Overview

overview

10

Static

static

3

e47d5a381d...eN.exe

windows7-x64

10

e47d5a381d...eN.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    119s
  • max time network
    120s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    12-11-2024 18:41

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    e47d5a381d3c9816f5886f278c8f3189457c55137c8042cc7131dea69572af2eN.exe

  • Size

    4.9MB

  • MD5

    af89c377c4187104880b9716a2291940

  • SHA1

    078bee54ed2d3935c55bf589d76eaba3af1ccb96

  • SHA256

    e47d5a381d3c9816f5886f278c8f3189457c55137c8042cc7131dea69572af2e

  • SHA512

    6bc81561adfa39cf3d0d4821799875b55ce5912009b6421113039a33100f9b2cf8d1770ac131a4a4cb0d811c2f2f8f790126a3a718a484096568728a52233762

  • SSDEEP

    49152:Dl5MTGChZpxtlBBgxchXb/zqP6DUtRgs5q289dAnSz44hnW1XgnYu6fYmPkMSx8E:

Score
10/10
dcratevasionexecutioninfostealerrattrojan

Malware Config

Signatures

  • DcRat

    DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

    ratinfostealerdcrat
  • Dcrat family
    dcrat
  • Process spawned unexpected child process 54 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • UAC bypass 3 TTPs 30 IoCs
    evasiontrojan
  • DCRat payload 1 IoCs

    Detects payload of DCRat, commonly dropped by NSIS installers.

