dcrat | 915f9f512ca5182e905b1ae904c984b30f5039884d1835d91248b0e6b19f0f83

Analysis

max time kernel
90s
max time network
30s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
12-12-2022 17:14

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8468c0223b7665174d19866d33ae9731.exe
Size

2.0MB
MD5

8468c0223b7665174d19866d33ae9731
SHA1

b261b25063f61b7194310d62912596df732ebbb7
SHA256

915f9f512ca5182e905b1ae904c984b30f5039884d1835d91248b0e6b19f0f83
SHA512

77397cc18ba208256e9fc4ebd182a197f6fc2f71e17ae737b0ab3bfa8c09d3da6a3ae30076a1bfaea9bd4889402f5e897f3b751cf86e8e12fd59f85f48613eb6
SSDEEP

49152:ubA3j3+gYXZTD1VXUqzX7VwjvMoh1IFyuyigWnMzm6sDBKvK:ubdTHUxUoh1IF9gl2x

Score

10^/10

dcrat infostealer rat

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat

Process spawned unexpected child process 24 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

Processes:

schtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exe

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1248	996	schtasks.exe	32
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1752	996	schtasks.exe	32
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1428	996	schtasks.exe	32
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1056	996	schtasks.exe	32
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	284	996	schtasks.exe	32
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1580	996	schtasks.exe	32
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1964	996	schtasks.exe	32
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1184	996	schtasks.exe	32
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1440	996	schtasks.exe	32
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	860	996	schtasks.exe	32
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1080	996	schtasks.exe	32
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1992	996	schtasks.exe	32
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1028	996	schtasks.exe	32
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1624	996	schtasks.exe	32
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	676	996	schtasks.exe	32
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1528	996	schtasks.exe	32
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	472	996	schtasks.exe	32
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	812	996	schtasks.exe	32
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	916	996	schtasks.exe	32
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1856	996	schtasks.exe	32
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	700	996	schtasks.exe	32
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	560	996	schtasks.exe	32
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1044	996	schtasks.exe	32
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2012	996	schtasks.exe	32

DCRat payload 8 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

Processes:

resource	yara_rule
behavioral1/files/0x00070000000142ea-60.dat	dcrat
behavioral1/files/0x00070000000142ea-61.dat	dcrat
behavioral1/files/0x00070000000142ea-62.dat	dcrat
behavioral1/files/0x00070000000142ea-64.dat	dcrat
behavioral1/memory/788-65-0x0000000000CC0000-0x0000000000E80000-memory.dmp	dcrat
behavioral1/files/0x0007000000014ef4-122.dat	dcrat
behavioral1/files/0x0007000000014ef4-123.dat	dcrat
behavioral1/memory/2304-124-0x0000000001180000-0x0000000001340000-memory.dmp	dcrat

Drops file in Drivers directory 1 IoCs

Processes:

SurrogateDll.exe

description	ioc	Process
File opened for modification	C:\Windows\System32\drivers\etc\hosts	SurrogateDll.exe

Executes dropped EXE 2 IoCs

Processes:

SurrogateDll.exeWMIADAP.exe

pid	Process
788	SurrogateDll.exe
2304	WMIADAP.exe

Loads dropped DLL 2 IoCs

Processes:

cmd.exe

pid	Process
516	cmd.exe
516	cmd.exe

Drops file in Program Files directory 10 IoCs

Processes:

SurrogateDll.exe

description	ioc	Process
File opened for modification	C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\RCX7EF6.tmp	SurrogateDll.exe
File opened for modification	C:\Program Files (x86)\Windows Portable Devices\WMIADAP.exe	SurrogateDll.exe
File opened for modification	C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\RCX7BE9.tmp	SurrogateDll.exe
File created	C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\b75386f1303e64	SurrogateDll.exe
File created	C:\Program Files (x86)\Windows Portable Devices\WMIADAP.exe	SurrogateDll.exe
File created	C:\Program Files (x86)\Windows Portable Devices\75a57c1bdf437c	SurrogateDll.exe
File opened for modification	C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\taskhost.exe	SurrogateDll.exe
File opened for modification	C:\Program Files (x86)\Windows Portable Devices\RCXACA3.tmp	SurrogateDll.exe
File opened for modification	C:\Program Files (x86)\Windows Portable Devices\RCXAF53.tmp	SurrogateDll.exe
File created	C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\taskhost.exe	SurrogateDll.exe

Drops file in Windows directory 5 IoCs

Processes:

SurrogateDll.exe

description	ioc	Process
File created	C:\Windows\en-US\sppsvc.exe	SurrogateDll.exe
File created	C:\Windows\en-US\0a1fd5f707cd16	SurrogateDll.exe
File opened for modification	C:\Windows\en-US\RCXA2F1.tmp	SurrogateDll.exe
File opened for modification	C:\Windows\en-US\RCXA5A0.tmp	SurrogateDll.exe
File opened for modification	C:\Windows\en-US\sppsvc.exe	SurrogateDll.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 24 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

