dcrat | 7839eb36f7eed422a53caef155ec171e4e75c2c8cf918432dcc933dda4241bcd

Analysis

max time kernel
149s
max time network
146s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
02-02-2023 12:53

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5a85456927d17627968250e487d8f714.exe
Size

1.3MB
MD5

5a85456927d17627968250e487d8f714
SHA1

21f6936933c7651e37c56f5986c889c33872af5c
SHA256

7839eb36f7eed422a53caef155ec171e4e75c2c8cf918432dcc933dda4241bcd
SHA512

cbce7dd84496805dfce1574f330450d5f32dd8966cec8a172b77281f58f0c55caa2f00db8ff2e5f48447eb2a5396c514379f67689a129d176c9ad4bfd91ce1c5
SSDEEP

24576:U2G/nvxW3Ww0t6TnzGmVBDh4+aknuRRZJND0gFJ4rD/IjC:UbA30GnzV/q+DnsXg

Score

10^/10

dcrat infostealer rat

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat

Process spawned unexpected child process 15 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

Processes:

schtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exe

description	pid	pid_target	process
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1368	1600	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1544	1600	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	880	1600	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1980	1600	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1988	1600	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1828	1600	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1860	1600	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	828	1600	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1736	1600	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1856	1600	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1616	1600	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	428	1600	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	884	1600	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1708	1600	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1256	1600	schtasks.exe

DCRat payload 19 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

Processes:

resource	yara_rule
\providercommon\DllCommonsvc.exe	dcrat
C:\providercommon\DllCommonsvc.exe	dcrat
\providercommon\DllCommonsvc.exe	dcrat
C:\providercommon\DllCommonsvc.exe	dcrat
behavioral1/memory/636-65-0x0000000000290000-0x00000000003A0000-memory.dmp	dcrat
C:\MSOCache\All Users\{90140000-0018-0409-0000-0000000FF1CE}-C\DllCommonsvc.exe	dcrat
behavioral1/memory/1948-84-0x00000000002E0000-0x00000000003F0000-memory.dmp	dcrat
C:\MSOCache\All Users\{90140000-0018-0409-0000-0000000FF1CE}-C\DllCommonsvc.exe	dcrat
C:\MSOCache\All Users\{90140000-0018-0409-0000-0000000FF1CE}-C\DllCommonsvc.exe	dcrat
behavioral1/memory/2032-113-0x00000000008D0000-0x00000000009E0000-memory.dmp	dcrat
C:\MSOCache\All Users\{90140000-0018-0409-0000-0000000FF1CE}-C\DllCommonsvc.exe	dcrat
behavioral1/memory/988-143-0x00000000000D0000-0x00000000001E0000-memory.dmp	dcrat
C:\MSOCache\All Users\{90140000-0018-0409-0000-0000000FF1CE}-C\DllCommonsvc.exe	dcrat
behavioral1/memory/688-149-0x0000000000090000-0x00000000001A0000-memory.dmp	dcrat
C:\MSOCache\All Users\{90140000-0018-0409-0000-0000000FF1CE}-C\DllCommonsvc.exe	dcrat
behavioral1/memory/832-155-0x0000000000AF0000-0x0000000000C00000-memory.dmp	dcrat
C:\MSOCache\All Users\{90140000-0018-0409-0000-0000000FF1CE}-C\DllCommonsvc.exe	dcrat
behavioral1/memory/1524-161-0x0000000000EA0000-0x0000000000FB0000-memory.dmp	dcrat
C:\MSOCache\All Users\{90140000-0018-0409-0000-0000000FF1CE}-C\DllCommonsvc.exe	dcrat

Executes dropped EXE 8 IoCs

Processes:

DllCommonsvc.exeDllCommonsvc.exeDllCommonsvc.exeDllCommonsvc.exeDllCommonsvc.exeDllCommonsvc.exeDllCommonsvc.exeDllCommonsvc.exe

pid	process
636	DllCommonsvc.exe
1948	DllCommonsvc.exe
2032	DllCommonsvc.exe
988	DllCommonsvc.exe
688	DllCommonsvc.exe
832	DllCommonsvc.exe
1524	DllCommonsvc.exe
1860	DllCommonsvc.exe

Loads dropped DLL 2 IoCs

Processes:

cmd.exe

pid process

1904 cmd.exe
1904 cmd.exe
Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

pid	process
1904	cmd.exe
1904	cmd.exe

Drops file in Program Files directory 5 IoCs

Processes:

DllCommonsvc.exe

description	ioc	process
File created	C:\Program Files\Uninstall Information\0a1fd5f707cd16	DllCommonsvc.exe
File created	C:\Program Files\Windows Photo Viewer\fr-FR\winlogon.exe	DllCommonsvc.exe
File opened for modification	C:\Program Files\Windows Photo Viewer\fr-FR\winlogon.exe	DllCommonsvc.exe
File created	C:\Program Files\Windows Photo Viewer\fr-FR\cc11b995f2a76d	DllCommonsvc.exe
File created	C:\Program Files\Uninstall Information\sppsvc.exe	DllCommonsvc.exe

