dcrat | f543b442481590bfa4e57778879155abbe4e739b96d3639a16aa0c4d994a7d60

Analysis

max time kernel
149s
max time network
145s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
21-12-2024 17:25

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f543b442481590bfa4e57778879155abbe4e739b96d3639a16aa0c4d994a7d60.exe
Size

1.3MB
MD5

149deb76fffc51f9f1558e47e3cd22e4
SHA1

60fab8427e78a80d47f8d0a4e18096390e3c43b2
SHA256

f543b442481590bfa4e57778879155abbe4e739b96d3639a16aa0c4d994a7d60
SHA512

b5779d9fcec6463a54535ad751b43a585b78d1d9693af646ec73c2a0e540c518f93e9f9f33edc07f5e3941611de70da43d0e8ac2c86b79b8a567bbb607febbee
SSDEEP

24576:U2G/nvxW3Ww0t6TnzGmVBDh4+aknuRRZJND0gFJ4rD/IjC:UbA30GnzV/q+DnsXg

Score

10^/10

dcrat discovery execution infostealer rat

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat
Dcrat family
dcrat

Process spawned unexpected child process 15 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1784	2852	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2760	2852	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2600	2852	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2672	2852	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3052	2852	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3024	2852	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	592	2852	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1980	2852	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1312	2852	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1468	2852	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2696	2852	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1648	2852	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1620	2852	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	288	2852	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1996	2852	schtasks.exe	34

DCRat payload 9 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral1/files/0x0008000000016141-9.dat	dcrat
behavioral1/memory/2440-13-0x0000000001120000-0x0000000001230000-memory.dmp	dcrat
behavioral1/memory/2284-38-0x0000000000360000-0x0000000000470000-memory.dmp	dcrat
behavioral1/memory/2456-125-0x0000000000080000-0x0000000000190000-memory.dmp	dcrat
behavioral1/memory/1312-185-0x0000000001200000-0x0000000001310000-memory.dmp	dcrat
behavioral1/memory/752-245-0x0000000001390000-0x00000000014A0000-memory.dmp	dcrat
behavioral1/memory/2460-305-0x0000000000100000-0x0000000000210000-memory.dmp	dcrat
behavioral1/memory/2944-365-0x0000000000B70000-0x0000000000C80000-memory.dmp	dcrat
behavioral1/memory/1948-425-0x0000000001210000-0x0000000001320000-memory.dmp	dcrat

Command and Scripting Interpreter: PowerShell 1 TTPs 6 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
1992	powershell.exe
2088	powershell.exe
2772	powershell.exe
828	powershell.exe
2348	powershell.exe
1692	powershell.exe

Executes dropped EXE 13 IoCs

pid	Process
2440	DllCommonsvc.exe
2284	Idle.exe
2456	Idle.exe
1312	Idle.exe
752	Idle.exe
2460	Idle.exe
2944	Idle.exe
1948	Idle.exe
888	Idle.exe
2500	Idle.exe
2140	Idle.exe
2096	Idle.exe
2600	Idle.exe

Loads dropped DLL 2 IoCs

pid	Process
2136	cmd.exe
2136	cmd.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 12 IoCs

Web Service

T1102

flow	ioc
13	raw.githubusercontent.com
20	raw.githubusercontent.com
34	raw.githubusercontent.com
37	raw.githubusercontent.com
5	raw.githubusercontent.com
9	raw.githubusercontent.com
23	raw.githubusercontent.com
27	raw.githubusercontent.com
30	raw.githubusercontent.com
41	raw.githubusercontent.com
4	raw.githubusercontent.com
16	raw.githubusercontent.com

Drops file in Program Files directory 3 IoCs

description	ioc	Process
File created	C:\Program Files\Windows Sidebar\Gadgets\smss.exe	DllCommonsvc.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\smss.exe	DllCommonsvc.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\69ddcba757bf72	DllCommonsvc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	f543b442481590bfa4e57778879155abbe4e739b96d3639a16aa0c4d994a7d60.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 15 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
1784	schtasks.exe
2672	schtasks.exe
592	schtasks.exe
1620	schtasks.exe
3024	schtasks.exe
1468	schtasks.exe
2760	schtasks.exe
1312	schtasks.exe
2696	schtasks.exe
1648	schtasks.exe
288	schtasks.exe
2600	schtasks.exe
3052	schtasks.exe
1980	schtasks.exe
1996	schtasks.exe

