660	schtasks.exe
324	schtasks.exe

Runs ping.exe 1 TTPs 6 IoCs

Remote System Discovery

T1018

pid	Process
2500	PING.EXE
1924	PING.EXE
2688	PING.EXE
2816	PING.EXE
828	PING.EXE
1732	PING.EXE

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2636	surrogatesessionsvc.exe
2636	surrogatesessionsvc.exe
2636	surrogatesessionsvc.exe
2636	surrogatesessionsvc.exe
2636	surrogatesessionsvc.exe
2636	surrogatesessionsvc.exe
2636	surrogatesessionsvc.exe
2636	surrogatesessionsvc.exe
2636	surrogatesessionsvc.exe
2636	surrogatesessionsvc.exe
2636	surrogatesessionsvc.exe
2636	surrogatesessionsvc.exe
2636	surrogatesessionsvc.exe
2636	surrogatesessionsvc.exe
2636	surrogatesessionsvc.exe
2636	surrogatesessionsvc.exe
2636	surrogatesessionsvc.exe
2636	surrogatesessionsvc.exe
2636	surrogatesessionsvc.exe
2636	surrogatesessionsvc.exe
2636	surrogatesessionsvc.exe
2636	surrogatesessionsvc.exe
2636	surrogatesessionsvc.exe
2636	surrogatesessionsvc.exe
2636	surrogatesessionsvc.exe
2636	surrogatesessionsvc.exe
2636	surrogatesessionsvc.exe
2636	surrogatesessionsvc.exe
2636	surrogatesessionsvc.exe
2636	surrogatesessionsvc.exe
2636	surrogatesessionsvc.exe
2636	surrogatesessionsvc.exe
2636	surrogatesessionsvc.exe
2636	surrogatesessionsvc.exe
2636	surrogatesessionsvc.exe
2636	surrogatesessionsvc.exe
2636	surrogatesessionsvc.exe
2636	surrogatesessionsvc.exe
2636	surrogatesessionsvc.exe
2636	surrogatesessionsvc.exe
2636	surrogatesessionsvc.exe
2636	surrogatesessionsvc.exe
2636	surrogatesessionsvc.exe
2636	surrogatesessionsvc.exe
2636	surrogatesessionsvc.exe
2636	surrogatesessionsvc.exe
2636	surrogatesessionsvc.exe
2636	surrogatesessionsvc.exe
2636	surrogatesessionsvc.exe
2636	surrogatesessionsvc.exe
2636	surrogatesessionsvc.exe
2636	surrogatesessionsvc.exe
2636	surrogatesessionsvc.exe
2636	surrogatesessionsvc.exe
2636	surrogatesessionsvc.exe
2636	surrogatesessionsvc.exe
2636	surrogatesessionsvc.exe
2636	surrogatesessionsvc.exe
2636	surrogatesessionsvc.exe
2636	surrogatesessionsvc.exe
2636	surrogatesessionsvc.exe
2636	surrogatesessionsvc.exe
2636	surrogatesessionsvc.exe
2636	surrogatesessionsvc.exe