Drops file in Windows directory 2 IoCs

Processes:

DllCommonsvc.exe

description ioc process

File created C:\Windows\Tasks\smss.exe DllCommonsvc.exe
File created C:\Windows\Tasks\69ddcba757bf72 DllCommonsvc.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

description	ioc	process
File created	C:\Windows\Tasks\smss.exe	DllCommonsvc.exe
File created	C:\Windows\Tasks\69ddcba757bf72	DllCommonsvc.exe

Creates scheduled task(s) 1 TTPs 15 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

Processes:

schtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exe

pid	process
1980	schtasks.exe
1988	schtasks.exe
1828	schtasks.exe
1856	schtasks.exe
1708	schtasks.exe
1368	schtasks.exe
1736	schtasks.exe
1860	schtasks.exe
1616	schtasks.exe
884	schtasks.exe
1256	schtasks.exe
880	schtasks.exe
828	schtasks.exe
428	schtasks.exe
1544	schtasks.exe

Modifies system certificate store 2 TTPs 2 IoCs

evasion spyware trojan

Install Root Certificate

T1130

Modify Registry

T1112

Processes:

DllCommonsvc.exe

description	ioc	process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\A8985D3A65E5E5C4B2D7D66D40C6DD2FB19C5436\Blob = 04000000010000001000000079e4a9840d7d3a96d7c04fe2434c892e0f0000000100000014000000b34ddd372ed92e8f2abfbb9e20a9d31f204f194b090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030814000000010000001400000003de503556d14cbb66f0a3e21b1bc397b23dd1550b00000001000000120000004400690067006900430065007200740000001d000000010000001000000059779e39e21a2e3dfced6857ed5c5fd9030000000100000014000000a8985d3a65e5e5c4b2d7d66d40c6dd2fb19c54361900000001000000100000000f3a0527d242de2dc98e5cfcb1e991ee2000000001000000b3030000308203af30820297a0030201020210083be056904246b1a1756ac95991c74a300d06092a864886f70d01010505003061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100e23be11172dea8a4d3a357aa50a28f0b7790c9a2a5ee12ce965b010920cc0193a74e30b753f743c46900579de28d22dd870640008109cece1b83bfdfcd3b7146e2d666c705b37627168f7b9e1e957deeb748a308dad6af7a0c3906657f4a5d1fbc17f8abbeee28d7747f7a78995985686e5c23324bbf4ec0e85a6de370bf7710bffc01f685d9a844105832a97518d5d1a2be47e2276af49a33f84908608bd45fb43a84bfa1aa4a4c7d3ecf4f5f6c765ea04b37919edc22e66dce141a8e6acbfecdb3146417c75b299e32bff2eefad30b42d4abb74132da0cd4eff881d5bb8d583fb51be84928a270da3104ddf7b216f24c0a4e07a8ed4a3d5eb57fa390c3af270203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041403de503556d14cbb66f0a3e21b1bc397b23dd155301f0603551d2304183016801403de503556d14cbb66f0a3e21b1bc397b23dd155300d06092a864886f70d01010505000382010100cb9c37aa4813120afadd449c4f52b0f4dfae04f5797908a32418fc4b2b84c02db9d5c7fef4c11f58cbb86d9c7a74e79829ab11b5e370a0a1cd4c8899938c9170e2ab0f1cbe93a9ff63d5e40760d3a3bf9d5b09f1d58ee353f48e63fa3fa7dbb466df6266d6d16e418df22db5ea774a9f9d58e22b59c04023ed2d2882453e7954922698e08048a837eff0d6796016deace80ecd6eac4417382f49dae1453e2ab93653cf3a5006f72ee8c457496c612118d504ad783c2c3a806ba7ebaf1514e9d889c1b9386ce2916c8aff64b977255730c01b24a3e1dce9df477cb5b424080530ec2dbd0bbf45bf50b9a9f3eb980112adc888c698345f8d0a3cc6e9d595956dde	DllCommonsvc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\A8985D3A65E5E5C4B2D7D66D40C6DD2FB19C5436	DllCommonsvc.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

Processes:

DllCommonsvc.exeDllCommonsvc.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exeDllCommonsvc.exeDllCommonsvc.exeDllCommonsvc.exeDllCommonsvc.exeDllCommonsvc.exeDllCommonsvc.exe

pid	process
636	DllCommonsvc.exe
1948	DllCommonsvc.exe
564	powershell.exe
1992	powershell.exe
1676	powershell.exe
1080	powershell.exe
1684	powershell.exe
2020	powershell.exe
2032	DllCommonsvc.exe
988	DllCommonsvc.exe
688	DllCommonsvc.exe
832	DllCommonsvc.exe
1524	DllCommonsvc.exe
1860	DllCommonsvc.exe

Suspicious use of AdjustPrivilegeToken 14 IoCs

Processes:

DllCommonsvc.exeDllCommonsvc.exeDllCommonsvc.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exeDllCommonsvc.exeDllCommonsvc.exeDllCommonsvc.exeDllCommonsvc.exeDllCommonsvc.exe

description	pid	process
Token: SeDebugPrivilege	636	DllCommonsvc.exe
Token: SeDebugPrivilege	1948	DllCommonsvc.exe
Token: SeDebugPrivilege	2032	DllCommonsvc.exe
Token: SeDebugPrivilege	564	powershell.exe
Token: SeDebugPrivilege	1992	powershell.exe
Token: SeDebugPrivilege	1676	powershell.exe
Token: SeDebugPrivilege	1080	powershell.exe
Token: SeDebugPrivilege	1684	powershell.exe
Token: SeDebugPrivilege	2020	powershell.exe
Token: SeDebugPrivilege	988	DllCommonsvc.exe
Token: SeDebugPrivilege	688	DllCommonsvc.exe
Token: SeDebugPrivilege	832	DllCommonsvc.exe
Token: SeDebugPrivilege	1524	DllCommonsvc.exe
Token: SeDebugPrivilege	1860	DllCommonsvc.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

5a85456927d17627968250e487d8f714.exeWScript.execmd.exeDllCommonsvc.exeDllCommonsvc.execmd.exeDllCommonsvc.execmd.exeDllCommonsvc.execmd.exeDllCommonsvc.execmd.exe

description	pid	process	target process
PID 2016 wrote to memory of 1344	2016	5a85456927d17627968250e487d8f714.exe	WScript.exe
PID 2016 wrote to memory of 1344	2016	5a85456927d17627968250e487d8f714.exe	WScript.exe
PID 2016 wrote to memory of 1344	2016	5a85456927d17627968250e487d8f714.exe	WScript.exe
PID 2016 wrote to memory of 1344	2016	5a85456927d17627968250e487d8f714.exe	WScript.exe
PID 1344 wrote to memory of 1904	1344	WScript.exe	cmd.exe
PID 1344 wrote to memory of 1904	1344	WScript.exe	cmd.exe
PID 1344 wrote to memory of 1904	1344	WScript.exe	cmd.exe
PID 1344 wrote to memory of 1904	1344	WScript.exe	cmd.exe
PID 1904 wrote to memory of 636	1904	cmd.exe	DllCommonsvc.exe
PID 1904 wrote to memory of 636	1904	cmd.exe	DllCommonsvc.exe
PID 1904 wrote to memory of 636	1904	cmd.exe	DllCommonsvc.exe
PID 1904 wrote to memory of 636	1904	cmd.exe	DllCommonsvc.exe
PID 636 wrote to memory of 1992	636	DllCommonsvc.exe	powershell.exe
PID 636 wrote to memory of 1992	636	DllCommonsvc.exe	powershell.exe
PID 636 wrote to memory of 1992	636	DllCommonsvc.exe	powershell.exe
PID 636 wrote to memory of 1676	636	DllCommonsvc.exe	powershell.exe
PID 636 wrote to memory of 1676	636	DllCommonsvc.exe	powershell.exe
PID 636 wrote to memory of 1676	636	DllCommonsvc.exe	powershell.exe
PID 636 wrote to memory of 1684	636	DllCommonsvc.exe	powershell.exe
PID 636 wrote to memory of 1684	636	DllCommonsvc.exe	powershell.exe
PID 636 wrote to memory of 1684	636	DllCommonsvc.exe	powershell.exe
PID 636 wrote to memory of 564	636	DllCommonsvc.exe	powershell.exe
PID 636 wrote to memory of 564	636	DllCommonsvc.exe	powershell.exe
PID 636 wrote to memory of 564	636	DllCommonsvc.exe	powershell.exe
PID 636 wrote to memory of 1080	636	DllCommonsvc.exe	powershell.exe
PID 636 wrote to memory of 1080	636	DllCommonsvc.exe	powershell.exe
PID 636 wrote to memory of 1080	636	DllCommonsvc.exe	powershell.exe
PID 636 wrote to memory of 2020	636	DllCommonsvc.exe	powershell.exe
PID 636 wrote to memory of 2020	636	DllCommonsvc.exe	powershell.exe
PID 636 wrote to memory of 2020	636	DllCommonsvc.exe	powershell.exe
PID 636 wrote to memory of 1948	636	DllCommonsvc.exe	DllCommonsvc.exe
PID 636 wrote to memory of 1948	636	DllCommonsvc.exe	DllCommonsvc.exe
PID 636 wrote to memory of 1948	636	DllCommonsvc.exe	DllCommonsvc.exe
PID 1948 wrote to memory of 1500	1948	DllCommonsvc.exe	cmd.exe
PID 1948 wrote to memory of 1500	1948	DllCommonsvc.exe	cmd.exe
PID 1948 wrote to memory of 1500	1948	DllCommonsvc.exe	cmd.exe
PID 1500 wrote to memory of 1048	1500	cmd.exe	w32tm.exe
PID 1500 wrote to memory of 1048	1500	cmd.exe	w32tm.exe
PID 1500 wrote to memory of 1048	1500	cmd.exe	w32tm.exe
PID 1500 wrote to memory of 2032	1500	cmd.exe	DllCommonsvc.exe
PID 1500 wrote to memory of 2032	1500	cmd.exe	DllCommonsvc.exe
PID 1500 wrote to memory of 2032	1500	cmd.exe	DllCommonsvc.exe
PID 2032 wrote to memory of 968	2032	DllCommonsvc.exe	cmd.exe
PID 2032 wrote to memory of 968	2032	DllCommonsvc.exe	cmd.exe
PID 2032 wrote to memory of 968	2032	DllCommonsvc.exe	cmd.exe
PID 968 wrote to memory of 1992	968	cmd.exe	w32tm.exe
PID 968 wrote to memory of 1992	968	cmd.exe	w32tm.exe
PID 968 wrote to memory of 1992	968	cmd.exe	w32tm.exe
PID 968 wrote to memory of 988	968	cmd.exe	DllCommonsvc.exe
PID 968 wrote to memory of 988	968	cmd.exe	DllCommonsvc.exe
PID 968 wrote to memory of 988	968	cmd.exe	DllCommonsvc.exe
PID 988 wrote to memory of 1700	988	DllCommonsvc.exe	cmd.exe
PID 988 wrote to memory of 1700	988	DllCommonsvc.exe	cmd.exe
PID 988 wrote to memory of 1700	988	DllCommonsvc.exe	cmd.exe
PID 1700 wrote to memory of 1532	1700	cmd.exe	w32tm.exe
PID 1700 wrote to memory of 1532	1700	cmd.exe	w32tm.exe
PID 1700 wrote to memory of 1532	1700	cmd.exe	w32tm.exe
PID 1700 wrote to memory of 688	1700	cmd.exe	DllCommonsvc.exe
PID 1700 wrote to memory of 688	1700	cmd.exe	DllCommonsvc.exe
PID 1700 wrote to memory of 688	1700	cmd.exe	DllCommonsvc.exe
PID 688 wrote to memory of 1548	688	DllCommonsvc.exe	cmd.exe
PID 688 wrote to memory of 1548	688	DllCommonsvc.exe	cmd.exe
PID 688 wrote to memory of 1548	688	DllCommonsvc.exe	cmd.exe
PID 1548 wrote to memory of 2020	1548	cmd.exe	w32tm.exe

