dcrat | bf35292b701b24b6a18aa29f6dd6c651d8a50b24098440fc90b8423ca732ee06

Analysis

max time kernel
122s
max time network
133s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
13-10-2023 20:26

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

NEAS.66c158147321a1ee377aaca871f67c10.exe
Size

783KB
MD5

66c158147321a1ee377aaca871f67c10
SHA1

e7d81492b40cf90d611538d4e9982919873ddb58
SHA256

bf35292b701b24b6a18aa29f6dd6c651d8a50b24098440fc90b8423ca732ee06
SHA512

23fd4833c37bc4d7fa2e5b58966431ab826540f7d1f2aa4f8a148fda666f5d1cf9624c6821528ab203012bf52cf77b1cd0c2de89bf2c8d2f0ef4ad64dbd351f4
SSDEEP

12288:GqnOYxdAgpoNeF91rg5iFdr0yQ9gYx+EIpakCYJRU7Q9bWoFzqK:G+OQbpbgsFdAyQvzSqaq8q

Score

10^/10

dcrat evasion infostealer persistence rat trojan

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat

Process spawned unexpected child process 9 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2600	2728	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2764	2728	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3008	2728	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2796	2728	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2732	2728	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2548	2728	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2744	2728	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2472	2728	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1680	2728	schtasks.exe	30

UAC bypass 3 TTPs 6 IoCs

evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	NEAS.66c158147321a1ee377aaca871f67c10.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	WMIADAP.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	WMIADAP.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	WMIADAP.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	NEAS.66c158147321a1ee377aaca871f67c10.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	NEAS.66c158147321a1ee377aaca871f67c10.exe

DCRat payload 7 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral1/memory/3056-1-0x0000000000BC0000-0x0000000000C8A000-memory.dmp	dcrat
behavioral1/memory/3056-2-0x000000001B1D0000-0x000000001B250000-memory.dmp	dcrat
behavioral1/files/0x0006000000016e61-35.dat	dcrat
behavioral1/files/0x0006000000016e61-129.dat	dcrat
behavioral1/files/0x0006000000016e61-130.dat	dcrat
behavioral1/memory/2580-131-0x0000000000F70000-0x000000000103A000-memory.dmp	dcrat
behavioral1/memory/2580-133-0x000000001AEC0000-0x000000001AF40000-memory.dmp	dcrat

Executes dropped EXE 1 IoCs

pid	Process
2580	WMIADAP.exe

Adds Run key to start application 2 TTPs 9 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\lsm = "\"C:\\Documents and Settings\\lsm.exe\""	NEAS.66c158147321a1ee377aaca871f67c10.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sppsvc = "\"C:\\Windows\\System32\\mfmjpegdec\\sppsvc.exe\""	NEAS.66c158147321a1ee377aaca871f67c10.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Program Files\\Java\\jre7\\bin\\server\\csrss.exe\""	NEAS.66c158147321a1ee377aaca871f67c10.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\taskhost = "\"C:\\Windows\\System32\\objsel\\taskhost.exe\""	NEAS.66c158147321a1ee377aaca871f67c10.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\explorer = "\"C:\\Documents and Settings\\explorer.exe\""	NEAS.66c158147321a1ee377aaca871f67c10.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\smss = "\"C:\\Windows\\System32\\idndl\\smss.exe\""	NEAS.66c158147321a1ee377aaca871f67c10.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\NEAS.66c158147321a1ee377aaca871f67c10 = "\"C:\\Program Files (x86)\\Microsoft SQL Server Compact Edition\\v3.5\\Desktop\\NEAS.66c158147321a1ee377aaca871f67c10.exe\""	NEAS.66c158147321a1ee377aaca871f67c10.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\System32\\CHxReadingStringIME\\csrss.exe\""	NEAS.66c158147321a1ee377aaca871f67c10.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WMIADAP = "\"C:\\MSOCache\\All Users\\{90140000-00A1-0409-0000-0000000FF1CE}-C\\WMIADAP.exe\""	NEAS.66c158147321a1ee377aaca871f67c10.exe

Checks whether UAC is enabled 1 TTPs 4 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	NEAS.66c158147321a1ee377aaca871f67c10.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	NEAS.66c158147321a1ee377aaca871f67c10.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	WMIADAP.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	WMIADAP.exe