Suspicious use of AdjustPrivilegeToken 11 IoCs

description	pid	Process
Token: SeDebugPrivilege	2636	surrogatesessionsvc.exe
Token: SeDebugPrivilege	1920	smss.exe
Token: SeDebugPrivilege	2576	BlastedCrack.exe
Token: SeDebugPrivilege	2876	smss.exe
Token: SeDebugPrivilege	1904	smss.exe
Token: SeDebugPrivilege	1676	smss.exe
Token: SeDebugPrivilege	716	smss.exe
Token: SeDebugPrivilege	2148	smss.exe
Token: SeDebugPrivilege	2900	smss.exe
Token: SeDebugPrivilege	1972	smss.exe
Token: SeDebugPrivilege	2004	smss.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2576	BlastedCrack.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2104 wrote to memory of 1712	2104	BlastedCracked.exe	28
PID 2104 wrote to memory of 1712	2104	BlastedCracked.exe	28
PID 2104 wrote to memory of 1712	2104	BlastedCracked.exe	28
PID 2104 wrote to memory of 1712	2104	BlastedCracked.exe	28
PID 2104 wrote to memory of 2576	2104	BlastedCracked.exe	29
PID 2104 wrote to memory of 2576	2104	BlastedCracked.exe	29
PID 2104 wrote to memory of 2576	2104	BlastedCracked.exe	29
PID 2104 wrote to memory of 2576	2104	BlastedCracked.exe	29
PID 1712 wrote to memory of 2772	1712	Cracker.exe	30
PID 1712 wrote to memory of 2772	1712	Cracker.exe	30
PID 1712 wrote to memory of 2772	1712	Cracker.exe	30
PID 1712 wrote to memory of 2772	1712	Cracker.exe	30
PID 2772 wrote to memory of 2512	2772	WScript.exe	31
PID 2772 wrote to memory of 2512	2772	WScript.exe	31
PID 2772 wrote to memory of 2512	2772	WScript.exe	31
PID 2772 wrote to memory of 2512	2772	WScript.exe	31
PID 2512 wrote to memory of 2636	2512	cmd.exe	33
PID 2512 wrote to memory of 2636	2512	cmd.exe	33
PID 2512 wrote to memory of 2636	2512	cmd.exe	33
PID 2512 wrote to memory of 2636	2512	cmd.exe	33
PID 2636 wrote to memory of 1564	2636	surrogatesessionsvc.exe	38
PID 2636 wrote to memory of 1564	2636	surrogatesessionsvc.exe	38
PID 2636 wrote to memory of 1564	2636	surrogatesessionsvc.exe	38
PID 1564 wrote to memory of 1276	1564	csc.exe	40
PID 1564 wrote to memory of 1276	1564	csc.exe	40
PID 1564 wrote to memory of 1276	1564	csc.exe	40
PID 2636 wrote to memory of 920	2636	surrogatesessionsvc.exe	56
PID 2636 wrote to memory of 920	2636	surrogatesessionsvc.exe	56
PID 2636 wrote to memory of 920	2636	surrogatesessionsvc.exe	56
PID 920 wrote to memory of 2080	920	cmd.exe	58
PID 920 wrote to memory of 2080	920	cmd.exe	58
PID 920 wrote to memory of 2080	920	cmd.exe	58
PID 920 wrote to memory of 948	920	cmd.exe	59
PID 920 wrote to memory of 948	920	cmd.exe	59
PID 920 wrote to memory of 948	920	cmd.exe	59
PID 920 wrote to memory of 1920	920	cmd.exe	60
PID 920 wrote to memory of 1920	920	cmd.exe	60
PID 920 wrote to memory of 1920	920	cmd.exe	60
PID 1920 wrote to memory of 2844	1920	smss.exe	61
PID 1920 wrote to memory of 2844	1920	smss.exe	61
PID 1920 wrote to memory of 2844	1920	smss.exe	61
PID 2844 wrote to memory of 2660	2844	cmd.exe	63
PID 2844 wrote to memory of 2660	2844	cmd.exe	63
PID 2844 wrote to memory of 2660	2844	cmd.exe	63
PID 2844 wrote to memory of 2688	2844	cmd.exe	64
PID 2844 wrote to memory of 2688	2844	cmd.exe	64
PID 2844 wrote to memory of 2688	2844	cmd.exe	64
PID 2844 wrote to memory of 2876	2844	cmd.exe	67
PID 2844 wrote to memory of 2876	2844	cmd.exe	67
PID 2844 wrote to memory of 2876	2844	cmd.exe	67
PID 2876 wrote to memory of 2872	2876	smss.exe	68
PID 2876 wrote to memory of 2872	2876	smss.exe	68
PID 2876 wrote to memory of 2872	2876	smss.exe	68
PID 2872 wrote to memory of 1148	2872	cmd.exe	70
PID 2872 wrote to memory of 1148	2872	cmd.exe	70
PID 2872 wrote to memory of 1148	2872	cmd.exe	70
PID 2872 wrote to memory of 2816	2872	cmd.exe	71
PID 2872 wrote to memory of 2816	2872	cmd.exe	71
PID 2872 wrote to memory of 2816	2872	cmd.exe	71
PID 2872 wrote to memory of 1904	2872	cmd.exe	72
PID 2872 wrote to memory of 1904	2872	cmd.exe	72
PID 2872 wrote to memory of 1904	2872	cmd.exe	72
PID 1904 wrote to memory of 592	1904	smss.exe	73
PID 1904 wrote to memory of 592	1904	smss.exe	73