Suspicious behavior: EnumeratesProcesses 19 IoCs

pid	Process
2440	DllCommonsvc.exe
2348	powershell.exe
2088	powershell.exe
1992	powershell.exe
1692	powershell.exe
2772	powershell.exe
828	powershell.exe
2284	Idle.exe
2456	Idle.exe
1312	Idle.exe
752	Idle.exe
2460	Idle.exe
2944	Idle.exe
1948	Idle.exe
888	Idle.exe
2500	Idle.exe
2140	Idle.exe
2096	Idle.exe
2600	Idle.exe

Suspicious use of AdjustPrivilegeToken 19 IoCs

description	pid	Process
Token: SeDebugPrivilege	2440	DllCommonsvc.exe
Token: SeDebugPrivilege	2284	Idle.exe
Token: SeDebugPrivilege	2348	powershell.exe
Token: SeDebugPrivilege	2088	powershell.exe
Token: SeDebugPrivilege	1992	powershell.exe
Token: SeDebugPrivilege	1692	powershell.exe
Token: SeDebugPrivilege	2772	powershell.exe
Token: SeDebugPrivilege	828	powershell.exe
Token: SeDebugPrivilege	2456	Idle.exe
Token: SeDebugPrivilege	1312	Idle.exe
Token: SeDebugPrivilege	752	Idle.exe
Token: SeDebugPrivilege	2460	Idle.exe
Token: SeDebugPrivilege	2944	Idle.exe
Token: SeDebugPrivilege	1948	Idle.exe
Token: SeDebugPrivilege	888	Idle.exe
Token: SeDebugPrivilege	2500	Idle.exe
Token: SeDebugPrivilege	2140	Idle.exe
Token: SeDebugPrivilege	2096	Idle.exe
Token: SeDebugPrivilege	2600	Idle.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 316 wrote to memory of 2372	316	f543b442481590bfa4e57778879155abbe4e739b96d3639a16aa0c4d994a7d60.exe	30
PID 316 wrote to memory of 2372	316	f543b442481590bfa4e57778879155abbe4e739b96d3639a16aa0c4d994a7d60.exe	30
PID 316 wrote to memory of 2372	316	f543b442481590bfa4e57778879155abbe4e739b96d3639a16aa0c4d994a7d60.exe	30
PID 316 wrote to memory of 2372	316	f543b442481590bfa4e57778879155abbe4e739b96d3639a16aa0c4d994a7d60.exe	30
PID 2372 wrote to memory of 2136	2372	WScript.exe	31
PID 2372 wrote to memory of 2136	2372	WScript.exe	31
PID 2372 wrote to memory of 2136	2372	WScript.exe	31
PID 2372 wrote to memory of 2136	2372	WScript.exe	31
PID 2136 wrote to memory of 2440	2136	cmd.exe	33
PID 2136 wrote to memory of 2440	2136	cmd.exe	33
PID 2136 wrote to memory of 2440	2136	cmd.exe	33
PID 2136 wrote to memory of 2440	2136	cmd.exe	33
PID 2440 wrote to memory of 2348	2440	DllCommonsvc.exe	50
PID 2440 wrote to memory of 2348	2440	DllCommonsvc.exe	50
PID 2440 wrote to memory of 2348	2440	DllCommonsvc.exe	50
PID 2440 wrote to memory of 1692	2440	DllCommonsvc.exe	51
PID 2440 wrote to memory of 1692	2440	DllCommonsvc.exe	51
PID 2440 wrote to memory of 1692	2440	DllCommonsvc.exe	51
PID 2440 wrote to memory of 1992	2440	DllCommonsvc.exe	52
PID 2440 wrote to memory of 1992	2440	DllCommonsvc.exe	52
PID 2440 wrote to memory of 1992	2440	DllCommonsvc.exe	52
PID 2440 wrote to memory of 828	2440	DllCommonsvc.exe	53
PID 2440 wrote to memory of 828	2440	DllCommonsvc.exe	53
PID 2440 wrote to memory of 828	2440	DllCommonsvc.exe	53
PID 2440 wrote to memory of 2772	2440	DllCommonsvc.exe	55
PID 2440 wrote to memory of 2772	2440	DllCommonsvc.exe	55
PID 2440 wrote to memory of 2772	2440	DllCommonsvc.exe	55
PID 2440 wrote to memory of 2088	2440	DllCommonsvc.exe	57
PID 2440 wrote to memory of 2088	2440	DllCommonsvc.exe	57
PID 2440 wrote to memory of 2088	2440	DllCommonsvc.exe	57
PID 2440 wrote to memory of 2284	2440	DllCommonsvc.exe	62
PID 2440 wrote to memory of 2284	2440	DllCommonsvc.exe	62
