dcrat | 8a2ca0027527f9c95ae338ad7eec0f9a71f07ff24f2d0af818aecc840f631b0d

Analysis

max time kernel
30s
max time network
33s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
19/12/2022, 22:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
file.exe
Size 1.9MB
Sample221219-2bdgwabd51
SHA256 8a2ca0027527f9c95ae338ad7eec0f9a71f07ff24f2d0af818aecc840f631b0d
MD5 ed6b760928d4f1a1f86e96e1aa77cb99
SHA1 223a6724b782409dec9ad3030275d7beb972d39e
SHA512 98006635bf2a9ee275cc2434492a740fd21a515d048dc10e5688ad46e0ff602bc1e833d80f78a25b65c04ab05e057282c0ebe98b5522b43cc24afeb0449b1dd4
SSDEEP 49152:8bA3leuusP5Xuuc79ViJs+h6UWcrPtaC+WOD8m:8biXrc7XiJLh6xcr1v+H4m
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

dcrat infostealer rat

Malware Config

Signatures

DcRat 52 IoCs

DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

rat infostealer dcrat

description	ioc	pid	Process
		2008	schtasks.exe
		1984	schtasks.exe
		1632	schtasks.exe
		828	schtasks.exe
		1760	schtasks.exe
		1008	schtasks.exe
		1500	schtasks.exe
		1596	schtasks.exe
		1352	schtasks.exe
		948	schtasks.exe
		1628	schtasks.exe
		776	schtasks.exe
		1984	schtasks.exe
		1776	schtasks.exe
		2008	schtasks.exe
		2040	schtasks.exe
		1632	schtasks.exe
		948	schtasks.exe
		1684	schtasks.exe
		1640	schtasks.exe
		472	schtasks.exe
		824	schtasks.exe
		592	schtasks.exe
		924	schtasks.exe
		1816	schtasks.exe
		1388	schtasks.exe
		904	schtasks.exe
		1976	schtasks.exe
		1808	schtasks.exe
File created	C:\Windows\Fonts\0a1fd5f707cd16		fesg.exe
		1376	schtasks.exe
		1952	schtasks.exe
		2020	schtasks.exe
		344	schtasks.exe
		1084	schtasks.exe
		1644	schtasks.exe
File created	C:\Program Files (x86)\Windows NT\27d1bcfc3c54e0		fesg.exe
File created	C:\Program Files\Windows Photo Viewer\de-DE\56085415360792		fesg.exe
		1968	schtasks.exe
		548	schtasks.exe
		964	schtasks.exe
		992	schtasks.exe
		1972	schtasks.exe
File created	C:\Program Files\Windows Mail\ja-JP\6ccacd8608530f		fesg.exe
		472	schtasks.exe
		1080	schtasks.exe
		992	schtasks.exe
		1712	schtasks.exe
		1296	schtasks.exe
		2012	schtasks.exe
		288	schtasks.exe
		832	schtasks.exe

Process spawned unexpected child process 48 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	776	1516	schtasks.exe	32
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1816	1516	schtasks.exe	32
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1712	1516	schtasks.exe	32
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1808	1516	schtasks.exe	32
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	924	1516	schtasks.exe	32
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1984	1516	schtasks.exe	32
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1376	1516	schtasks.exe	32
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1976	1516	schtasks.exe	32
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1644	1516	schtasks.exe	32
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1080	1516	schtasks.exe	32
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1296	1516	schtasks.exe	32
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	948	1516	schtasks.exe	32
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	904	1516	schtasks.exe	32
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1684	1516	schtasks.exe	32
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1596	1516	schtasks.exe	32
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2008	1516	schtasks.exe	32
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	472	1516	schtasks.exe	32
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1388	1516	schtasks.exe	32
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	592	1516	schtasks.exe	32
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1500	1516	schtasks.exe	32
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	992	1516	schtasks.exe	32
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1984	1516	schtasks.exe	32
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1952	1516	schtasks.exe	32
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2020	1516	schtasks.exe	32
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2012	1516	schtasks.exe	32
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1632	1516	schtasks.exe	32
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1352	1516	schtasks.exe	32
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1968	1516	schtasks.exe	32
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1640	1516	schtasks.exe	32
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	344	1516	schtasks.exe	32
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	828	1516	schtasks.exe	32
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	548	1516	schtasks.exe	32
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	288	1516	schtasks.exe	32
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1760	1516	schtasks.exe	32
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1084	1516	schtasks.exe	32
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	832	1516	schtasks.exe	32
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1776	1516	schtasks.exe	32
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	964	1516	schtasks.exe	32
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2008	1516	schtasks.exe	32
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	948	1516	schtasks.exe	32
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	472	1516	schtasks.exe	32
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	992	1516	schtasks.exe	32
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1972	1516	schtasks.exe	32
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1628	1516	schtasks.exe	32
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	824	1516	schtasks.exe	32
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2040	1516	schtasks.exe	32
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1008	1516	schtasks.exe	32
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1632	1516	schtasks.exe	32