    rat
  • Command and Scripting Interpreter: PowerShell 1 TTPs 12 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution
  • Executes dropped EXE 9 IoCs
  • Checks whether UAC is enabled 1 TTPs 20 IoCs
    evasiontrojan
  • Drops file in Program Files directory 16 IoCs
  • Drops file in Windows directory 13 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Scheduled Task/Job: Scheduled Task 1 TTPs 54 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistenceexecution
  • Suspicious behavior: EnumeratesProcesses 24 IoCs
  • Suspicious use of AdjustPrivilegeToken 22 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • System policy modification 1 TTPs 30 IoCs
    evasion
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\e47d5a381d3c9816f5886f278c8f3189457c55137c8042cc7131dea69572af2eN.exe
    "C:\Users\Admin\AppData\Local\Temp\e47d5a381d3c9816f5886f278c8f3189457c55137c8042cc7131dea69572af2eN.exe"
    1⤵
    • UAC bypass
    • Checks whether UAC is enabled
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    • System policy modification
    PID:2100
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:/'
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:1748
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:/$Recycle.Bin/'
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:696
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Documents and Settings/'
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:684
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:/MSOCache/'
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2108
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:/PerfLogs/'
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2244
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files/'
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:1288
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files (x86)/'
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2668
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:/ProgramData/'
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:940
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Recovery/'
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2204
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:/System Volume Information/'
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2824
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Users/'
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:1920
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Windows/'
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2068
    • C:\Windows\Tasks\audiodg.exe
      "C:\Windows\Tasks\audiodg.exe"
      2⤵
      • UAC bypass
      • Executes dropped EXE
      • Checks whether UAC is enabled
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      • System policy modification
      PID:1620
      • C:\Windows\System32\WScript.exe
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\97b4586e-221a-4d88-8af0-0ee6812e3a7f.vbs"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:1168
        • C:\Windows\Tasks\audiodg.exe
          C:\Windows\Tasks\audiodg.exe
          4⤵
          • UAC bypass
          • Executes dropped EXE
          • Checks whether UAC is enabled
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          • System policy modification
          PID:1468
          • C:\Windows\System32\WScript.exe
            "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\0edcf5c9-fbf2-43e4-9ca8-03d6d193c217.vbs"
            5⤵
            • Suspicious use of WriteProcessMemory
            PID:320
            • C:\Windows\Tasks\audiodg.exe
              C:\Windows\Tasks\audiodg.exe
              6⤵
              • UAC bypass
              • Executes dropped EXE
              • Checks whether UAC is enabled
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              • Suspicious use of WriteProcessMemory
              • System policy modification
              PID:2144
              • C:\Windows\System32\WScript.exe
                "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\ecf0a31e-4f1c-4256-ad2f-9a7314462b6b.vbs"
                7⤵
                • Suspicious use of WriteProcessMemory
                PID:2888
                • C:\Windows\Tasks\audiodg.exe
                  C:\Windows\Tasks\audiodg.exe
                  8⤵
                  • UAC bypass
                  • Executes dropped EXE
                  • Checks whether UAC is enabled
                  • Suspicious behavior: EnumeratesProcesses
                  • Suspicious use of AdjustPrivilegeToken
                  • System policy modification
                  PID:2700
                  • C:\Windows\System32\WScript.exe
                    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\ee93df7c-46f5-41d8-8c0e-8ec760a9a247.vbs"
                    9⤵
                      PID:1600
                      • C:\Windows\Tasks\audiodg.exe
                        C:\Windows\Tasks\audiodg.exe
                        10⤵
                        • UAC bypass
                        • Executes dropped EXE
                        • Checks whether UAC is enabled
                        • Suspicious behavior: EnumeratesProcesses
                        • Suspicious use of AdjustPrivilegeToken
                        • System policy modification
                        PID:2264
                        • C:\Windows\System32\WScript.exe
                          "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\f4d0ec0e-71af-4b78-8265-33539a8b42dc.vbs"
                          11⤵
                            PID:2616
                            • C:\Windows\Tasks\audiodg.exe
                              C:\Windows\Tasks\audiodg.exe
                              12⤵
                              • UAC bypass
                              • Executes dropped EXE
                              • Checks whether UAC is enabled
                              • Suspicious behavior: EnumeratesProcesses
                              • Suspicious use of AdjustPrivilegeToken
                              • System policy modification
                              PID:1660
                              • C:\Windows\System32\WScript.exe
                                "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\38cda287-abc8-4acb-b2f1-e85a95a22957.vbs"
                                13⤵
                                  PID:2132
                                  • C:\Windows\Tasks\audiodg.exe
                                    C:\Windows\Tasks\audiodg.exe
                                    14⤵
                                    • UAC bypass
                                    • Executes dropped EXE
                                    • Checks whether UAC is enabled
                                    • Suspicious behavior: EnumeratesProcesses
                                    • Suspicious use of AdjustPrivilegeToken
                                    • System policy modification
                                    PID:3044
                                    • C:\Windows\System32\WScript.exe
                                      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\691dd687-bfa1-4d2d-8523-1bcc367f2e0a.vbs"
                                      15⤵
                                        PID:352
                                        • C:\Windows\Tasks\audiodg.exe
                                          C:\Windows\Tasks\audiodg.exe
                                          16⤵
                                          • UAC bypass
                                          • Executes dropped EXE
                                          • Checks whether UAC is enabled
                                          • Suspicious behavior: EnumeratesProcesses
                                          • Suspicious use of AdjustPrivilegeToken
                                          • System policy modification
                                          PID:2972
                                          • C:\Windows\System32\WScript.exe
                                            "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\b8e5825a-1768-4bc5-845c-8a8a930bee9f.vbs"
                                            17⤵
                                              PID:1356
                                              • C:\Windows\Tasks\audiodg.exe
                                                C:\Windows\Tasks\audiodg.exe
                                                18⤵
                                                • UAC bypass
                                                • Executes dropped EXE
                                                • Checks whether UAC is enabled
                                                • Suspicious behavior: EnumeratesProcesses
                                                • Suspicious use of AdjustPrivilegeToken
                                                • System policy modification
                                                PID:2512
                                                • C:\Windows\System32\WScript.exe
                                                  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\d4f59d68-69ef-410c-8386-e006fc9ae17c.vbs"