PID 2440 wrote to memory of 2284	2440	DllCommonsvc.exe	62
PID 2284 wrote to memory of 2128	2284	Idle.exe	63
PID 2284 wrote to memory of 2128	2284	Idle.exe	63
PID 2284 wrote to memory of 2128	2284	Idle.exe	63
PID 2128 wrote to memory of 2100	2128	cmd.exe	65
PID 2128 wrote to memory of 2100	2128	cmd.exe	65
PID 2128 wrote to memory of 2100	2128	cmd.exe	65
PID 2128 wrote to memory of 2456	2128	cmd.exe	67
PID 2128 wrote to memory of 2456	2128	cmd.exe	67
PID 2128 wrote to memory of 2456	2128	cmd.exe	67
PID 2456 wrote to memory of 2844	2456	Idle.exe	68
PID 2456 wrote to memory of 2844	2456	Idle.exe	68
PID 2456 wrote to memory of 2844	2456	Idle.exe	68
PID 2844 wrote to memory of 1044	2844	cmd.exe	70
PID 2844 wrote to memory of 1044	2844	cmd.exe	70
PID 2844 wrote to memory of 1044	2844	cmd.exe	70
PID 2844 wrote to memory of 1312	2844	cmd.exe	71
PID 2844 wrote to memory of 1312	2844	cmd.exe	71
PID 2844 wrote to memory of 1312	2844	cmd.exe	71
PID 1312 wrote to memory of 1324	1312	Idle.exe	72
PID 1312 wrote to memory of 1324	1312	Idle.exe	72
PID 1312 wrote to memory of 1324	1312	Idle.exe	72
PID 1324 wrote to memory of 1504	1324	cmd.exe	74
PID 1324 wrote to memory of 1504	1324	cmd.exe	74
PID 1324 wrote to memory of 1504	1324	cmd.exe	74
PID 1324 wrote to memory of 752	1324	cmd.exe	75
PID 1324 wrote to memory of 752	1324	cmd.exe	75
PID 1324 wrote to memory of 752	1324	cmd.exe	75
PID 752 wrote to memory of 2932	752	Idle.exe	76
PID 752 wrote to memory of 2932	752	Idle.exe	76
PID 752 wrote to memory of 2932	752	Idle.exe	76
PID 2932 wrote to memory of 2968	2932	cmd.exe	78

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\f543b442481590bfa4e57778879155abbe4e739b96d3639a16aa0c4d994a7d60.exe
"C:\Users\Admin\AppData\Local\Temp\f543b442481590bfa4e57778879155abbe4e739b96d3639a16aa0c4d994a7d60.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:316
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\providercommon\yTUdeXjbLOhnrN32dgrxVg.vbe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2372
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c ""C:\providercommon\1zu9dW.bat" "
    3⤵
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2136
  - - C:\providercommon\DllCommonsvc.exe
      "C:\providercommon\DllCommonsvc.exe"
      4⤵
      Executes dropped EXE
      Drops file in Program Files directory
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:2440
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\DllCommonsvc.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2348
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Windows Sidebar\Gadgets\smss.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1692
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\Idle.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1992
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Public\Pictures\Sample Pictures\audiodg.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:828
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\209d6542-69f6-11ef-b491-62cb582c238c\System.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2772
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\209d6542-69f6-11ef-b491-62cb582c238c\wininit.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2088
    - - C:\providercommon\Idle.exe
        