Drops file in System32 directory 16 IoCs

description	ioc	Process
File created	C:\Windows\System32\CHxReadingStringIME\csrss.exe	NEAS.66c158147321a1ee377aaca871f67c10.exe
File created	C:\Windows\System32\CHxReadingStringIME\886983d96e3d3e31032c679b2d4ea91b6c05afef	NEAS.66c158147321a1ee377aaca871f67c10.exe
File opened for modification	C:\Windows\System32\mfmjpegdec\RCX4956.tmp	NEAS.66c158147321a1ee377aaca871f67c10.exe
File created	C:\Windows\System32\idndl\69ddcba757bf72f7d36c464c71f42baab150b2b9	NEAS.66c158147321a1ee377aaca871f67c10.exe
File created	C:\Windows\System32\mfmjpegdec\0a1fd5f707cd16ea89afd3d6db52b2da58214a6c	NEAS.66c158147321a1ee377aaca871f67c10.exe
File created	C:\Windows\System32\objsel\b75386f1303e64d8139363b71e44ac16341adf4e	NEAS.66c158147321a1ee377aaca871f67c10.exe
File opened for modification	C:\Windows\System32\CHxReadingStringIME\RCX44D1.tmp	NEAS.66c158147321a1ee377aaca871f67c10.exe
File opened for modification	C:\Windows\System32\CHxReadingStringIME\csrss.exe	NEAS.66c158147321a1ee377aaca871f67c10.exe
File opened for modification	C:\Windows\System32\objsel\RCX4F50.tmp	NEAS.66c158147321a1ee377aaca871f67c10.exe
File created	C:\Windows\System32\mfmjpegdec\sppsvc.exe	NEAS.66c158147321a1ee377aaca871f67c10.exe
File created	C:\Windows\System32\objsel\taskhost.exe	NEAS.66c158147321a1ee377aaca871f67c10.exe
File opened for modification	C:\Windows\System32\idndl\smss.exe	NEAS.66c158147321a1ee377aaca871f67c10.exe
File opened for modification	C:\Windows\System32\mfmjpegdec\sppsvc.exe	NEAS.66c158147321a1ee377aaca871f67c10.exe
File created	C:\Windows\System32\idndl\smss.exe	NEAS.66c158147321a1ee377aaca871f67c10.exe
File opened for modification	C:\Windows\System32\idndl\RCX404D.tmp	NEAS.66c158147321a1ee377aaca871f67c10.exe
File opened for modification	C:\Windows\System32\objsel\taskhost.exe	NEAS.66c158147321a1ee377aaca871f67c10.exe

Drops file in Program Files directory 8 IoCs

description	ioc	Process
File created	C:\Program Files\Java\jre7\bin\server\886983d96e3d3e31032c679b2d4ea91b6c05afef	NEAS.66c158147321a1ee377aaca871f67c10.exe
File opened for modification	C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\Desktop\RCX42BE.tmp	NEAS.66c158147321a1ee377aaca871f67c10.exe
File opened for modification	C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\Desktop\NEAS.66c158147321a1ee377aaca871f67c10.exe	NEAS.66c158147321a1ee377aaca871f67c10.exe
File opened for modification	C:\Program Files\Java\jre7\bin\server\RCX4BC7.tmp	NEAS.66c158147321a1ee377aaca871f67c10.exe
File opened for modification	C:\Program Files\Java\jre7\bin\server\csrss.exe	NEAS.66c158147321a1ee377aaca871f67c10.exe
File created	C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\Desktop\NEAS.66c158147321a1ee377aaca871f67c10.exe	NEAS.66c158147321a1ee377aaca871f67c10.exe
File created	C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\Desktop\efd9b3bce1d0bba7aa3bb465b9330e0bcf0aa161	NEAS.66c158147321a1ee377aaca871f67c10.exe
File created	C:\Program Files\Java\jre7\bin\server\csrss.exe	NEAS.66c158147321a1ee377aaca871f67c10.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 9 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
3008	schtasks.exe
2796	schtasks.exe
2548	schtasks.exe
2472	schtasks.exe
2764	schtasks.exe
2732	schtasks.exe
2744	schtasks.exe
1680	schtasks.exe
2600	schtasks.exe