C:\Users\Admin\AppData\Local\Temp\5a85456927d17627968250e487d8f714.exe
"C:\Users\Admin\AppData\Local\Temp\5a85456927d17627968250e487d8f714.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2016

C:\Windows\SysWOW64\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\providercommon\yTUdeXjbLOhnrN32dgrxVg.vbe"
2⤵
- Suspicious use of WriteProcessMemory
PID:1344

C:\Windows\SysWOW64\cmd.exe
cmd /c ""C:\providercommon\1zu9dW.bat" "
3⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1904

C:\providercommon\DllCommonsvc.exe
"C:\providercommon\DllCommonsvc.exe"
4⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:636

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\DllCommonsvc.exe'
5⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1992

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Windows Photo Viewer\fr-FR\winlogon.exe'
5⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1676

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell" -Command Add-MpPreference -ExclusionPath 'C:\MSOCache\All Users\{90140000-0018-0409-0000-0000000FF1CE}-C\DllCommonsvc.exe'
5⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1684

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\dwm.exe'
5⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:564

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Uninstall Information\sppsvc.exe'
5⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1080

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\Tasks\smss.exe'
5⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2020

C:\MSOCache\All Users\{90140000-0018-0409-0000-0000000FF1CE}-C\DllCommonsvc.exe
"C:\MSOCache\All Users\{90140000-0018-0409-0000-0000000FF1CE}-C\DllCommonsvc.exe"
5⤵
- Executes dropped EXE
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1948

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\WqeaogqjWu.bat"
6⤵
- Suspicious use of WriteProcessMemory
PID:1500

C:\Windows\system32\w32tm.exe
w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
7⤵
PID:1048

C:\MSOCache\All Users\{90140000-0018-0409-0000-0000000FF1CE}-C\DllCommonsvc.exe
"C:\MSOCache\All Users\{90140000-0018-0409-0000-0000000FF1CE}-C\DllCommonsvc.exe"
7⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2032

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\USq6qxpMr5.bat"
8⤵
- Suspicious use of WriteProcessMemory
PID:968

C:\Windows\system32\w32tm.exe
w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
9⤵
PID:1992

C:\MSOCache\All Users\{90140000-0018-0409-0000-0000000FF1CE}-C\DllCommonsvc.exe
"C:\MSOCache\All Users\{90140000-0018-0409-0000-0000000FF1CE}-C\DllCommonsvc.exe"
9⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:988