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\BlastedCracked.exe
"C:\Users\Admin\AppData\Local\Temp\BlastedCracked.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2104
- C:\Users\Admin\AppData\Local\Temp\Cracker.exe
  "C:\Users\Admin\AppData\Local\Temp\Cracker.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:1712
- - C:\Windows\SysWOW64\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\ProviderSession\bsSZWUX62rbs.vbe"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2772
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c ""C:\ProviderSession\zpmu3ESIavPlU5h4gyS3YPEo2FY3dCgO4x55.bat" "
      4⤵
      Loads dropped DLL
      Suspicious use of WriteProcessMemory
      PID:2512
    - - C:\ProviderSession\surrogatesessionsvc.exe
        
        "C:\ProviderSession/surrogatesessionsvc.exe"
        5⤵
        Modifies WinLogon for persistence
        Executes dropped EXE
        Adds Run key to start application
        Drops file in Program Files directory
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2636
      - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\nzx1wium\nzx1wium.cmdline"
        6⤵
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:1564
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES8CA6.tmp" "c:\Windows\System32\CSC21E48722A13E4EEA9BB6EB392AB2A78D.TMP"
        7⤵
        
        PID:1276
      - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\9Blx0cZtRk.bat"
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:920
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        7⤵
        
        PID:2080
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        7⤵
        
        PID:948
        
        C:\Program Files\Windows Sidebar\Gadgets\smss.exe
        
        "C:\Program Files\Windows Sidebar\Gadgets\smss.exe"
        7⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1920
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\iZ9ZaL1wLl.bat"
        8⤵
        Suspicious use of WriteProcessMemory
        
        PID:2844
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        9⤵
        
        PID:2660
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        9⤵
        Runs ping.exe
        
        PID:2688
        
        C:\Program Files\Windows Sidebar\Gadgets\smss.exe
        
        "C:\Program Files\Windows Sidebar\Gadgets\smss.exe"
        9⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2876
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\3cBJ2i3CCl.bat"
        10⤵
        Suspicious use of WriteProcessMemory
        
        PID:2872
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        11⤵
        
        PID:1148
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        11⤵
        Runs ping.exe
        
        PID:2816
        
        C:\Program Files\Windows Sidebar\Gadgets\smss.exe
        
        "C:\Program Files\Windows Sidebar\Gadgets\smss.exe"
        11⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1904
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\SbXYQ83spR.bat"
        12⤵
        
        PID:592
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        13⤵
        
        PID:1204
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        13⤵
        
        PID:792
        
        C:\Program Files\Windows Sidebar\Gadgets\smss.exe
        
        "C:\Program Files\Windows Sidebar\Gadgets\smss.exe"
        13⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:1676
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\04ySO8WbXQ.bat"
        14⤵
        
        PID:3032
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        15⤵
        
        PID:2904
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        15⤵
        Runs ping.exe
        
        PID:828
        
        C:\Program Files\Windows Sidebar\Gadgets\smss.exe
        
        "C:\Program Files\Windows Sidebar\Gadgets\smss.exe"
        15⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:716
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\e6v3dq4CIc.bat"
        16⤵
        
        PID:2280
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        17⤵
        
        PID:1724
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        17⤵
        Runs ping.exe
        
        PID:1732
        
        C:\Program Files\Windows Sidebar\Gadgets\smss.exe
        
        "C:\Program Files\Windows Sidebar\Gadgets\smss.exe"
        17⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:2148
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\atyOD99Im6.bat"
        18⤵
        
        PID:2488
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        19⤵
        
        PID:2128
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        19⤵
        Runs ping.exe
        
        PID:2500
        
        C:\Program Files\Windows Sidebar\Gadgets\smss.exe
        
        "C:\Program Files\Windows Sidebar\Gadgets\smss.exe"
        19⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:2900
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\s2nU7uS06N.bat"
        20⤵
        
        PID:2200
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        21⤵
        
        PID:848
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        21⤵
        
        PID:2948
        
        C:\Program Files\Windows Sidebar\Gadgets\smss.exe
        
        "C:\Program Files\Windows Sidebar\Gadgets\smss.exe"
        21⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:1972
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\KfiEaGEkVw.bat"
        22⤵
        