DCRat payload 8 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral1/memory/568-75-0x0000000000910000-0x0000000000D2C000-memory.dmp	dcrat
behavioral1/memory/568-83-0x0000000000910000-0x0000000000D2C000-memory.dmp	dcrat
behavioral1/memory/1068-84-0x0000000000910000-0x0000000000D2C000-memory.dmp	dcrat
behavioral1/memory/1068-85-0x0000000000910000-0x0000000000D2C000-memory.dmp	dcrat
behavioral1/memory/1720-95-0x0000000000AC0000-0x0000000000EDC000-memory.dmp	dcrat
behavioral1/memory/1720-96-0x0000000000AC0000-0x0000000000EDC000-memory.dmp	dcrat
behavioral1/memory/1068-98-0x0000000000910000-0x0000000000D2C000-memory.dmp	dcrat
behavioral1/memory/1720-99-0x0000000000AC0000-0x0000000000EDC000-memory.dmp	dcrat

Executes dropped EXE 4 IoCs

pid	Process
328	work.exe
568	fesg.exe
1068	fesg.exe
1720	work.exe

Loads dropped DLL 9 IoCs

pid	Process
2012	cmd.exe
328	work.exe
328	work.exe
328	work.exe
328	work.exe
328	work.exe
568	fesg.exe
1068	fesg.exe
1068	fesg.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 4 IoCs

pid	Process
568	fesg.exe
1068	fesg.exe
1720	work.exe
1720	work.exe

Drops file in Program Files directory 8 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Common Files\microsoft shared\OfficeSoftwareProtectionPlatform\69ddcba757bf72	fesg.exe
File created	C:\Program Files (x86)\Windows NT\System.exe	fesg.exe
File created	C:\Program Files (x86)\Windows NT\27d1bcfc3c54e0	fesg.exe
File created	C:\Program Files\Windows Photo Viewer\de-DE\wininit.exe	fesg.exe
File created	C:\Program Files\Windows Photo Viewer\de-DE\56085415360792	fesg.exe
File created	C:\Program Files\Windows Mail\ja-JP\Idle.exe	fesg.exe
File created	C:\Program Files\Windows Mail\ja-JP\6ccacd8608530f	fesg.exe
File created	C:\Program Files (x86)\Common Files\microsoft shared\OfficeSoftwareProtectionPlatform\smss.exe	fesg.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File created	C:\Windows\addins\WMIADAP.exe	fesg.exe
File created	C:\Windows\addins\75a57c1bdf437c	fesg.exe
File created	C:\Windows\Fonts\sppsvc.exe	fesg.exe
File created	C:\Windows\Fonts\0a1fd5f707cd16	fesg.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 48 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
288	schtasks.exe
1760	schtasks.exe
1008	schtasks.exe
2008	schtasks.exe
1388	schtasks.exe
1080	schtasks.exe
1952	schtasks.exe
832	schtasks.exe
472	schtasks.exe
992	schtasks.exe
1816	schtasks.exe
1644	schtasks.exe
904	schtasks.exe
1596	schtasks.exe
1500	schtasks.exe
1640	schtasks.exe
2008	schtasks.exe
948	schtasks.exe
1712	schtasks.exe
1376	schtasks.exe
1632	schtasks.exe
1352	schtasks.exe
344	schtasks.exe
548	schtasks.exe
1084	schtasks.exe
1776	schtasks.exe
1984	schtasks.exe
2012	schtasks.exe
1632	schtasks.exe
992	schtasks.exe
776	schtasks.exe
1808	schtasks.exe
964	schtasks.exe
824	schtasks.exe
924	schtasks.exe
828	schtasks.exe
1984	schtasks.exe
2020	schtasks.exe
1628	schtasks.exe
1976	schtasks.exe
472	schtasks.exe
1684	schtasks.exe
592	schtasks.exe
1968	schtasks.exe
1972	schtasks.exe
2040	schtasks.exe
1296	schtasks.exe
948	schtasks.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
568	fesg.exe
1068	fesg.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	568	fesg.exe
Token: SeDebugPrivilege	1068	fesg.exe
Token: SeDebugPrivilege	1720	work.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
568	fesg.exe
1068	fesg.exe
1720	work.exe

