dcrat | fdaa21ae214d6212d81b966051fa320b9b6cea4181f8e8b64776f4bface87e4f

Analysis

max time kernel
147s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
16/12/2023, 02:41

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
a4b6ae4a5718a076483089c71f90aaf9.exe
Size 1.5MB
Sample231216-c6e7hsbef4
SHA256 fdaa21ae214d6212d81b966051fa320b9b6cea4181f8e8b64776f4bface87e4f
MD5 a4b6ae4a5718a076483089c71f90aaf9
SHA1 68605bcaed4de8a26b2c45d4124b9db098cdc0cf
SHA512 219e7365a9c36c019a5d2345e483bb03bde686b0c13b501391ff44ca3bf361eacf21b15f20193db75917c27886eed750f7c52cd10c432ef4c94bf571ad986817
SSDEEP 24576:KZ8oMOMwiZhlVTfkG+3DFk83Hsv17ZEQmNHpFWjOCMGDahtjVV:KZ8oezAprsv1ZROCMGDah5
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

dcrat infostealer persistence rat

Malware Config

Signatures

DcRat 59 IoCs

DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

rat infostealer dcrat

description	ioc	pid	Process
		5084	schtasks.exe
		384	schtasks.exe
		3816	schtasks.exe
		3440	schtasks.exe
		1732	schtasks.exe
		3928	schtasks.exe
		1592	schtasks.exe
		2672	schtasks.exe
		916	schtasks.exe
		952	schtasks.exe
		4364	schtasks.exe
		5104	schtasks.exe
		3964	schtasks.exe
		880	schtasks.exe
File created	C:\Program Files (x86)\Reference Assemblies\Microsoft\csrss.exe		a4b6ae4a5718a076483089c71f90aaf9.exe
		2980	schtasks.exe
		4476	schtasks.exe
		3960	schtasks.exe
		60	schtasks.exe
		3088	schtasks.exe
		4912	schtasks.exe
		4580	schtasks.exe
		2364	schtasks.exe
		2608	schtasks.exe
		2888	schtasks.exe
		1892	schtasks.exe
		3468	schtasks.exe
		4964	schtasks.exe
		4268	schtasks.exe
		4720	schtasks.exe
		4344	schtasks.exe
		2952	schtasks.exe
		1012	schtasks.exe
		3352	schtasks.exe
		404	schtasks.exe
		4620	schtasks.exe
		2224	schtasks.exe
		2788	schtasks.exe
		1888	schtasks.exe
		1832	schtasks.exe
		2912	schtasks.exe
		4988	schtasks.exe
		4812	schtasks.exe
		64	schtasks.exe
		1240	schtasks.exe
		2772	schtasks.exe
		1404	schtasks.exe
		4628	schtasks.exe
		3992	schtasks.exe
		1400	schtasks.exe
File created	C:\Program Files (x86)\Reference Assemblies\Microsoft\886983d96e3d3e		a4b6ae4a5718a076483089c71f90aaf9.exe
		4004	schtasks.exe
		2424	schtasks.exe
		4656	schtasks.exe
		5060	schtasks.exe
		4820	schtasks.exe
		3660	schtasks.exe
		4764	schtasks.exe
		4704	schtasks.exe