                                                  19⤵
                                                    PID:884
                                                  • C:\Windows\System32\WScript.exe
                                                    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\836eaac4-b57d-446f-874f-c3d55ff80704.vbs"
                                                    19⤵
                                                      PID:2408
                                                • C:\Windows\System32\WScript.exe
                                                  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\4d56a2c5-69d1-48bf-9764-3bb31cd63c6d.vbs"
                                                  17⤵
                                                    PID:2516
                                              • C:\Windows\System32\WScript.exe
                                                "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\ed4403c9-a003-42cd-a95a-ef3926d7f882.vbs"
                                                15⤵
                                                  PID:2832
                                            • C:\Windows\System32\WScript.exe
                                              "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\12d914a6-764c-4970-b312-5fdf49ea364b.vbs"
                                              13⤵
                                                PID:2904
                                          • C:\Windows\System32\WScript.exe
                                            "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\d053a277-488b-40f3-a1dd-38976c3b9ae3.vbs"
                                            11⤵
                                              PID:2632
                                        • C:\Windows\System32\WScript.exe
                                          "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\f90fb209-4a1f-4866-8ccc-e59be81c0ed5.vbs"
                                          9⤵
                                            PID:2096
                                      • C:\Windows\System32\WScript.exe
                                        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\22d3ea18-8a6e-4aff-8ed1-87cf99cb26bf.vbs"
                                        7⤵
                                          PID:780
                                    • C:\Windows\System32\WScript.exe
                                      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\d7b6ab5c-2333-4b77-b687-11d4e872ab97.vbs"
                                      5⤵
                                        PID:2836
                                  • C:\Windows\System32\WScript.exe
                                    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\8dbb594f-8872-4a77-a16b-5a7234db6ada.vbs"
                                    3⤵
                                      PID:2920
                                • C:\Windows\system32\schtasks.exe
                                  schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 9 /tr "'C:\Recovery\18fc4542-69f6-11ef-a46c-62cb582c238c\csrss.exe'" /f
                                  1⤵
                                  • Process spawned unexpected child process
                                  • Scheduled Task/Job: Scheduled Task
                                  PID:600
                                • C:\Windows\system32\schtasks.exe
                                  schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Recovery\18fc4542-69f6-11ef-a46c-62cb582c238c\csrss.exe'" /rl HIGHEST /f
                                  1⤵
                                  • Process spawned unexpected child process
                                  • Scheduled Task/Job: Scheduled Task
                                  PID:2848
                                • C:\Windows\system32\schtasks.exe
                                  schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 8 /tr "'C:\Recovery\18fc4542-69f6-11ef-a46c-62cb582c238c\csrss.exe'" /rl HIGHEST /f
                                  1⤵
                                  • Process spawned unexpected child process
                                  • Scheduled Task/Job: Scheduled Task
                                  PID:2860
                                • C:\Windows\system32\schtasks.exe
                                  schtasks.exe /create /tn "audiodga" /sc MINUTE /mo 5 /tr "'C:\Windows\Tasks\audiodg.exe'" /f
                                  1⤵
                                  • Process spawned unexpected child process
                                  • Scheduled Task/Job: Scheduled Task
                                  PID:2984
                                • C:\Windows\system32\schtasks.exe
                                  schtasks.exe /create /tn "audiodg" /sc ONLOGON /tr "'C:\Windows\Tasks\audiodg.exe'" /rl HIGHEST /f
                                  1⤵
                                  • Process spawned unexpected child process
                                  • Scheduled Task/Job: Scheduled Task
                                  PID:2980
                                • C:\Windows\system32\schtasks.exe
                                  schtasks.exe /create /tn "audiodga" /sc MINUTE /mo 13 /tr "'C:\Windows\Tasks\audiodg.exe'" /rl HIGHEST /f
                                  1⤵
                                  • Process spawned unexpected child process
                                  • Scheduled Task/Job: Scheduled Task
                                  PID:2876
                                • C:\Windows\system32\schtasks.exe
                                  schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 12 /tr "'C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\wininit.exe'" /f
                                  1⤵
                                  • Process spawned unexpected child process
                                  • Scheduled Task/Job: Scheduled Task
                                  PID:2676
                                • C:\Windows\system32\schtasks.exe
                                  schtasks.exe /create /tn "wininit" /sc ONLOGON /tr "'C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\wininit.exe'" /rl HIGHEST /f
                                  1⤵
                                  • Process spawned unexpected child process
                                  • Scheduled Task/Job: Scheduled Task
                                  PID:2800
                                • C:\Windows\system32\schtasks.exe
                                  schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 13 /tr "'C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\wininit.exe'" /rl HIGHEST /f
                                  1⤵
                                  • Process spawned unexpected child process
                                  • Scheduled Task/Job: Scheduled Task
                                  PID:2868
                                • C:\Windows\system32\schtasks.exe
                                  schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 7 /tr "'C:\Program Files (x86)\Microsoft Sync Framework\v1.0\Documentation\1033\License Agreements\System.exe'" /f
                                  1⤵
                                  • Process spawned unexpected child process
                                  • Scheduled Task/Job: Scheduled Task
                                  PID:2680
                                • C:\Windows\system32\schtasks.exe
                                  schtasks.exe /create /tn "System" /sc ONLOGON /tr "'C:\Program Files (x86)\Microsoft Sync Framework\v1.0\Documentation\1033\License Agreements\System.exe'" /rl HIGHEST /f
                                  1⤵
                                  • Process spawned unexpected child process
                                  • Scheduled Task/Job: Scheduled Task
                                  PID:2756
                                • C:\Windows\system32\schtasks.exe
                                  schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 7 /tr "'C:\Program Files (x86)\Microsoft Sync Framework\v1.0\Documentation\1033\License Agreements\System.exe'" /rl HIGHEST /f
                                  1⤵
                                  • Process spawned unexpected child process
                                  • Scheduled Task/Job: Scheduled Task
                                  PID:2244
                                • C:\Windows\system32\schtasks.exe
                                  schtasks.exe /create /tn "explorere" /sc MINUTE /mo 9 /tr "'C:\Users\Default User\explorer.exe'" /f
                                  1⤵
                                  • Process spawned unexpected child process
                                  • Scheduled Task/Job: Scheduled Task
                                  PID:2240
                                • C:\Windows\system32\schtasks.exe
                                  schtasks.exe /create /tn "explorer" /sc ONLOGON /tr "'C:\Users\Default User\explorer.exe'" /rl HIGHEST /f