        "C:\providercommon\Idle.exe"
        5⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2284
      - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\owZfSNRP11.bat"
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:2128
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        7⤵
        
        PID:2100
        
        C:\providercommon\Idle.exe
        
        "C:\providercommon\Idle.exe"
        7⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2456
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\HKL0gj8mBn.bat"
        8⤵
        Suspicious use of WriteProcessMemory
        
        PID:2844
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        9⤵
        
        PID:1044
        
        C:\providercommon\Idle.exe
        
        "C:\providercommon\Idle.exe"
        9⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1312
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\H7eFR6a9mI.bat"
        10⤵
        Suspicious use of WriteProcessMemory
        
        PID:1324
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        11⤵
        
        PID:1504
        
        C:\providercommon\Idle.exe
        
        "C:\providercommon\Idle.exe"
        11⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:752
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\kwOVarqRTQ.bat"
        12⤵
        Suspicious use of WriteProcessMemory
        
        PID:2932
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        13⤵
        
        PID:2968
        
        C:\providercommon\Idle.exe
        
        "C:\providercommon\Idle.exe"
        13⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2460
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\BlQmztffGe.bat"
        14⤵
        
        PID:2040
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        15⤵
        
        PID:592
        
        C:\providercommon\Idle.exe
        
        "C:\providercommon\Idle.exe"
        15⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2944
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\0xFiNVDkrN.bat"
        16⤵
        
        PID:2216
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        17⤵
        
        PID:2956
        
        C:\providercommon\Idle.exe
        
        "C:\providercommon\Idle.exe"
        17⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1948
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\ounU5LkXKE.bat"
        18⤵
        
        PID:2884
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        19⤵
        
        PID:1540
        
        C:\providercommon\Idle.exe
        
        "C:\providercommon\Idle.exe"
        19⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:888
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\jI650TZYhJ.bat"
        20⤵
        
        PID:2688
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        21⤵
        
        PID:2084
        
        C:\providercommon\Idle.exe
        
        "C:\providercommon\Idle.exe"
        21⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2500
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\iLsGNVHQP6.bat"
        22⤵
        
        PID:1656
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        23⤵
        
        PID:2892
        
        C:\providercommon\Idle.exe
        
        "C:\providercommon\Idle.exe"
        23⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2140
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\hc9iMPvVJ4.bat"
        24⤵
        
        PID:2108
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        25⤵
        
        PID:1372
        
        C:\providercommon\Idle.exe
        
        "C:\providercommon\Idle.exe"
        25⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2096
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\Xnyek1SZun.bat"
        26⤵
        
        PID:2640
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        27⤵
        
        PID:1472
        
        C:\providercommon\Idle.exe
        
        "C:\providercommon\Idle.exe"
        27⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2600

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 9 /tr "'C:\Program Files\Windows Sidebar\Gadgets\smss.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1784

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smss" /sc ONLOGON /tr "'C:\Program Files\Windows Sidebar\Gadgets\smss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2760

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 7 /tr "'C:\Program Files\Windows Sidebar\Gadgets\smss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2600

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 6 /tr "'C:\providercommon\Idle.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2672

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Idle" /sc ONLOGON /tr "'C:\providercommon\Idle.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3052

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 13 /tr "'C:\providercommon\Idle.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3024

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "audiodga" /sc MINUTE /mo 13 /tr "'C:\Users\Public\Pictures\Sample Pictures\audiodg.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:592

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "audiodg" /sc ONLOGON /tr "'C:\Users\Public\Pictures\Sample Pictures\audiodg.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1980