Suspicious use of WriteProcessMemory 20 IoCs

description	pid	Process	procid_target
PID 1092 wrote to memory of 2012	1092	file.exe	28
PID 1092 wrote to memory of 2012	1092	file.exe	28
PID 1092 wrote to memory of 2012	1092	file.exe	28
PID 1092 wrote to memory of 2012	1092	file.exe	28
PID 2012 wrote to memory of 328	2012	cmd.exe	30
PID 2012 wrote to memory of 328	2012	cmd.exe	30
PID 2012 wrote to memory of 328	2012	cmd.exe	30
PID 2012 wrote to memory of 328	2012	cmd.exe	30
PID 328 wrote to memory of 568	328	work.exe	31
PID 328 wrote to memory of 568	328	work.exe	31
PID 328 wrote to memory of 568	328	work.exe	31
PID 328 wrote to memory of 568	328	work.exe	31
PID 568 wrote to memory of 1068	568	fesg.exe	54
PID 568 wrote to memory of 1068	568	fesg.exe	54
PID 568 wrote to memory of 1068	568	fesg.exe	54
PID 568 wrote to memory of 1068	568	fesg.exe	54
PID 1068 wrote to memory of 1720	1068	fesg.exe	82
PID 1068 wrote to memory of 1720	1068	fesg.exe	82
PID 1068 wrote to memory of 1720	1068	fesg.exe	82
PID 1068 wrote to memory of 1720	1068	fesg.exe	82

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1092
- C:\Windows\SysWOW64\cmd.exe
  cmd /c ""C:\Users\Admin\AppData\Local\Temp\RarSFX0\1.bat" "
  2⤵
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:2012
- - C:\Users\Admin\AppData\Local\Temp\RarSFX0\work.exe
    work.exe -priverdD
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of WriteProcessMemory
    PID:328
  - - C:\Users\Admin\AppData\Local\Temp\RarSFX1\fesg.exe
      "C:\Users\Admin\AppData\Local\Temp\RarSFX1\fesg.exe"
      4⤵
      DcRat
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of NtSetInformationThreadHideFromDebugger
      Drops file in Program Files directory
      Drops file in Windows directory
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:568
    - - C:\Users\Admin\AppData\Local\Temp\RarSFX1\fesg.exe
        
        "C:\Users\Admin\AppData\Local\Temp\RarSFX1\fesg.exe"
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of NtSetInformationThreadHideFromDebugger
        Drops file in Program Files directory
        Drops file in Windows directory
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:1068
      - C:\Users\All Users\Microsoft\Crypto\work.exe
        
        "C:\Users\All Users\Microsoft\Crypto\work.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of NtSetInformationThreadHideFromDebugger
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of SetWindowsHookEx
        
        PID:1720

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 6 /tr "'C:\Recovery\ad6fdfc2-6219-11ed-a572-5e34c4ab0fa3\WmiPrvSE.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:776

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSE" /sc ONLOGON /tr "'C:\Recovery\ad6fdfc2-6219-11ed-a572-5e34c4ab0fa3\WmiPrvSE.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1816

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 13 /tr "'C:\Recovery\ad6fdfc2-6219-11ed-a572-5e34c4ab0fa3\WmiPrvSE.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1712

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 8 /tr "'C:\Program Files (x86)\Windows NT\System.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1808

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "System" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows NT\System.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:924

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 10 /tr "'C:\Program Files (x86)\Windows NT\System.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1984

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 13 /tr "'C:\Program Files\Windows Photo Viewer\de-DE\wininit.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1376

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininit" /sc ONLOGON /tr "'C:\Program Files\Windows Photo Viewer\de-DE\wininit.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1976