                                  1⤵
                                  • Process spawned unexpected child process
                                  • Scheduled Task/Job: Scheduled Task
                                  PID:868
                                • C:\Windows\system32\schtasks.exe
                                  schtasks.exe /create /tn "explorere" /sc MINUTE /mo 13 /tr "'C:\Users\Default User\explorer.exe'" /rl HIGHEST /f
                                  1⤵
                                  • Process spawned unexpected child process
                                  • Scheduled Task/Job: Scheduled Task
                                  PID:1672
                                • C:\Windows\system32\schtasks.exe
                                  schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 11 /tr "'C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\Desktop\lsass.exe'" /f
                                  1⤵
                                  • Process spawned unexpected child process
                                  • Scheduled Task/Job: Scheduled Task
                                  PID:2696
                                • C:\Windows\system32\schtasks.exe
                                  schtasks.exe /create /tn "lsass" /sc ONLOGON /tr "'C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\Desktop\lsass.exe'" /rl HIGHEST /f
                                  1⤵
                                  • Process spawned unexpected child process
                                  • Scheduled Task/Job: Scheduled Task
                                  PID:540
                                • C:\Windows\system32\schtasks.exe
                                  schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 10 /tr "'C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\Desktop\lsass.exe'" /rl HIGHEST /f
                                  1⤵
                                  • Process spawned unexpected child process
                                  • Scheduled Task/Job: Scheduled Task
                                  PID:1228
                                • C:\Windows\system32\schtasks.exe
                                  schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 11 /tr "'C:\Users\Public\Documents\My Pictures\winlogon.exe'" /f
                                  1⤵
                                  • Process spawned unexpected child process
                                  • Scheduled Task/Job: Scheduled Task
                                  PID:2460
                                • C:\Windows\system32\schtasks.exe
                                  schtasks.exe /create /tn "winlogon" /sc ONLOGON /tr "'C:\Users\Public\Documents\My Pictures\winlogon.exe'" /rl HIGHEST /f
                                  1⤵
                                  • Process spawned unexpected child process
                                  • Scheduled Task/Job: Scheduled Task
                                  PID:1936
                                • C:\Windows\system32\schtasks.exe
                                  schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 9 /tr "'C:\Users\Public\Documents\My Pictures\winlogon.exe'" /rl HIGHEST /f
                                  1⤵
                                  • Process spawned unexpected child process
                                  • Scheduled Task/Job: Scheduled Task
                                  PID:1972
                                • C:\Windows\system32\schtasks.exe
                                  schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 12 /tr "'C:\Recovery\18fc4542-69f6-11ef-a46c-62cb582c238c\wininit.exe'" /f
                                  1⤵
                                  • Process spawned unexpected child process
                                  • Scheduled Task/Job: Scheduled Task
                                  PID:2936
                                • C:\Windows\system32\schtasks.exe
                                  schtasks.exe /create /tn "wininit" /sc ONLOGON /tr "'C:\Recovery\18fc4542-69f6-11ef-a46c-62cb582c238c\wininit.exe'" /rl HIGHEST /f
                                  1⤵
                                  • Process spawned unexpected child process
                                  • Scheduled Task/Job: Scheduled Task
                                  PID:812
                                • C:\Windows\system32\schtasks.exe
                                  schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 7 /tr "'C:\Recovery\18fc4542-69f6-11ef-a46c-62cb582c238c\wininit.exe'" /rl HIGHEST /f
                                  1⤵
                                  • Process spawned unexpected child process
                                  • Scheduled Task/Job: Scheduled Task
                                  PID:336
                                • C:\Windows\system32\schtasks.exe
                                  schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 6 /tr "'C:\Windows\security\templates\dllhost.exe'" /f
                                  1⤵
                                  • Process spawned unexpected child process
                                  • Scheduled Task/Job: Scheduled Task
                                  PID:2824
                                • C:\Windows\system32\schtasks.exe
                                  schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Windows\security\templates\dllhost.exe'" /rl HIGHEST /f
                                  1⤵
                                  • Process spawned unexpected child process
                                  • Scheduled Task/Job: Scheduled Task
                                  PID:2512
                                • C:\Windows\system32\schtasks.exe
                                  schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 6 /tr "'C:\Windows\security\templates\dllhost.exe'" /rl HIGHEST /f
                                  1⤵
                                  • Process spawned unexpected child process
                                  • Scheduled Task/Job: Scheduled Task
                                  PID:352
                                • C:\Windows\system32\schtasks.exe
                                  schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 13 /tr "'C:\Users\Admin\Searches\spoolsv.exe'" /f
                                  1⤵
                                  • Process spawned unexpected child process
                                  • Scheduled Task/Job: Scheduled Task
                                  PID:2732
                                • C:\Windows\system32\schtasks.exe
                                  schtasks.exe /create /tn "spoolsv" /sc ONLOGON /tr "'C:\Users\Admin\Searches\spoolsv.exe'" /rl HIGHEST /f
                                  1⤵
                                  • Process spawned unexpected child process
                                  • Scheduled Task/Job: Scheduled Task
                                  PID:2008
                                • C:\Windows\system32\schtasks.exe
                                  schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 7 /tr "'C:\Users\Admin\Searches\spoolsv.exe'" /rl HIGHEST /f
                                  1⤵
                                  • Process spawned unexpected child process
                                  • Scheduled Task/Job: Scheduled Task
                                  PID:1072
                                • C:\Windows\system32\schtasks.exe
                                  schtasks.exe /create /tn "OSPPSVCO" /sc MINUTE /mo 14 /tr "'C:\Recovery\18fc4542-69f6-11ef-a46c-62cb582c238c\OSPPSVC.exe'" /f
                                  1⤵
                                  • Process spawned unexpected child process
                                  • Scheduled Task/Job: Scheduled Task
                                  PID:920
                                • C:\Windows\system32\schtasks.exe
                                  schtasks.exe /create /tn "OSPPSVC" /sc ONLOGON /tr "'C:\Recovery\18fc4542-69f6-11ef-a46c-62cb582c238c\OSPPSVC.exe'" /rl HIGHEST /f
                                  1⤵
                                  • Process spawned unexpected child process
                                  • Scheduled Task/Job: Scheduled Task
                                  PID:1108
                                • C:\Windows\system32\schtasks.exe
                                  schtasks.exe /create /tn "OSPPSVCO" /sc MINUTE /mo 12 /tr "'C:\Recovery\18fc4542-69f6-11ef-a46c-62cb582c238c\OSPPSVC.exe'" /rl HIGHEST /f
                                  1⤵
                                  • Process spawned unexpected child process
                                  • Scheduled Task/Job: Scheduled Task
                                  PID:3008
                                • C:\Windows\system32\schtasks.exe
                                  schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 5 /tr "'C:\Windows\Registration\CRMLog\Idle.exe'" /f
                                  1⤵
                                  • Process spawned unexpected child process
                                  • Scheduled Task/Job: Scheduled Task
