6c6a951636ae4dee7a842c6af1d43236.exe

General
Target

6c6a951636ae4dee7a842c6af1d43236.exe

Filesize

1MB

Completed

22-07-2021 08:07

Score
10 /10
MD5

6c6a951636ae4dee7a842c6af1d43236

SHA1

387e2f026ca3ec2a291b09fa76f88fe40ae7007c

SHA256

2ebc7cf945c4eba60eb0f25f6b58eb8d7d0558f6b5622530b2b3808987173952

Malware Config

Extracted

Family darkcomet
Botnet ADSAW
C2

secret92.ddns.net:82

Attributes
InstallPath
MSDCSC\msdcsc.exe
gencode
4ltiP4nFeytX
install
true
offline_keylogger
true
persistence
true
reg_key
MicroUpdate
Signatures 18

Filter: none

Defense Evasion
Discovery
Persistence
  • Darkcomet

    Description

    DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

  • Modifies WinLogon for persistence
    darknj.exe

    TTPs

    Winlogon Helper DLLModify Registry

    Reported IOCs

    descriptioniocprocess
    Set value (str)\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\MSDCSC\\msdcsc.exe"darknj.exe
  • njRAT/Bladabindi

    Description

    Widely used RAT written in .NET.

  • Executes dropped EXE
    R-Launcher.exedarknj.exeNJ.EXEmsdcsc.exeWindowsServices.exe

    Reported IOCs

    pidprocess
    1980R-Launcher.exe
    1948darknj.exe
    1168NJ.EXE
    752msdcsc.exe
    1860WindowsServices.exe
  • Modifies Windows Firewall

    Tags

    TTPs

    Modify Existing Service
  • Sets file to hidden

    Description

    Modifies file attributes to stop it showing in Explorer etc.

    Tags

    TTPs

    Hidden Files and Directories
  • Drops startup file
    WindowsServices.exe

    Reported IOCs

    descriptioniocprocess
    File createdC:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cf6e0aafbf214c3565426c44740c8dce.exeWindowsServices.exe
    File opened for modificationC:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cf6e0aafbf214c3565426c44740c8dce.exeWindowsServices.exe
  • Loads dropped DLL
    6c6a951636ae4dee7a842c6af1d43236.exedarknj.exeNJ.EXE

    Reported IOCs

    pidprocess
    18206c6a951636ae4dee7a842c6af1d43236.exe
    18206c6a951636ae4dee7a842c6af1d43236.exe
    18206c6a951636ae4dee7a842c6af1d43236.exe
    18206c6a951636ae4dee7a842c6af1d43236.exe
    1948darknj.exe
    1948darknj.exe
    1948darknj.exe
    1168NJ.EXE
  • Adds Run key to start application
    darknj.exemsdcsc.exeWindowsServices.exe

    TTPs

    Registry Run Keys / Startup FolderModify Registry

    Reported IOCs

    descriptioniocprocess
    Set value (str)\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Windows\CurrentVersion\Run\MicroUpdate = "C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\MSDCSC\\msdcsc.exe"darknj.exe
    Set value (str)\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Windows\CurrentVersion\Run\MicroUpdate = "C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\MSDCSC\\msdcsc.exe"msdcsc.exe
    Set value (str)\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Windows\CurrentVersion\Run\cf6e0aafbf214c3565426c44740c8dce = "\"C:\\Users\\Admin\\AppData\\Roaming\\WindowsServices.exe\" .."WindowsServices.exe
    Set value (str)\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\cf6e0aafbf214c3565426c44740c8dce = "\"C:\\Users\\Admin\\AppData\\Roaming\\WindowsServices.exe\" .."WindowsServices.exe
  • Enumerates physical storage devices

    Description

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

    TTPs

    System Information Discovery
  • Modifies Internet Explorer settings
    iexplore.exeIEXPLORE.EXE

