Overview

overview

10

Static

static

3

mapper.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    150s
  • max time network
    149s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    27-01-2025 16:50

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    mapper.exe

  • Size

    2.2MB

  • MD5

    fa4133a7fdab4e145e1f314517e0aea6

  • SHA1

    198e79c9360e4862c8b3f31753b79d8b30de2bc0

  • SHA256

    201b19bee9b23aa8e7b3dbd48c26807575d1afefc93b3c48919c53c2f783efe8

  • SHA512

    e788806d5b28a58ea36020a5c0182ced2c8432f184196e90c5dc908d0fae16b6e7b7db43c15318050a2ed2e5af1dc92400a10bbec884c8c8500d194af78f23c8

  • SSDEEP

    24576:PFOaMTbBv5rUyXVDUcOnLthC1NYSwMqIX/UgNG0Bb1+M/zRP9Edn6xk7ha5KnJUy:t6BJZOKwMqE/U4vBsMrYn6mha5uJ6Q0O

Score
10/10
dcratdefense_evasiondiscoveryinfostealerpersistencerat

Malware Config

Signatures

  • DcRat

    DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

    ratinfostealerdcrat
  • Dcrat family
    dcrat
  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
    defense_evasion
  • Checks computer location settings 2 TTPs 19 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 24 IoCs
  • Adds Run key to start application 2 TTPs 4 IoCs
    persistence
  • Drops file in System32 directory 2 IoCs
  • Drops file in Windows directory 5 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 7 IoCs