                                  PID:780
                                • C:\Windows\system32\schtasks.exe
                                  schtasks.exe /create /tn "Idle" /sc ONLOGON /tr "'C:\Windows\Registration\CRMLog\Idle.exe'" /rl HIGHEST /f
                                  1⤵
                                  • Process spawned unexpected child process
                                  • Scheduled Task/Job: Scheduled Task
                                  PID:1544
                                • C:\Windows\system32\schtasks.exe
                                  schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 12 /tr "'C:\Windows\Registration\CRMLog\Idle.exe'" /rl HIGHEST /f
                                  1⤵
                                  • Process spawned unexpected child process
                                  • Scheduled Task/Job: Scheduled Task
                                  PID:1136
                                • C:\Windows\system32\schtasks.exe
                                  schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 9 /tr "'C:\MSOCache\All Users\{90140000-0116-0409-1000-0000000FF1CE}-C\dllhost.exe'" /f
                                  1⤵
                                  • Process spawned unexpected child process
                                  • Scheduled Task/Job: Scheduled Task
                                  PID:1296
                                • C:\Windows\system32\schtasks.exe
                                  schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-0116-0409-1000-0000000FF1CE}-C\dllhost.exe'" /rl HIGHEST /f
                                  1⤵
                                  • Process spawned unexpected child process
                                  • Scheduled Task/Job: Scheduled Task
                                  PID:2220
                                • C:\Windows\system32\schtasks.exe
                                  schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 13 /tr "'C:\MSOCache\All Users\{90140000-0116-0409-1000-0000000FF1CE}-C\dllhost.exe'" /rl HIGHEST /f
                                  1⤵
                                  • Process spawned unexpected child process
                                  • Scheduled Task/Job: Scheduled Task
                                  PID:2004
                                • C:\Windows\system32\schtasks.exe
                                  schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 7 /tr "'C:\MSOCache\All Users\{90140000-001A-0409-0000-0000000FF1CE}-C\csrss.exe'" /f
                                  1⤵
                                  • Process spawned unexpected child process
                                  • Scheduled Task/Job: Scheduled Task
                                  PID:1788
                                • C:\Windows\system32\schtasks.exe
                                  schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-001A-0409-0000-0000000FF1CE}-C\csrss.exe'" /rl HIGHEST /f
                                  1⤵
                                  • Process spawned unexpected child process
                                  • Scheduled Task/Job: Scheduled Task
                                  PID:2288
                                • C:\Windows\system32\schtasks.exe
                                  schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 12 /tr "'C:\MSOCache\All Users\{90140000-001A-0409-0000-0000000FF1CE}-C\csrss.exe'" /rl HIGHEST /f
                                  1⤵
                                  • Process spawned unexpected child process
                                  • Scheduled Task/Job: Scheduled Task
                                  PID:1044
                                • C:\Windows\system32\schtasks.exe
                                  schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 9 /tr "'C:\Recovery\18fc4542-69f6-11ef-a46c-62cb582c238c\wininit.exe'" /f
                                  1⤵
                                  • Process spawned unexpected child process
                                  • Scheduled Task/Job: Scheduled Task
                                  PID:2604
                                • C:\Windows\system32\schtasks.exe
                                  schtasks.exe /create /tn "wininit" /sc ONLOGON /tr "'C:\Recovery\18fc4542-69f6-11ef-a46c-62cb582c238c\wininit.exe'" /rl HIGHEST /f
                                  1⤵
                                  • Process spawned unexpected child process
                                  • Scheduled Task/Job: Scheduled Task
                                  PID:1852
                                • C:\Windows\system32\schtasks.exe
                                  schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 12 /tr "'C:\Recovery\18fc4542-69f6-11ef-a46c-62cb582c238c\wininit.exe'" /rl HIGHEST /f
                                  1⤵
                                  • Process spawned unexpected child process
                                  • Scheduled Task/Job: Scheduled Task
                                  PID:716
                                • C:\Windows\system32\schtasks.exe
                                  schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 13 /tr "'C:\Recovery\18fc4542-69f6-11ef-a46c-62cb582c238c\Idle.exe'" /f
                                  1⤵
                                  • Process spawned unexpected child process
                                  • Scheduled Task/Job: Scheduled Task
                                  PID:2280
                                • C:\Windows\system32\schtasks.exe
                                  schtasks.exe /create /tn "Idle" /sc ONLOGON /tr "'C:\Recovery\18fc4542-69f6-11ef-a46c-62cb582c238c\Idle.exe'" /rl HIGHEST /f
                                  1⤵
                                  • Process spawned unexpected child process
                                  • Scheduled Task/Job: Scheduled Task
                                  PID:2488
                                • C:\Windows\system32\schtasks.exe
                                  schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 9 /tr "'C:\Recovery\18fc4542-69f6-11ef-a46c-62cb582c238c\Idle.exe'" /rl HIGHEST /f
                                  1⤵
                                  • Process spawned unexpected child process
                                  • Scheduled Task/Job: Scheduled Task
                                  PID:2260
                                • C:\Windows\system32\schtasks.exe
                                  schtasks.exe /create /tn "lsml" /sc MINUTE /mo 11 /tr "'C:\Recovery\18fc4542-69f6-11ef-a46c-62cb582c238c\lsm.exe'" /f
                                  1⤵
                                  • Process spawned unexpected child process
                                  • Scheduled Task/Job: Scheduled Task
                                  PID:320
                                • C:\Windows\system32\schtasks.exe
                                  schtasks.exe /create /tn "lsm" /sc ONLOGON /tr "'C:\Recovery\18fc4542-69f6-11ef-a46c-62cb582c238c\lsm.exe'" /rl HIGHEST /f
                                  1⤵
                                  • Process spawned unexpected child process
                                  • Scheduled Task/Job: Scheduled Task
                                  PID:348
                                • C:\Windows\system32\schtasks.exe
                                  schtasks.exe /create /tn "lsml" /sc MINUTE /mo 13 /tr "'C:\Recovery\18fc4542-69f6-11ef-a46c-62cb582c238c\lsm.exe'" /rl HIGHEST /f
                                  1⤵
                                  • Process spawned unexpected child process
                                  • Scheduled Task/Job: Scheduled Task
                                  PID:884
                                • C:\Windows\system32\schtasks.exe
                                  schtasks.exe /create /tn "smsss" /sc MINUTE /mo 9 /tr "'C:\Program Files (x86)\Windows Defender\fr-FR\smss.exe'" /f
                                  1⤵
                                  • Process spawned unexpected child process
                                  • Scheduled Task/Job: Scheduled Task
                                  PID:2248
                                • C:\Windows\system32\schtasks.exe
                                  schtasks.exe /create /tn "smss" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Defender\fr-FR\smss.exe'" /rl HIGHEST /f
                                  1⤵
                                  • Process spawned unexpected child process
                                  • Scheduled Task/Job: Scheduled Task
                                  PID:1528
                                • C:\Windows\system32\schtasks.exe
                                  schtasks.exe /create /tn "smsss" /sc MINUTE /mo 7 /tr "'C:\Program Files (x86)\Windows Defender\fr-FR\smss.exe'" /rl HIGHEST /f
                                  1⤵
                                  • Process spawned unexpected child process
                                  • Scheduled Task/Job: Scheduled Task
                                  PID:1520