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 9 /tr "'C:\Program Files\Windows Photo Viewer\de-DE\wininit.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1644

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 7 /tr "'C:\MSOCache\All Users\{90140000-0018-0409-0000-0000000FF1CE}-C\smss.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1080

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smss" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-0018-0409-0000-0000000FF1CE}-C\smss.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1296

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 8 /tr "'C:\MSOCache\All Users\{90140000-0018-0409-0000-0000000FF1CE}-C\smss.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:948

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 9 /tr "'C:\Windows\Fonts\sppsvc.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:904

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvc" /sc ONLOGON /tr "'C:\Windows\Fonts\sppsvc.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1684

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 13 /tr "'C:\Windows\Fonts\sppsvc.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1596

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 5 /tr "'C:\Program Files\Windows Mail\ja-JP\Idle.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2008

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Idle" /sc ONLOGON /tr "'C:\Program Files\Windows Mail\ja-JP\Idle.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:472

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 13 /tr "'C:\Program Files\Windows Mail\ja-JP\Idle.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1388

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 7 /tr "'C:\Recovery\ad6fdfc2-6219-11ed-a572-5e34c4ab0fa3\WmiPrvSE.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:592

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSE" /sc ONLOGON /tr "'C:\Recovery\ad6fdfc2-6219-11ed-a572-5e34c4ab0fa3\WmiPrvSE.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1500

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 6 /tr "'C:\Recovery\ad6fdfc2-6219-11ed-a572-5e34c4ab0fa3\WmiPrvSE.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:992

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "schtaskss" /sc MINUTE /mo 8 /tr "'C:\Recovery\ad6fdfc2-6219-11ed-a572-5e34c4ab0fa3\schtasks.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1984

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "schtasks" /sc ONLOGON /tr "'C:\Recovery\ad6fdfc2-6219-11ed-a572-5e34c4ab0fa3\schtasks.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1952

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "schtaskss" /sc MINUTE /mo 9 /tr "'C:\Recovery\ad6fdfc2-6219-11ed-a572-5e34c4ab0fa3\schtasks.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2020

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "schtaskss" /sc MINUTE /mo 14 /tr "'C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\schtasks.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2012

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "schtasks" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\schtasks.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1632

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "schtaskss" /sc MINUTE /mo 14 /tr "'C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\schtasks.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1352

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostt" /sc MINUTE /mo 5 /tr "'C:\MSOCache\All Users\taskhost.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1968

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhost" /sc ONLOGON /tr "'C:\MSOCache\All Users\taskhost.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1640

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostt" /sc MINUTE /mo 6 /tr "'C:\MSOCache\All Users\taskhost.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:344

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WMIADAPW" /sc MINUTE /mo 14 /tr "'C:\Windows\addins\WMIADAP.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:828

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WMIADAP" /sc ONLOGON /tr "'C:\Windows\addins\WMIADAP.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:548

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WMIADAPW" /sc MINUTE /mo 8 /tr "'C:\Windows\addins\WMIADAP.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:288

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "schtaskss" /sc MINUTE /mo 11 /tr "'C:\Recovery\ad6fdfc2-6219-11ed-a572-5e34c4ab0fa3\schtasks.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1760

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "schtasks" /sc ONLOGON /tr "'C:\Recovery\ad6fdfc2-6219-11ed-a572-5e34c4ab0fa3\schtasks.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1084

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "schtaskss" /sc MINUTE /mo 11 /tr "'C:\Recovery\ad6fdfc2-6219-11ed-a572-5e34c4ab0fa3\schtasks.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:832

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 14 /tr "'C:\Recovery\ad6fdfc2-6219-11ed-a572-5e34c4ab0fa3\lsass.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1776

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsass" /sc ONLOGON /tr "'C:\Recovery\ad6fdfc2-6219-11ed-a572-5e34c4ab0fa3\lsass.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:964

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 9 /tr "'C:\Recovery\ad6fdfc2-6219-11ed-a572-5e34c4ab0fa3\lsass.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2008

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 13 /tr "'C:\Program Files (x86)\Common Files\microsoft shared\OfficeSoftwareProtectionPlatform\smss.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:948

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smss" /sc ONLOGON /tr "'C:\Program Files (x86)\Common Files\microsoft shared\OfficeSoftwareProtectionPlatform\smss.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:472