    Adversaries may check for Internet connectivity on compromised systems.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 6 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Modifies registry class 19 IoCs
  • Runs ping.exe 1 TTPs 7 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 26 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs
  • Suspicious use of SetWindowsHookEx 12 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\mapper.exe
    "C:\Users\Admin\AppData\Local\Temp\mapper.exe"
    1⤵
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:5104
    • \??\c:\users\admin\appdata\local\temp\mapper.exe 
      c:\users\admin\appdata\local\temp\mapper.exe 
      2⤵
      • Checks computer location settings
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Modifies registry class
      • Suspicious use of WriteProcessMemory
      PID:3164
      • C:\Windows\SysWOW64\WScript.exe
        "C:\Windows\System32\WScript.exe" "C:\Sessionmonitor\uGKEf17W5UFdKyvhpzBZN53V3al.vbe"
        3⤵
        • Checks computer location settings
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:2636
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /c ""C:\Sessionmonitor\gWy3murIAkbQBAvjnA7qra.bat" "
          4⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:4508
          • C:\Sessionmonitor\blockwebCrtDll.exe
            "C:\Sessionmonitor/blockwebCrtDll.exe"
            5⤵
            • Checks computer location settings
            • Executes dropped EXE
            • Modifies registry class
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of WriteProcessMemory
            PID:1220
            • C:\Windows\System32\cmd.exe
              "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\ZXx7vcf4zU.bat"
              6⤵
              • Suspicious use of WriteProcessMemory
              PID:4536
              • C:\Windows\system32\chcp.com
                chcp 65001
                7⤵
                  PID:4268
                • C:\Windows\system32\w32tm.exe
                  w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                  7⤵
                    PID:532
                  • C:\Sessionmonitor\sppsvc.exe
                    "C:\Sessionmonitor\sppsvc.exe"
                    7⤵
                    • Checks computer location settings
                    • Executes dropped EXE
                    • Modifies registry class
                    • Suspicious use of AdjustPrivilegeToken
                    • Suspicious use of WriteProcessMemory
                    PID:736
                    • C:\Windows\System32\cmd.exe
                      "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\tpiwJJ3Pd2.bat"
                      8⤵
                      • Suspicious use of WriteProcessMemory
                      PID:4208
                      • C:\Windows\system32\chcp.com
                        chcp 65001
                        9⤵
                          PID:852
                        • C:\Windows\system32\w32tm.exe
                          w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                          9⤵
                            PID:1088
                          • C:\Sessionmonitor\sppsvc.exe
                            "C:\Sessionmonitor\sppsvc.exe"
                            9⤵
                            • Checks computer location settings
                            • Executes dropped EXE
                            • Modifies registry class
                            • Suspicious use of AdjustPrivilegeToken
                            • Suspicious use of WriteProcessMemory
                            PID:3328
                            • C:\Windows\System32\cmd.exe
                              "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\2vzlDYcv1s.bat"
                              10⤵
                              • Suspicious use of WriteProcessMemory
                              PID:2748
                              • C:\Windows\system32\chcp.com
                                chcp 65001
                                11⤵
                                  PID:676
                                • C:\Windows\system32\PING.EXE
                                  ping -n 10 localhost
                                  11⤵
                                  • System Network Configuration Discovery: Internet Connection Discovery
                                  • Runs ping.exe
                                  PID:4028
                                • C:\Sessionmonitor\sppsvc.exe
                                  "C:\Sessionmonitor\sppsvc.exe"
                                  11⤵
                                  • Checks computer location settings
                                  • Executes dropped EXE
                                  • Modifies registry class
                                  • Suspicious use of AdjustPrivilegeToken
                                  • Suspicious use of WriteProcessMemory
                                  PID:4700
                                  • C:\Windows\System32\cmd.exe
                                    "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\9LyY97a2AO.bat"
                                    12⤵
                                    • Suspicious use of WriteProcessMemory
                                    PID:4584
                                    • C:\Windows\system32\chcp.com
                                      chcp 65001
                                      13⤵
                                        PID:1116
                                      • C:\Windows\system32\PING.EXE
                                        ping -n 10 localhost
                                        13⤵
                                        • System Network Configuration Discovery: Internet Connection Discovery
                                        • Runs ping.exe
                                        PID:4928
                                      • C:\Sessionmonitor\sppsvc.exe
                                        "C:\Sessionmonitor\sppsvc.exe"
                                        13⤵
                                        • Checks computer location settings
                                        • Executes dropped EXE
                                        • Modifies registry class
                                        • Suspicious use of AdjustPrivilegeToken
                                        • Suspicious use of WriteProcessMemory
                                        PID:2900
                                        • C:\Windows\System32\cmd.exe
                                          "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\RvL1cycbdY.bat"
                                          14⤵
                                          • Suspicious use of WriteProcessMemory
                                          PID:2412
                                          • C:\Windows\system32\chcp.com
                                            chcp 65001
                                            15⤵
                                              PID:4532
                                            • C:\Windows\system32\w32tm.exe
                                              w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                                              15⤵
                                                PID:2184
                                              • C:\Sessionmonitor\sppsvc.exe
                                                "C:\Sessionmonitor\sppsvc.exe"
                                                15⤵
                                                • Checks computer location settings
                                                • Executes dropped EXE
                                                • Modifies registry class
                                                • Suspicious use of AdjustPrivilegeToken
                                                PID:4040
                                                • C:\Windows\System32\cmd.exe
                                                  "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\TqMgut2j0M.bat"
                                                  16⤵
                                                    PID:2144
                                                    • C:\Windows\system32\chcp.com
                                                      chcp 65001
                                                      17⤵
                                                        PID:3344
                                                      • C:\Windows\system32\w32tm.exe
                                                        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                                                        17⤵
                                                          PID:704
                                                        • C:\Sessionmonitor\sppsvc.exe
                                                          "C:\Sessionmonitor\sppsvc.exe"
                                                          17⤵
                                                          • Checks computer location settings
                                                          • Executes dropped EXE
                                                          • Modifies registry class
                                                          • Suspicious use of AdjustPrivilegeToken
                                                          PID:968
                                                          • C:\Windows\System32\cmd.exe
                                                            "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\s6L5myzuOs.bat"
                                                            18⤵
                                                              PID:3656
                                                              • C:\Windows\system32\chcp.com
                                                                chcp 65001
                                                                19⤵
                                                                  PID:3880
                                                                • C:\Windows\system32\w32tm.exe
                                                                  w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                                                                  19⤵
                                                                    PID:3920
                                                                  • C:\Sessionmonitor\sppsvc.exe
                                                                    "C:\Sessionmonitor\sppsvc.exe"
                                                                    19⤵
                                                                    • Checks computer location settings
                                                                    • Executes dropped EXE
                                                                    • Modifies registry class
                                                                    • Suspicious use of AdjustPrivilegeToken
                                                                    PID:1056
                                                                    • C:\Windows\System32\cmd.exe
                                                                      "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\MeHUYFCmAF.bat"
                                                                      20⤵
                                                                        PID:776
                                                                        • C:\Windows\system32\chcp.com
                                                                          chcp 65001
                                                                          21⤵
                                                                            PID:1992
                                                                          • C:\Windows\system32\PING.EXE
                                                                            ping -n 10 localhost
                                                                            21⤵
                                                                            • System Network Configuration Discovery: Internet Connection Discovery
                                                                            • Runs ping.exe
                                                                            PID:4596
                                                                          • C:\Sessionmonitor\sppsvc.exe
                                                                            "C:\Sessionmonitor\sppsvc.exe"
                                                                            21⤵
                                                                            • Checks computer location settings
                                                                            • Executes dropped EXE
                                                                            • Modifies registry class
                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                            PID:3924
                                                                            • C:\Windows\System32\cmd.exe
                                                                              "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\PmJFabuBut.bat"
                                                                              22⤵
                                                                                PID:2532
                                                                                • C:\Windows\system32\chcp.com
                                                                                  chcp 65001
                                                                                  23⤵
                                                                                    PID:2360
                                                                                  • C:\Windows\system32\w32tm.exe
                                                                                    w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                                                                                    23⤵
                                                                                      PID:2972
                                                                                    • C:\Sessionmonitor\sppsvc.exe
                                                                                      "C:\Sessionmonitor\sppsvc.exe"
                                                                                      23⤵
                                                                                      • Checks computer location settings
                                                                                      • Executes dropped EXE
                                                                                      • Modifies registry class
                                                                                      • Suspicious use of AdjustPrivilegeToken
                                                                                      PID:392
                                                                                      • C:\Windows\System32\cmd.exe
                                                                                        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\MJezb5uUW4.bat"
                                                                                        24⤵
                                                                                          PID:4924
                                                                                          • C:\Windows\system32\chcp.com
                                                                                            chcp 65001
                                                                                            25⤵
                                                                                              PID:5096
                                                                                            • C:\Windows\system32\PING.EXE
                                                                                              ping -n 10 localhost
                                                                                              25⤵
                                                                                              • System Network Configuration Discovery: Internet Connection Discovery
                                                                                              • Runs ping.exe
                                                                                              PID:1840
                                                                                            • C:\Sessionmonitor\sppsvc.exe
                                                                                              "C:\Sessionmonitor\sppsvc.exe"
                                                                                              25⤵
                                                                                              • Checks computer location settings
                                                                                              • Executes dropped EXE
                                                                                              • Modifies registry class
                                                                                              • Suspicious use of AdjustPrivilegeToken
                                                                                              PID:3684
                                                                                              • C:\Windows\System32\cmd.exe
                                                                                                "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\AkiujJMGlN.bat"
                                                                                                26⤵
                                                                                                  PID:2008
                                                                                                  • C:\Windows\system32\chcp.com
                                                                                                    chcp 65001
                                                                                                    27⤵
                                                                                                      PID:2776
                                                                                                    • C:\Windows\system32\PING.EXE
                                                                                                      ping -n 10 localhost
                                                                                                      27⤵
                                                                                                      • System Network Configuration Discovery: Internet Connection Discovery
                                                                                                      • Runs ping.exe
                                                                                                      PID:4956
                                                                                                    • C:\Sessionmonitor\sppsvc.exe
                                                                                                      "C:\Sessionmonitor\sppsvc.exe"
                                                                                                      27⤵
                                                                                                      • Checks computer location settings
                                                                                                      • Executes dropped EXE
                                                                                                      • Modifies registry class
                                                                                                      • Suspicious use of AdjustPrivilegeToken
                                                                                                      PID:1084
                                                                                                      • C:\Windows\System32\cmd.exe
                                                                                                        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\0BhMlNgjsC.bat"
                                                                                                        28⤵
                                                                                                          PID:4476
                                                                                                          • C:\Windows\system32\chcp.com
                                                                                                            chcp 65001
                                                                                                            29⤵
                                                                                                              PID:1344
                                                                                                            • C:\Windows\system32\w32tm.exe
                                                                                                              w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                                                                                                              29⤵
                                                                                                                PID:4472
                                                                                                              • C:\Sessionmonitor\sppsvc.exe
                                                                                                                "C:\Sessionmonitor\sppsvc.exe"
                                                                                                                29⤵
                                                                                                                • Checks computer location settings
                                                                                                                • Executes dropped EXE
                                                                                                                • Modifies registry class
                                                                                                                • Suspicious use of AdjustPrivilegeToken
                                                                                                                PID:4232
                                                                                                                • C:\Windows\System32\cmd.exe
                                                                                                                  "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\s6L5myzuOs.bat"
                                                                                                                  30⤵