        PID:2168
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        23⤵
        
        PID:1820
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        23⤵
        Runs ping.exe
        
        PID:1924
        
        C:\Program Files\Windows Sidebar\Gadgets\smss.exe
        
        "C:\Program Files\Windows Sidebar\Gadgets\smss.exe"
        23⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:2004
- C:\Users\Admin\AppData\Local\Temp\BlastedCrack.exe
  "C:\Users\Admin\AppData\Local\Temp\BlastedCrack.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  PID:2576

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "BlastedCrackB" /sc MINUTE /mo 13 /tr "'C:\ProviderSession\BlastedCrack.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:916

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "BlastedCrack" /sc ONLOGON /tr "'C:\ProviderSession\BlastedCrack.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:776

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "BlastedCrackB" /sc MINUTE /mo 14 /tr "'C:\ProviderSession\BlastedCrack.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1660

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 11 /tr "'C:\MSOCache\All Users\{90140000-0117-0409-0000-0000000FF1CE}-C\Access.en-us\conhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1976

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhost" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-0117-0409-0000-0000000FF1CE}-C\Access.en-us\conhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:324

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 13 /tr "'C:\MSOCache\All Users\{90140000-0117-0409-0000-0000000FF1CE}-C\Access.en-us\conhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:792

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 10 /tr "'C:\Users\All Users\Templates\dwm.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:280

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwm" /sc ONLOGON /tr "'C:\Users\All Users\Templates\dwm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1476

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 8 /tr "'C:\Users\All Users\Templates\dwm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1492

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 14 /tr "'C:\Program Files\Windows Sidebar\Gadgets\smss.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1924

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smss" /sc ONLOGON /tr "'C:\Program Files\Windows Sidebar\Gadgets\smss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1140

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 10 /tr "'C:\Program Files\Windows Sidebar\Gadgets\smss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1044

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 11 /tr "'C:\Program Files (x86)\Common Files\Services\services.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2220

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "services" /sc ONLOGON /tr "'C:\Program Files (x86)\Common Files\Services\services.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1992

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 9 /tr "'C:\Program Files (x86)\Common Files\Services\services.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1612

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "surrogatesessionsvcs" /sc MINUTE /mo 9 /tr "'C:\ProviderSession\surrogatesessionsvc.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:992

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "surrogatesessionsvc" /sc ONLOGON /tr "'C:\ProviderSession\surrogatesessionsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:652

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "surrogatesessionsvcs" /sc MINUTE /mo 8 /tr "'C:\ProviderSession\surrogatesessionsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1996

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Scheduled Task/Job

T1053

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Scheduled Task/Job

T1053

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProviderSession\bsSZWUX62rbs.vbe

Filesize
230B

MD5
c59360784e5ae0db16c6e319cc53bf8d

SHA1
7e7b6afc92d466512f383f01d24d3fc0ba5d249d

SHA256
4edef9b23ac770fb41a5dec471ddf37d3d1c5dc868999b79358bbdd34523b7c1

SHA512
8a3fcbcc366567b11444bcc033dbf4597c33ab3230c9f6d603bb60fb2b9ee746271e4f6b332109973eb54a9247569feac76691dcc2602a9727e960e78f0968ff

Download Submit
C:\ProviderSession\zpmu3ESIavPlU5h4gyS3YPEo2FY3dCgO4x55.bat

Filesize
74B

MD5
bdd66a5a523ff5c2d0546fdefcfde8aa

SHA1
76eb5ea9114693dc22b4241732fe5dd6b25037bb

SHA256
222da2e8abc8fe3b8acb5c84f61f635078fc7237816126348e600f458506398c

SHA512
b79c03ffb10bfdc16268a6872e4b9b522366b9d7edca992212c315133ce920768a0726595b65c0aa4878d25b143e65c42ec271863e9be8ad726dfe63062a6e3c

Download Submit
C:\Users\Admin\AppData\Local\Temp\04ySO8WbXQ.bat

Filesize
177B

MD5
6b4351f4b462997dec7baabc14f441a4

SHA1
15cebf9603b5be1a15f8d52e4cad6243a99ef563

SHA256
8e49a415b295a873ae11b63388e082cf8a8ab950e5912256314941d0acb058fd

SHA512
b584029e951907d55e5f08155d803c4255cd38cad3be072426b332b33f5339bd8cb5fece7ef7d5301de1011e3906394cbbbfe5f1ea74c30fe40fe824dec79ffa