    TTPs

    Modify Registry

    Reported IOCs

    descriptioniocprocess
    Key created\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\PageSetupiexplore.exe
    Set value (int)\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"iexplore.exe
    Set value (str)\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"IEXPLORE.EXE
    Set value (int)\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "224"IEXPLORE.EXE
    Set value (int)\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\DOMStorage\java.com\Total = "42"IEXPLORE.EXE
    Set value (int)\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\DOMStorage\java.com\Total = "122"IEXPLORE.EXE
    Key created\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\MainIEXPLORE.EXE
    Key created\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecoveryiexplore.exe
    Set value (int)\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\DOMStorage\java.com\ = "209"IEXPLORE.EXE
    Set value (int)\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\DOMStorage\java.com\Total = "276"IEXPLORE.EXE
    Set value (int)\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\DOMStorage\java.com\ = "333"IEXPLORE.EXE
    Set value (data)\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000064e463d9293d4143bd14e3345f65ac8600000000020000000000106600000001000020000000c997c4386f40ff93550657245277d60eea5b37903dd0dbcf85f7560522caf520000000000e800000000200002000000069d2acd76f26318ba944d6eed6103b706e0aca998955fd08391da2cdced1014a200100007e644b94a4eb41e0a454ac5c018685b5b5047a2904852b5069b66f77ace50b52a61c21d8f909a2a90b85473f1b2cdc33b0e55176105538e996803562a04572bad5204d767b7166225ab995f0c248ce406d185dbaaefe395f5b6c0ba76f05e0afb08b564f1268be8f09af1589efab6317667bae7d87bfdb6559115c2f733d3e0613ac9d0a8c38e036b2aee03be290f23effe81b638a7d77aef5f93f64705c42de2f9e8ec8d4708eb3779da354b49067b496b0a4f8a0ee9435a76f85e3cdba685cc08f86853a6aeb5a6e44d60b33abfcf5a8610f984669e70ec5ea78d8458f310ad81ce1f40d56a93214b43d87b494e5fe60dced2e3cca15f70e1f3a606195f1d04523be75979b8ff074a30d67c96edc1c90d1e39c209d4b6e6e94d4634279df0540000000a774037caab474875cbeef2cad4706ef83168de071d27fce6d6c6fb26b88e211e9711c15c07ba7c9e79ccc812d3b68692f098e17596cf81c1af55a4c95f00b93iexplore.exe
    Key created\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMiciexplore.exe
    Key created\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorageiexplore.exe
    Set value (int)\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\DOMStorage\java.com\ = "0"IEXPLORE.EXE
    Set value (int)\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "333"IEXPLORE.EXE
    Set value (int)\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\DOMStorage\java.com\Total = "333"IEXPLORE.EXE
    Key created\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\iexplore.exe
    Set value (int)\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\DOMStorage\java.com\Total = "209"IEXPLORE.EXE
    Set value (int)\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\DOMStorage\java.com\ = "276"IEXPLORE.EXE
    Set value (int)\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\DOMStorage\java.com\ = "42"IEXPLORE.EXE
    Set value (int)\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\DOMStorage\java.com\ = "224"IEXPLORE.EXE
    Set value (int)\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"iexplore.exe
    Key created\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\DomainSuggestioniexplore.exe
    Set value (str)\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"iexplore.exe
    Set value (int)\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "333706268"iexplore.exe
    Key created\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\InternetRegistryiexplore.exe
    Key created\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\Toolbariexplore.exe
    Key created\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowseriexplore.exe
    Set value (int)\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "276"IEXPLORE.EXE
    Set value (data)\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000064e463d9293d4143bd14e3345f65ac8600000000020000000000106600000001000020000000e419290e9c934eafc812517151000341dcd462a927c068a5ec19608c0be6985c000000000e8000000002000020000000333a08088de63b4e94f612dda907e1a30f0f90653af8333fbac54597338a4c44200000006d3e64d1ede7ed75629ba2973851c0d034b70f1e61e9d127978db549ea7f3ba6400000006fd53790b4cde96c56c71a21a01fa6af00e8483f3f02c56595aa8953305a152892eaf80a309f7ce7cf5f82966cf1a4d8bc3f64c5101b3ddd239e80ece02d52f3iexplore.exe
    Key created\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\IETld\LowMiciexplore.exe
    Key created\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\LowRegistryiexplore.exe
    Key created\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearchiexplore.exe
    Key created\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\DOMStorage\java.comIEXPLORE.EXE
    Set value (int)\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "209"IEXPLORE.EXE
    Set value (int)\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\DOMStorage\java.com\Total = "224"IEXPLORE.EXE
    Set value (int)\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\DOMStorage\java.com\ = "229"IEXPLORE.EXE
    Set value (int)\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\DOMStorage\trustarc.com\NumberOfSubdomains = "1"IEXPLORE.EXE
    Key created\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\Zoomiexplore.exe
    Set value (int)\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\DOMStorage\java.com\Total = "22"IEXPLORE.EXE
    Key created\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPageiexplore.exe
    Set value (int)\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "229"IEXPLORE.EXE
    Set value (int)\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\DOMStorage\java.com\Total = "229"IEXPLORE.EXE
    Set value (int)\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{F66AD391-EAC3-11EB-849A-C2EBB310CB62} = "0"iexplore.exe
    Set value (data)\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000iexplore.exe
    Set value (int)\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "42"IEXPLORE.EXE
    Set value (int)\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\DOMStorage\java.com\Total = "0"IEXPLORE.EXE
    Set value (int)\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "22"IEXPLORE.EXE
    Set value (int)\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\DOMStorage\java.com\ = "22"IEXPLORE.EXE
    Key created\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNamesiexplore.exe
    Key created\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\IntelliFormsiexplore.exe
    Key created\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgainiexplore.exe
    Set value (int)\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"iexplore.exe
    Key created\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActiveiexplore.exe
    Key created\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\DOMStorage\trustarc.comIEXPLORE.EXE
    Set value (str)\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"iexplore.exe
    Set value (int)\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\DOMStorage\java.com\NumberOfSubdomains = "1"IEXPLORE.EXE
    Set value (data)\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = d02cf8cdd07ed701iexplore.exe
    Key created\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\DOMStorage\TotalIEXPLORE.EXE
    Key created\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\Mainiexplore.exe
    Set value (int)\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "0"IEXPLORE.EXE
    Set value (int)\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\DOMStorage\java.com\ = "122"IEXPLORE.EXE
    Key created\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\GPUiexplore.exe
  • Suspicious behavior: EnumeratesProcesses
    NJ.EXE