                                                                                                                    PID:516
                                                                                                                    • C:\Windows\system32\chcp.com
                                                                                                                      chcp 65001
                                                                                                                      31⤵
                                                                                                                        PID:3528
                                                                                                                      • C:\Windows\system32\w32tm.exe
                                                                                                                        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                                                                                                                        31⤵
                                                                                                                          PID:1760
                                                                                                                        • C:\Sessionmonitor\sppsvc.exe
                                                                                                                          "C:\Sessionmonitor\sppsvc.exe"
                                                                                                                          31⤵
                                                                                                                          • Checks computer location settings
                                                                                                                          • Executes dropped EXE
                                                                                                                          • Modifies registry class
                                                                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                                                                          PID:2436
                                                                                                                          • C:\Windows\System32\cmd.exe
                                                                                                                            "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\imE7OxQXo6.bat"
                                                                                                                            32⤵
                                                                                                                              PID:2172
                                                                                                                              • C:\Windows\system32\chcp.com
                                                                                                                                chcp 65001
                                                                                                                                33⤵
                                                                                                                                  PID:1464
                                                                                                                                • C:\Windows\system32\w32tm.exe
                                                                                                                                  w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                                                                                                                                  33⤵
                                                                                                                                    PID:2500
                                                                                                                                  • C:\Sessionmonitor\sppsvc.exe
                                                                                                                                    "C:\Sessionmonitor\sppsvc.exe"
                                                                                                                                    33⤵
                                                                                                                                    • Checks computer location settings
                                                                                                                                    • Executes dropped EXE
                                                                                                                                    • Modifies registry class
                                                                                                                                    • Suspicious use of AdjustPrivilegeToken
                                                                                                                                    PID:2616
                                                                                                                                    • C:\Windows\System32\cmd.exe
                                                                                                                                      "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\luGtQJ8wXl.bat"
                                                                                                                                      34⤵
                                                                                                                                        PID:2624
                                                                                                                                        • C:\Windows\system32\chcp.com
                                                                                                                                          chcp 65001
                                                                                                                                          35⤵
                                                                                                                                            PID:4640
                                                                                                                                          • C:\Windows\system32\PING.EXE
                                                                                                                                            ping -n 10 localhost
                                                                                                                                            35⤵
                                                                                                                                            • System Network Configuration Discovery: Internet Connection Discovery
                                                                                                                                            • Runs ping.exe
                                                                                                                                            PID:2868
                                                                                                                                          • C:\Sessionmonitor\sppsvc.exe
                                                                                                                                            "C:\Sessionmonitor\sppsvc.exe"
                                                                                                                                            35⤵
                                                                                                                                            • Checks computer location settings
                                                                                                                                            • Executes dropped EXE
                                                                                                                                            • Modifies registry class
                                                                                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                                                                                            PID:4960
                                                                                                                                            • C:\Windows\System32\cmd.exe
                                                                                                                                              "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\6Nq0CBezpn.bat"
                                                                                                                                              36⤵
                                                                                                                                                PID:3804
                                                                                                                                                • C:\Windows\system32\chcp.com
                                                                                                                                                  chcp 65001
                                                                                                                                                  37⤵
                                                                                                                                                    PID:3704
                                                                                                                                                  • C:\Windows\system32\w32tm.exe
                                                                                                                                                    w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                                                                                                                                                    37⤵
                                                                                                                                                      PID:3988
                                                                                                                                                    • C:\Sessionmonitor\sppsvc.exe
                                                                                                                                                      "C:\Sessionmonitor\sppsvc.exe"
                                                                                                                                                      37⤵
                                                                                                                                                      • Checks computer location settings
                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                      • Modifies registry class
                                                                                                                                                      • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                      PID:4804
                                                                                                                                                      • C:\Windows\System32\cmd.exe
                                                                                                                                                        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\FT8q7RDVDe.bat"
                                                                                                                                                        38⤵
                                                                                                                                                          PID:4792
                                                                                                                                                          • C:\Windows\system32\chcp.com
                                                                                                                                                            chcp 65001
                                                                                                                                                            39⤵
                                                                                                                                                              PID:2768
                                                                                                                                                            • C:\Windows\system32\PING.EXE
                                                                                                                                                              ping -n 10 localhost
                                                                                                                                                              39⤵
                                                                                                                                                              • System Network Configuration Discovery: Internet Connection Discovery
                                                                                                                                                              • Runs ping.exe
                                                                                                                                                              PID:1600
                                                                                                                                                            • C:\Sessionmonitor\sppsvc.exe
                                                                                                                                                              "C:\Sessionmonitor\sppsvc.exe"
                                                                                                                                                              39⤵
                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                              • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                              PID:3964
                                                                                  • C:\Windows\Resources\Themes\icsys.icn.exe
                                                                                    C:\Windows\Resources\Themes\icsys.icn.exe
                                                                                    2⤵
                                                                                    • Executes dropped EXE
                                                                                    • Drops file in Windows directory
                                                                                    • System Location Discovery: System Language Discovery
                                                                                    • Suspicious behavior: EnumeratesProcesses
                                                                                    • Suspicious use of SetWindowsHookEx
                                                                                    • Suspicious use of WriteProcessMemory
                                                                                    PID:860
                                                                                    • \??\c:\windows\resources\themes\explorer.exe
                                                                                      c:\windows\resources\themes\explorer.exe
                                                                                      3⤵
                                                                                      • Modifies visiblity of hidden/system files in Explorer
                                                                                      • Executes dropped EXE
                                                                                      • Adds Run key to start application
                                                                                      • Drops file in System32 directory
                                                                                      • Drops file in Windows directory
                                                                                      • System Location Discovery: System Language Discovery
                                                                                      • Suspicious behavior: GetForegroundWindowSpam
                                                                                      • Suspicious use of SetWindowsHookEx
                                                                                      • Suspicious use of WriteProcessMemory
                                                                                      PID:4676
                                                                                      • \??\c:\windows\resources\spoolsv.exe
                                                                                        c:\windows\resources\spoolsv.exe SE
                                                                                        4⤵
                                                                                        • Executes dropped EXE
                                                                                        • Drops file in Windows directory
                                                                                        • System Location Discovery: System Language Discovery
                                                                                        • Suspicious use of SetWindowsHookEx
                                                                                        • Suspicious use of WriteProcessMemory
                                                                                        PID:1368
                                                                                        • \??\c:\windows\resources\svchost.exe
                                                                                          c:\windows\resources\svchost.exe
                                                                                          5⤵
                                                                                          • Modifies visiblity of hidden/system files in Explorer
                                                                                          • Executes dropped EXE
                                                                                          • Adds Run key to start application
                                                                                          • Drops file in System32 directory
                                                                                          • System Location Discovery: System Language Discovery
                                                                                          • Suspicious behavior: GetForegroundWindowSpam
                                                                                          • Suspicious use of SetWindowsHookEx
                                                                                          • Suspicious use of WriteProcessMemory
                                                                                          PID:3436
                                                                                          • \??\c:\windows\resources\spoolsv.exe
                                                                                            c:\windows\resources\spoolsv.exe PR
                                                                                            6⤵
                                                                                            • Executes dropped EXE
                                                                                            • System Location Discovery: System Language Discovery
                                                                                            • Suspicious use of SetWindowsHookEx
                                                                                            PID:3800
                                                                                • C:\Windows\system32\taskmgr.exe
                                                                                  "C:\Windows\system32\taskmgr.exe" /4
                                                                                  1⤵
                                                                                  • Checks SCSI registry key(s)
                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                  • Suspicious use of FindShellTrayWindow
                                                                                  • Suspicious use of SendNotifyMessage
                                                                                  • Suspicious use of WriteProcessMemory
                                                                                  PID:3056
                                                                                  • C:\Windows\system32\taskmgr.exe
                                                                                    "C:\Windows\system32\taskmgr.exe" /1
                                                                                    2⤵
                                                                                    • Checks SCSI registry key(s)
                                                                                    • Checks processor information in registry
                                                                                    • Modifies registry class
                                                                                    • Suspicious behavior: GetForegroundWindowSpam
                                                                                    • Suspicious use of AdjustPrivilegeToken
                                                                                    • Suspicious use of FindShellTrayWindow
                                                                                    • Suspicious use of SendNotifyMessage
                                                                                    PID:4392
                                                                                • C:\Windows\System32\rundll32.exe
                                                                                  C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
                                                                                  1⤵
                                                                                    PID:64