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 7 /tr "'C:\Program Files (x86)\Common Files\microsoft shared\OfficeSoftwareProtectionPlatform\smss.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:992

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WMIADAPW" /sc MINUTE /mo 14 /tr "'C:\Users\Admin\NetHood\WMIADAP.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1972

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WMIADAP" /sc ONLOGON /tr "'C:\Users\Admin\NetHood\WMIADAP.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1628

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WMIADAPW" /sc MINUTE /mo 5 /tr "'C:\Users\Admin\NetHood\WMIADAP.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:824

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "workw" /sc MINUTE /mo 7 /tr "'C:\Users\All Users\Microsoft\Crypto\work.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2040

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "work" /sc ONLOGON /tr "'C:\Users\All Users\Microsoft\Crypto\work.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1008

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "workw" /sc MINUTE /mo 8 /tr "'C:\Users\All Users\Microsoft\Crypto\work.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1632

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

work.exe

Path C:\ProgramData\Microsoft\Crypto\work.exe
Size 1.4MB
SHA256 ef665c001e7cf59486abf7a79d1ef9fbd5daa557feb81e7a1deac8d98b49f9ea
MD5 8a5398289a9636bda70188b260a8c898
SHA1 5985c0bf8704208e817219ef0cdc73ea782f2785
SHA512 738c0bd5545a46d4c1a3869348a9aa4a611055a5c10c4094ca3f97499ec097403eb6a8d56c71899f9b43e4bf730bc82fece782382ab57540a865de71b453cf5c
SSDEEP 24576:sTmXKQ25yxwFr+o047uUJvKbE2mmsTs9ifLAz5vzRP1tsyRfVuT:KVD5H+oAmvKo2DsTskDABRPvjj
MD5 SHA1 SHA512 SSDEEP

Submit Download

1.bat

Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\1.bat
Size 35B
SHA256 065d2b17ad499587dc9de7ee9ecda4938b45da1df388bc72e6627dff220f64d2
MD5 ff59d999beb970447667695ce3273f75
SHA1 316fa09f467ba90ac34a054daf2e92e6e2854ff8
SHA512 d5ac72cb065a3cd3cb118a69a2f356314eeed24dcb4880751e1a3683895e66cedc62607967e29f77a0c27adf1c9fe0efd86e804f693f0a63a5b51b0bf0056b5d
MD5 SHA1 SHA512

Submit Download

work.exe

Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\work.exe
Size 1.7MB
SHA256 26e61186a405c7ba6614cf47a1b363ea35e9406aaa667ac58f2dcb36525398dc
MD5 4090a67b12f7d37091b469635513f71a
SHA1 9c694379a0bffba0cde0a4bf4369f2ab67b84f53
SHA512 6e01d96e3e06dafe8ceb246710c81d1be6eab9dd009357c487eca4373676b2a4f5488245cb275307169b99d2709291a3154370c41fe87a04355de09af972ccc3
SSDEEP 49152:8bA3lGkrQubjT9m+JiEl2/NMKBwb8hyZ8HyU:8bbhYjw+JiE3UyGSU
MD5 SHA1 SHA512 SSDEEP

Submit Download

work.exe

Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\work.exe
Size 1.7MB
SHA256 26e61186a405c7ba6614cf47a1b363ea35e9406aaa667ac58f2dcb36525398dc
MD5 4090a67b12f7d37091b469635513f71a
SHA1 9c694379a0bffba0cde0a4bf4369f2ab67b84f53
SHA512 6e01d96e3e06dafe8ceb246710c81d1be6eab9dd009357c487eca4373676b2a4f5488245cb275307169b99d2709291a3154370c41fe87a04355de09af972ccc3
SSDEEP 49152:8bA3lGkrQubjT9m+JiEl2/NMKBwb8hyZ8HyU:8bbhYjw+JiE3UyGSU
MD5 SHA1 SHA512 SSDEEP

Submit Download

fesg.exe

Path C:\Users\Admin\AppData\Local\Temp\RarSFX1\fesg.exe
Size 1.4MB
SHA256 ef665c001e7cf59486abf7a79d1ef9fbd5daa557feb81e7a1deac8d98b49f9ea
MD5 8a5398289a9636bda70188b260a8c898
SHA1 5985c0bf8704208e817219ef0cdc73ea782f2785
SHA512 738c0bd5545a46d4c1a3869348a9aa4a611055a5c10c4094ca3f97499ec097403eb6a8d56c71899f9b43e4bf730bc82fece782382ab57540a865de71b453cf5c
SSDEEP 24576:sTmXKQ25yxwFr+o047uUJvKbE2mmsTs9ifLAz5vzRP1tsyRfVuT:KVD5H+oAmvKo2DsTskDABRPvjj
MD5 SHA1 SHA512 SSDEEP