    Reported IOCs

    pidprocess
    1168NJ.EXE
    1168NJ.EXE
    1168NJ.EXE
    1168NJ.EXE
    1168NJ.EXE
    1168NJ.EXE
    1168NJ.EXE
    1168NJ.EXE
    1168NJ.EXE
    1168NJ.EXE
    1168NJ.EXE
    1168NJ.EXE
    1168NJ.EXE
    1168NJ.EXE
    1168NJ.EXE
    1168NJ.EXE
    1168NJ.EXE
    1168NJ.EXE
    1168NJ.EXE
    1168NJ.EXE
    1168NJ.EXE
    1168NJ.EXE
    1168NJ.EXE
    1168NJ.EXE
    1168NJ.EXE
    1168NJ.EXE
    1168NJ.EXE
    1168NJ.EXE
    1168NJ.EXE
    1168NJ.EXE
    1168NJ.EXE
    1168NJ.EXE
    1168NJ.EXE
    1168NJ.EXE
    1168NJ.EXE
    1168NJ.EXE
    1168NJ.EXE
    1168NJ.EXE
    1168NJ.EXE
    1168NJ.EXE
    1168NJ.EXE
    1168NJ.EXE
    1168NJ.EXE
    1168NJ.EXE
    1168NJ.EXE
    1168NJ.EXE
    1168NJ.EXE
    1168NJ.EXE
    1168NJ.EXE
    1168NJ.EXE
    1168NJ.EXE
    1168NJ.EXE
    1168NJ.EXE
    1168NJ.EXE
    1168NJ.EXE
    1168NJ.EXE
    1168NJ.EXE
    1168NJ.EXE
    1168NJ.EXE
    1168NJ.EXE
    1168NJ.EXE
    1168NJ.EXE
    1168NJ.EXE
    1168NJ.EXE
  • Suspicious behavior: GetForegroundWindowSpam
    msdcsc.exe

    Reported IOCs

    pidprocess
    752msdcsc.exe
  • Suspicious use of AdjustPrivilegeToken
    darknj.exeNJ.EXEmsdcsc.exeWindowsServices.exe

    Reported IOCs

    descriptionpidprocess
    Token: SeIncreaseQuotaPrivilege1948darknj.exe
    Token: SeSecurityPrivilege1948darknj.exe
    Token: SeTakeOwnershipPrivilege1948darknj.exe
    Token: SeLoadDriverPrivilege1948darknj.exe
    Token: SeSystemProfilePrivilege1948darknj.exe
    Token: SeSystemtimePrivilege1948darknj.exe
    Token: SeProfSingleProcessPrivilege1948darknj.exe
    Token: SeIncBasePriorityPrivilege1948darknj.exe
    Token: SeCreatePagefilePrivilege1948darknj.exe
    Token: SeBackupPrivilege1948darknj.exe
    Token: SeRestorePrivilege1948darknj.exe
    Token: SeShutdownPrivilege1948darknj.exe
    Token: SeDebugPrivilege1948darknj.exe
    Token: SeSystemEnvironmentPrivilege1948darknj.exe
    Token: SeChangeNotifyPrivilege1948darknj.exe
    Token: SeRemoteShutdownPrivilege1948darknj.exe
    Token: SeUndockPrivilege1948darknj.exe
    Token: SeManageVolumePrivilege1948darknj.exe
    Token: SeImpersonatePrivilege1948darknj.exe
    Token: SeCreateGlobalPrivilege1948darknj.exe
    Token: 331948darknj.exe
    Token: 341948darknj.exe
    Token: 351948darknj.exe
    Token: SeDebugPrivilege1168NJ.EXE
    Token: SeIncreaseQuotaPrivilege752msdcsc.exe
    Token: SeSecurityPrivilege752msdcsc.exe
    Token: SeTakeOwnershipPrivilege752msdcsc.exe
    Token: SeLoadDriverPrivilege752msdcsc.exe
    Token: SeSystemProfilePrivilege752msdcsc.exe
    Token: SeSystemtimePrivilege752msdcsc.exe
    Token: SeProfSingleProcessPrivilege752msdcsc.exe
    Token: SeIncBasePriorityPrivilege752msdcsc.exe
    Token: SeCreatePagefilePrivilege752msdcsc.exe
    Token: SeBackupPrivilege752msdcsc.exe
    Token: SeRestorePrivilege752msdcsc.exe
    Token: SeShutdownPrivilege752msdcsc.exe
    Token: SeDebugPrivilege752msdcsc.exe
    Token: SeSystemEnvironmentPrivilege752msdcsc.exe
    Token: SeChangeNotifyPrivilege752msdcsc.exe
    Token: SeRemoteShutdownPrivilege752msdcsc.exe
    Token: SeUndockPrivilege752msdcsc.exe
    Token: SeManageVolumePrivilege752msdcsc.exe
    Token: SeImpersonatePrivilege752msdcsc.exe
    Token: SeCreateGlobalPrivilege752msdcsc.exe
    Token: 33752msdcsc.exe
    Token: 34752msdcsc.exe
    Token: 35752msdcsc.exe
    Token: SeDebugPrivilege1860WindowsServices.exe
    Token: 331860WindowsServices.exe
    Token: SeIncBasePriorityPrivilege1860WindowsServices.exe
    Token: 331860WindowsServices.exe
    Token: SeIncBasePriorityPrivilege1860WindowsServices.exe
    Token: 331860WindowsServices.exe
    Token: SeIncBasePriorityPrivilege1860WindowsServices.exe
    Token: 331860WindowsServices.exe
    Token: SeIncBasePriorityPrivilege1860WindowsServices.exe
    Token: 331860WindowsServices.exe
    Token: SeIncBasePriorityPrivilege1860WindowsServices.exe
    Token: 331860WindowsServices.exe
    Token: SeIncBasePriorityPrivilege1860WindowsServices.exe
    Token: 331860WindowsServices.exe
    Token: SeIncBasePriorityPrivilege1860WindowsServices.exe
    Token: 331860WindowsServices.exe
    Token: SeIncBasePriorityPrivilege1860WindowsServices.exe
  • Suspicious use of FindShellTrayWindow
    iexplore.exe