                                                                                  Network

                                                                                  MITRE ATT&CK Enterprise v15

                                                                                  Replay Monitor

                                                                                  Loading Replay Monitor...

                                                                                  Downloads

                                                                                  • C:\Sessionmonitor\blockwebCrtDll.exe
                                                                                    Filesize

                                                                                    1.8MB

                                                                                    MD5

                                                                                    3ad7279b076c274f201e0b92a7a55e96

                                                                                    SHA1

                                                                                    ffac2f3c59ec1eb113dc792a0b704655ee6387a2

                                                                                    SHA256

                                                                                    97df8dd6709a54b2c8dd44cc9957e2618f2f0d433d86aad1985babe8b60eeb9a

                                                                                    SHA512

                                                                                    3c6f9df7dae6dde84eef061242c36659cde5bb36785d3660af8df84b526b46272ca0c70295b3ff9ef90558a97ad742c24ed76b688fecbc36a9fe9e022d43a7d0

                                                                                    Download Submit

                                                                                  • C:\Sessionmonitor\gWy3murIAkbQBAvjnA7qra.bat
                                                                                    Filesize

                                                                                    73B

                                                                                    MD5

                                                                                    37851a0699ffe406710790b01169a14b

                                                                                    SHA1

                                                                                    e0d77f4c89b68bd84d401c43c396a7479e721f8f

                                                                                    SHA256

                                                                                    6bcfa5c5717dbd869315facfc91ac607552b63b1c4c486e23b08771b4bbde5c1

                                                                                    SHA512

                                                                                    4e7e72b7eb5aea874d0998b8a15bbd240d68c0b7ddae3fbe0c35159d2e725aea7df2089e5760f1e3f3b53c29670088c61803092fe77d60ad7d71266d23eb7350

                                                                                    Download Submit

                                                                                  • C:\Sessionmonitor\uGKEf17W5UFdKyvhpzBZN53V3al.vbe
                                                                                    Filesize

                                                                                    214B

                                                                                    MD5

                                                                                    58db642de236117559c80bdcf2f46571

                                                                                    SHA1

                                                                                    b21d95a0b197c8f9c0d47ce1c63c8a113de6c202

                                                                                    SHA256

                                                                                    2f2533e0fdeed33a2e845f800d55c420c8217e9e1b2b36672ff6f4da6db2b0ec

                                                                                    SHA512

                                                                                    46e03a6f3e4a36dff39e2bffbd609b3451f7b54fb5fca3803ad12e39ef40368de6ccbf0dfd38544724e1205b4309789cff5ece7fbbb2c591e6121ef75b3daf8a