Processes:

pid	Process
560	schtasks.exe
1248	schtasks.exe
1752	schtasks.exe
284	schtasks.exe
1184	schtasks.exe
700	schtasks.exe
1528	schtasks.exe
916	schtasks.exe
1044	schtasks.exe
1964	schtasks.exe
1440	schtasks.exe
860	schtasks.exe
1028	schtasks.exe
676	schtasks.exe
2012	schtasks.exe
1056	schtasks.exe
1080	schtasks.exe
472	schtasks.exe
812	schtasks.exe
1856	schtasks.exe
1428	schtasks.exe
1580	schtasks.exe
1992	schtasks.exe
1624	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

SurrogateDll.exe

pid	Process
788	SurrogateDll.exe
788	SurrogateDll.exe
788	SurrogateDll.exe
788	SurrogateDll.exe
788	SurrogateDll.exe
788	SurrogateDll.exe
788	SurrogateDll.exe
788	SurrogateDll.exe
788	SurrogateDll.exe
788	SurrogateDll.exe
788	SurrogateDll.exe
788	SurrogateDll.exe
788	SurrogateDll.exe
788	SurrogateDll.exe
788	SurrogateDll.exe
788	SurrogateDll.exe
788	SurrogateDll.exe
788	SurrogateDll.exe
788	SurrogateDll.exe
788	SurrogateDll.exe
788	SurrogateDll.exe
788	SurrogateDll.exe
788	SurrogateDll.exe
788	SurrogateDll.exe
788	SurrogateDll.exe
788	SurrogateDll.exe
788	SurrogateDll.exe
788	SurrogateDll.exe
788	SurrogateDll.exe
788	SurrogateDll.exe
788	SurrogateDll.exe
788	SurrogateDll.exe
788	SurrogateDll.exe
788	SurrogateDll.exe
788	SurrogateDll.exe
788	SurrogateDll.exe
788	SurrogateDll.exe
788	SurrogateDll.exe
788	SurrogateDll.exe
788	SurrogateDll.exe
788	SurrogateDll.exe
788	SurrogateDll.exe
788	SurrogateDll.exe
788	SurrogateDll.exe
788	SurrogateDll.exe
788	SurrogateDll.exe
788	SurrogateDll.exe
788	SurrogateDll.exe
788	SurrogateDll.exe
788	SurrogateDll.exe
788	SurrogateDll.exe
788	SurrogateDll.exe
788	SurrogateDll.exe
788	SurrogateDll.exe
788	SurrogateDll.exe
788	SurrogateDll.exe
788	SurrogateDll.exe
788	SurrogateDll.exe
788	SurrogateDll.exe
788	SurrogateDll.exe
788	SurrogateDll.exe
788	SurrogateDll.exe
788	SurrogateDll.exe
788	SurrogateDll.exe

Suspicious use of AdjustPrivilegeToken 15 IoCs

Processes:

SurrogateDll.exeWMIADAP.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exe

description	pid	Process
Token: SeDebugPrivilege	788	SurrogateDll.exe
Token: SeDebugPrivilege	2304	WMIADAP.exe
Token: SeDebugPrivilege	992	powershell.exe
Token: SeDebugPrivilege	568	powershell.exe
Token: SeDebugPrivilege	1748	powershell.exe
Token: SeDebugPrivilege	1004	powershell.exe
Token: SeDebugPrivilege	2076	powershell.exe
Token: SeDebugPrivilege	1580	powershell.exe
Token: SeDebugPrivilege	1520	powershell.exe
Token: SeDebugPrivilege	2140	powershell.exe
Token: SeDebugPrivilege	1924	powershell.exe
Token: SeDebugPrivilege	1080	powershell.exe
Token: SeDebugPrivilege	1940	powershell.exe
Token: SeDebugPrivilege	548	powershell.exe
Token: SeDebugPrivilege	1800	powershell.exe

Suspicious use of WriteProcessMemory 54 IoCs

Processes:

8468c0223b7665174d19866d33ae9731.exeWScript.execmd.exeSurrogateDll.exe

description	pid	Process	procid_target
PID 2004 wrote to memory of 2000	2004	8468c0223b7665174d19866d33ae9731.exe	28
PID 2004 wrote to memory of 2000	2004	8468c0223b7665174d19866d33ae9731.exe	28
PID 2004 wrote to memory of 2000	2004	8468c0223b7665174d19866d33ae9731.exe	28
PID 2004 wrote to memory of 2000	2004	8468c0223b7665174d19866d33ae9731.exe	28
PID 2000 wrote to memory of 516	2000	WScript.exe	29
PID 2000 wrote to memory of 516	2000	WScript.exe	29
PID 2000 wrote to memory of 516	2000	WScript.exe	29
PID 2000 wrote to memory of 516	2000	WScript.exe	29
PID 516 wrote to memory of 788	516	cmd.exe	31
PID 516 wrote to memory of 788	516	cmd.exe	31
PID 516 wrote to memory of 788	516	cmd.exe	31
PID 516 wrote to memory of 788	516	cmd.exe	31
PID 788 wrote to memory of 548	788	SurrogateDll.exe	57
PID 788 wrote to memory of 548	788	SurrogateDll.exe	57
PID 788 wrote to memory of 548	788	SurrogateDll.exe	57
PID 788 wrote to memory of 1520	788	SurrogateDll.exe	64
PID 788 wrote to memory of 1520	788	SurrogateDll.exe	64
PID 788 wrote to memory of 1520	788	SurrogateDll.exe	64
PID 788 wrote to memory of 992	788	SurrogateDll.exe	63
PID 788 wrote to memory of 992	788	SurrogateDll.exe	63
PID 788 wrote to memory of 992	788	SurrogateDll.exe	63
PID 788 wrote to memory of 1748	788	SurrogateDll.exe	61
PID 788 wrote to memory of 1748	788	SurrogateDll.exe	61
PID 788 wrote to memory of 1748	788	SurrogateDll.exe	61
PID 788 wrote to memory of 1924	788	SurrogateDll.exe	59
PID 788 wrote to memory of 1924	788	SurrogateDll.exe	59
PID 788 wrote to memory of 1924	788	SurrogateDll.exe	59
PID 788 wrote to memory of 1800	788	SurrogateDll.exe	83
PID 788 wrote to memory of 1800	788	SurrogateDll.exe	83
PID 788 wrote to memory of 1800	788	SurrogateDll.exe	83
PID 788 wrote to memory of 1580	788	SurrogateDll.exe	81
PID 788 wrote to memory of 1580	788	SurrogateDll.exe	81
PID 788 wrote to memory of 1580	788	SurrogateDll.exe	81
PID 788 wrote to memory of 1940	788	SurrogateDll.exe	66
PID 788 wrote to memory of 1940	788	SurrogateDll.exe	66
PID 788 wrote to memory of 1940	788	SurrogateDll.exe	66
PID 788 wrote to memory of 1080	788	SurrogateDll.exe	78
PID 788 wrote to memory of 1080	788	SurrogateDll.exe	78
PID 788 wrote to memory of 1080	788	SurrogateDll.exe	78
PID 788 wrote to memory of 568	788	SurrogateDll.exe	67
PID 788 wrote to memory of 568	788	SurrogateDll.exe	67
PID 788 wrote to memory of 568	788	SurrogateDll.exe	67
PID 788 wrote to memory of 1004	788	SurrogateDll.exe	75
PID 788 wrote to memory of 1004	788	SurrogateDll.exe	75
PID 788 wrote to memory of 1004	788	SurrogateDll.exe	75
PID 788 wrote to memory of 2076	788	SurrogateDll.exe	73
PID 788 wrote to memory of 2076	788	SurrogateDll.exe	73
PID 788 wrote to memory of 2076	788	SurrogateDll.exe	73
PID 788 wrote to memory of 2140	788	SurrogateDll.exe	68
PID 788 wrote to memory of 2140	788	SurrogateDll.exe	68
PID 788 wrote to memory of 2140	788	SurrogateDll.exe	68
PID 788 wrote to memory of 2304	788	SurrogateDll.exe	70
PID 788 wrote to memory of 2304	788	SurrogateDll.exe	70
PID 788 wrote to memory of 2304	788	SurrogateDll.exe	70

C:\Users\Admin\AppData\Local\Temp\8468c0223b7665174d19866d33ae9731.exe
"C:\Users\Admin\AppData\Local\Temp\8468c0223b7665174d19866d33ae9731.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2004
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\agentBrowsersavesRefBroker\uC6xwKvnImSiiPHU7zpWHQ8u.vbe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2000
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c ""C:\agentBrowsersavesRefBroker\r205Pw8aNtR7tAq13alM.bat" "
    3⤵
    - Loads dropped DLL
    - Suspicious use of WriteProcessMemory
    PID:516
  - - C:\agentBrowsersavesRefBroker\SurrogateDll.exe
      "C:\agentBrowsersavesRefBroker\SurrogateDll.exe"
      4⤵
      Drops file in Drivers directory
      Executes dropped EXE
      Drops file in Program Files directory
      Drops file in Windows directory
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:788
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:/'
        5⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:548
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:/MSOCache/'
        5⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:1924
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Documents and Settings/'
        5⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:1748
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:/agentBrowsersavesRefBroker/'
        5⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:992
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:/$Recycle.Bin/'
        5⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:1520
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files (x86)/'
        5⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:1940
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Recovery/'
        5⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:568
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Windows/'
        5⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:2140
    - - C:\Program Files (x86)\Windows Portable Devices\WMIADAP.exe
        
        "C:\Program Files (x86)\Windows Portable Devices\WMIADAP.exe"
        5⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:2304
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Users/'
        5⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:2076
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:/System Volume Information/'
        5⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:1004
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:/ProgramData/'
        5⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:1080
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files/'
        5⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:1580
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:/PerfLogs/'
        5⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:1800

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 10 /tr "'C:\Recovery\5e97ab82-6219-11ed-b9ee-5e34c4ab0fa3\spoolsv.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1248

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsv" /sc ONLOGON /tr "'C:\Recovery\5e97ab82-6219-11ed-b9ee-5e34c4ab0fa3\spoolsv.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1752

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 6 /tr "'C:\Recovery\5e97ab82-6219-11ed-b9ee-5e34c4ab0fa3\spoolsv.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1428

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostt" /sc MINUTE /mo 14 /tr "'C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\taskhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1056

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhost" /sc ONLOGON /tr "'C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\taskhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:284

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostt" /sc MINUTE /mo 13 /tr "'C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\taskhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1580