    Reported IOCs

    pidprocess
    2028iexplore.exe
  • Suspicious use of SetWindowsHookEx
    msdcsc.exeiexplore.exeIEXPLORE.EXE

    Reported IOCs

    pidprocess
    752msdcsc.exe
    2028iexplore.exe
    2028iexplore.exe
    1432IEXPLORE.EXE
    1432IEXPLORE.EXE
  • Suspicious use of WriteProcessMemory
    6c6a951636ae4dee7a842c6af1d43236.exedarknj.execmd.execmd.exemsdcsc.exe

    Reported IOCs

    descriptionpidprocesstarget process
    PID 1820 wrote to memory of 198018206c6a951636ae4dee7a842c6af1d43236.exeR-Launcher.exe
    PID 1820 wrote to memory of 198018206c6a951636ae4dee7a842c6af1d43236.exeR-Launcher.exe
    PID 1820 wrote to memory of 198018206c6a951636ae4dee7a842c6af1d43236.exeR-Launcher.exe
    PID 1820 wrote to memory of 198018206c6a951636ae4dee7a842c6af1d43236.exeR-Launcher.exe
    PID 1820 wrote to memory of 198018206c6a951636ae4dee7a842c6af1d43236.exeR-Launcher.exe
    PID 1820 wrote to memory of 198018206c6a951636ae4dee7a842c6af1d43236.exeR-Launcher.exe
    PID 1820 wrote to memory of 198018206c6a951636ae4dee7a842c6af1d43236.exeR-Launcher.exe
    PID 1820 wrote to memory of 194818206c6a951636ae4dee7a842c6af1d43236.exedarknj.exe
    PID 1820 wrote to memory of 194818206c6a951636ae4dee7a842c6af1d43236.exedarknj.exe
    PID 1820 wrote to memory of 194818206c6a951636ae4dee7a842c6af1d43236.exedarknj.exe
    PID 1820 wrote to memory of 194818206c6a951636ae4dee7a842c6af1d43236.exedarknj.exe
    PID 1948 wrote to memory of 17881948darknj.execmd.exe
    PID 1948 wrote to memory of 17881948darknj.execmd.exe
    PID 1948 wrote to memory of 17881948darknj.execmd.exe
    PID 1948 wrote to memory of 17881948darknj.execmd.exe
    PID 1948 wrote to memory of 17241948darknj.execmd.exe
    PID 1948 wrote to memory of 17241948darknj.execmd.exe
    PID 1948 wrote to memory of 17241948darknj.execmd.exe
    PID 1948 wrote to memory of 17241948darknj.execmd.exe
    PID 1788 wrote to memory of 13641788cmd.exeattrib.exe
    PID 1788 wrote to memory of 13641788cmd.exeattrib.exe
    PID 1788 wrote to memory of 13641788cmd.exeattrib.exe
    PID 1788 wrote to memory of 13641788cmd.exeattrib.exe
    PID 1948 wrote to memory of 11681948darknj.exeNJ.EXE
    PID 1948 wrote to memory of 11681948darknj.exeNJ.EXE
    PID 1948 wrote to memory of 11681948darknj.exeNJ.EXE
    PID 1948 wrote to memory of 11681948darknj.exeNJ.EXE
    PID 1724 wrote to memory of 12401724cmd.exeattrib.exe
    PID 1724 wrote to memory of 12401724cmd.exeattrib.exe
    PID 1724 wrote to memory of 12401724cmd.exeattrib.exe
    PID 1724 wrote to memory of 12401724cmd.exeattrib.exe
    PID 1948 wrote to memory of 12521948darknj.exenotepad.exe
    PID 1948 wrote to memory of 12521948darknj.exenotepad.exe
    PID 1948 wrote to memory of 12521948darknj.exenotepad.exe
    PID 1948 wrote to memory of 12521948darknj.exenotepad.exe
    PID 1948 wrote to memory of 12521948darknj.exenotepad.exe
    PID 1948 wrote to memory of 12521948darknj.exenotepad.exe
    PID 1948 wrote to memory of 12521948darknj.exenotepad.exe
    PID 1948 wrote to memory of 12521948darknj.exenotepad.exe
    PID 1948 wrote to memory of 12521948darknj.exenotepad.exe
    PID 1948 wrote to memory of 12521948darknj.exenotepad.exe
    PID 1948 wrote to memory of 12521948darknj.exenotepad.exe
    PID 1948 wrote to memory of 12521948darknj.exenotepad.exe
    PID 1948 wrote to memory of 12521948darknj.exenotepad.exe
    PID 1948 wrote to memory of 12521948darknj.exenotepad.exe
    PID 1948 wrote to memory of 12521948darknj.exenotepad.exe
    PID 1948 wrote to memory of 12521948darknj.exenotepad.exe
    PID 1948 wrote to memory of 12521948darknj.exenotepad.exe
    PID 1948 wrote to memory of 12521948darknj.exenotepad.exe
    PID 1948 wrote to memory of 7521948darknj.exemsdcsc.exe
    PID 1948 wrote to memory of 7521948darknj.exemsdcsc.exe
    PID 1948 wrote to memory of 7521948darknj.exemsdcsc.exe
    PID 1948 wrote to memory of 7521948darknj.exemsdcsc.exe
    PID 752 wrote to memory of 1524752msdcsc.exenotepad.exe
    PID 752 wrote to memory of 1524752msdcsc.exenotepad.exe
    PID 752 wrote to memory of 1524752msdcsc.exenotepad.exe
    PID 752 wrote to memory of 1524752msdcsc.exenotepad.exe
    PID 752 wrote to memory of 1524752msdcsc.exenotepad.exe
    PID 752 wrote to memory of 1524752msdcsc.exenotepad.exe
    PID 752 wrote to memory of 1524752msdcsc.exenotepad.exe
    PID 752 wrote to memory of 1524752msdcsc.exenotepad.exe
    PID 752 wrote to memory of 1524752msdcsc.exenotepad.exe
    PID 752 wrote to memory of 1524752msdcsc.exenotepad.exe
    PID 752 wrote to memory of 1524752msdcsc.exenotepad.exe
  • Views/modifies file attributes
    attrib.exeattrib.exe