                                                                                    Download Submit

                                                                                  • C:\Users\Admin\AppData\Local\D3DSCache\e8010882af4f153f\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.idx
                                                                                    Filesize

                                                                                    64KB

                                                                                    MD5

                                                                                    d2fb266b97caff2086bf0fa74eddb6b2

                                                                                    SHA1

                                                                                    2f0061ce9c51b5b4fbab76b37fc6a540be7f805d

                                                                                    SHA256

                                                                                    b09f68b61d9ff5a7c7c8b10eee9447d4813ee0e866346e629e788cd4adecb66a

                                                                                    SHA512

                                                                                    c3ba95a538c1d266beb83334af755c34ce642a4178ab0f2e5f7822fd6821d3b68862a8b58f167a9294e6d913b08c1054a69b5d7aec2efdb3cf9796ed84de21a8

                                                                                    Download Submit

                                                                                  • C:\Users\Admin\AppData\Local\D3DSCache\e8010882af4f153f\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.lock
                                                                                    Filesize

                                                                                    4B

                                                                                    MD5

                                                                                    f49655f856acb8884cc0ace29216f511

                                                                                    SHA1

                                                                                    cb0f1f87ec0455ec349aaa950c600475ac7b7b6b

                                                                                    SHA256

                                                                                    7852fce59c67ddf1d6b8b997eaa1adfac004a9f3a91c37295de9223674011fba

                                                                                    SHA512

                                                                                    599e93d25b174524495ed29653052b3590133096404873318f05fd68f4c9a5c9a3b30574551141fbb73d7329d6be342699a17f3ae84554bab784776dfda2d5f8

                                                                                    Download Submit

                                                                                  • C:\Users\Admin\AppData\Local\D3DSCache\e8010882af4f153f\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.val
                                                                                    Filesize

                                                                                    944B

                                                                                    MD5

                                                                                    6bd369f7c74a28194c991ed1404da30f

                                                                                    SHA1

                                                                                    0f8e3f8ab822c9374409fe399b6bfe5d68cbd643

                                                                                    SHA256

                                                                                    878947d0ec814fe7c343cdebc05eebf00eb14f3023bdb3809a559e17f399fe5d

                                                                                    SHA512

                                                                                    8fc5f073dc9fa1e1ae47c60a5f06e0a48709fd6a4302dffaa721858409e7bde64bc6856d3fb28891090516d1a7afc542579de287778b5755eafe75cc67d45d93

                                                                                    Download Submit

                                                                                  • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\sppsvc.exe.log
                                                                                    Filesize

                                                                                    1KB

                                                                                    MD5

                                                                                    f8b2fca3a50771154571c11f1c53887b

                                                                                    SHA1

                                                                                    2e83b0c8e2f4c10b145b7fb4832ed1c78743de3f

                                                                                    SHA256

                                                                                    0efa72802031a8f902c3a4ab18fe3d667dafc71c93eb3a1811e78353ecf4a6b6

                                                                                    SHA512

                                                                                    b98b8d5516593d13415199d4ac6fbe4ff924488487c4bd863cb677601048785d872a3ff30129148e2961cb6fb2fc33117540302980a132f57f7ec9a497813f1a

                                                                                    Download Submit

                                                                                  • C:\Users\Admin\AppData\Local\Temp\0BhMlNgjsC.bat
                                                                                    Filesize

                                                                                    204B

                                                                                    MD5

                                                                                    e7cbc92c80099f8b23d9e434cc548683

                                                                                    SHA1

                                                                                    0df3776e8adcc785c127d71cfb2dac66489d3aba

                                                                                    SHA256

                                                                                    5b2aeb6d6d06e0ea72f4bf3c2c5b353cd6235a202ce7fcf9190f51f93d48f4e0

                                                                                    SHA512

                                                                                    ce7d18b935794e014fc98eb7c58a280317f4062050fdc1aa7eed2eabe40f4e241e326693a0038701a43b08c96f5f80d21f30d200ce6b46c118ef2b0ee6e2616c

                                                                                    Download Submit

                                                                                  • C:\Users\Admin\AppData\Local\Temp\2vzlDYcv1s.bat
                                                                                    Filesize

                                                                                    156B

                                                                                    MD5

                                                                                    7a87ec254f53d68dafaab1ee68319ad3

                                                                                    SHA1

                                                                                    23dd4d7b50eadcc3e8fca9fd9d3ec32099b3f2b5

                                                                                    SHA256

                                                                                    f292ac882908585f93d5de079dbc47018707fc7bf0199711e81605428988da73

                                                                                    SHA512

                                                                                    52ec5d871fbb2692b628b1ae61a734b5c44d56d900c55af0550779a06aaab3447b4d7c843454ed4e41e53c735d1330bee2b5b64b499c3a4afb1a384d1cde1eec

                                                                                    Download Submit

                                                                                  • C:\Users\Admin\AppData\Local\Temp\6Nq0CBezpn.bat
                                                                                    Filesize

                                                                                    204B

                                                                                    MD5

                                                                                    e235feb8678632796eed956eb7ba3a64

                                                                                    SHA1

                                                                                    86269a135b1adce5c316be31ad9b8d3cf45c1fb6

                                                                                    SHA256

                                                                                    67bc86f6f734f1eae1919bde3d5bd6abebc2821b2d500af8a5538f8428aaa28b

                                                                                    SHA512

                                                                                    9a23d63ef93e86ca9bdf860cab9fdb9b518426e597e0dcf648eb740e2c50cb178f32732992375389346be8124d4a24a58433e13e982bd59d3acd179e01b12cde

                                                                                    Download Submit

                                                                                  • C:\Users\Admin\AppData\Local\Temp\9LyY97a2AO.bat
                                                                                    Filesize