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 6 /tr "'C:\agentBrowsersavesRefBroker\services.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1964

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "services" /sc ONLOGON /tr "'C:\agentBrowsersavesRefBroker\services.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1184

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 11 /tr "'C:\agentBrowsersavesRefBroker\services.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1440

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostt" /sc MINUTE /mo 12 /tr "'C:\agentBrowsersavesRefBroker\taskhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:860

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhost" /sc ONLOGON /tr "'C:\agentBrowsersavesRefBroker\taskhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1080

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostt" /sc MINUTE /mo 5 /tr "'C:\agentBrowsersavesRefBroker\taskhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1992

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 5 /tr "'C:\Recovery\5e97ab82-6219-11ed-b9ee-5e34c4ab0fa3\smss.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1028

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smss" /sc ONLOGON /tr "'C:\Recovery\5e97ab82-6219-11ed-b9ee-5e34c4ab0fa3\smss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1624

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 10 /tr "'C:\Recovery\5e97ab82-6219-11ed-b9ee-5e34c4ab0fa3\smss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:676

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 11 /tr "'C:\Windows\en-US\sppsvc.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1528

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvc" /sc ONLOGON /tr "'C:\Windows\en-US\sppsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:472

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 11 /tr "'C:\Windows\en-US\sppsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:812

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WMIADAPW" /sc MINUTE /mo 13 /tr "'C:\Program Files (x86)\Windows Portable Devices\WMIADAP.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:916

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WMIADAP" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Portable Devices\WMIADAP.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1856

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WMIADAPW" /sc MINUTE /mo 8 /tr "'C:\Program Files (x86)\Windows Portable Devices\WMIADAP.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:700

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 6 /tr "'C:\agentBrowsersavesRefBroker\spoolsv.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:560

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsv" /sc ONLOGON /tr "'C:\agentBrowsersavesRefBroker\spoolsv.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1044

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 11 /tr "'C:\agentBrowsersavesRefBroker\spoolsv.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2012

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Windows Portable Devices\WMIADAP.exe

Filesize
1.7MB

MD5
22cac256b50f1290411792a39baf1ec9

SHA1
76f496bd92791fad8b59a1e044b0cba60ec469dc

SHA256
0f732c197b606a58af0e85aa919fff8e83576b1ad9bf7e5c41b58d86f5d18824

SHA512
bbea4498dd300dd3c9290faccae24cc32dd44d69aaf74481ce27153bca9fd465f8e0851d9cecb5943d553e45df3f9fe8434d868a689ca641c70858799bc7ec56

Download Submit
C:\Program Files (x86)\Windows Portable Devices\WMIADAP.exe

Filesize
1.7MB

MD5
22cac256b50f1290411792a39baf1ec9

SHA1
76f496bd92791fad8b59a1e044b0cba60ec469dc

SHA256
0f732c197b606a58af0e85aa919fff8e83576b1ad9bf7e5c41b58d86f5d18824

SHA512
bbea4498dd300dd3c9290faccae24cc32dd44d69aaf74481ce27153bca9fd465f8e0851d9cecb5943d553e45df3f9fe8434d868a689ca641c70858799bc7ec56

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
7KB

MD5
1f8af3c8a72e67a8146826856c8d391b

SHA1
30cbfa57b8f66c502ce70d17552788487589b0a0

SHA256
d9f80729d7f2883b1a6a370dc17cf831bbb65244ff1a3d473e42008943236e99

SHA512
3d290711f94b674f9955bf0ad53b788c7b5e42c993413c6e6d3bbe7c93cc53bf7b880573695cdb6d7f666acf4e91b3345358508e47d60d12708cabc6b3eda8c3

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
7KB

MD5
1f8af3c8a72e67a8146826856c8d391b

SHA1
30cbfa57b8f66c502ce70d17552788487589b0a0

SHA256
d9f80729d7f2883b1a6a370dc17cf831bbb65244ff1a3d473e42008943236e99

SHA512
3d290711f94b674f9955bf0ad53b788c7b5e42c993413c6e6d3bbe7c93cc53bf7b880573695cdb6d7f666acf4e91b3345358508e47d60d12708cabc6b3eda8c3

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
7KB

MD5
1f8af3c8a72e67a8146826856c8d391b

SHA1
30cbfa57b8f66c502ce70d17552788487589b0a0

SHA256
d9f80729d7f2883b1a6a370dc17cf831bbb65244ff1a3d473e42008943236e99

SHA512
3d290711f94b674f9955bf0ad53b788c7b5e42c993413c6e6d3bbe7c93cc53bf7b880573695cdb6d7f666acf4e91b3345358508e47d60d12708cabc6b3eda8c3

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
7KB

MD5
1f8af3c8a72e67a8146826856c8d391b

SHA1
30cbfa57b8f66c502ce70d17552788487589b0a0

SHA256
d9f80729d7f2883b1a6a370dc17cf831bbb65244ff1a3d473e42008943236e99

SHA512
3d290711f94b674f9955bf0ad53b788c7b5e42c993413c6e6d3bbe7c93cc53bf7b880573695cdb6d7f666acf4e91b3345358508e47d60d12708cabc6b3eda8c3