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "audiodga" /sc MINUTE /mo 8 /tr "'C:\Users\Public\Pictures\Sample Pictures\audiodg.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1312

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 8 /tr "'C:\Recovery\209d6542-69f6-11ef-b491-62cb582c238c\System.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1468

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "System" /sc ONLOGON /tr "'C:\Recovery\209d6542-69f6-11ef-b491-62cb582c238c\System.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2696

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 5 /tr "'C:\Recovery\209d6542-69f6-11ef-b491-62cb582c238c\System.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1648

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 6 /tr "'C:\Recovery\209d6542-69f6-11ef-b491-62cb582c238c\wininit.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1620

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininit" /sc ONLOGON /tr "'C:\Recovery\209d6542-69f6-11ef-b491-62cb582c238c\wininit.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:288

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 8 /tr "'C:\Recovery\209d6542-69f6-11ef-b491-62cb582c238c\wininit.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1996

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d1f3e4b0583ef19fada66942642bcf53

SHA1
3a63e3b662e737cf0c563100992e7e3c81f2be4a

SHA256
1f9a179014b6b7a1830fd42a432b33593c2f76d1892a03fcd64755aad05e9822

SHA512
e6a48e71c74dc7ddda2f6dd2316d3ba849e551dd8cb3a627ce0186bdd6f38234f807a5087ed3fcbf16265cf7259bd61a3bb331fc573674ece221e50652e7ee59

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
12e8a3e74d19b0e92ed88358d5516965

SHA1
01fd7ec6f84a03582588cf2f9131be3a3174a592

SHA256
4de003362edf0e3ecef550e924a866274bc4b12b07f405d3ee37758f7398cccc

SHA512
41d394e3c6a7e2488234f9cc4555ff65cf348e0ee16cbd14672a84f609f3d23f56b033eebfa2a6b27bf7155d7c6350daca27bddca25197a4d32ad938f794a5da

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f15d5b30bc2e008beebc56c683ef99e9

SHA1
82ece8fdd22224d9aba72b928db93d75b608beb6

SHA256
97590bb37a53c9e7f83b6230fc5319c6a4c2e1c2aa39f12d1d5952e72a0f2272

SHA512
7623f79bbedf7efd2fda112d9b9029e65ec0a7b993a01fbcde6b0b04073bb1ff7e25d77633d830f8d6c1bdaf689d63a2aaf2a072fcfdb69d234718519d6d471e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a7caf7ed4b6fa3c35f6354794cf4d2b4

SHA1
d24b6a32f1626bfa8a53d9f324ac0e8f3a8684e5

SHA256
2650f1c4bb21bd2999dcb45a5f8972b39b659cb10785fe980ac5130162ec204a

SHA512
f5b8edb4f765c42c9550f98a07bc70a2736351a1d86f09d05512f77da17bca10997ff182f7d3037c4570af063e12ddf4c355fecf0f4f6f9e2e7394fe5269c3e8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ff380a50bf64d4331384a6b62e8a7240

SHA1
42993f8de6a1b9f433f04cbf21aaebfaf6ad07ff

SHA256
591948d9a953fcdba013161d9e4be591879e1a1aa9a80ff14723a674b8994552

SHA512
bef7d87c4c913187d5c58fe88c71113237e4fb52b30dd07e56d5a8610cbc40e26eb13319f58ebed59c6fef109148e18c65e58cf8d35096254d43ba6ddeb3ad97

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
75eb0dbe66068305bd5f3ae13fef5fdd

SHA1
6858947c6c25b3e46aeb568805a85b7a1d5684f5

SHA256
a6e15276e080e1c4a234d8b8ea4291601d3333c28fcdf298d82f217c83f48619

SHA512
0b329abfd445ff519fbddaeb4be99a0988c90806bf8efc0a02d130bc416a4b3ef7eac24a2929b7b0ce9cec74148ea626775f0b363f492f8c205573807a058066

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4f6917fe1c3404d633b6edbbd54d07cb