Download Submit
C:\Users\Admin\AppData\Local\Temp\3cBJ2i3CCl.bat

Filesize
177B

MD5
ecaacb0f0b6f5616748163768ef64c16

SHA1
f8e64a46a94e734e711e99c7717f05229e61845e

SHA256
b87687680a22b86d33b2057186125f0500a054c3bcc53803280c89c1f94c67f8

SHA512
0b74b1001605900ce1270698667413c6a5a5b4d39f1cde6f658bc5f178420aba48be8307af46f0a2f4bcdd4191ea9d41c3127ab63d95e6be53d4db69946be611

Download Submit
C:\Users\Admin\AppData\Local\Temp\9Blx0cZtRk.bat

Filesize
225B

MD5
421874548a3d94a0397792c59d8775a9

SHA1
14f844e480c37379c30b07fbad7bb791317e0977

SHA256
afeb8c681e02a91982d1be1992f72d60d4abf8133d4da25f616f0d3dd0db8874

SHA512
40516928256d6e20237f0d8a044978798802d8b550d49f5b92fcd2d86a15ff12359ba7cac6b6204e5fc462f85389fe98a44688432e59bddd0df0cf28e09a948f

Download Submit
C:\Users\Admin\AppData\Local\Temp\KfiEaGEkVw.bat

Filesize
177B

MD5
a888c4abeea5948266324a33e9acb76e

SHA1
5f93624a6f43e8de3051576c7115b8244fe37d0f

SHA256
9b51c5ce036562d2b4a330d9c58e12d9e4ccf60b7f7ccb97815d1f86e7bb5e44

SHA512
72aa64dfec288b4ddf4d53b63c51a564d79617a1fb2aff1e40e2487e7b85b5862a7518541305a75eee2c372e036aebcd0493d7b10e7467567aa621fe423d497d

Download Submit
C:\Users\Admin\AppData\Local\Temp\RES8CA6.tmp

Filesize
1KB

MD5
7de7ffefbfce2838018ac125999a5d5b

SHA1
89df4d74f852b5f23ad6f267c54ffb9134cc6a83

SHA256
a5da9ce6f6ac9adc07878224a933531c641e481f87e87042ad4b08d6335ef8a9

SHA512
5eb570d9ef619de39e201a298e84ad78d393f3eff4ed795ce8782bc07c6661845350478cfb750aef977e53074227992de2978a09448c86d7423a0331276ce2d2

Download Submit
C:\Users\Admin\AppData\Local\Temp\SbXYQ83spR.bat

Filesize
225B

MD5
793378a3f695506469cde7276b280b2a

SHA1
c4724beefe28f62a9c0aa05c61e0790bc7cce075

SHA256
f18b1c10ba86e7ae30aa1c394c156078fa1b737ff46ad203c5a6853cafda1f42

SHA512
818daae65d6852cf4704eb30f162ade9f7502d6d44d202166558ceff4202f7e68b5ca1ec7e24cbfb4a394c39ebe76f43d2354fa2ea72ce98eccded5be28539fc

Download Submit
C:\Users\Admin\AppData\Local\Temp\atyOD99Im6.bat

Filesize
177B

MD5
75781a457ab394aceccab0c3a4f85abc

SHA1
5cba6fd18823e482e5a1230ec88cd77d62451a1d

SHA256
a88b2739ef59aca1a1d01988a9a5c04e27db34899ebac9d5b4e64cdab8dcf6c0

SHA512
53ab0d99660f81589eb1db55bb3fc5ed01c25b4d85d23aea27821b2bbfeb38e8aab63a127973ebda3e584f240cbb46ea3e364e613d9aebb2db3659ea6dac8848

Download Submit
C:\Users\Admin\AppData\Local\Temp\e6v3dq4CIc.bat

Filesize
177B

MD5
ea14f39751a91202f2fe7a677840f9ee

SHA1
c80ee4d70853f3029ce65df20c765391c363f354

SHA256
0d7b05619441e47057a50de53033627ec9129a7c027d6adcadee23d48993d36c

SHA512
1e3b6a41303a1f17783e2392db714a1cedd8d75c29032867ddff5dc78716f089dd3cc0182c3a6634980a9f46dacc80e1c0f497064500c12ee65bf3a2681b2e28