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
7KB

MD5
1f8af3c8a72e67a8146826856c8d391b

SHA1
30cbfa57b8f66c502ce70d17552788487589b0a0

SHA256
d9f80729d7f2883b1a6a370dc17cf831bbb65244ff1a3d473e42008943236e99

SHA512
3d290711f94b674f9955bf0ad53b788c7b5e42c993413c6e6d3bbe7c93cc53bf7b880573695cdb6d7f666acf4e91b3345358508e47d60d12708cabc6b3eda8c3

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
7KB

MD5
1f8af3c8a72e67a8146826856c8d391b

SHA1
30cbfa57b8f66c502ce70d17552788487589b0a0

SHA256
d9f80729d7f2883b1a6a370dc17cf831bbb65244ff1a3d473e42008943236e99

SHA512
3d290711f94b674f9955bf0ad53b788c7b5e42c993413c6e6d3bbe7c93cc53bf7b880573695cdb6d7f666acf4e91b3345358508e47d60d12708cabc6b3eda8c3

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
7KB

MD5
1f8af3c8a72e67a8146826856c8d391b

SHA1
30cbfa57b8f66c502ce70d17552788487589b0a0

SHA256
d9f80729d7f2883b1a6a370dc17cf831bbb65244ff1a3d473e42008943236e99

SHA512
3d290711f94b674f9955bf0ad53b788c7b5e42c993413c6e6d3bbe7c93cc53bf7b880573695cdb6d7f666acf4e91b3345358508e47d60d12708cabc6b3eda8c3

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
7KB

MD5
1f8af3c8a72e67a8146826856c8d391b

SHA1
30cbfa57b8f66c502ce70d17552788487589b0a0

SHA256
d9f80729d7f2883b1a6a370dc17cf831bbb65244ff1a3d473e42008943236e99

SHA512
3d290711f94b674f9955bf0ad53b788c7b5e42c993413c6e6d3bbe7c93cc53bf7b880573695cdb6d7f666acf4e91b3345358508e47d60d12708cabc6b3eda8c3

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
7KB

MD5
1f8af3c8a72e67a8146826856c8d391b

SHA1
30cbfa57b8f66c502ce70d17552788487589b0a0

SHA256
d9f80729d7f2883b1a6a370dc17cf831bbb65244ff1a3d473e42008943236e99

SHA512
3d290711f94b674f9955bf0ad53b788c7b5e42c993413c6e6d3bbe7c93cc53bf7b880573695cdb6d7f666acf4e91b3345358508e47d60d12708cabc6b3eda8c3

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
7KB

MD5
1f8af3c8a72e67a8146826856c8d391b

SHA1
30cbfa57b8f66c502ce70d17552788487589b0a0

SHA256
d9f80729d7f2883b1a6a370dc17cf831bbb65244ff1a3d473e42008943236e99

SHA512
3d290711f94b674f9955bf0ad53b788c7b5e42c993413c6e6d3bbe7c93cc53bf7b880573695cdb6d7f666acf4e91b3345358508e47d60d12708cabc6b3eda8c3

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
7KB

MD5
1f8af3c8a72e67a8146826856c8d391b

SHA1
30cbfa57b8f66c502ce70d17552788487589b0a0

SHA256
d9f80729d7f2883b1a6a370dc17cf831bbb65244ff1a3d473e42008943236e99

SHA512
3d290711f94b674f9955bf0ad53b788c7b5e42c993413c6e6d3bbe7c93cc53bf7b880573695cdb6d7f666acf4e91b3345358508e47d60d12708cabc6b3eda8c3

Download Submit
C:\agentBrowsersavesRefBroker\SurrogateDll.exe

Filesize
1.7MB

MD5
fa982bede3552e226a6950a59fa9862b

SHA1
f0c2ca51c5c5a82028fff8757690594bde320ab7

SHA256
f4adc7f379298f2480544b0baae139e98fd93da4b0a8e12b47d35ef101671b72

SHA512
7c8afa2e1bbdcd36eaf2239ddce8dc46cd695a99b0c9b0b69030f6bc83d3b5a1133e609df4e7d19965b2543ed7ffd1ce29b11af1cb25b3e4b87520f82534c34d

Download Submit
C:\agentBrowsersavesRefBroker\SurrogateDll.exe

Filesize
1.7MB

MD5
fa982bede3552e226a6950a59fa9862b

SHA1
f0c2ca51c5c5a82028fff8757690594bde320ab7

SHA256
f4adc7f379298f2480544b0baae139e98fd93da4b0a8e12b47d35ef101671b72

SHA512
7c8afa2e1bbdcd36eaf2239ddce8dc46cd695a99b0c9b0b69030f6bc83d3b5a1133e609df4e7d19965b2543ed7ffd1ce29b11af1cb25b3e4b87520f82534c34d

Download Submit
C:\agentBrowsersavesRefBroker\r205Pw8aNtR7tAq13alM.bat

Filesize
48B

MD5
5bb1a4946c35c47dd502dfbcd6d3a3d7

SHA1
1e1e42c5996031e92e8314c45201ccbf1fa23607

SHA256
30921e7d9a89121e8d56de5182e7e487f8e02293e82e82c2c04a6a537150ef06

SHA512
87a63b9f407a21db0cc2d80e3b639833e5e9f790790a9fc69a65788b193af80e19717ac4dc449190cc69817b161aabaf4a9c338e8936c6907adf5c432f7156e1