                                                                                    156B

                                                                                    MD5

                                                                                    6606b83b9e3f6a2bc23c232216ae0a78

                                                                                    SHA1

                                                                                    ec8525622b358791b5e1119df70d91f0ee72c790

                                                                                    SHA256

                                                                                    29ba375028ab090bc4ad90b2eed97a67446d8092d178c98d985dcd8261b3c204

                                                                                    SHA512

                                                                                    b4e549c227442a4e4c7f88b97c835310e83ecd7f659c7f69cc98a9df10ab40ab901126569a0f4cdffa009dd45dd08df66aa76f3377dd39b6ccd072901d6de30d

                                                                                    Download Submit

                                                                                  • C:\Users\Admin\AppData\Local\Temp\AkiujJMGlN.bat
                                                                                    Filesize

                                                                                    156B

                                                                                    MD5

                                                                                    c3de064a39189251dd3660a8ff532875

                                                                                    SHA1

                                                                                    3dbf3cc52f0bb179901a092fcf9c3a574e587326

                                                                                    SHA256

                                                                                    d8e40a8d29bc20d7a27f34f05c3ddc5dd957e8abe5239fdd907c7c430c533c9c

                                                                                    SHA512

                                                                                    49fe6d76a6737c351b6eef451da959aa20654e33b67ba413013936ec20cc60178a95c94be2a5c54274f3a4f137ef5bd753501824d1062d53ddd948495463d4d0

                                                                                    Download Submit

                                                                                  • C:\Users\Admin\AppData\Local\Temp\FT8q7RDVDe.bat
                                                                                    Filesize

                                                                                    156B

                                                                                    MD5

                                                                                    15fce198acbd82ffe3936d0eb9ea0541

                                                                                    SHA1

                                                                                    60833dff8b32fcd3da93ecc285d847f4c97ccd2c

                                                                                    SHA256

                                                                                    db12be83f590a8a10342da936929b8fba5c6d121e72dc2686f2385b891e127ef

                                                                                    SHA512

                                                                                    b30b954ac0e083c0f0416588a3f06602a9ba4260fae5310bf720f185c2a144cda4277b1103b55ff2e2aa34d9bf842bd7ed6552c3b088d1d637626867ab21db9a

                                                                                    Download Submit

                                                                                  • C:\Users\Admin\AppData\Local\Temp\MJezb5uUW4.bat
                                                                                    Filesize

                                                                                    156B

                                                                                    MD5

                                                                                    4cc06c76f30d36d2d13b452827f5882c

                                                                                    SHA1

                                                                                    fa28d58b343ceae6fee5203cbbe86bc238b301c9

                                                                                    SHA256

                                                                                    1911e8fa9b971034439aa5aa55a8b7067f5555a4cdee8d81d88c51da2d71f861

                                                                                    SHA512

                                                                                    5bc7f4fdc4beb2455850bc57a351fafff6cf3fcb07dacf99e37d48a248f96f23359e255a1794fc2ce758e73029bffb158b8e2c36ce97931feb745e2517b687a6

                                                                                    Download Submit

                                                                                  • C:\Users\Admin\AppData\Local\Temp\MeHUYFCmAF.bat
                                                                                    Filesize

                                                                                    156B

                                                                                    MD5

                                                                                    163c5d5b54e59e9020bda7933f805cfc

                                                                                    SHA1

                                                                                    6a922d30096ffcb58b75c7c491c8fbc901aabd02

                                                                                    SHA256

                                                                                    d767bd49abf2db99df20dda372df8e2b1a81663224118cdd5f82c5cfa712d15a

                                                                                    SHA512

                                                                                    0c6ac379c3a78833dd0cbb3f344170df01b6298639dc7fd599244410323fffde8803534e62e7897695fd41f28e03de9a545387dfa0f0e1cc7bea0e67bd06717e

                                                                                    Download Submit

                                                                                  • C:\Users\Admin\AppData\Local\Temp\PmJFabuBut.bat
                                                                                    Filesize

                                                                                    204B

                                                                                    MD5

                                                                                    f1c8495e629f80688f63c55977676974

                                                                                    SHA1

                                                                                    fbae7fed08d6822e98023b942cd24877163ca4c5

                                                                                    SHA256

                                                                                    8c6225667c53ceb4056c72a00c9dd23716e2971ba5dd4162f8f608fade15d910

                                                                                    SHA512

                                                                                    a0383774ca0025bf84a3b03bdc88de9c69284fc0857e7c07986c8cd18ad23801d06ebc6bebf51f201a73039ead1c797714c7fd7aa20560160e59b301dc09ff3a

                                                                                    Download Submit

                                                                                  • C:\Users\Admin\AppData\Local\Temp\RvL1cycbdY.bat
                                                                                    Filesize

                                                                                    204B

                                                                                    MD5

                                                                                    f453f393453c0842fe30a51200e5f0e5

                                                                                    SHA1

                                                                                    166b13591c1f9ba95cfbd78f993e612c74b93afc

                                                                                    SHA256

                                                                                    c834316b6daeab774a28dd5e21aeef0160c101b616b84fc704f7b1d6c670caa2

                                                                                    SHA512

                                                                                    0369e58c5a7fe56f6ffe8ad9e6020f03347cefbc7b55febddf7159f4eb457b0b0fb7c2061a3f10621b80e9dd8627661c930baf6365deae0837c1bd7b20fe0ded

                                                                                    Download Submit

                                                                                  • C:\Users\Admin\AppData\Local\Temp\TqMgut2j0M.bat
                                                                                    Filesize

                                                                                    204B

                                                                                    MD5

                                                                                    3a3604596577d5bbad37458e48575a8d

                                                                                    SHA1

                                                                                    b73d84fe11f79eb7e71dc7156e1a8a23c397db8b

                                                                                    SHA256

                                                                                    9fa7ec6d0fea42dd05a4b3f24e6afbf9224360576291c16f0143faf1b44010ca

                                                                                    SHA512

                                                                                    358c8c4a231170dbd0951d1c41a10bfe6bbb572590663d80f032fbea7cadc4c9a810a6fe91b128c377c9843b0afc83eb84c84cf728aa4b15150ac951e32afb2d