Submit Download

fesg.exe

Path C:\Users\Admin\AppData\Local\Temp\RarSFX1\fesg.exe
Size 1.4MB
SHA256 ef665c001e7cf59486abf7a79d1ef9fbd5daa557feb81e7a1deac8d98b49f9ea
MD5 8a5398289a9636bda70188b260a8c898
SHA1 5985c0bf8704208e817219ef0cdc73ea782f2785
SHA512 738c0bd5545a46d4c1a3869348a9aa4a611055a5c10c4094ca3f97499ec097403eb6a8d56c71899f9b43e4bf730bc82fece782382ab57540a865de71b453cf5c
SSDEEP 24576:sTmXKQ25yxwFr+o047uUJvKbE2mmsTs9ifLAz5vzRP1tsyRfVuT:KVD5H+oAmvKo2DsTskDABRPvjj
MD5 SHA1 SHA512 SSDEEP

Submit Download

fesg.exe

Path \??\c:\users\admin\appdata\local\temp\rarsfx1\fesg.exe
Size 1.4MB
SHA256 ef665c001e7cf59486abf7a79d1ef9fbd5daa557feb81e7a1deac8d98b49f9ea
MD5 8a5398289a9636bda70188b260a8c898
SHA1 5985c0bf8704208e817219ef0cdc73ea782f2785
SHA512 738c0bd5545a46d4c1a3869348a9aa4a611055a5c10c4094ca3f97499ec097403eb6a8d56c71899f9b43e4bf730bc82fece782382ab57540a865de71b453cf5c
SSDEEP 24576:sTmXKQ25yxwFr+o047uUJvKbE2mmsTs9ifLAz5vzRP1tsyRfVuT:KVD5H+oAmvKo2DsTskDABRPvjj
MD5 SHA1 SHA512 SSDEEP

Submit Download

work.exe

Path \??\c:\users\all users\microsoft\crypto\work.exe
Size 1.4MB
SHA256 ef665c001e7cf59486abf7a79d1ef9fbd5daa557feb81e7a1deac8d98b49f9ea
MD5 8a5398289a9636bda70188b260a8c898
SHA1 5985c0bf8704208e817219ef0cdc73ea782f2785
SHA512 738c0bd5545a46d4c1a3869348a9aa4a611055a5c10c4094ca3f97499ec097403eb6a8d56c71899f9b43e4bf730bc82fece782382ab57540a865de71b453cf5c
SSDEEP 24576:sTmXKQ25yxwFr+o047uUJvKbE2mmsTs9ifLAz5vzRP1tsyRfVuT:KVD5H+oAmvKo2DsTskDABRPvjj
MD5 SHA1 SHA512 SSDEEP

Submit Download

work.exe

Path \ProgramData\Microsoft\Crypto\work.exe
Size 1.4MB
SHA256 ef665c001e7cf59486abf7a79d1ef9fbd5daa557feb81e7a1deac8d98b49f9ea
MD5 8a5398289a9636bda70188b260a8c898
SHA1 5985c0bf8704208e817219ef0cdc73ea782f2785
SHA512 738c0bd5545a46d4c1a3869348a9aa4a611055a5c10c4094ca3f97499ec097403eb6a8d56c71899f9b43e4bf730bc82fece782382ab57540a865de71b453cf5c
SSDEEP 24576:sTmXKQ25yxwFr+o047uUJvKbE2mmsTs9ifLAz5vzRP1tsyRfVuT:KVD5H+oAmvKo2DsTskDABRPvjj
MD5 SHA1 SHA512 SSDEEP