Download Submit
C:\agentBrowsersavesRefBroker\uC6xwKvnImSiiPHU7zpWHQ8u.vbe

Filesize
223B

MD5
9403175bdfbadf333200b08d0f9a97e4

SHA1
c3383de367a292b0b2d12659468b7aa53985171d

SHA256
3185c369451bdae7ed017894d541c6957d5b583b4a31a8efd288cfe4ff457f87

SHA512
65ca9bdc7f0c2d9ddae0c2f6253386587f5e41fd0a1353a11c43c7352d6b218ad3b87160b536839f10bd2a6cd78d89053e77e3686284a5e66d7dd3ffd2176002

Download Submit
\agentBrowsersavesRefBroker\SurrogateDll.exe

Filesize
1.7MB

MD5
fa982bede3552e226a6950a59fa9862b

SHA1
f0c2ca51c5c5a82028fff8757690594bde320ab7

SHA256
f4adc7f379298f2480544b0baae139e98fd93da4b0a8e12b47d35ef101671b72

SHA512
7c8afa2e1bbdcd36eaf2239ddce8dc46cd695a99b0c9b0b69030f6bc83d3b5a1133e609df4e7d19965b2543ed7ffd1ce29b11af1cb25b3e4b87520f82534c34d

Download Submit
\agentBrowsersavesRefBroker\SurrogateDll.exe

Filesize
1.7MB

MD5
fa982bede3552e226a6950a59fa9862b

SHA1
f0c2ca51c5c5a82028fff8757690594bde320ab7

SHA256
f4adc7f379298f2480544b0baae139e98fd93da4b0a8e12b47d35ef101671b72

SHA512
7c8afa2e1bbdcd36eaf2239ddce8dc46cd695a99b0c9b0b69030f6bc83d3b5a1133e609df4e7d19965b2543ed7ffd1ce29b11af1cb25b3e4b87520f82534c34d