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\VJj2LbMAw3.bat"
10⤵
- Suspicious use of WriteProcessMemory
PID:1700

C:\Windows\system32\w32tm.exe
w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
11⤵
PID:1532

C:\MSOCache\All Users\{90140000-0018-0409-0000-0000000FF1CE}-C\DllCommonsvc.exe
"C:\MSOCache\All Users\{90140000-0018-0409-0000-0000000FF1CE}-C\DllCommonsvc.exe"
11⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:688

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\3gUlVaPHfz.bat"
12⤵
- Suspicious use of WriteProcessMemory
PID:1548

C:\Windows\system32\w32tm.exe
w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
13⤵
PID:2020

C:\MSOCache\All Users\{90140000-0018-0409-0000-0000000FF1CE}-C\DllCommonsvc.exe
"C:\MSOCache\All Users\{90140000-0018-0409-0000-0000000FF1CE}-C\DllCommonsvc.exe"
13⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:832

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\MKE9IzBoeI.bat"
14⤵
PID:512

C:\Windows\system32\w32tm.exe
w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
15⤵
PID:1816

C:\MSOCache\All Users\{90140000-0018-0409-0000-0000000FF1CE}-C\DllCommonsvc.exe
"C:\MSOCache\All Users\{90140000-0018-0409-0000-0000000FF1CE}-C\DllCommonsvc.exe"
15⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1524

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\tYG4XGbOex.bat"
16⤵
PID:752

C:\Windows\system32\w32tm.exe
w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
17⤵
PID:1972

C:\MSOCache\All Users\{90140000-0018-0409-0000-0000000FF1CE}-C\DllCommonsvc.exe
"C:\MSOCache\All Users\{90140000-0018-0409-0000-0000000FF1CE}-C\DllCommonsvc.exe"
17⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1860

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 13 /tr "'C:\Program Files\Windows Photo Viewer\fr-FR\winlogon.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1368

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogon" /sc ONLOGON /tr "'C:\Program Files\Windows Photo Viewer\fr-FR\winlogon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1544

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 9 /tr "'C:\Program Files\Windows Photo Viewer\fr-FR\winlogon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:880

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "DllCommonsvcD" /sc MINUTE /mo 5 /tr "'C:\MSOCache\All Users\{90140000-0018-0409-0000-0000000FF1CE}-C\DllCommonsvc.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1980

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "DllCommonsvc" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-0018-0409-0000-0000000FF1CE}-C\DllCommonsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1988

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "DllCommonsvcD" /sc MINUTE /mo 14 /tr "'C:\MSOCache\All Users\{90140000-0018-0409-0000-0000000FF1CE}-C\DllCommonsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1828

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 10 /tr "'C:\providercommon\dwm.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1860

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwm" /sc ONLOGON /tr "'C:\providercommon\dwm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:828

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 9 /tr "'C:\providercommon\dwm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1736

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 9 /tr "'C:\Program Files\Uninstall Information\sppsvc.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1856

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvc" /sc ONLOGON /tr "'C:\Program Files\Uninstall Information\sppsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1616

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 11 /tr "'C:\Program Files\Uninstall Information\sppsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:428

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 9 /tr "'C:\Windows\Tasks\smss.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:884

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smss" /sc ONLOGON /tr "'C:\Windows\Tasks\smss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1708

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 9 /tr "'C:\Windows\Tasks\smss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1256

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Install Root Certificate

T1130

Modify Registry

T1112

Web Service

T1102

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\MSOCache\All Users\{90140000-0018-0409-0000-0000000FF1CE}-C\DllCommonsvc.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\MSOCache\All Users\{90140000-0018-0409-0000-0000000FF1CE}-C\DllCommonsvc.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\MSOCache\All Users\{90140000-0018-0409-0000-0000000FF1CE}-C\DllCommonsvc.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\MSOCache\All Users\{90140000-0018-0409-0000-0000000FF1CE}-C\DllCommonsvc.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\MSOCache\All Users\{90140000-0018-0409-0000-0000000FF1CE}-C\DllCommonsvc.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\MSOCache\All Users\{90140000-0018-0409-0000-0000000FF1CE}-C\DllCommonsvc.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\MSOCache\All Users\{90140000-0018-0409-0000-0000000FF1CE}-C\DllCommonsvc.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\MSOCache\All Users\{90140000-0018-0409-0000-0000000FF1CE}-C\DllCommonsvc.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\Users\Admin\AppData\Local\Temp\3gUlVaPHfz.bat

Filesize
244B

MD5
cfc60614e95870d27a7fd67073eed6f2

SHA1
397ee4f640f8f9ad4054a773a2a4250b0ac0e032

SHA256
69a47a7d17b62a57f8ef59e43f640044d1d178e3acfa555b85f6819d3234d9fa

SHA512
45cec76d696dcc0ea4050037f992087cf635b36d26383a4eb3fbc6eff13fb60f1c246889bf7a8cb90d6020ffa44d7d77287df80bb48fd626315fff7e0ec7abad