Submit Download

work.exe

Path \ProgramData\Microsoft\Crypto\work.exe
Size 1.4MB
SHA256 ef665c001e7cf59486abf7a79d1ef9fbd5daa557feb81e7a1deac8d98b49f9ea
MD5 8a5398289a9636bda70188b260a8c898
SHA1 5985c0bf8704208e817219ef0cdc73ea782f2785
SHA512 738c0bd5545a46d4c1a3869348a9aa4a611055a5c10c4094ca3f97499ec097403eb6a8d56c71899f9b43e4bf730bc82fece782382ab57540a865de71b453cf5c
SSDEEP 24576:sTmXKQ25yxwFr+o047uUJvKbE2mmsTs9ifLAz5vzRP1tsyRfVuT:KVD5H+oAmvKo2DsTskDABRPvjj
MD5 SHA1 SHA512 SSDEEP

Submit Download

work.exe

Path \Users\Admin\AppData\Local\Temp\RarSFX0\work.exe
Size 1.7MB
SHA256 26e61186a405c7ba6614cf47a1b363ea35e9406aaa667ac58f2dcb36525398dc
MD5 4090a67b12f7d37091b469635513f71a
SHA1 9c694379a0bffba0cde0a4bf4369f2ab67b84f53
SHA512 6e01d96e3e06dafe8ceb246710c81d1be6eab9dd009357c487eca4373676b2a4f5488245cb275307169b99d2709291a3154370c41fe87a04355de09af972ccc3
SSDEEP 49152:8bA3lGkrQubjT9m+JiEl2/NMKBwb8hyZ8HyU:8bbhYjw+JiE3UyGSU
MD5 SHA1 SHA512 SSDEEP

Submit Download

fesg.exe

Path \Users\Admin\AppData\Local\Temp\RarSFX1\fesg.exe
Size 1.4MB
SHA256 ef665c001e7cf59486abf7a79d1ef9fbd5daa557feb81e7a1deac8d98b49f9ea
MD5 8a5398289a9636bda70188b260a8c898
SHA1 5985c0bf8704208e817219ef0cdc73ea782f2785
SHA512 738c0bd5545a46d4c1a3869348a9aa4a611055a5c10c4094ca3f97499ec097403eb6a8d56c71899f9b43e4bf730bc82fece782382ab57540a865de71b453cf5c
SSDEEP 24576:sTmXKQ25yxwFr+o047uUJvKbE2mmsTs9ifLAz5vzRP1tsyRfVuT:KVD5H+oAmvKo2DsTskDABRPvjj
MD5 SHA1 SHA512 SSDEEP

Submit Download

fesg.exe

Path \Users\Admin\AppData\Local\Temp\RarSFX1\fesg.exe
Size 1.4MB
SHA256 ef665c001e7cf59486abf7a79d1ef9fbd5daa557feb81e7a1deac8d98b49f9ea
MD5 8a5398289a9636bda70188b260a8c898
SHA1 5985c0bf8704208e817219ef0cdc73ea782f2785
SHA512 738c0bd5545a46d4c1a3869348a9aa4a611055a5c10c4094ca3f97499ec097403eb6a8d56c71899f9b43e4bf730bc82fece782382ab57540a865de71b453cf5c
SSDEEP 24576:sTmXKQ25yxwFr+o047uUJvKbE2mmsTs9ifLAz5vzRP1tsyRfVuT:KVD5H+oAmvKo2DsTskDABRPvjj
MD5 SHA1 SHA512 SSDEEP

Submit Download

fesg.exe

Path \Users\Admin\AppData\Local\Temp\RarSFX1\fesg.exe
Size 1.4MB
SHA256 ef665c001e7cf59486abf7a79d1ef9fbd5daa557feb81e7a1deac8d98b49f9ea
MD5 8a5398289a9636bda70188b260a8c898
SHA1 5985c0bf8704208e817219ef0cdc73ea782f2785
SHA512 738c0bd5545a46d4c1a3869348a9aa4a611055a5c10c4094ca3f97499ec097403eb6a8d56c71899f9b43e4bf730bc82fece782382ab57540a865de71b453cf5c
SSDEEP 24576:sTmXKQ25yxwFr+o047uUJvKbE2mmsTs9ifLAz5vzRP1tsyRfVuT:KVD5H+oAmvKo2DsTskDABRPvjj
MD5 SHA1 SHA512 SSDEEP