Modifies system certificate store 2 TTPs 6 IoCs

evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DAC9024F54D8F6DF94935FB1732638CA6AD77C13	WMIADAP.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DAC9024F54D8F6DF94935FB1732638CA6AD77C13\Blob = 0f00000001000000140000005bcaa1c2780f0bcb5a90770451d96f38963f012d0b000000010000001e000000440053005400200052006f006f0074002000430041002000580033000000090000000100000016000000301406082b0601050507030406082b06010505070301140000000100000014000000c4a7b1a47b2c71fadbe14b9075ffc415608589101d00000001000000100000004558d512eecb27464920897de7b66053030000000100000014000000dac9024f54d8f6df94935fb1732638ca6ad77c1320000000010000004e0300003082034a30820232a003020102021044afb080d6a327ba893039862ef8406b300d06092a864886f70d0101050500303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f74204341205833301e170d3030303933303231313231395a170d3231303933303134303131355a303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f7420434120583330820122300d06092a864886f70d01010105000382010f003082010a0282010100dfafe99750088357b4cc6265f69082ecc7d32c6b30ca5becd9c37dc740c118148be0e83376492ae33f214993ac4e0eaf3e48cb65eefcd3210f65d22ad9328f8ce5f777b0127bb595c089a3a9baed732e7a0c063283a27e8a1430cd11a0e12a38b9790a31fd50bd8065dfb7516383c8e28861ea4b6181ec526bb9a2e24b1a289f48a39e0cda098e3e172e1edd20df5bc62a8aab2ebd70adc50b1a25907472c57b6aab34d63089ffe568137b540bc8d6aeec5a9c921e3d64b38cc6dfbfc94170ec1672d526ec38553943d0fcfd185c40f197ebd59a9b8d1dbada25b9c6d8dfc115023aabda6ef13e2ef55c089c3cd68369e4109b192ab62957e3e53d9b9ff0025d0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e04160414c4a7b1a47b2c71fadbe14b9075ffc41560858910300d06092a864886f70d01010505000382010100a31a2c9b17005ca91eee2866373abf83c73f4bc309a095205de3d95944d23e0d3ebd8a4ba0741fce10829c741a1d7e981addcb134bb32044e491e9ccfc7da5db6ae5fee6fde04eddb7003ab57049aff2e5eb02f1d1028b19cb943a5e48c4181e58195f1e025af00cf1b1ada9dc59868b6ee991f586cafab96633aa595bcee2a7167347cb2bcc99b03748cfe3564bf5cf0f0c723287c6f044bb53726d43f526489a5267b758abfe67767178db0da256141339243185a2a8025a3047e1dd5007bc02099000eb6463609b16bc88c912e6d27d918bf93d328d65b4e97cb15776eac5b62839bf15651cc8f677966a0a8d770bd8910b048e07db29b60aee9d82353510	WMIADAP.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DAC9024F54D8F6DF94935FB1732638CA6AD77C13\Blob = 1900000001000000100000006cf252fec3e8f20996de5d4dd9aef424030000000100000014000000dac9024f54d8f6df94935fb1732638ca6ad77c131d00000001000000100000004558d512eecb27464920897de7b66053140000000100000014000000c4a7b1a47b2c71fadbe14b9075ffc41560858910090000000100000016000000301406082b0601050507030406082b060105050703010b000000010000001e000000440053005400200052006f006f00740020004300410020005800330000000f00000001000000140000005bcaa1c2780f0bcb5a90770451d96f38963f012d20000000010000004e0300003082034a30820232a003020102021044afb080d6a327ba893039862ef8406b300d06092a864886f70d0101050500303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f74204341205833301e170d3030303933303231313231395a170d3231303933303134303131355a303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f7420434120583330820122300d06092a864886f70d01010105000382010f003082010a0282010100dfafe99750088357b4cc6265f69082ecc7d32c6b30ca5becd9c37dc740c118148be0e83376492ae33f214993ac4e0eaf3e48cb65eefcd3210f65d22ad9328f8ce5f777b0127bb595c089a3a9baed732e7a0c063283a27e8a1430cd11a0e12a38b9790a31fd50bd8065dfb7516383c8e28861ea4b6181ec526bb9a2e24b1a289f48a39e0cda098e3e172e1edd20df5bc62a8aab2ebd70adc50b