                                                                                    Download Submit

                                                                                  • C:\Users\Admin\AppData\Local\Temp\ZXx7vcf4zU.bat
                                                                                    Filesize

                                                                                    204B

                                                                                    MD5

                                                                                    d6abc16bdad68733c00cea33f54ac339

                                                                                    SHA1

                                                                                    10e919953bdc299a7a461b588f63f2262396550e

                                                                                    SHA256

                                                                                    f4a014ca9b98ef27261b7438b822d1588089bf41862764547539ca030a47b11f

                                                                                    SHA512

                                                                                    214826bcf742305bdfcf6170c6642b7ad856b0287ba3a2871f1fd6d1d58badaded21dfe495df67cb0e80cb71dfcaafac1a195f55044afbc07572719a64202cb1

                                                                                    Download Submit

                                                                                  • C:\Users\Admin\AppData\Local\Temp\imE7OxQXo6.bat
                                                                                    Filesize

                                                                                    204B

                                                                                    MD5

                                                                                    fcab75c0e6a98abb8b8c454b4cb8e98f

                                                                                    SHA1

                                                                                    736fce1a1bae2b3b336be213fd920575c723055a

                                                                                    SHA256

                                                                                    6b43a7a62f8d9037d899cfa602c91b1b9279b1ac36fefc61b713067e52f9ce7e

                                                                                    SHA512

                                                                                    fc26970e3cc527be5fd9dbfbb4a9c9b6ff561bf47c8cb724e91e83b357dd218c3566083cf636ef6460052563b377d531f44f7b4cc8a3aa1cd2051b3872701fbe

                                                                                    Download Submit

                                                                                  • C:\Users\Admin\AppData\Local\Temp\luGtQJ8wXl.bat
                                                                                    Filesize

                                                                                    156B

                                                                                    MD5

                                                                                    119f7a8e2b57c437773a6f3831df442a

                                                                                    SHA1

                                                                                    7877c243ac0c40e5c347c4ad8d0e2f2b0958675d

                                                                                    SHA256

                                                                                    4c5df8a48af25a2d90d477413d032e8bb7d7465c62bf8139c1204fd896907433

                                                                                    SHA512

                                                                                    8f07a241abad4fb107c4563de29b98aad46f327ecea684fda473fee698a830874e4e8e8e2ff6bf91896825e21015be3b011abb544befad1f7b1abf0d9b5fc3da

                                                                                    Download Submit

                                                                                  • C:\Users\Admin\AppData\Local\Temp\mapper.exe 
                                                                                    Filesize

                                                                                    2.1MB

                                                                                    MD5

                                                                                    a2a3db704bbb8002aea8e3085bb93bf7

                                                                                    SHA1

                                                                                    cf23bc2d22706eef776b308e4f16b70f9f58f2b8

                                                                                    SHA256

                                                                                    d91963c6538fb30c4713ce487225ca96f517665989ea3c9a1b8aa0a592be540e

                                                                                    SHA512

                                                                                    37bb7289682c77da75af210d5b31d7d03c5ac52c4c6c7b184a4cbdf8e4ed6be5835e49da442d7c394a5567852df9ff7be28fe4dbc051ee2b50829d5bef1a7a75

                                                                                    Download Submit

                                                                                  • C:\Users\Admin\AppData\Local\Temp\s6L5myzuOs.bat
                                                                                    Filesize

                                                                                    204B

                                                                                    MD5

                                                                                    2b6f2de13ab2d5471ff1c7b0f9eb4d86

                                                                                    SHA1

                                                                                    cd64d8d0e0429de603e728f3d728e75ffda7be8c

                                                                                    SHA256

                                                                                    eeb592935ce6ee17f36c5dc40508ffb21b0714672f668f35bdb20d4b8cc60190

                                                                                    SHA512

                                                                                    3cab95f860239ac3c9be55b155061fb6046fccf12488d3c6da7f62a5e5dab2c4cf8fadb209097eecc0e0eb6edfa7ecb01ae62c7cee2d152fe6f0ca60144ab368

                                                                                    Download Submit

                                                                                  • C:\Users\Admin\AppData\Local\Temp\tpiwJJ3Pd2.bat
                                                                                    Filesize

                                                                                    204B

                                                                                    MD5

                                                                                    67d1229a7c228279ebe7a1e3edce88a9

                                                                                    SHA1

                                                                                    4d4936507856f5b12446103fbd0206b6904c32e9

                                                                                    SHA256

                                                                                    fda064fb2cffdf5d9546a4cba85f9db732f07fba41d4a012ed547407da9e776d

                                                                                    SHA512

                                                                                    910f649aed386ba5b15c08e6585f2e2d5868b0dd2c79bddbdc7026beebd55da45ae01f59c9f07547ff37f2491f810a72d692f344355958c352c1ef74c1329e60

                                                                                    Download Submit

                                                                                  • C:\Windows\Resources\Themes\explorer.exe
                                                                                    Filesize

                                                                                    135KB

                                                                                    MD5

                                                                                    172349e5d03d81048681f732d9ef1be4

                                                                                    SHA1

                                                                                    f3b60eb57bdbd514c0c09fe466edfd352eca0cde

                                                                                    SHA256

                                                                                    313f01fb6a5523cfbea79b35501c61a321b6a4cc48346051514ca376034cbc17

                                                                                    SHA512

                                                                                    09f5175326c432c5a297291c37309147d3ee12dd74dbbfd24b4e91fffa6bd6f4c28d187c684579bd8665b7042b36589a7efca50f8ff0d02d70280161bbfee623

                                                                                    Download Submit

                                                                                  • C:\Windows\Resources\Themes\icsys.icn.exe
                                                                                    Filesize