Submit Download

fesg.exe

Path \Users\Admin\AppData\Local\Temp\RarSFX1\fesg.exe
Size 1.4MB
SHA256 ef665c001e7cf59486abf7a79d1ef9fbd5daa557feb81e7a1deac8d98b49f9ea
MD5 8a5398289a9636bda70188b260a8c898
SHA1 5985c0bf8704208e817219ef0cdc73ea782f2785
SHA512 738c0bd5545a46d4c1a3869348a9aa4a611055a5c10c4094ca3f97499ec097403eb6a8d56c71899f9b43e4bf730bc82fece782382ab57540a865de71b453cf5c
SSDEEP 24576:sTmXKQ25yxwFr+o047uUJvKbE2mmsTs9ifLAz5vzRP1tsyRfVuT:KVD5H+oAmvKo2DsTskDABRPvjj
MD5 SHA1 SHA512 SSDEEP

Submit Download

fesg.exe

Path \Users\Admin\AppData\Local\Temp\RarSFX1\fesg.exe
Size 1.4MB
SHA256 ef665c001e7cf59486abf7a79d1ef9fbd5daa557feb81e7a1deac8d98b49f9ea
MD5 8a5398289a9636bda70188b260a8c898
SHA1 5985c0bf8704208e817219ef0cdc73ea782f2785
SHA512 738c0bd5545a46d4c1a3869348a9aa4a611055a5c10c4094ca3f97499ec097403eb6a8d56c71899f9b43e4bf730bc82fece782382ab57540a865de71b453cf5c
SSDEEP 24576:sTmXKQ25yxwFr+o047uUJvKbE2mmsTs9ifLAz5vzRP1tsyRfVuT:KVD5H+oAmvKo2DsTskDABRPvjj
MD5 SHA1 SHA512 SSDEEP

Submit Download

fesg.exe

Path \Users\Admin\AppData\Local\Temp\RarSFX1\fesg.exe
Size 1.4MB
SHA256 ef665c001e7cf59486abf7a79d1ef9fbd5daa557feb81e7a1deac8d98b49f9ea
MD5 8a5398289a9636bda70188b260a8c898
SHA1 5985c0bf8704208e817219ef0cdc73ea782f2785
SHA512 738c0bd5545a46d4c1a3869348a9aa4a611055a5c10c4094ca3f97499ec097403eb6a8d56c71899f9b43e4bf730bc82fece782382ab57540a865de71b453cf5c
SSDEEP 24576:sTmXKQ25yxwFr+o047uUJvKbE2mmsTs9ifLAz5vzRP1tsyRfVuT:KVD5H+oAmvKo2DsTskDABRPvjj
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/328-73-0x0000000003890000-0x0000000003CAC000-memory.dmp

Download

memory/328-68-0x0000000003890000-0x0000000003CAC000-memory.dmp

Download

memory/328-72-0x0000000003890000-0x0000000003CAC000-memory.dmp

Download

memory/328-71-0x0000000003890000-0x0000000003CAC000-memory.dmp

Download

memory/568-75-0x0000000000910000-0x0000000000D2C000-memory.dmp

Download

memory/568-76-0x0000000002310000-0x000000000232C000-memory.dmp

Download

memory/568-77-0x00000000025B0000-0x00000000025C6000-memory.dmp

Download

memory/568-78-0x00000000029C0000-0x00000000029CE000-memory.dmp

Download

memory/568-83-0x0000000000910000-0x0000000000D2C000-memory.dmp

Download

memory/1068-85-0x0000000000910000-0x0000000000D2C000-memory.dmp

Download

memory/1068-86-0x0000000000910000-0x0000000000D2C000-memory.dmp

Download

memory/1068-98-0x0000000000910000-0x0000000000D2C000-memory.dmp

Download

memory/1068-84-0x0000000000910000-0x0000000000D2C000-memory.dmp

Download

memory/1068-92-0x0000000006D00000-0x000000000711C000-memory.dmp

Download

memory/1068-94-0x0000000006D00000-0x000000000711C000-memory.dmp

Download

memory/1092-54-0x0000000076AE1000-0x0000000076AE3000-memory.dmp

Download

memory/1720-96-0x0000000000AC0000-0x0000000000EDC000-memory.dmp

Download

memory/1720-97-0x0000000000AC0000-0x0000000000EDC000-memory.dmp

Download

memory/1720-95-0x0000000000AC0000-0x0000000000EDC000-memory.dmp

Download

memory/1720-99-0x0000000000AC0000-0x0000000000EDC000-memory.dmp

Download