1a25907472c57b6aab34d63089ffe568137b540bc8d6aeec5a9c921e3d64b38cc6dfbfc94170ec1672d526ec38553943d0fcfd185c40f197ebd59a9b8d1dbada25b9c6d8dfc115023aabda6ef13e2ef55c089c3cd68369e4109b192ab62957e3e53d9b9ff0025d0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e04160414c4a7b1a47b2c71fadbe14b9075ffc41560858910300d06092a864886f70d01010505000382010100a31a2c9b17005ca91eee2866373abf83c73f4bc309a095205de3d95944d23e0d3ebd8a4ba0741fce10829c741a1d7e981addcb134bb32044e491e9ccfc7da5db6ae5fee6fde04eddb7003ab57049aff2e5eb02f1d1028b19cb943a5e48c4181e58195f1e025af00cf1b1ada9dc59868b6ee991f586cafab96633aa595bcee2a7167347cb2bcc99b03748cfe3564bf5cf0f0c723287c6f044bb53726d43f526489a5267b758abfe67767178db0da256141339243185a2a8025a3047e1dd5007bc02099000eb6463609b16bc88c912e6d27d918bf93d328d65b4e97cb15776eac5b62839bf15651cc8f677966a0a8d770bd8910b048e07db29b60aee9d82353510	WMIADAP.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DAC9024F54D8F6DF94935FB1732638CA6AD77C13\Blob = 040000000100000010000000410352dc0ff7501b16f0028eba6f45c50f00000001000000140000005bcaa1c2780f0bcb5a90770451d96f38963f012d0b000000010000001e000000440053005400200052006f006f0074002000430041002000580033000000090000000100000016000000301406082b0601050507030406082b06010505070301140000000100000014000000c4a7b1a47b2c71fadbe14b9075ffc415608589101d00000001000000100000004558d512eecb27464920897de7b66053030000000100000014000000dac9024f54d8f6df94935fb1732638ca6ad77c131900000001000000100000006cf252fec3e8f20996de5d4dd9aef42420000000010000004e0300003082034a30820232a003020102021044afb080d6a327ba893039862ef8406b300d06092a864886f70d0101050500303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f74204341205833301e170d3030303933303231313231395a170d3231303933303134303131355a303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f7420434120583330820122300d06092a864886f70d01010105000382010f003082010a0282010100dfafe99750088357b4cc6265f69082ecc7d32c6b30ca5becd9c37dc740c118148be0e83376492ae33f214993ac4e0eaf3e48cb65eefcd3210f65d22ad9328f8ce5f777b0127bb595c089a3a9baed732e7a0c063283a27e8a1430cd11a0e12a38b9790a31fd50bd8065dfb7516383c8e28861ea4b6181ec526bb9a2e24b1a289f48a39e0cda098e3e172e1edd20df5bc62a8aab2ebd70adc50b1a25907472c57b6aab34d63089ffe568137b540bc8d6aeec5a9c921e3d64b38cc6dfbfc94170ec1672d526ec38553943d0fcfd185c40f197ebd59a9b8d1dbada25b9c6d8dfc115023aabda6ef13e2ef55c089c3cd68369e4109b192ab62957e3e53d9b9ff0025d0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e04160414c4a7b1a47b2c71fadbe14b9075ffc41560858910300d06092a864886f70d01010505000382010100a31a2c9b17005ca91eee2866373abf83c73f4bc309a095205de3d95944d23e0d3ebd8a4ba0741fce10829c741a1d7e981addcb134bb32044e491e9ccfc7da5db6ae5fee6fde04eddb7003ab57049aff2e5eb02f1d1028b19cb943a5e48c4181e58195f1e025af00cf1b1ada9dc59868b6ee991f586cafab96633aa595bcee2a7167347cb2bcc99b03748cfe3564bf5cf0f0c723287c6f044bb53726d43f526489a5267b758abfe67767178db0da256141339243185a2a8025a3047e1dd5007bc02099000eb6463609b16bc88c912e6d27d918bf93d328d65b4e97cb15776eac5b62839bf15651cc8f677966a0a8d770bd8910b048e07db29b60aee9d82353510	WMIADAP.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8	WMIADAP.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 0400000001000000100000000cd2f9e0da1773e9ed864da5e370e74e14000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e80f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f631900000001000000100000002fe1f70bb05d7c92335bc5e05b984da620000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827	WMIADAP.exe