                                Network

                                MITRE ATT&CK Enterprise v15

                                Replay Monitor

                                Loading Replay Monitor...

                                Downloads

                                • C:\Program Files (x86)\Windows Defender\fr-FR\RCXF5A7.tmp
                                  Filesize

                                  4.9MB

                                  MD5

                                  69faec69fa2ef4a766ce52b2ae8afcde

                                  SHA1

                                  889962d312f2ed5a084a60070beb5190be8dee95

                                  SHA256

                                  99ef6abfe865530a13372ede07c14c6062ed6aad42f3d7129ffe9eebd7316cae

                                  SHA512

                                  81565731891df6b915f93a24af8a3d84a625203d32984b3011056a00acda43c37011bfba999d72b4bad5fc41c48905ae9b70c6493f14a6100fa9a2c26da25b73

                                  Download Submit

                                • C:\Recovery\18fc4542-69f6-11ef-a46c-62cb582c238c\lsm.exe
                                  Filesize

                                  4.9MB

                                  MD5

                                  8a7b87c5c5cea9b70f566d9b287d6e19

                                  SHA1

                                  1cc1c5eb5a5c22ce8a716d31e3ea031f1dceebf0

                                  SHA256

                                  640f36454e6518b1753288e4014e761d629f68cacb30fd4cc850167891e21af9

                                  SHA512

                                  ac4edb53c13e52b51808b4e02271889694b8edcf2bcb9b12a1935505ebcd6454919dc7d08cbca647714bbd1c400992ba7cc354106adf1f7184cac2c9e856ff6e

                                  Download Submit

                                • C:\Users\Admin\AppData\Local\Temp\0edcf5c9-fbf2-43e4-9ca8-03d6d193c217.vbs
                                  Filesize

                                  704B

                                  MD5

                                  e3c265729f5e1b30c144d8f3b64eec16

                                  SHA1

                                  8c6ec544ba7c08748533e82a99185de40032fadc

                                  SHA256

                                  6c59528af09536b5f2047b381e47cf9bbdf008282a65c05e423c5384969bf09b

                                  SHA512

                                  45023eec260249cbfd542a936e6977f60f2edb05065f96db33985ac298c5241c27f6829cc63ea316a27f1a7023c1961a78fe7c902db4b3fccb6874d40e73fab0

                                  Download Submit

                                • C:\Users\Admin\AppData\Local\Temp\38cda287-abc8-4acb-b2f1-e85a95a22957.vbs
                                  Filesize

                                  704B

                                  MD5

                                  0cfbd6b4dd8519b71f2a00b0030a9275

                                  SHA1

                                  36e3f11baa1d36b294dfd54af2fb2911c214237d

                                  SHA256

                                  4a32579db562452585baa75f940208140bea64394c2027cdc65cb7845deedc0b

                                  SHA512

                                  b26a0a07831ae153bf082b5254b89089736716975950bda844cacaaeec9ab72284e871bf15f8bfcaea2d79cd5864c428259277f680f8b46ebce015181c1b9c67

                                  Download Submit

                                • C:\Users\Admin\AppData\Local\Temp\691dd687-bfa1-4d2d-8523-1bcc367f2e0a.vbs
                                  Filesize

                                  704B

                                  MD5

                                  88e8d768e2f5ba9d7a32b89f2c8b87b9

                                  SHA1

                                  0d1cf039642baa24a58193bccb2653b7a6a39573

                                  SHA256

                                  b59e493067e760c720403bde3e4cb97e1e50446f203205935f4139f284dc3151

                                  SHA512

                                  8471b4484427cea74deaae0148c5034fe01dac256b4a98b48b1dd6a5d18d799e8ff773d2f5f0d2448f05f67f15b96dd78ea942b9faf1f7a459b9783d6589bc7d

                                  Download Submit

                                • C:\Users\Admin\AppData\Local\Temp\8dbb594f-8872-4a77-a16b-5a7234db6ada.vbs
                                  Filesize

                                  480B

                                  MD5

                                  645bed1425bd559288b8597e86bd6554

                                  SHA1

                                  da82179ac95c932246db04c309295f71e24e4924

                                  SHA256

                                  abe1a434a48134a0e6aea59d2497099f1a27079e6971951e1688d09e2e2703f1

                                  SHA512

                                  427eb3b7e76a81480750813f368bf852ad125f245bf2ce95fc9994ded747c95bd208add66cb610788983a2ced20f0db9e6daa85f37781960bdbd7e1e0b9a0932

                                  Download Submit

                                • C:\Users\Admin\AppData\Local\Temp\97b4586e-221a-4d88-8af0-0ee6812e3a7f.vbs
                                  Filesize