Download Submit
C:\Users\Admin\AppData\Local\Temp\iZ9ZaL1wLl.bat

Filesize
177B

MD5
35be5d02d40aa6673f47c335810cba60

SHA1
f0037fc8f63d44af6d6ae7bc4b70f52e1b5e6c9f

SHA256
a8683f1c74281bc1f3ef943747de83879e873414370eddd53308e7c3598bff3f

SHA512
6d81085405dbf91f2efb184775e8c263e7380d136c9889a5fce64f96506b6c90a3e0d0718e15c3217367a87d63a836de3a120380e1024385ace4de35185c5e38

Download Submit
C:\Users\Admin\AppData\Local\Temp\s2nU7uS06N.bat

Filesize
225B

MD5
25c8759561ea57ce71285030195ffd16

SHA1
f4dd5b8f2134a05e9b59c869721a17319e4790ab

SHA256
ccf8e663ee7a801c1d3074b458768fb978eb959c44ff6ffc69ca16a6d9536cb0

SHA512
33cf3a0da62be579e17a50f503d1351caa530dda4c7f71c374d9dbcb34f3f3f77c25751bf8c4b0dec421bfba5c9c16a5a08bedd4be4c027065453270836bc9f1

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\nzx1wium\nzx1wium.0.cs

Filesize
367B

MD5
d3a0167497238600ca590f0d2532f4cc

SHA1
71a3483a8cdb6421753a4d9ab1252e77fa7d4e8c

SHA256
7ddc580a4c391fb824d04d0a5f4510ff8ee15c649d813e9609b4f99c40975e9f

SHA512
922adcf9fbf6ccc445ff07c7ba918c37e8d002b446f707924dff73a157f47afb18d788d94d78063db763c0a823114c666b4803b7bc240e41fcc3a428e872e351

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\nzx1wium\nzx1wium.cmdline

Filesize
235B

MD5
b433d4d76ac8fbaeefe8c1fa835fe382

SHA1
62ccbaebe8a5e283ba9ca37dcfdb4bfd670c6de4

SHA256
b5494c52f0022bf43a208d809d10d48fdf676df1ccb6f833cbdcd6729d0ce98a

SHA512
de8def6d3bf9cd9abf269ff07f73a53b4874d286c14782b275ef4c6da167a18fd7b5fbdd1ea4a0066b663682a53e70332c2f386c43ec11b84b723eaf15837b6c

Download Submit
\??\c:\Windows\System32\CSC21E48722A13E4EEA9BB6EB392AB2A78D.TMP

Filesize
1KB

MD5
3fcb2bd8a227751c0367dff5940613bb

SHA1
bcca174ab4499de5713d836fbc368966aa1f5b2c

SHA256
aca1f364ec354097cdecc50336698c1180b10ae84fc6051eab154482e0965e8c

SHA512
c7357bb6ee27df96ba39066e893ce8521cb1d5c550be24ced7f860e11cc36ecc04fbec14f61da920bca04e0ae150df8dbc53de0c4a6880afa6067bccfe767672

Download Submit
\ProviderSession\surrogatesessionsvc.exe

Filesize
3.5MB

MD5
5a75e59d28b7b443280c733ebd3c22cf

SHA1
8d4781c8cf4a42ec9f6d5a57633eaf0e589dd11b

SHA256
651072ebbd54a10b843d35b050186915e876b513d09d3cdbf864e4277f5ebb6a

SHA512
4674881eb1923cbe19456d6b7822153213dd2a914a7f66f9898ea6ab8569e42f09b7702c0eabbcdb7182c4b37afa2b9d0edfa92b53e68ef9c213c0ee7903f2fc

Download Submit
\Users\Admin\AppData\Local\Temp\BlastedCrack.exe

Filesize
17KB

MD5
21f525dd782bb2ccf33e2f3ec6c85660

SHA1
5bc5763dd316385d5feab0274b24ac7cbb2790a0

SHA256
ea2e948a4c0224a15195153a0aa10600047d04aa634a19fd388c26810db6847e

SHA512
0f56a381db55c17f570aaccfa46ab17900e563a0307bb232b61b17cebf305dbe7b762ad722daa239e71dfedc024df076806cdf9b4702d009457a6b054a753c0c