Suspicious behavior: EnumeratesProcesses 41 IoCs

pid	Process
3056	NEAS.66c158147321a1ee377aaca871f67c10.exe
3056	NEAS.66c158147321a1ee377aaca871f67c10.exe
3056	NEAS.66c158147321a1ee377aaca871f67c10.exe
3056	NEAS.66c158147321a1ee377aaca871f67c10.exe
3056	NEAS.66c158147321a1ee377aaca871f67c10.exe
3056	NEAS.66c158147321a1ee377aaca871f67c10.exe
3056	NEAS.66c158147321a1ee377aaca871f67c10.exe
3056	NEAS.66c158147321a1ee377aaca871f67c10.exe
3056	NEAS.66c158147321a1ee377aaca871f67c10.exe
3056	NEAS.66c158147321a1ee377aaca871f67c10.exe
3056	NEAS.66c158147321a1ee377aaca871f67c10.exe
3056	NEAS.66c158147321a1ee377aaca871f67c10.exe
3056	NEAS.66c158147321a1ee377aaca871f67c10.exe
3056	NEAS.66c158147321a1ee377aaca871f67c10.exe
3056	NEAS.66c158147321a1ee377aaca871f67c10.exe
3056	NEAS.66c158147321a1ee377aaca871f67c10.exe
3056	NEAS.66c158147321a1ee377aaca871f67c10.exe
3056	NEAS.66c158147321a1ee377aaca871f67c10.exe
3056	NEAS.66c158147321a1ee377aaca871f67c10.exe
3056	NEAS.66c158147321a1ee377aaca871f67c10.exe
3056	NEAS.66c158147321a1ee377aaca871f67c10.exe
3056	NEAS.66c158147321a1ee377aaca871f67c10.exe
3056	NEAS.66c158147321a1ee377aaca871f67c10.exe
3056	NEAS.66c158147321a1ee377aaca871f67c10.exe
3056	NEAS.66c158147321a1ee377aaca871f67c10.exe
3056	NEAS.66c158147321a1ee377aaca871f67c10.exe
2580	WMIADAP.exe
2580	WMIADAP.exe
2580	WMIADAP.exe
2580	WMIADAP.exe
2580	WMIADAP.exe
2580	WMIADAP.exe
2580	WMIADAP.exe
2580	WMIADAP.exe
2580	WMIADAP.exe
2580	WMIADAP.exe
2580	WMIADAP.exe
2580	WMIADAP.exe
2580	WMIADAP.exe
2580	WMIADAP.exe
2580	WMIADAP.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	3056	NEAS.66c158147321a1ee377aaca871f67c10.exe
Token: SeDebugPrivilege	2580	WMIADAP.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 3056 wrote to memory of 2960	3056	NEAS.66c158147321a1ee377aaca871f67c10.exe	40
PID 3056 wrote to memory of 2960	3056	NEAS.66c158147321a1ee377aaca871f67c10.exe	40
PID 3056 wrote to memory of 2960	3056	NEAS.66c158147321a1ee377aaca871f67c10.exe	40
PID 2960 wrote to memory of 1344	2960	cmd.exe	42
PID 2960 wrote to memory of 1344	2960	cmd.exe	42
PID 2960 wrote to memory of 1344	2960	cmd.exe	42
PID 2960 wrote to memory of 2580	2960	cmd.exe	43
PID 2960 wrote to memory of 2580	2960	cmd.exe	43
PID 2960 wrote to memory of 2580	2960	cmd.exe	43

System policy modification 1 TTPs 6 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	WMIADAP.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	NEAS.66c158147321a1ee377aaca871f67c10.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	NEAS.66c158147321a1ee377aaca871f67c10.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	NEAS.66c158147321a1ee377aaca871f67c10.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	WMIADAP.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	WMIADAP.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\NEAS.66c158147321a1ee377aaca871f67c10.exe
"C:\Users\Admin\AppData\Local\Temp\NEAS.66c158147321a1ee377aaca871f67c10.exe"
1⤵
- UAC bypass
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:3056
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\KNWZ7r49sR.bat"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2960
- - C:\Windows\system32\w32tm.exe
    w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
    3⤵
    PID:1344
- - C:\MSOCache\All Users\{90140000-00A1-0409-0000-0000000FF1CE}-C\WMIADAP.exe
    "C:\MSOCache\All Users\{90140000-00A1-0409-0000-0000000FF1CE}-C\WMIADAP.exe"
    3⤵
    - UAC bypass
    - Executes dropped EXE
    - Checks whether UAC is enabled
    - Modifies system certificate store
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - System policy modification
    PID:2580