Download Submit
C:\Users\Admin\AppData\Local\Temp\MKE9IzBoeI.bat

Filesize
244B

MD5
c566ccba246173e6299dee21e5b01da4

SHA1
bfe4a09aa5117d79e176ac8ca59934bf3e5786e5

SHA256
5c5b329886e1dc9ba64b4956433cd17852e30c68255415ee669d354c6e6e2164

SHA512
f94ebb17c661146a3868a2cfd2664651a92ed1d859eb3a60bede201b4362f7f3ca0c3d53e43c80e8595be5f0563cdc04cae396226b6fa7c57d76d709ff029c33

Download Submit
C:\Users\Admin\AppData\Local\Temp\USq6qxpMr5.bat

Filesize
244B

MD5
82c39b7c6b230924c7d6135efdda4fe9

SHA1
2c67c06aae103ed785fb6f706b3b6a5f0fb29285

SHA256
84cf84593b0db83d3a74be161f7b5a7841591a2cbd73b969b8244984fbf923c0

SHA512
b28acce95d48c94515e7d3277d074e0a03ec88af6817b28b8f859759d8379262e68b388bfd67e768a708d5c80c1bb8923a3afb7139f5659c567ea2e2c6abc899

Download Submit
C:\Users\Admin\AppData\Local\Temp\VJj2LbMAw3.bat

Filesize
244B

MD5
950db042f6646c6b22574b3c166ee4f1

SHA1
b22b2bd7c1c3a4046c8dc5495bacfa6d38b8a1d0

SHA256
5a113d532f66da0ee2b11e0232bc85be67c348aafb9ce4a7cff48755b50bd101

SHA512
738843e33fdbb457278ba7a8e6e71a613f69703a6092a0470c2bf28dd013109ebf384083a54ad1f109865afeb445af24ed5eeced7d656f48e318f53e9c3daae9

Download Submit
C:\Users\Admin\AppData\Local\Temp\WqeaogqjWu.bat

Filesize
244B

MD5
325c9084344d41a42de1b03fa5dad094

SHA1
ee42feb23627baa75f29b04d968422d56340b860

SHA256
f8a954825f99643570824b62d3757fef0832ed6773c340874daf1388c543e3a3

SHA512
f054860bdde8603ce44f47d748dc3b5cd0ed2f6f9544f3ec306d01ed6960834389e02d5cdb3d583c387e1795732bf7435f542248b79dd24f44a66fffb47e2b7f

Download Submit
C:\Users\Admin\AppData\Local\Temp\tYG4XGbOex.bat

Filesize
244B

MD5
0da97a3a70334db49474abe49831c8de

SHA1
c4b9b9fb403282c70881513bb5ec08e1351161b7

SHA256
21c6756c50c0442e6fbab9bc7e844b4e0d9a3254120b4c9d96bdf02a067dd61d

SHA512
c7b02fcd91bffd259a0e773b758c28910317b274cbfaa43a94f353ca03abfafe46e595b1eef3f9650f3bc89c75472047077f6dc333714f7eed42354905e82aff

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
7KB

MD5
b47fbb1f9e236b9c6ba3a1c3ad60f6c6

SHA1
d84e20fd4dadc0406cff293a7a5047ca7f86850d

SHA256
4c5a3b0a905a5493a49b4f42ba2216c5a7f262b4be76614a1d99e5c4debdd7f0

SHA512
d0785d14fc970db9ae97da8574c333e5d2836fa6bf2c66a280ab175447d851207e6ec8c61c205d2a0c72b0eca5dc83799155e0a178a207534202ae68b0088b95

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
7KB

MD5
b47fbb1f9e236b9c6ba3a1c3ad60f6c6

SHA1
d84e20fd4dadc0406cff293a7a5047ca7f86850d

SHA256
4c5a3b0a905a5493a49b4f42ba2216c5a7f262b4be76614a1d99e5c4debdd7f0

SHA512
d0785d14fc970db9ae97da8574c333e5d2836fa6bf2c66a280ab175447d851207e6ec8c61c205d2a0c72b0eca5dc83799155e0a178a207534202ae68b0088b95

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
7KB

MD5
b47fbb1f9e236b9c6ba3a1c3ad60f6c6

SHA1
d84e20fd4dadc0406cff293a7a5047ca7f86850d

SHA256
4c5a3b0a905a5493a49b4f42ba2216c5a7f262b4be76614a1d99e5c4debdd7f0

SHA512
d0785d14fc970db9ae97da8574c333e5d2836fa6bf2c66a280ab175447d851207e6ec8c61c205d2a0c72b0eca5dc83799155e0a178a207534202ae68b0088b95