    Tags

    TTPs

    Hidden Files and Directories

    Reported IOCs

    pidprocess
    1364attrib.exe
    1240attrib.exe
Processes 15
  • C:\Users\Admin\AppData\Local\Temp\6c6a951636ae4dee7a842c6af1d43236.exe
    "C:\Users\Admin\AppData\Local\Temp\6c6a951636ae4dee7a842c6af1d43236.exe"
    Loads dropped DLL
    Suspicious use of WriteProcessMemory
    PID:1820
    • C:\Users\Admin\AppData\Local\Temp\R-Launcher.exe
      "C:\Users\Admin\AppData\Local\Temp\R-Launcher.exe"
      Executes dropped EXE
      PID:1980
      • C:\Program Files\Internet Explorer\iexplore.exe
        "C:\Program Files\Internet Explorer\iexplore.exe" http://java.com/download
        Modifies Internet Explorer settings
        Suspicious use of FindShellTrayWindow
        Suspicious use of SetWindowsHookEx
        PID:2028
        • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
          "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2028 CREDAT:275457 /prefetch:2
          Modifies Internet Explorer settings
          Suspicious use of SetWindowsHookEx
          PID:1432
    • C:\Users\Admin\AppData\Local\Temp\darknj.exe
      "C:\Users\Admin\AppData\Local\Temp\darknj.exe"
      Modifies WinLogon for persistence
      Executes dropped EXE
      Loads dropped DLL
      Adds Run key to start application
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:1948
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp\darknj.exe" +s +h
        Suspicious use of WriteProcessMemory
        PID:1788
        • C:\Windows\SysWOW64\attrib.exe
          attrib "C:\Users\Admin\AppData\Local\Temp\darknj.exe" +s +h
          Views/modifies file attributes
          PID:1364
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp" +s +h
        Suspicious use of WriteProcessMemory
        PID:1724
        • C:\Windows\SysWOW64\attrib.exe
          attrib "C:\Users\Admin\AppData\Local\Temp" +s +h
          Views/modifies file attributes
          PID:1240
      • C:\Users\Admin\AppData\Local\Temp\NJ.EXE
        "C:\Users\Admin\AppData\Local\Temp\NJ.EXE"
        Executes dropped EXE
        Loads dropped DLL
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        PID:1168
        • C:\Users\Admin\AppData\Roaming\WindowsServices.exe
          "C:\Users\Admin\AppData\Roaming\WindowsServices.exe"
          Executes dropped EXE
          Drops startup file
          Adds Run key to start application
          Suspicious use of AdjustPrivilegeToken
          PID:1860
          • C:\Windows\SysWOW64\netsh.exe
            netsh firewall add allowedprogram "C:\Users\Admin\AppData\Roaming\WindowsServices.exe" "WindowsServices.exe" ENABLE
            PID:320
      • C:\Windows\SysWOW64\notepad.exe
        notepad
        PID:1252
      • C:\ProgramData\Microsoft\Windows\Start Menu\MSDCSC\msdcsc.exe
        "C:\ProgramData\Microsoft\Windows\Start Menu\MSDCSC\msdcsc.exe"
        Executes dropped EXE
        Adds Run key to start application
        Suspicious behavior: GetForegroundWindowSpam
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        PID:752
        • C:\Windows\SysWOW64\notepad.exe
          notepad
          PID:1524
Network
MITRE ATT&CK Matrix
Collection
    Command and Control
      Credential Access
        Execution
          Exfiltration
            Impact
              Initial Access
                Lateral Movement
                  Privilege Escalation
                    Replay Monitor
                    00:00 00:00
                    Downloads
                    • C:\ProgramData\Microsoft\Windows\Start Menu\MSDCSC\msdcsc.exe