SHA1
40c94bac6406939deab0f4109c47a9e1627dfe9a

SHA256
d4a9f337a7318ef3d8b14300f805bed36e046f6ce5bb329ef3ee3566ab1d5684

SHA512
004f4381aee2d6463355a611c149a643be10a2bfc0ed8c68a16fae16be55384f0d79d164e39d65afe4ab8a5200d08a820c71944bf44df8c510ee4fe288ea3750

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
634fedbe305f1c3cc5c7b2d038711276

SHA1
fc20e7c7e47f1900db01408e38341cca767cf6a3

SHA256
8fa8b35b897287849e595933700abe186c045bd41166c4f0e30abbf9143491e0

SHA512
d591c07dea49b4802beb205c14567bf626bff07c7d8bccaa5aa7a605906db129d9748d8f652313000d4c2c6c9e4218c18e08e3b946282ed9cdd1f8b7a4d5b9bf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3b2ba4f7a03a19d106b76d17fd34b5d1

SHA1
d3dc9aafeebbd0abdaeda2f1d6a5c581352d5d76

SHA256
6b0e85f7306a1d1b97af29150a7302bb0184c838607c962547b9702614d3685f

SHA512
979f7d6af168457b38914b8ef4563efb7bbf0cf38fd53a6fbe7745158b1adffbbd491f52481238ef7634dc399b92d3fe31f7285bd366c319a9eefc8e610707da

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8427a81926e1e444e0d6eb582cadad6e

SHA1
d58b84ccf90112a8b5315c140eaf3cec7c0cbd7b

SHA256
8b9639377f15f344bbcdd9604656ecd958afc58412866955640d8d9a5499c1d7

SHA512
5e8ce4a98a1fbf5ef57f63c96c4306b962d8ec6ecb6efa70ba3e5fda63a442b1fbde8ae1514e2086ffbc37e212020d27c1cacf5365a760c627b376b62df2e73d

Download Submit
C:\Users\Admin\AppData\Local\Temp\0xFiNVDkrN.bat

Filesize
191B

MD5
9d92d8d7702c408bca1b2d9097ca0294

SHA1
0ce49bca3ca64c5b76cd36abd0aea5477949561f

SHA256
8da76793eca4b52798b1131327714e453ba34d6ba8197a713fd11a3b5e0d7b9a

SHA512
4f9f0bda9b3e6c7ce3dd860d5b219e8bffa61cbf10e49b67ba117ec06a4c75619840d91f0a3d4cbf037eece0b759b0a5d6af1455a16879735039fe89d92579fc

Download Submit
C:\Users\Admin\AppData\Local\Temp\BlQmztffGe.bat

Filesize
191B

MD5
3917f9a0cb951eec20ecd45397909fb7

SHA1
abb305d7e7e46f2209a31ea4df80610ada9dc98b

SHA256
bbda255e9283f24b6b68d147e8801a680133630cc1b2fbee2241a47cb7d55099

SHA512
665e0cc131de783eb2217ac3b0b6e814e42ae8ee573f5ddc3379db3fb8bce2706a881b732ccade5753c5bfa9e1ffb16d2815488134c7c9bb72c0094a81804daa

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabBA6B.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\H7eFR6a9mI.bat

Filesize
191B

MD5
edf7479118a3f5d7ef3bd9b51bf946b2

SHA1
d2c0f58022f1a34189db7ba42b417a54f19a377b

SHA256
20e244bd2f7c7d65a690ce1a49082a00533390222e8dae25b024232942a797ae

SHA512
1ccc6035713d9e7dead855214b97ec3d2fb63fb13cd6027416af3952ff505ed6b8baedaf5e41b3d493cc57236eb4a86225e78e22d8671fb9172fbafac2ab89aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\HKL0gj8mBn.bat

Filesize
191B

MD5
e2eff887726c518d9ee126cc8f355562

SHA1
c3345fe796b37813944d68bc288497740b2023e6

SHA256
276fe2b16f39e9c966c6f9d41abbaa8700978edfebc4e12438be796085e1ac03

SHA512
5548df45c63c4ce8a48481519ca66315eaba0346f341c266ce995f4bea2dd550fd184f2c8353de3d5229bc563398fac516de80be56fa42a44791a13d7914e619