                                  704B

                                  MD5

                                  a993db419467220a453200f00ac52d58

                                  SHA1

                                  5ac08e88ac9d237c1144ccfd58383b6d0e48ef9e

                                  SHA256

                                  7ebb6369df59b99b8eef8b94b655916999ca73c20f038ead20bd46b2ab94a683

                                  SHA512

                                  1326a0aae3cb7e2c1cf5ebb7e438e1c1f5ac8a51b13411ed4cd9599d6c4a043ffe8045f04b91f89e238a0c380820e1ab0a532de234f51ba5668568a2af25dfba

                                  Download Submit

                                • C:\Users\Admin\AppData\Local\Temp\b8e5825a-1768-4bc5-845c-8a8a930bee9f.vbs
                                  Filesize

                                  704B

                                  MD5

                                  8abe52ff5db527a4f673cd0a6ee22eb4

                                  SHA1

                                  b0a4803539e887715959c94953f050aceeec0447

                                  SHA256

                                  2699561e9653e792e8947b18b19927c7ecba60b2943ff1f9cfde1074339d7f33

                                  SHA512

                                  754b35770eced1ba6aee2b2801aa79161972d1d5a0b8d0b24cbe10c15fa9b4739e270cfb83923781b1e4d9f2547b53c35c7171d652c4bcebb077bb527a7c10e8

                                  Download Submit

                                • C:\Users\Admin\AppData\Local\Temp\d4f59d68-69ef-410c-8386-e006fc9ae17c.vbs
                                  Filesize

                                  704B

                                  MD5

                                  138703db57551e518094a39f3ab37f1c

                                  SHA1

                                  458eb1fdb240edb3e74e3bf3a76adbd5c2626939

                                  SHA256

                                  215d37d312b2780c1b2f262924b04d8425d66b60fa1cc9a2414049733dbb4d42

                                  SHA512

                                  250f7643fd47d1f77a50eee2051a4b2d0359477882899296693d60ed1a1f40de42c3cb41fea9b3a022eef1c57df5ba7305c8573b54397371d3087a899c9613da

                                  Download Submit

                                • C:\Users\Admin\AppData\Local\Temp\ecf0a31e-4f1c-4256-ad2f-9a7314462b6b.vbs
                                  Filesize

                                  704B

                                  MD5

                                  5defeeb4256e3ec11aa310973d5e2965

                                  SHA1

                                  2701bd242b382288b5bc00e500c8de610f219755

                                  SHA256

                                  356316ade6e6f754c36a5c70c989d1b8c17db77bdd5dd99eeeeeb8071476bee2

                                  SHA512

                                  272f41ec7223fd7ebbe7cd9b8812a131d9a005ceeae537d97276a1e0ef75b6ad4b00f3b839c0f2b93c258cc4da5988b0fa445edfa3df5a543025880bf9844b58

                                  Download Submit

                                • C:\Users\Admin\AppData\Local\Temp\ee93df7c-46f5-41d8-8c0e-8ec760a9a247.vbs
                                  Filesize

                                  704B

                                  MD5

                                  1185e7b7a9721db576caf4d8c2ee92ff

                                  SHA1

                                  bd0b0bb245f32415794bf3c720689534a5599d26

                                  SHA256

                                  c98ddcab2e79acbd585f48f85bfcb92966817ffb08271fc2b616afe706446750

                                  SHA512

                                  cfca5d949c76ca38747d63fea665da27c4dce7c524997652948e49d0f90670578456ec37bd1c342d752ddec5b1036deecac009639e3f6c7a61a3220dfcadc58b

                                  Download Submit

                                • C:\Users\Admin\AppData\Local\Temp\f4d0ec0e-71af-4b78-8265-33539a8b42dc.vbs
                                  Filesize

                                  704B

                                  MD5

                                  bf9b90f9862b3e98e3025bcb5a5a5005

                                  SHA1

                                  0b8aec2534b20354a738f1f847dc9f757462f6f3

                                  SHA256

                                  8384fcc4d6e90e39dc6a932839b1d0ae5ed0305127a4997cfbb8841b9ebe48c9

                                  SHA512

                                  44030f11c057c8940707021d83504a4139900dbd6ca13c6c0d0641a6af4de5970453dbc1f9e3bfea1eff2a08194b37c8577dcd6c03c639ebcbe62c15b28a3fbe

                                  Download Submit

                                • C:\Users\Admin\AppData\Local\Temp\tmpA3E.tmp.exe
                                  Filesize

                                  75KB

                                  MD5

                                  e0a68b98992c1699876f818a22b5b907

                                  SHA1

                                  d41e8ad8ba51217eb0340f8f69629ccb474484d0

                                  SHA256

                                  2b00d8c2bcc6b48e90524cdd41a07735dc94548ed41925baff86e43a61a4c37f

                                  SHA512

                                  856854f5fd89ae1669e4b2db10b73b4a78496bf80117003244c83e781f75e533e2e2bea9aa6c1b3aba3db1ed92ea0ed9755fbfd78cd6c86ba95867d07fc0ece2

                                  Download Submit

                                • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms
                                  Filesize

                                  7KB

                                  MD5

                                  3ce46dcd3c4e720efa3a96b7286e9a66

                                  SHA1

                                  bf590b2105e902ed8202b96f2fffcf7740bf114e

                                  SHA256

                                  d960ee6a5a8fed1ac7c2a07a23615fce83e5c1909f893bdb66396b9f895eae64

                                  SHA512

                                  e260c7f9fe9c534e912d4eb568d5d4bb8b05ced453ce1c8572e3a7c38f55d7de3c943ed45a332c075b0bbe2a53ab3ad0d6793baf37b25a8b94e7cb09249d4f7d