                      MD5

                      b0fe10b99dd5f8494e7c71b8fda9239b

                      SHA1

                      e93f7447408e10424ea3f4b3a92473e125d2af6b

                      SHA256

                      121a202b4ff70f91e823c347f13784ec44525a9b0d4940c449e5db442acc6536

                      SHA512

                      6c9fdf8b1d097e454c4530a1660ef67aa1daed8e9eab8045c200b3ab1b89a8df84ef0d68be2a3c5affc30000d610dede7ea2fa7760f78c8a9983ad5d0283e518

                    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

                      MD5

                      2902de11e30dcc620b184e3bb0f0c1cb

                      SHA1

                      5d11d14a2558801a2688dc2d6dfad39ac294f222

                      SHA256

                      e6a7f1f8810e46a736e80ee5ac6187690f28f4d5d35d130d410e20084b2c1544

                      SHA512

                      efd415cde25b827ac2a7ca4d6486ce3a43cdcc1c31d3a94fd7944681aa3e83a4966625bf2e6770581c4b59d05e35ff9318d9adaddade9070f131076892af2fa0

                    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

                      MD5

                      d24ea0e6fc2f548a03bea6b1c10783fc

                      SHA1

                      af4d3e7ba838b336a991756af35683da0ddfda72

                      SHA256

                      a2b73a80fef0a9ce87e87f6f6d19d70ce566bb31d1ffc7872f559abb7b5b4125

                      SHA512

                      2b4e7feea3ea3f5875a15dc3bbfbddb699a29745398dba1f51a23e3a34949f53b5fd0fec2e78538a1b3762ea46f66540ea3f69b723998d4d415e2004668f162e

                    • C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\imagestore\sgyae4t\imagestore.dat

                      MD5

                      f6cd1bcd4e9a0990490d57f1e89b2ce6

                      SHA1

                      48fabaee02577bff18797bcaf08e5a0d4f444a21

                      SHA256

                      28479cd6ee5e85d6d7c81983ece7772f39140941e9ab3c85636f49dd76c97e69

                      SHA512

                      2e78968ff2e8724f90e0d4e538276c0cd28eeb6173f9971a406d515645608e9dd4cd839a44faad857d482f687d321e6f67a9114c0ede9779738f8fde6992071f

                    • C:\Users\Admin\AppData\Local\Temp\NJ.EXE

                      MD5

                      d3b0deb25e223b27361f1024bdbcba0c

                      SHA1

                      8e250d9ea3abf31f589005d9406eb6850a2a02b6

                      SHA256

                      ee68e3f8ce8f704003575076c1b48a29361adb3af5fe858e0e59b5f41c685d8d

                      SHA512

                      d392c1202b14b99418158f75dc1496cb35f079911d8c5922d3b23d8d5a188027dee3650dfa145ff14e8f01e57c01c0f0fda09603f210e1884354e5c621565b7d

                    • C:\Users\Admin\AppData\Local\Temp\NJ.EXE

                      MD5

                      d3b0deb25e223b27361f1024bdbcba0c

                      SHA1

                      8e250d9ea3abf31f589005d9406eb6850a2a02b6

                      SHA256

                      ee68e3f8ce8f704003575076c1b48a29361adb3af5fe858e0e59b5f41c685d8d

                      SHA512

                      d392c1202b14b99418158f75dc1496cb35f079911d8c5922d3b23d8d5a188027dee3650dfa145ff14e8f01e57c01c0f0fda09603f210e1884354e5c621565b7d

                    • C:\Users\Admin\AppData\Local\Temp\R-Launcher.exe

                      MD5

                      f09f583748cb26682f60279b8bba14c8

                      SHA1

                      caf750a85d3abd708c080ebfa995bc2cc0b4cafd

                      SHA256

                      7f5b29de3370f01b63bcdf4fc7939728f2b11428462d0e2ba77a2bb62b7698dc

                      SHA512

                      cf8c278f297e250966ce2302191718dae3e7b09f5f9e2da2efb2bfe87ba87196f69be5c0fe52bf7048230ce616bee76d005a11fa646986fa8b33688d95861ae9