Download Submit
\Users\Admin\AppData\Local\Temp\Cracker.exe

Filesize
4.0MB

MD5
2b7ed32dc61c861ffd3e9e35a208aafe

SHA1
307dcf28a2b397e8b22a3f31290bb30045853787

SHA256
568030e4ac1923f3d261c5bb137481c2db277a30957db6fef76b60381f75051b

SHA512
a1550f037c74ffee99ca0db21fcc46e06f24394c88c8b3b9171de97dc8eb7f5aa74eb4c3185b9956c529430da5511c901a5488c54b7370d7758476e31dfe254d

Download Submit
memory/1904-177-0x0000000001210000-0x000000000159E000-memory.dmp

Filesize
3.6MB

Download
memory/1920-119-0x0000000001090000-0x000000000141E000-memory.dmp

Filesize
3.6MB

Download
memory/1972-320-0x00000000001D0000-0x000000000055E000-memory.dmp

Filesize
3.6MB

Download
memory/2004-349-0x0000000000F80000-0x000000000130E000-memory.dmp

Filesize
3.6MB

Download
memory/2576-38-0x0000000000E70000-0x0000000000E7A000-memory.dmp

Filesize
40KB

Download
memory/2636-56-0x00000000003F0000-0x0000000000400000-memory.dmp

Filesize
64KB

Download
memory/2636-68-0x0000000000670000-0x0000000000682000-memory.dmp

Filesize
72KB

Download
memory/2636-84-0x0000000000B70000-0x0000000000B88000-memory.dmp

Filesize
96KB

Download
memory/2636-86-0x0000000000B50000-0x0000000000B5C000-memory.dmp

Filesize
48KB

Download
memory/2636-88-0x0000000000FC0000-0x000000000100E000-memory.dmp

Filesize
312KB

Download
memory/2636-80-0x0000000000690000-0x00000000006A0000-memory.dmp

Filesize
64KB

Download
memory/2636-78-0x0000000000630000-0x000000000063E000-memory.dmp

Filesize
56KB

Download
memory/2636-76-0x0000000000E90000-0x0000000000EEA000-memory.dmp

Filesize
360KB

Download
memory/2636-74-0x0000000000620000-0x0000000000630000-memory.dmp

Filesize
64KB

Download
memory/2636-72-0x0000000000610000-0x0000000000620000-memory.dmp

Filesize
64KB

Download
memory/2636-70-0x00000000005E0000-0x00000000005EE000-memory.dmp

Filesize
56KB

Download
memory/2636-82-0x00000000006A0000-0x00000000006AE000-memory.dmp

Filesize
56KB

Download
memory/2636-66-0x0000000000650000-0x0000000000666000-memory.dmp

Filesize
88KB

Download
memory/2636-64-0x00000000005D0000-0x00000000005E0000-memory.dmp

Filesize
64KB

Download
memory/2636-62-0x00000000005F0000-0x0000000000602000-memory.dmp

Filesize
72KB

Download
memory/2636-60-0x00000000005C0000-0x00000000005CE000-memory.dmp

Filesize
56KB

Download
memory/2636-58-0x0000000000410000-0x0000000000420000-memory.dmp

Filesize
64KB

Download
memory/2636-54-0x0000000000420000-0x0000000000438000-memory.dmp

Filesize
96KB

Download
memory/2636-52-0x00000000003E0000-0x00000000003F0000-memory.dmp

Filesize
64KB

Download
memory/2636-44-0x00000000011F0000-0x000000000157E000-memory.dmp

Filesize
3.6MB

Download
memory/2636-50-0x00000000003C0000-0x00000000003DC000-memory.dmp

Filesize
112KB

Download
memory/2636-48-0x00000000003B0000-0x00000000003BE000-memory.dmp

Filesize
56KB

Download
memory/2636-46-0x0000000000180000-0x00000000001A6000-memory.dmp

Filesize
152KB

Download
memory/2900-290-0x0000000000360000-0x00000000006EE000-memory.dmp

Filesize
3.6MB

Download