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarBA8E.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Xnyek1SZun.bat

Filesize
191B

MD5
7193a0ad91bcb1ba01464d055686eecd

SHA1
bfab6346444c476959179212b7181d27e283c566

SHA256
c49e004537889f9e841fa84e0799c78fafee157bb6737ba4466197a5c2da72b7

SHA512
4cc1e657337992410be44b3d6841ae091d292fa00513e3751e741c35cbb6b7f54c4bbf8b95e2eb1f7e04c3cb318e7387e55f84168199426bfd98ee0ed97f99ab

Download Submit
C:\Users\Admin\AppData\Local\Temp\hc9iMPvVJ4.bat

Filesize
191B

MD5
f890a41c9abf72893c3205224dee00df

SHA1
7a38b8b7e7af57ea5183eb444297b8eba5d5aa89

SHA256
367173978883852bedf023edfa9cd8156625c4300e41e623b673968f7b1cb3ac

SHA512
59718e6ba0da5aa3f7c486b81d1b929661bc365a714879b19401653ef2ae88f37aeb8febc6417b00a8f61e2f6608c9ce4b81381f11328f385af19e62b0512f91

Download Submit
C:\Users\Admin\AppData\Local\Temp\iLsGNVHQP6.bat

Filesize
191B

MD5
8a5c9eb8f867bc310a65fbd469eea845

SHA1
bcc79494f8f727111e53e0b4ab055ad4e1c3c435

SHA256
6f55fbcd7b7bc9b2c181f0124955df03b050c07d1042a5bf9aa0f252e4620609

SHA512
5f00fa89cfa601451bd66b33d8ccb86acca19f598d372c9b33eebd4b456b8eb22e04b00c1dd40e4617cad9cf8528ded19f98b060eb748d0f5fa620c2c6a85cee

Download Submit
C:\Users\Admin\AppData\Local\Temp\jI650TZYhJ.bat

Filesize
191B

MD5
38fb40b633aadcbee571072738a4fa7c

SHA1
0796c689521cfc866f6196a90299a4bd4f8a0b17

SHA256
68a5bd00aee9437d402246ecdfbe34a23802f806870b9c05230cdfdf5660366f

SHA512
ad2e5a11a2ee8a92f51a7dca8131b47d116ebda85642720f66581a25a4ec33e4d9da82c0fe71a19d20d1f42d88109d135bceaf4e9eb5052f3ab0fe3bb5de5bcb

Download Submit
C:\Users\Admin\AppData\Local\Temp\kwOVarqRTQ.bat

Filesize
191B

MD5
4f7f5cd08edb5aa58c075379fabd939d

SHA1
a76eceb6e74d37a6471c73856dcdf21da982994b

SHA256
b966d971f71dd5662b9e7ce58c79d7ef08856d212d06e15ab22220e38d0a3784

SHA512
43f14842fec339f0de99d5157e008fa5e20e9da867e61bab26c9e53c204778996f3b23411c0b187c9f6da60413899c8940425b33e3ddf8ca7a2c624b096d6cb8

Download Submit
C:\Users\Admin\AppData\Local\Temp\ounU5LkXKE.bat

Filesize
191B

MD5
816adbc27d0436ff7d1699c02623232e

SHA1
bab2ddb7e9fea21c9a5c115d4ad6ff17a5ce0377

SHA256
2f4df5a18abda3b7b39eb29536dc7366e55e486019de3d5134b1e93cd6fd6303

SHA512
73c8a23b0e5667d5ebe41091bcb9482f2a0fb92a8e5e56adcb9af0ebe861dc7b3c8cd7c99f31a64d8f03f1beef534923e38fc56f7b7e33298b9624141df9b325