                                                                                    135KB

                                                                                    MD5

                                                                                    156504ca3ea055d274d1e62bc54492f0

                                                                                    SHA1

                                                                                    1a0a648e48460270058d7f5e885a679142ef36a4

                                                                                    SHA256

                                                                                    dc2c6e60593b738c22d376da312994fa66b6be05a192178ac90a65f98a7371b3

                                                                                    SHA512

                                                                                    ca6f78d2d444e71fe9e177cae8f45963421e187a14721517fbbe11a6b0f2bdd2946c244b928feeacb55eee57907147605aa339474aa36d91b8d9955a623de8d5

                                                                                    Download Submit

                                                                                  • C:\Windows\Resources\spoolsv.exe
                                                                                    Filesize

                                                                                    135KB

                                                                                    MD5

                                                                                    074f33d4c81702b4b4fb20e0cb3d0069

                                                                                    SHA1

                                                                                    0a1a929d03a923a97855484c5e2da8436d040938

                                                                                    SHA256

                                                                                    3f1ee71abc6a54cdd2a089d19d1660a6e648bc917b2d576b1c978ca576046823

                                                                                    SHA512

                                                                                    901d91b02942df9a558be22f5b720cec8b342dee695ea7361c00e2aa42b6584a3efdb2b52a5ae644c59d3145d1a103752c3e1780278dd825470f9a842e8e4e3c

                                                                                    Download Submit

                                                                                  • \??\c:\windows\resources\svchost.exe
                                                                                    Filesize

                                                                                    135KB

                                                                                    MD5

                                                                                    d1f8ef57690f8610837d6366a414bf50

                                                                                    SHA1

                                                                                    9ada3ef36972d09571bbb2bd0789b2114c4f4a82

                                                                                    SHA256

                                                                                    54e84a478e9f95c4b5ace97e230d3f69f85727f72af692d02e936e2a92188c43

                                                                                    SHA512

                                                                                    f617843cdebf16c202146bfcbe41d40426c2e6394ff835021c51f1bcdfb4dd0ec7fbac6dcfb47d6ff243064af1f85a624a70a7cf6c0b8d1e157f60c3a064348c

                                                                                    Download Submit

                                                                                  • memory/860-54-0x0000000000400000-0x000000000041F000-memory.dmp

                                                                                    Filesize

                                                                                    124KB

                                                                                    Download

                                                                                  • memory/1220-73-0x0000000000050000-0x0000000000222000-memory.dmp

                                                                                    Filesize

                                                                                    1.8MB

                                                                                    Download

                                                                                  • memory/1220-80-0x0000000002390000-0x00000000023A8000-memory.dmp

                                                                                    Filesize

                                                                                    96KB

                                                                                    Download

                                                                                  • memory/1220-78-0x000000001ADF0000-0x000000001AE40000-memory.dmp

                                                                                    Filesize

                                                                                    320KB

                                                                                    Download

                                                                                  • memory/1220-77-0x0000000002370000-0x000000000238C000-memory.dmp

                                                                                    Filesize

                                                                                    112KB

                                                                                    Download

                                                                                  • memory/1220-75-0x00000000022F0000-0x00000000022FE000-memory.dmp

                                                                                    Filesize

                                                                                    56KB

                                                                                    Download

                                                                                  • memory/1368-53-0x0000000000400000-0x000000000041F000-memory.dmp

                                                                                    Filesize

                                                                                    124KB

                                                                                    Download

                                                                                  • memory/3056-67-0x00000242A1620000-0x00000242A1621000-memory.dmp

                                                                                    Filesize

                                                                                    4KB

                                                                                    Download

                                                                                  • memory/3056-57-0x00000242A1620000-0x00000242A1621000-memory.dmp

                                                                                    Filesize

                                                                                    4KB

                                                                                    Download

                                                                                  • memory/3056-64-0x00000242A1620000-0x00000242A1621000-memory.dmp

                                                                                    Filesize

                                                                                    4KB

                                                                                    Download

                                                                                  • memory/3056-65-0x00000242A1620000-0x00000242A1621000-memory.dmp

                                                                                    Filesize

                                                                                    4KB

                                                                                    Download

                                                                                  • memory/3056-66-0x00000242A1620000-0x00000242A1621000-memory.dmp

                                                                                    Filesize

                                                                                    4KB

                                                                                    Download

                                                                                  • memory/3056-62-0x00000242A1620000-0x00000242A1621000-memory.dmp

                                                                                    Filesize

                                                                                    4KB

                                                                                    Download

                                                                                  • memory/3056-68-0x00000242A1620000-0x00000242A1621000-memory.dmp

                                                                                    Filesize

                                                                                    4KB

                                                                                    Download

                                                                                  • memory/3056-56-0x00000242A1620000-0x00000242A1621000-memory.dmp

                                                                                    Filesize

                                                                                    4KB

                                                                                    Download

                                                                                  • memory/3056-63-0x00000242A1620000-0x00000242A1621000-memory.dmp

                                                                                    Filesize

                                                                                    4KB

                                                                                    Download

                                                                                  • memory/3056-58-0x00000242A1620000-0x00000242A1621000-memory.dmp

                                                                                    Filesize

                                                                                    4KB

                                                                                    Download

                                                                                  • memory/3436-190-0x0000000000400000-0x000000000041F000-memory.dmp

                                                                                    Filesize

                                                                                    124KB

                                                                                    Download

                                                                                  • memory/3800-52-0x0000000000400000-0x000000000041F000-memory.dmp

                                                                                    Filesize

                                                                                    124KB

                                                                                    Download

                                                                                  • memory/4676-189-0x0000000000400000-0x000000000041F000-memory.dmp

                                                                                    Filesize

                                                                                    124KB

                                                                                    Download

                                                                                  • memory/4676-20-0x0000000000400000-0x000000000041F000-memory.dmp

                                                                                    Filesize

                                                                                    124KB

                                                                                    Download

                                                                                  • memory/5104-55-0x0000000000400000-0x000000000041F000-memory.dmp

                                                                                    Filesize

                                                                                    124KB

                                                                                    Download

                                                                                  • memory/5104-0-0x0000000000400000-0x000000000041F000-memory.dmp

                                                                                    Filesize

                                                                                    124KB

                                                                                    Download