Download Submit
memory/516-59-0x0000000000000000-mapping.dmp

Download
memory/548-82-0x0000000000000000-mapping.dmp

Download
memory/548-129-0x000007FEEACC0000-0x000007FEEB6E3000-memory.dmp

Filesize
10.1MB

Download
memory/548-162-0x000007FEF5820000-0x000007FEF637D000-memory.dmp

Filesize
11.4MB

Download
memory/548-183-0x00000000026E4000-0x00000000026E7000-memory.dmp

Filesize
12KB

Download
memory/548-192-0x00000000026EB000-0x000000000270A000-memory.dmp

Filesize
124KB

Download
memory/548-151-0x00000000026E4000-0x00000000026E7000-memory.dmp

Filesize
12KB

Download
memory/568-189-0x000000000235B000-0x000000000237A000-memory.dmp

Filesize
124KB

Download
memory/568-166-0x0000000002354000-0x0000000002357000-memory.dmp

Filesize
12KB

Download
memory/568-203-0x000000000235B000-0x000000000237A000-memory.dmp

Filesize
124KB

Download
memory/568-102-0x0000000000000000-mapping.dmp

Download
memory/568-167-0x000000001B8A0000-0x000000001BB9F000-memory.dmp

Filesize
3.0MB

Download
memory/568-138-0x000007FEF5820000-0x000007FEF637D000-memory.dmp

Filesize
11.4MB

Download
memory/568-145-0x0000000002354000-0x0000000002357000-memory.dmp

Filesize
12KB

Download
memory/568-202-0x0000000002354000-0x0000000002357000-memory.dmp

Filesize
12KB

Download
memory/568-132-0x000007FEEACC0000-0x000007FEEB6E3000-memory.dmp

Filesize
10.1MB

Download
memory/788-76-0x0000000000CA0000-0x0000000000CAE000-memory.dmp

Filesize
56KB

Download
memory/788-73-0x0000000000650000-0x0000000000662000-memory.dmp

Filesize
72KB

Download
memory/788-63-0x0000000000000000-mapping.dmp

Download
memory/788-65-0x0000000000CC0000-0x0000000000E80000-memory.dmp

Filesize
1.8MB

Download
memory/788-66-0x0000000000350000-0x000000000036C000-memory.dmp

Filesize
112KB

Download
memory/788-67-0x0000000000370000-0x0000000000378000-memory.dmp

Filesize
32KB

Download
memory/788-71-0x0000000000420000-0x000000000042C000-memory.dmp

Filesize
48KB

Download
memory/788-81-0x000000001AAB6000-0x000000001AAD5000-memory.dmp

Filesize
124KB

Download
memory/788-80-0x000000001AAB6000-0x000000001AAD5000-memory.dmp

Filesize
124KB

Download
memory/788-79-0x0000000002370000-0x000000000237C000-memory.dmp

Filesize
48KB

Download
memory/788-78-0x0000000002360000-0x000000000236C000-memory.dmp

Filesize
48KB

Download
memory/788-69-0x0000000000620000-0x0000000000636000-memory.dmp

Filesize
88KB

Download
memory/788-72-0x0000000000640000-0x0000000000648000-memory.dmp

Filesize
32KB

Download
memory/788-125-0x000000001AAB6000-0x000000001AAD5000-memory.dmp

Filesize
124KB

Download
memory/788-77-0x0000000000CB0000-0x0000000000CB8000-memory.dmp

Filesize
32KB

Download
memory/788-70-0x0000000000390000-0x00000000003A0000-memory.dmp

Filesize
64KB

Download
memory/788-75-0x0000000000C30000-0x0000000000C3A000-memory.dmp

Filesize
40KB

Download
memory/788-74-0x0000000000660000-0x000000000066C000-memory.dmp

Filesize
48KB

Download
memory/788-68-0x0000000000380000-0x0000000000390000-memory.dmp

Filesize
64KB

Download
memory/992-137-0x000007FEF5820000-0x000007FEF637D000-memory.dmp

Filesize
11.4MB

Download
memory/992-163-0x000000001B7E0000-0x000000001BADF000-memory.dmp

Filesize
3.0MB

Download
memory/992-207-0x00000000027F4000-0x00000000027F7000-memory.dmp

Filesize
12KB

Download
memory/992-92-0x000007FEEACC0000-0x000007FEEB6E3000-memory.dmp

Filesize
10.1MB

Download
memory/992-165-0x00000000027F4000-0x00000000027F7000-memory.dmp

Filesize
12KB

Download
memory/992-188-0x00000000027FB000-0x000000000281A000-memory.dmp

Filesize
124KB

Download
memory/992-144-0x00000000027F4000-0x00000000027F7000-memory.dmp

Filesize
12KB

Download
memory/992-84-0x0000000000000000-mapping.dmp

Download
memory/1004-107-0x0000000000000000-mapping.dmp

Download
memory/1004-204-0x00000000028F4000-0x00000000028F7000-memory.dmp

Filesize
12KB

Download
memory/1004-181-0x00000000028F4000-0x00000000028F7000-memory.dmp

Filesize
12KB

Download
memory/1004-142-0x000007FEF5820000-0x000007FEF637D000-memory.dmp

Filesize
11.4MB

Download
memory/1004-149-0x00000000028F4000-0x00000000028F7000-memory.dmp

Filesize
12KB

Download
memory/1004-205-0x00000000028FB000-0x000000000291A000-memory.dmp

Filesize
124KB

Download
memory/1004-168-0x000000001B7C0000-0x000000001BABF000-memory.dmp

Filesize
3.0MB

Download
memory/1004-130-0x000007FEEACC0000-0x000007FEEB6E3000-memory.dmp

Filesize
10.1MB

Download
memory/1004-190-0x00000000028FB000-0x000000000291A000-memory.dmp

Filesize
124KB

Download
memory/1080-159-0x000007FEF5820000-0x000007FEF637D000-memory.dmp

Filesize
11.4MB

Download
memory/1080-97-0x0000000000000000-mapping.dmp

Download
memory/1080-135-0x000007FEEACC0000-0x000007FEEB6E3000-memory.dmp

Filesize
10.1MB

Download
memory/1080-156-0x0000000002370000-0x00000000023F0000-memory.dmp

Filesize
512KB

Download
memory/1080-191-0x0000000002370000-0x00000000023F0000-memory.dmp

Filesize
512KB

Download
memory/1080-169-0x000000001B810000-0x000000001BB0F000-memory.dmp

Filesize
3.0MB

Download
memory/1520-100-0x000007FEEACC0000-0x000007FEEB6E3000-memory.dmp

Filesize
10.1MB

Download
memory/1520-146-0x0000000002714000-0x0000000002717000-memory.dmp