                    • C:\Users\Admin\AppData\Local\Temp\R-Launcher.exe

                      MD5

                      f09f583748cb26682f60279b8bba14c8

                      SHA1

                      caf750a85d3abd708c080ebfa995bc2cc0b4cafd

                      SHA256

                      7f5b29de3370f01b63bcdf4fc7939728f2b11428462d0e2ba77a2bb62b7698dc

                      SHA512

                      cf8c278f297e250966ce2302191718dae3e7b09f5f9e2da2efb2bfe87ba87196f69be5c0fe52bf7048230ce616bee76d005a11fa646986fa8b33688d95861ae9

                    • C:\Users\Admin\AppData\Local\Temp\darknj.exe

                      MD5

                      b0fe10b99dd5f8494e7c71b8fda9239b

                      SHA1

                      e93f7447408e10424ea3f4b3a92473e125d2af6b

                      SHA256

                      121a202b4ff70f91e823c347f13784ec44525a9b0d4940c449e5db442acc6536

                      SHA512

                      6c9fdf8b1d097e454c4530a1660ef67aa1daed8e9eab8045c200b3ab1b89a8df84ef0d68be2a3c5affc30000d610dede7ea2fa7760f78c8a9983ad5d0283e518

                    • C:\Users\Admin\AppData\Local\Temp\darknj.exe

                      MD5

                      b0fe10b99dd5f8494e7c71b8fda9239b

                      SHA1

                      e93f7447408e10424ea3f4b3a92473e125d2af6b

                      SHA256

                      121a202b4ff70f91e823c347f13784ec44525a9b0d4940c449e5db442acc6536

                      SHA512

                      6c9fdf8b1d097e454c4530a1660ef67aa1daed8e9eab8045c200b3ab1b89a8df84ef0d68be2a3c5affc30000d610dede7ea2fa7760f78c8a9983ad5d0283e518

                    • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\MO55EVN6.txt

                      MD5

                      ec84659dd308144c2b8772179cec344c

                      SHA1

                      a97805cf4b8720aa9101f182fb18f582d78f7ac2

                      SHA256

                      90da5fb52e4d4cdb53a451e71d4fb8497f35c8af235402c2fe1df72ae2ca11b4

                      SHA512

                      8ba761bcd0c076f303b3a852e21e5fe755af2f144fa93180536cb72375886187093babb069a6fb8e42f927761761769cf73bf5090cb33af1d863c8f2a580aed3

                    • C:\Users\Admin\AppData\Roaming\WindowsServices.exe

                      MD5

                      d3b0deb25e223b27361f1024bdbcba0c

                      SHA1

                      8e250d9ea3abf31f589005d9406eb6850a2a02b6

                      SHA256

                      ee68e3f8ce8f704003575076c1b48a29361adb3af5fe858e0e59b5f41c685d8d

                      SHA512

                      d392c1202b14b99418158f75dc1496cb35f079911d8c5922d3b23d8d5a188027dee3650dfa145ff14e8f01e57c01c0f0fda09603f210e1884354e5c621565b7d

                    • C:\Users\Admin\AppData\Roaming\WindowsServices.exe

                      MD5

                      d3b0deb25e223b27361f1024bdbcba0c

                      SHA1

                      8e250d9ea3abf31f589005d9406eb6850a2a02b6

                      SHA256

                      ee68e3f8ce8f704003575076c1b48a29361adb3af5fe858e0e59b5f41c685d8d

                      SHA512

                      d392c1202b14b99418158f75dc1496cb35f079911d8c5922d3b23d8d5a188027dee3650dfa145ff14e8f01e57c01c0f0fda09603f210e1884354e5c621565b7d

                    • \ProgramData\Microsoft\Windows\Start Menu\MSDCSC\msdcsc.exe

                      MD5

                      b0fe10b99dd5f8494e7c71b8fda9239b

                      SHA1

                      e93f7447408e10424ea3f4b3a92473e125d2af6b

                      SHA256

                      121a202b4ff70f91e823c347f13784ec44525a9b0d4940c449e5db442acc6536

                      SHA512

                      6c9fdf8b1d097e454c4530a1660ef67aa1daed8e9eab8045c200b3ab1b89a8df84ef0d68be2a3c5affc30000d610dede7ea2fa7760f78c8a9983ad5d0283e518

                    • \ProgramData\Microsoft\Windows\Start Menu\MSDCSC\msdcsc.exe

                      MD5

                      b0fe10b99dd5f8494e7c71b8fda9239b

                      SHA1

                      e93f7447408e10424ea3f4b3a92473e125d2af6b

                      SHA256

                      121a202b4ff70f91e823c347f13784ec44525a9b0d4940c449e5db442acc6536

                      SHA512

                      6c9fdf8b1d097e454c4530a1660ef67aa1daed8e9eab8045c200b3ab1b89a8df84ef0d68be2a3c5affc30000d610dede7ea2fa7760f78c8a9983ad5d0283e518