Download Submit
C:\providercommon\1zu9dW.bat

Filesize
36B

MD5
6783c3ee07c7d151ceac57f1f9c8bed7

SHA1
17468f98f95bf504cc1f83c49e49a78526b3ea03

SHA256
8ab782f0f327a2021530e7230d3aee8abbecb7eed59482a3a46e78b9e3862322

SHA512
c6012d4bfac1ed14d0fd9f0eabd0e1c3d647b343db292a907b246271d52a4b7469c809db43910ddba2e8c5045f9cb3d24d0af62d363281e6cb8b39ee94a183e8

Download Submit
C:\providercommon\DllCommonsvc.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\providercommon\DllCommonsvc.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\providercommon\yTUdeXjbLOhnrN32dgrxVg.vbe

Filesize
197B

MD5
8088241160261560a02c84025d107592

SHA1
083121f7027557570994c9fc211df61730455bb5

SHA256
2072cc9a4a3b84d4c5178ab41c5588eea7d0103e3928e34d64f17bf97f3d1cc1

SHA512
20d9369dd359315848ea30144383a0bb479d86059fdbc3b3256ac84f998193512feb3b1799ab663619920c99fe7e0ebba33ada31a3855094b956fcd351c90478

Download Submit
\providercommon\DllCommonsvc.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
\providercommon\DllCommonsvc.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
memory/512-156-0x0000000000000000-mapping.dmp