Filesize
12KB

Download
memory/1520-83-0x0000000000000000-mapping.dmp

Download
memory/1520-88-0x000007FEFBBA1000-0x000007FEFBBA3000-memory.dmp

Filesize
8KB

Download
memory/1520-172-0x000000001B8F0000-0x000000001BBEF000-memory.dmp

Filesize
3.0MB

Download
memory/1520-139-0x000007FEF5820000-0x000007FEF637D000-memory.dmp

Filesize
11.4MB

Download
memory/1520-178-0x0000000002714000-0x0000000002717000-memory.dmp

Filesize
12KB

Download
memory/1520-193-0x000000000271B000-0x000000000273A000-memory.dmp

Filesize
124KB

Download
memory/1580-90-0x0000000000000000-mapping.dmp

Download
memory/1580-182-0x0000000002784000-0x0000000002787000-memory.dmp

Filesize
12KB

Download
memory/1580-175-0x000000001B980000-0x000000001BC7F000-memory.dmp

Filesize
3.0MB

Download
memory/1580-143-0x000007FEF5820000-0x000007FEF637D000-memory.dmp

Filesize
11.4MB

Download
memory/1580-126-0x000007FEEACC0000-0x000007FEEB6E3000-memory.dmp

Filesize
10.1MB

Download
memory/1580-150-0x0000000002784000-0x0000000002787000-memory.dmp

Filesize
12KB

Download
memory/1748-179-0x0000000002434000-0x0000000002437000-memory.dmp

Filesize
12KB

Download
memory/1748-85-0x0000000000000000-mapping.dmp

Download
memory/1748-147-0x0000000002434000-0x0000000002437000-memory.dmp

Filesize
12KB

Download
memory/1748-140-0x000007FEF5820000-0x000007FEF637D000-memory.dmp

Filesize
11.4MB

Download
memory/1748-187-0x000000000243B000-0x000000000245A000-memory.dmp

Filesize
124KB

Download
memory/1748-127-0x000007FEEACC0000-0x000007FEEB6E3000-memory.dmp

Filesize
10.1MB

Download
memory/1748-195-0x000000000243B000-0x000000000245A000-memory.dmp

Filesize
124KB

Download
memory/1748-164-0x000000001B780000-0x000000001BA7F000-memory.dmp

Filesize
3.0MB

Download
memory/1748-194-0x0000000002434000-0x0000000002437000-memory.dmp

Filesize
12KB

Download
memory/1800-155-0x00000000025A4000-0x00000000025A7000-memory.dmp

Filesize
12KB

Download
memory/1800-198-0x00000000025AB000-0x00000000025CA000-memory.dmp

Filesize
124KB

Download
memory/1800-174-0x000000001B940000-0x000000001BC3F000-memory.dmp

Filesize
3.0MB

Download
memory/1800-87-0x0000000000000000-mapping.dmp

Download
memory/1800-160-0x000007FEF5820000-0x000007FEF637D000-memory.dmp

Filesize
11.4MB

Download
memory/1800-134-0x000007FEEACC0000-0x000007FEEB6E3000-memory.dmp

Filesize
10.1MB

Download
memory/1924-200-0x000000000291B000-0x000000000293A000-memory.dmp

Filesize
124KB

Download
memory/1924-154-0x0000000002914000-0x0000000002917000-memory.dmp

Filesize
12KB

Download
memory/1924-186-0x0000000002914000-0x0000000002917000-memory.dmp

Filesize
12KB

Download
memory/1924-86-0x0000000000000000-mapping.dmp

Download
memory/1924-177-0x000000001B860000-0x000000001BB5F000-memory.dmp

Filesize
3.0MB

Download
memory/1924-158-0x000007FEF5820000-0x000007FEF637D000-memory.dmp

Filesize
11.4MB

Download
memory/1924-136-0x000007FEEACC0000-0x000007FEEB6E3000-memory.dmp

Filesize
10.1MB

Download
memory/1940-153-0x00000000027D4000-0x00000000027D7000-memory.dmp

Filesize
12KB

Download
memory/1940-133-0x000007FEEACC0000-0x000007FEEB6E3000-memory.dmp

Filesize
10.1MB

Download
memory/1940-185-0x00000000027D4000-0x00000000027D7000-memory.dmp

Filesize
12KB

Download
memory/1940-161-0x000007FEF5820000-0x000007FEF637D000-memory.dmp

Filesize
11.4MB

Download
memory/1940-91-0x0000000000000000-mapping.dmp

Download
memory/2000-55-0x0000000000000000-mapping.dmp

Download
memory/2004-54-0x00000000753D1000-0x00000000753D3000-memory.dmp

Filesize
8KB

Download
memory/2076-201-0x00000000029BB000-0x00000000029DA000-memory.dmp

Filesize
124KB

Download
memory/2076-171-0x000000001B8B0000-0x000000001BBAF000-memory.dmp

Filesize
3.0MB

Download
memory/2076-180-0x00000000029B4000-0x00000000029B7000-memory.dmp

Filesize
12KB

Download
memory/2076-131-0x000007FEEACC0000-0x000007FEEB6E3000-memory.dmp

Filesize
10.1MB

Download
memory/2076-196-0x00000000029BB000-0x00000000029DA000-memory.dmp

Filesize
124KB

Download
memory/2076-199-0x00000000029B4000-0x00000000029B7000-memory.dmp

Filesize
12KB

Download
memory/2076-110-0x0000000000000000-mapping.dmp

Download
memory/2076-148-0x00000000029B4000-0x00000000029B7000-memory.dmp

Filesize
12KB

Download
memory/2076-141-0x000007FEF5820000-0x000007FEF637D000-memory.dmp

Filesize
11.4MB

Download
memory/2140-197-0x000000000286B000-0x000000000288A000-memory.dmp

Filesize
124KB

Download
memory/2140-152-0x0000000002864000-0x0000000002867000-memory.dmp

Filesize
12KB

Download
memory/2140-113-0x0000000000000000-mapping.dmp

Download
memory/2140-184-0x0000000002864000-0x0000000002867000-memory.dmp

Filesize
12KB

Download
memory/2140-206-0x0000000002864000-0x0000000002867000-memory.dmp

Filesize
12KB

Download
memory/2140-128-0x000007FEEACC0000-0x000007FEEB6E3000-memory.dmp

Filesize
10.1MB

Download
memory/2140-157-0x000007FEF5820000-0x000007FEF637D000-memory.dmp

Filesize
11.4MB

Download
memory/2140-173-0x000000001B9B0000-0x000000001BCAF000-memory.dmp

Filesize
3.0MB

Download
memory/2304-124-0x0000000001180000-0x0000000001340000-memory.dmp

Filesize
1.8MB

Download
memory/2304-121-0x0000000000000000-mapping.dmp

Download