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsm" /sc ONLOGON /tr "'C:\Documents and Settings\lsm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2600

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smss" /sc ONLOGON /tr "'C:\Windows\System32\idndl\smss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2764

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "NEAS.66c158147321a1ee377aaca871f67c10" /sc ONLOGON /tr "'C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\Desktop\NEAS.66c158147321a1ee377aaca871f67c10.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3008

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Windows\System32\CHxReadingStringIME\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2796

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WMIADAP" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-00A1-0409-0000-0000000FF1CE}-C\WMIADAP.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2732

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvc" /sc ONLOGON /tr "'C:\Windows\System32\mfmjpegdec\sppsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2548

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Program Files\Java\jre7\bin\server\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2744

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhost" /sc ONLOGON /tr "'C:\Windows\System32\objsel\taskhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2472

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorer" /sc ONLOGON /tr "'C:\Documents and Settings\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1680

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\MSOCache\All Users\{90140000-00A1-0409-0000-0000000FF1CE}-C\WMIADAP.exe

Filesize
783KB

MD5
66c158147321a1ee377aaca871f67c10

SHA1
e7d81492b40cf90d611538d4e9982919873ddb58

SHA256
bf35292b701b24b6a18aa29f6dd6c651d8a50b24098440fc90b8423ca732ee06

SHA512
23fd4833c37bc4d7fa2e5b58966431ab826540f7d1f2aa4f8a148fda666f5d1cf9624c6821528ab203012bf52cf77b1cd0c2de89bf2c8d2f0ef4ad64dbd351f4

Download Submit
C:\MSOCache\All Users\{90140000-00A1-0409-0000-0000000FF1CE}-C\WMIADAP.exe

Filesize
783KB

MD5
66c158147321a1ee377aaca871f67c10

SHA1
e7d81492b40cf90d611538d4e9982919873ddb58

SHA256
bf35292b701b24b6a18aa29f6dd6c651d8a50b24098440fc90b8423ca732ee06

SHA512
23fd4833c37bc4d7fa2e5b58966431ab826540f7d1f2aa4f8a148fda666f5d1cf9624c6821528ab203012bf52cf77b1cd0c2de89bf2c8d2f0ef4ad64dbd351f4

Download Submit
C:\MSOCache\All Users\{90140000-00A1-0409-0000-0000000FF1CE}-C\WMIADAP.exe

Filesize
783KB

MD5
66c158147321a1ee377aaca871f67c10

SHA1
e7d81492b40cf90d611538d4e9982919873ddb58

SHA256
bf35292b701b24b6a18aa29f6dd6c651d8a50b24098440fc90b8423ca732ee06

SHA512
23fd4833c37bc4d7fa2e5b58966431ab826540f7d1f2aa4f8a148fda666f5d1cf9624c6821528ab203012bf52cf77b1cd0c2de89bf2c8d2f0ef4ad64dbd351f4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8929da1c6691bb6a0655dbb44c6a05d9

SHA1
906073220ef23a1912bf21c0a5a83db91ac1f619

SHA256
fb855994f006c4726fc06decd04914f924fdf08cf7382b26ff2fa2db2462518d

SHA512
d335d2ae7242c713ea110673033b2cbf08251f39d4708b8142191ac734d632fa7ee7adce1378980d73b258cc4af34e3267d0658305964d459f00c9d61bfd8d07

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab8539.tmp

Filesize
61KB

MD5
f3441b8572aae8801c04f3060b550443

SHA1
4ef0a35436125d6821831ef36c28ffaf196cda15

SHA256
6720349e7d82ee0a8e73920d3c2b7cb2912d9fcf2edb6fd98f2f12820158b0bf

SHA512
5ba01ba421b50030e380ae6bbcd2f681f2a91947fe7fedb3c8e6b5f24dce9517abf57b1cf26cc6078d4bb53bde6fcfb2561591337c841f8f2cb121a3d71661b9