                    • \Users\Admin\AppData\Local\Temp\NJ.EXE

                      MD5

                      d3b0deb25e223b27361f1024bdbcba0c

                      SHA1

                      8e250d9ea3abf31f589005d9406eb6850a2a02b6

                      SHA256

                      ee68e3f8ce8f704003575076c1b48a29361adb3af5fe858e0e59b5f41c685d8d

                      SHA512

                      d392c1202b14b99418158f75dc1496cb35f079911d8c5922d3b23d8d5a188027dee3650dfa145ff14e8f01e57c01c0f0fda09603f210e1884354e5c621565b7d

                    • \Users\Admin\AppData\Local\Temp\R-Launcher.exe

                      MD5

                      f09f583748cb26682f60279b8bba14c8

                      SHA1

                      caf750a85d3abd708c080ebfa995bc2cc0b4cafd

                      SHA256

                      7f5b29de3370f01b63bcdf4fc7939728f2b11428462d0e2ba77a2bb62b7698dc

                      SHA512

                      cf8c278f297e250966ce2302191718dae3e7b09f5f9e2da2efb2bfe87ba87196f69be5c0fe52bf7048230ce616bee76d005a11fa646986fa8b33688d95861ae9

                    • \Users\Admin\AppData\Local\Temp\R-Launcher.exe

                      MD5

                      f09f583748cb26682f60279b8bba14c8

                      SHA1

                      caf750a85d3abd708c080ebfa995bc2cc0b4cafd

                      SHA256

                      7f5b29de3370f01b63bcdf4fc7939728f2b11428462d0e2ba77a2bb62b7698dc

                      SHA512

                      cf8c278f297e250966ce2302191718dae3e7b09f5f9e2da2efb2bfe87ba87196f69be5c0fe52bf7048230ce616bee76d005a11fa646986fa8b33688d95861ae9

                    • \Users\Admin\AppData\Local\Temp\darknj.exe

                      MD5

                      b0fe10b99dd5f8494e7c71b8fda9239b

                      SHA1

                      e93f7447408e10424ea3f4b3a92473e125d2af6b

                      SHA256

                      121a202b4ff70f91e823c347f13784ec44525a9b0d4940c449e5db442acc6536

                      SHA512

                      6c9fdf8b1d097e454c4530a1660ef67aa1daed8e9eab8045c200b3ab1b89a8df84ef0d68be2a3c5affc30000d610dede7ea2fa7760f78c8a9983ad5d0283e518

                    • \Users\Admin\AppData\Local\Temp\darknj.exe

                      MD5

                      b0fe10b99dd5f8494e7c71b8fda9239b

                      SHA1

                      e93f7447408e10424ea3f4b3a92473e125d2af6b

                      SHA256

                      121a202b4ff70f91e823c347f13784ec44525a9b0d4940c449e5db442acc6536

                      SHA512

                      6c9fdf8b1d097e454c4530a1660ef67aa1daed8e9eab8045c200b3ab1b89a8df84ef0d68be2a3c5affc30000d610dede7ea2fa7760f78c8a9983ad5d0283e518

                    • \Users\Admin\AppData\Roaming\WindowsServices.exe

                      MD5

                      d3b0deb25e223b27361f1024bdbcba0c

                      SHA1

                      8e250d9ea3abf31f589005d9406eb6850a2a02b6

                      SHA256

                      ee68e3f8ce8f704003575076c1b48a29361adb3af5fe858e0e59b5f41c685d8d

                      SHA512

                      d392c1202b14b99418158f75dc1496cb35f079911d8c5922d3b23d8d5a188027dee3650dfa145ff14e8f01e57c01c0f0fda09603f210e1884354e5c621565b7d

                    • memory/320-106-0x0000000000000000-mapping.dmp

                    • memory/752-93-0x0000000000240000-0x0000000000241000-memory.dmp

                    • memory/752-88-0x0000000000000000-mapping.dmp

                    • memory/1168-77-0x0000000000000000-mapping.dmp

                    • memory/1168-84-0x0000000000510000-0x0000000000511000-memory.dmp

                    • memory/1240-78-0x0000000000000000-mapping.dmp

                    • memory/1252-85-0x00000000001D0000-0x00000000001D1000-memory.dmp

                    • memory/1252-82-0x0000000000000000-mapping.dmp

                    • memory/1364-75-0x0000000000000000-mapping.dmp

                    • memory/1432-97-0x0000000000000000-mapping.dmp

                    • memory/1524-94-0x00000000001C0000-0x00000000001C1000-memory.dmp

                    • memory/1524-91-0x0000000000000000-mapping.dmp

                    • memory/1724-74-0x0000000000000000-mapping.dmp

                    • memory/1788-73-0x0000000000000000-mapping.dmp

                    • memory/1820-59-0x0000000075FE1000-0x0000000075FE3000-memory.dmp

                    • memory/1860-100-0x0000000000000000-mapping.dmp

                    • memory/1860-104-0x0000000002120000-0x0000000002121000-memory.dmp

                    • memory/1948-68-0x0000000000000000-mapping.dmp

                    • memory/1948-71-0x0000000000250000-0x0000000000251000-memory.dmp

                    • memory/1980-62-0x0000000000000000-mapping.dmp

                    • memory/2028-96-0x000007FEFBD21000-0x000007FEFBD23000-memory.dmp

                    • memory/2028-95-0x0000000000000000-mapping.dmp