Download
memory/564-128-0x0000000002804000-0x0000000002807000-memory.dmp

Filesize
12KB

Download
memory/564-73-0x0000000000000000-mapping.dmp

Download
memory/564-129-0x000000000280B000-0x000000000282A000-memory.dmp

Filesize
124KB

Download
memory/564-118-0x000000001B820000-0x000000001BB1F000-memory.dmp

Filesize
3.0MB

Download
memory/564-99-0x000007FEEE600000-0x000007FEEF15D000-memory.dmp

Filesize
11.4MB

Download
memory/564-88-0x000007FEEC2E0000-0x000007FEECD03000-memory.dmp

Filesize
10.1MB

Download
memory/564-107-0x0000000002804000-0x0000000002807000-memory.dmp

Filesize
12KB

Download
memory/636-65-0x0000000000290000-0x00000000003A0000-memory.dmp

Filesize
1.1MB

Download
memory/636-69-0x00000000001E0000-0x00000000001EC000-memory.dmp

Filesize
48KB

Download
memory/636-68-0x00000000001D0000-0x00000000001DC000-memory.dmp

Filesize
48KB

Download
memory/636-67-0x0000000000280000-0x000000000028C000-memory.dmp

Filesize
48KB

Download
memory/636-66-0x00000000001C0000-0x00000000001D2000-memory.dmp

Filesize
72KB

Download
memory/636-63-0x0000000000000000-mapping.dmp

Download
memory/688-147-0x0000000000000000-mapping.dmp

Download
memory/688-149-0x0000000000090000-0x00000000001A0000-memory.dmp

Filesize
1.1MB

Download
memory/752-163-0x0000000000000000-mapping.dmp

Download
memory/832-153-0x0000000000000000-mapping.dmp

Download
memory/832-155-0x0000000000AF0000-0x0000000000C00000-memory.dmp

Filesize
1.1MB

Download
memory/968-138-0x0000000000000000-mapping.dmp

Download
memory/988-141-0x0000000000000000-mapping.dmp

Download
memory/988-143-0x00000000000D0000-0x00000000001E0000-memory.dmp

Filesize
1.1MB

Download
memory/1048-106-0x0000000000000000-mapping.dmp

Download
memory/1080-130-0x0000000002984000-0x0000000002987000-memory.dmp

Filesize
12KB

Download
memory/1080-103-0x0000000002984000-0x0000000002987000-memory.dmp

Filesize
12KB

Download
memory/1080-115-0x000000001B990000-0x000000001BC8F000-memory.dmp

Filesize
3.0MB

Download
memory/1080-87-0x000007FEEC2E0000-0x000007FEECD03000-memory.dmp

Filesize
10.1MB

Download
memory/1080-125-0x0000000002984000-0x0000000002987000-memory.dmp

Filesize
12KB

Download
memory/1080-74-0x0000000000000000-mapping.dmp

Download
memory/1080-131-0x000000000298B000-0x00000000029AA000-memory.dmp

Filesize
124KB

Download
memory/1080-109-0x000007FEEE600000-0x000007FEEF15D000-memory.dmp

Filesize
11.4MB

Download
memory/1344-55-0x0000000000000000-mapping.dmp

Download
memory/1500-104-0x0000000000000000-mapping.dmp

Download
memory/1524-162-0x00000000003C0000-0x00000000003D2000-memory.dmp

Filesize
72KB

Download
memory/1524-159-0x0000000000000000-mapping.dmp

Download
memory/1524-161-0x0000000000EA0000-0x0000000000FB0000-memory.dmp

Filesize
1.1MB

Download
memory/1532-146-0x0000000000000000-mapping.dmp

Download
memory/1548-150-0x0000000000000000-mapping.dmp

Download
memory/1676-134-0x00000000027D4000-0x00000000027D7000-memory.dmp

Filesize
12KB

Download
memory/1676-136-0x00000000027DB000-0x00000000027FA000-memory.dmp

Filesize
124KB

Download
memory/1676-116-0x000000001B910000-0x000000001BC0F000-memory.dmp

Filesize
3.0MB

Download
memory/1676-71-0x0000000000000000-mapping.dmp

Download
memory/1676-100-0x00000000027D4000-0x00000000027D7000-memory.dmp

Filesize
12KB

Download
memory/1676-92-0x000007FEEC2E0000-0x000007FEECD03000-memory.dmp

Filesize
10.1MB

Download
memory/1676-97-0x000007FEEE600000-0x000007FEEF15D000-memory.dmp

Filesize
11.4MB

Download
memory/1676-122-0x00000000027D4000-0x00000000027D7000-memory.dmp

Filesize
12KB

Download
memory/1676-75-0x000007FEFC011000-0x000007FEFC013000-memory.dmp

Filesize
8KB

Download
memory/1684-101-0x0000000002694000-0x0000000002697000-memory.dmp

Filesize
12KB

Download
memory/1684-72-0x0000000000000000-mapping.dmp

Download
memory/1684-117-0x000000001B730000-0x000000001BA2F000-memory.dmp

Filesize
3.0MB

Download
memory/1684-108-0x000007FEEE600000-0x000007FEEF15D000-memory.dmp

Filesize
11.4MB

Download
memory/1684-132-0x0000000002694000-0x0000000002697000-memory.dmp

Filesize
12KB

Download
memory/1684-93-0x000007FEEC2E0000-0x000007FEECD03000-memory.dmp

Filesize
10.1MB

Download
memory/1684-123-0x0000000002694000-0x0000000002697000-memory.dmp

Filesize
12KB

Download
memory/1684-133-0x000000000269B000-0x00000000026BA000-memory.dmp

Filesize
124KB

Download
memory/1700-144-0x0000000000000000-mapping.dmp

Download
memory/1816-158-0x0000000000000000-mapping.dmp

Download
memory/1860-166-0x0000000000000000-mapping.dmp

Download
memory/1904-59-0x0000000000000000-mapping.dmp

Download
memory/1948-91-0x0000000000540000-0x0000000000552000-memory.dmp

Filesize
72KB

Download
memory/1948-84-0x00000000002E0000-0x00000000003F0000-memory.dmp

Filesize
1.1MB

Download
memory/1948-79-0x0000000000000000-mapping.dmp

Download
memory/1972-165-0x0000000000000000-mapping.dmp

Download
memory/1992-119-0x000000001B720000-0x000000001BA1F000-memory.dmp

Filesize
3.0MB

Download
memory/1992-98-0x0000000002644000-0x0000000002647000-memory.dmp

Filesize
12KB

Download
memory/1992-121-0x0000000002644000-0x0000000002647000-memory.dmp

Filesize
12KB

Download
memory/1992-140-0x0000000000000000-mapping.dmp

Download
memory/1992-94-0x000007FEEC2E0000-0x000007FEECD03000-memory.dmp

Filesize
10.1MB

Download
memory/1992-126-0x0000000002644000-0x0000000002647000-memory.dmp

Filesize
12KB

Download
memory/1992-70-0x0000000000000000-mapping.dmp

Download
memory/1992-127-0x000000000264B000-0x000000000266A000-memory.dmp

Filesize
124KB

Download
memory/1992-96-0x000007FEEE600000-0x000007FEEF15D000-memory.dmp

Filesize
11.4MB

Download
memory/2016-54-0x00000000757A1000-0x00000000757A3000-memory.dmp

Filesize
8KB

Download
memory/2020-135-0x0000000002464000-0x0000000002467000-memory.dmp

Filesize
12KB

Download
memory/2020-137-0x000000000246B000-0x000000000248A000-memory.dmp

Filesize
124KB

Download
memory/2020-76-0x0000000000000000-mapping.dmp

Download
memory/2020-152-0x0000000000000000-mapping.dmp

Download
memory/2020-102-0x0000000002464000-0x0000000002467000-memory.dmp

Filesize
12KB

Download
memory/2020-120-0x000000001B8B0000-0x000000001BBAF000-memory.dmp

Filesize
3.0MB

Download
memory/2020-95-0x000007FEEC2E0000-0x000007FEECD03000-memory.dmp

Filesize
10.1MB

Download
memory/2020-124-0x0000000002464000-0x0000000002467000-memory.dmp

Filesize
12KB

Download
memory/2020-110-0x000007FEEE600000-0x000007FEEF15D000-memory.dmp

Filesize
11.4MB

Download
memory/2032-113-0x00000000008D0000-0x00000000009E0000-memory.dmp

Filesize
1.1MB

Download
memory/2032-111-0x0000000000000000-mapping.dmp

Download
memory/2032-114-0x00000000003C0000-0x00000000003D2000-memory.dmp

Filesize
72KB

Download