Download Submit
C:\Users\Admin\AppData\Local\Temp\KNWZ7r49sR.bat

Filesize
238B

MD5
7cdfef68961eaf264356a37f683f7caa

SHA1
9313be0b1b861a792c1e1032b5f33cdd67c76cce

SHA256
9abe02b287d3c1059a218009f344ce27aab17a119ccdd37d88b750c2be19e5d4

SHA512
5f717d18c836c1aa4d967d23cd6927882699c2c5a3b044247a22c850dc7f27b71d73c60d40378960f3a77b5b38bf1b98d6c100d982050dda1b824de09a23076d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar85C8.tmp

Filesize
163KB

MD5
9441737383d21192400eca82fda910ec

SHA1
725e0d606a4fc9ba44aa8ffde65bed15e65367e4

SHA256
bc3a6e84e41faeb57e7c21aa3b60c2a64777107009727c5b7c0ed8fe658909e5

SHA512
7608dd653a66cd364392a78d4711b48d1707768d36996e4d38871c6843b5714e1d7da4b4cc6db969e6000cfa182bcb74216ef6823d1063f036fc5c3413fb8dcf

Download Submit
memory/2580-139-0x000000001AEC0000-0x000000001AF40000-memory.dmp

Filesize
512KB

Download
memory/2580-135-0x000000001AEC0000-0x000000001AF40000-memory.dmp

Filesize
512KB

Download
memory/2580-140-0x000000001AEC0000-0x000000001AF40000-memory.dmp

Filesize
512KB

Download
memory/2580-169-0x000000001AEC0000-0x000000001AF40000-memory.dmp

Filesize
512KB

Download
memory/2580-138-0x000007FEF5580000-0x000007FEF5F6C000-memory.dmp

Filesize
9.9MB

Download
memory/2580-137-0x000000001AEC0000-0x000000001AF40000-memory.dmp

Filesize
512KB

Download
memory/2580-136-0x000000001AEC0000-0x000000001AF40000-memory.dmp

Filesize
512KB

Download
memory/2580-168-0x000000001AEC0000-0x000000001AF40000-memory.dmp

Filesize
512KB

Download
memory/2580-134-0x000000001AEC0000-0x000000001AF40000-memory.dmp

Filesize
512KB

Download
memory/2580-133-0x000000001AEC0000-0x000000001AF40000-memory.dmp

Filesize
512KB

Download
memory/2580-132-0x000007FEF5580000-0x000007FEF5F6C000-memory.dmp

Filesize
9.9MB

Download
memory/2580-131-0x0000000000F70000-0x000000000103A000-memory.dmp

Filesize
808KB

Download
memory/2580-204-0x000000001AEC0000-0x000000001AF40000-memory.dmp

Filesize
512KB

Download
memory/2580-205-0x000000001AEC0000-0x000000001AF40000-memory.dmp

Filesize
512KB

Download
memory/2580-224-0x000007FEF5580000-0x000007FEF5F6C000-memory.dmp

Filesize
9.9MB

Download
memory/3056-17-0x0000000000200000-0x0000000000208000-memory.dmp

Filesize
32KB

Download
memory/3056-127-0x000000001B1D0000-0x000000001B250000-memory.dmp

Filesize
512KB

Download
memory/3056-24-0x0000000000440000-0x0000000000448000-memory.dmp

Filesize
32KB

Download
memory/3056-27-0x000000001B1D0000-0x000000001B250000-memory.dmp

Filesize
512KB

Download
memory/3056-34-0x000000001B1D0000-0x000000001B250000-memory.dmp

Filesize
512KB

Download
memory/3056-22-0x00000000021C0000-0x00000000021CC000-memory.dmp

Filesize
48KB

Download
memory/3056-39-0x000000001B1D0000-0x000000001B250000-memory.dmp

Filesize
512KB

Download
memory/3056-40-0x000000001B1D0000-0x000000001B250000-memory.dmp

Filesize
512KB

Download
memory/3056-47-0x000000001B1D0000-0x000000001B250000-memory.dmp

Filesize
512KB

Download
memory/3056-57-0x000000001B1D0000-0x000000001B250000-memory.dmp

Filesize
512KB

Download
memory/3056-64-0x000000001B1D0000-0x000000001B250000-memory.dmp