                                  Download Submit

                                • C:\Users\Default\explorer.exe
                                  Filesize

                                  4.9MB

                                  MD5

                                  af89c377c4187104880b9716a2291940

                                  SHA1

                                  078bee54ed2d3935c55bf589d76eaba3af1ccb96

                                  SHA256

                                  e47d5a381d3c9816f5886f278c8f3189457c55137c8042cc7131dea69572af2e

                                  SHA512

                                  6bc81561adfa39cf3d0d4821799875b55ce5912009b6421113039a33100f9b2cf8d1770ac131a4a4cb0d811c2f2f8f790126a3a718a484096568728a52233762

                                  Download Submit

                                • C:\Windows\Tasks\audiodg.exe
                                  Filesize

                                  4.9MB

                                  MD5

                                  2cab9b0b29b5e5bb6a859b5597026b3a

                                  SHA1

                                  37a8f0b3ce9e0965159ae4ffa334bf416838a028

                                  SHA256

                                  312800ca0e0794814ea43c67e67bb733de652f958f91b36bf9b8431eca498791

                                  SHA512

                                  ecbddc2d337a08d95bfaf082b35fa95e2aedbb2f8bfe290ae8c30510cd51f381c25648ff06ea27b7be0aa84a9dd66fad634f879428e7d374f04eb8b77ed44bbe

                                  Download Submit

                                • memory/684-212-0x0000000001EE0000-0x0000000001EE8000-memory.dmp

                                  Filesize

                                  32KB

                                  Download

                                • memory/684-210-0x000000001B7F0000-0x000000001BAD2000-memory.dmp

                                  Filesize

                                  2.9MB

                                  Download

                                • memory/1468-255-0x00000000000E0000-0x00000000005D4000-memory.dmp

                                  Filesize

                                  5.0MB

                                  Download

                                • memory/1620-240-0x0000000001280000-0x0000000001774000-memory.dmp

                                  Filesize

                                  5.0MB

                                  Download

                                • memory/1660-314-0x0000000000220000-0x0000000000714000-memory.dmp

                                  Filesize

                                  5.0MB

                                  Download

                                • memory/2100-11-0x0000000000C50000-0x0000000000C5A000-memory.dmp

                                  Filesize

                                  40KB

                                  Download

                                • memory/2100-9-0x0000000000C30000-0x0000000000C3A000-memory.dmp

                                  Filesize

                                  40KB

                                  Download

                                • memory/2100-144-0x000007FEF5FE3000-0x000007FEF5FE4000-memory.dmp

                                  Filesize

                                  4KB

                                  Download

                                • memory/2100-14-0x0000000000C80000-0x0000000000C88000-memory.dmp

                                  Filesize

                                  32KB

                                  Download

                                • memory/2100-16-0x00000000026A0000-0x00000000026AC000-memory.dmp

                                  Filesize

                                  48KB

                                  Download

                                • memory/2100-241-0x000007FEF5FE0000-0x000007FEF69CC000-memory.dmp

                                  Filesize

                                  9.9MB

                                  Download

                                • memory/2100-15-0x0000000002690000-0x0000000002698000-memory.dmp

                                  Filesize

                                  32KB

                                  Download

                                • memory/2100-13-0x0000000000C70000-0x0000000000C7E000-memory.dmp

                                  Filesize

                                  56KB

                                  Download

                                • memory/2100-12-0x0000000000C60000-0x0000000000C6E000-memory.dmp

                                  Filesize

                                  56KB

                                  Download

                                • memory/2100-0-0x000007FEF5FE3000-0x000007FEF5FE4000-memory.dmp

                                  Filesize

                                  4KB

                                  Download

                                • memory/2100-10-0x0000000000C40000-0x0000000000C52000-memory.dmp

                                  Filesize

                                  72KB

                                  Download

                                • memory/2100-153-0x000007FEF5FE0000-0x000007FEF69CC000-memory.dmp

                                  Filesize

                                  9.9MB

                                  Download

                                • memory/2100-1-0x0000000000C90000-0x0000000001184000-memory.dmp

                                  Filesize

                                  5.0MB

                                  Download

                                • memory/2100-8-0x00000000006E0000-0x00000000006F0000-memory.dmp

                                  Filesize

                                  64KB

                                  Download

                                • memory/2100-2-0x000007FEF5FE0000-0x000007FEF69CC000-memory.dmp

                                  Filesize

                                  9.9MB

                                  Download

                                • memory/2100-7-0x0000000000460000-0x0000000000476000-memory.dmp

                                  Filesize

                                  88KB

                                  Download

                                • memory/2100-6-0x0000000000450000-0x0000000000460000-memory.dmp

                                  Filesize

                                  64KB

                                  Download

                                • memory/2100-5-0x0000000000440000-0x0000000000448000-memory.dmp

                                  Filesize

                                  32KB

                                  Download

                                • memory/2100-4-0x0000000000310000-0x000000000032C000-memory.dmp

                                  Filesize

                                  112KB

                                  Download

                                • memory/2100-3-0x000000001B3A0000-0x000000001B4CE000-memory.dmp

                                  Filesize

                                  1.2MB

                                  Download

                                • memory/2144-270-0x0000000000190000-0x0000000000684000-memory.dmp

                                  Filesize

                                  5.0MB

                                  Download

                                • memory/2700-285-0x00000000013E0000-0x00000000018D4000-memory.dmp

                                  Filesize

                                  5.0MB

                                  Download

                                • memory/3044-329-0x0000000001020000-0x0000000001514000-memory.dmp

                                  Filesize

                                  5.0MB

                                  Download