Download Submit
C:\Users\Admin\AppData\Local\Temp\owZfSNRP11.bat

Filesize
191B

MD5
2633515a53159951ed8ed93708c59d27

SHA1
8e56dd3a2a3fc36de914459f6b66f4d5d31664ce

SHA256
1ff1d1737062750a35cee57b614397434e9d085a877171a82632dcfcccca90b7

SHA512
ad057c8bb8792f6eaea46966ef833eebdc7f643bfd876e35dc03afe4204efd367a698fb37ffbe3b42989df2c1ab29e667909550ce35c0187fe84551fe51d2c60

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
7KB

MD5
92d3bf25e62c81ba9fd410793cc5b269

SHA1
1d4aef558cc11ab843b321a8b91e8e57f0ef590e

SHA256
b7dd50b19634cde3386cb882f2ad624c6e595f8ac62fa8a3ad6b4f12ab9c8596

SHA512
596c4372a1290786aaef58e91d979d0d66ade7dee51e1095c7f14cd9ef24a78db0d913fc09790f189c9a8a624bca9fd2e637c71af12894495fda1987cc4c4516

Download Submit
C:\providercommon\1zu9dW.bat

Filesize
36B

MD5
6783c3ee07c7d151ceac57f1f9c8bed7

SHA1
17468f98f95bf504cc1f83c49e49a78526b3ea03

SHA256
8ab782f0f327a2021530e7230d3aee8abbecb7eed59482a3a46e78b9e3862322

SHA512
c6012d4bfac1ed14d0fd9f0eabd0e1c3d647b343db292a907b246271d52a4b7469c809db43910ddba2e8c5045f9cb3d24d0af62d363281e6cb8b39ee94a183e8

Download Submit
C:\providercommon\yTUdeXjbLOhnrN32dgrxVg.vbe

Filesize
197B

MD5
8088241160261560a02c84025d107592

SHA1
083121f7027557570994c9fc211df61730455bb5

SHA256
2072cc9a4a3b84d4c5178ab41c5588eea7d0103e3928e34d64f17bf97f3d1cc1

SHA512
20d9369dd359315848ea30144383a0bb479d86059fdbc3b3256ac84f998193512feb3b1799ab663619920c99fe7e0ebba33ada31a3855094b956fcd351c90478

Download Submit
\providercommon\DllCommonsvc.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
memory/752-245-0x0000000001390000-0x00000000014A0000-memory.dmp

Filesize
1.1MB

Download
memory/888-485-0x00000000003C0000-0x00000000003D2000-memory.dmp

Filesize
72KB

Download
memory/1312-185-0x0000000001200000-0x0000000001310000-memory.dmp

Filesize
1.1MB

Download
memory/1948-425-0x0000000001210000-0x0000000001320000-memory.dmp

Filesize
1.1MB

Download
memory/2284-66-0x0000000000670000-0x0000000000682000-memory.dmp

Filesize
72KB

Download
memory/2284-38-0x0000000000360000-0x0000000000470000-memory.dmp

Filesize
1.1MB

Download
memory/2348-52-0x00000000022C0000-0x00000000022C8000-memory.dmp

Filesize
32KB

Download
memory/2348-49-0x000000001B690000-0x000000001B972000-memory.dmp

Filesize
2.9MB

Download
memory/2440-15-0x0000000000630000-0x000000000063C000-memory.dmp

Filesize
48KB

Download
memory/2440-17-0x0000000000640000-0x000000000064C000-memory.dmp

Filesize
48KB

Download
memory/2440-14-0x00000000002D0000-0x00000000002E2000-memory.dmp

Filesize
72KB

Download
memory/2440-16-0x0000000000360000-0x000000000036C000-memory.dmp

Filesize
48KB

Download
memory/2440-13-0x0000000001120000-0x0000000001230000-memory.dmp

Filesize
1.1MB

Download
memory/2456-125-0x0000000000080000-0x0000000000190000-memory.dmp

Filesize
1.1MB

Download
memory/2460-305-0x0000000000100000-0x0000000000210000-memory.dmp

Filesize
1.1MB

Download
memory/2944-365-0x0000000000B70000-0x0000000000C80000-memory.dmp

Filesize
1.1MB

Download