Filesize
512KB

Download
memory/3056-65-0x000000001B1D0000-0x000000001B250000-memory.dmp

Filesize
512KB

Download
memory/3056-73-0x000000001B1D0000-0x000000001B250000-memory.dmp

Filesize
512KB

Download
memory/3056-87-0x000000001B1D0000-0x000000001B250000-memory.dmp

Filesize
512KB

Download
memory/3056-88-0x000000001B1D0000-0x000000001B250000-memory.dmp

Filesize
512KB

Download
memory/3056-89-0x000000001B1D0000-0x000000001B250000-memory.dmp

Filesize
512KB

Download
memory/3056-99-0x000000001B1D0000-0x000000001B250000-memory.dmp

Filesize
512KB

Download
memory/3056-110-0x000000001B1D0000-0x000000001B250000-memory.dmp

Filesize
512KB

Download
memory/3056-111-0x000000001B1D0000-0x000000001B250000-memory.dmp

Filesize
512KB

Download
memory/3056-118-0x000000001B1D0000-0x000000001B250000-memory.dmp

Filesize
512KB

Download
memory/3056-119-0x000000001B1D0000-0x000000001B250000-memory.dmp

Filesize
512KB

Download
memory/3056-20-0x0000000000BB0000-0x0000000000BB8000-memory.dmp

Filesize
32KB

Download
memory/3056-126-0x000000001B1D0000-0x000000001B250000-memory.dmp

Filesize
512KB

Download
memory/3056-23-0x000000001B1D0000-0x000000001B250000-memory.dmp

Filesize
512KB

Download
memory/3056-128-0x000007FEF5F70000-0x000007FEF695C000-memory.dmp

Filesize
9.9MB

Download
memory/3056-21-0x00000000021A0000-0x00000000021A8000-memory.dmp

Filesize
32KB

Download
memory/3056-16-0x0000000000420000-0x0000000000428000-memory.dmp

Filesize
32KB

Download
memory/3056-19-0x0000000000B90000-0x0000000000B98000-memory.dmp

Filesize
32KB

Download
memory/3056-18-0x0000000000410000-0x0000000000418000-memory.dmp

Filesize
32KB

Download
memory/3056-0-0x000007FEF5F70000-0x000007FEF695C000-memory.dmp

Filesize
9.9MB

Download
memory/3056-15-0x0000000000430000-0x0000000000438000-memory.dmp

Filesize
32KB

Download
memory/3056-14-0x0000000000B80000-0x0000000000B88000-memory.dmp

Filesize
32KB

Download
memory/3056-13-0x00000000001E0000-0x00000000001E8000-memory.dmp

Filesize
32KB

Download
memory/3056-12-0x00000000001F0000-0x00000000001F8000-memory.dmp

Filesize
32KB

Download
memory/3056-9-0x00000000001B0000-0x00000000001BA000-memory.dmp

Filesize
40KB

Download
memory/3056-10-0x00000000001A0000-0x00000000001AA000-memory.dmp

Filesize
40KB

Download
memory/3056-11-0x00000000001C0000-0x00000000001C8000-memory.dmp

Filesize
32KB

Download
memory/3056-8-0x00000000001D0000-0x00000000001DC000-memory.dmp

Filesize
48KB

Download
memory/3056-7-0x0000000000190000-0x0000000000198000-memory.dmp

Filesize
32KB

Download
memory/3056-5-0x0000000000160000-0x0000000000168000-memory.dmp

Filesize
32KB

Download
memory/3056-6-0x0000000000180000-0x0000000000190000-memory.dmp

Filesize
64KB

Download
memory/3056-4-0x0000000000150000-0x0000000000158000-memory.dmp

Filesize
32KB

Download
memory/3056-3-0x000007FEF5F70000-0x000007FEF695C000-memory.dmp

Filesize
9.9MB

Download
memory/3056-2-0x000000001B1D0000-0x000000001B250000-memory.dmp

Filesize
512KB

Download
memory/3056-1-0x0000000000BC0000-0x0000000000C8A000-memory.dmp

Filesize
808KB

Download