Modifies WinLogon for persistence 2 TTPs 19 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\csrss.exe\", \"C:\\Users\\Default\\NetHood\\services.exe\", \"C:\\Users\\All Users\\Documents\\RuntimeBroker.exe\", \"C:\\odt\\fontdrvhost.exe\", \"C:\\Program Files\\Windows Security\\BrowserCore\\en-US\\winlogon.exe\", \"C:\\Windows\\InputMethod\\CHS\\OfficeClickToRun.exe\", \"C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Esl\\smss.exe\", \"C:\\Program Files\\Java\\jdk-1.8\\include\\RuntimeBroker.exe\", \"C:\\odt\\WmiPrvSE.exe\", \"C:\\Program Files\\Internet Explorer\\ja-JP\\TextInputHost.exe\", \"C:\\Windows\\DiagTrack\\Settings\\OfficeClickToRun.exe\""	a4b6ae4a5718a076483089c71f90aaf9.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\csrss.exe\", \"C:\\Users\\Default\\NetHood\\services.exe\", \"C:\\Users\\All Users\\Documents\\RuntimeBroker.exe\", \"C:\\odt\\fontdrvhost.exe\", \"C:\\Program Files\\Windows Security\\BrowserCore\\en-US\\winlogon.exe\", \"C:\\Windows\\InputMethod\\CHS\\OfficeClickToRun.exe\", \"C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Esl\\smss.exe\", \"C:\\Program Files\\Java\\jdk-1.8\\include\\RuntimeBroker.exe\", \"C:\\odt\\WmiPrvSE.exe\", \"C:\\Program Files\\Internet Explorer\\ja-JP\\TextInputHost.exe\", \"C:\\Windows\\DiagTrack\\Settings\\OfficeClickToRun.exe\", \"C:\\odt\\lsass.exe\", \"C:\\Recovery\\WindowsRE\\csrss.exe\""	a4b6ae4a5718a076483089c71f90aaf9.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\csrss.exe\", \"C:\\Users\\Default\\NetHood\\services.exe\", \"C:\\Users\\All Users\\Documents\\RuntimeBroker.exe\", \"C:\\odt\\fontdrvhost.exe\", \"C:\\Program Files\\Windows Security\\BrowserCore\\en-US\\winlogon.exe\", \"C:\\Windows\\InputMethod\\CHS\\OfficeClickToRun.exe\", \"C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Esl\\smss.exe\", \"C:\\Program Files\\Java\\jdk-1.8\\include\\RuntimeBroker.exe\", \"C:\\odt\\WmiPrvSE.exe\", \"C:\\Program Files\\Internet Explorer\\ja-JP\\TextInputHost.exe\", \"C:\\Windows\\DiagTrack\\Settings\\OfficeClickToRun.exe\", \"C:\\odt\\lsass.exe\", \"C:\\Recovery\\WindowsRE\\csrss.exe\", \"C:\\Recovery\\WindowsRE\\backgroundTaskHost.exe\", \"C:\\Program Files (x86)\\Internet Explorer\\ja-JP\\dwm.exe\", \"C:\\Windows\\Speech_OneCore\\Engines\\Lexicon\\en-US\\System.exe\", \"C:\\odt\\sysmon.exe\""	a4b6ae4a5718a076483089c71f90aaf9.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\csrss.exe\", \"C:\\Users\\Default\\NetHood\\services.exe\", \"C:\\Users\\All Users\\Documents\\RuntimeBroker.exe\""	a4b6ae4a5718a076483089c71f90aaf9.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\csrss.exe\", \"C:\\Users\\Default\\NetHood\\services.exe\", \"C:\\Users\\All Users\\Documents\\RuntimeBroker.exe\", \"C:\\odt\\fontdrvhost.exe\""	a4b6ae4a5718a076483089c71f90aaf9.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\csrss.exe\", \"C:\\Users\\Default\\NetHood\\services.exe\", \"C:\\Users\\All Users\\Documents\\RuntimeBroker.exe\", \"C:\\odt\\fontdrvhost.exe\", \"C:\\Program Files\\Windows Security\\BrowserCore\\en-US\\winlogon.exe\""	a4b6ae4a5718a076483089c71f90aaf9.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\csrss.exe\", \"C:\\Users\\Default\\NetHood\\services.exe\", \"C:\\Users\\All Users\\Documents\\RuntimeBroker.exe\", \"C:\\odt\\fontdrvhost.exe\", \"C:\\Program Files\\Windows Security\\BrowserCore\\en-US\\winlogon.exe\", \"C:\\Windows\\InputMethod\\CHS\\OfficeClickToRun.exe\", \"C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Esl\\smss.exe\", \"C:\\Program Files\\Java\\jdk-1.8\\include\\RuntimeBroker.exe\", \"C:\\odt\\WmiPrvSE.exe\", \"C:\\Program Files\\Internet Explorer\\ja-JP\\TextInputHost.exe\""	a4b6ae4a5718a076483089c71f90aaf9.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\csrss.exe\", \"C:\\Users\\Default\\NetHood\\services.exe\""	a4b6ae4a5718a076483089c71f90aaf9.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\csrss.exe\", \"C:\\Users\\Default\\NetHood\\services.exe\", \"C:\\Users\\All Users\\Documents\\RuntimeBroker.exe\", \"C:\\odt\\fontdrvhost.exe\", \"C:\\Program Files\\Windows Security\\BrowserCore\\en-US\\winlogon.exe\", \"C:\\Windows\\InputMethod\\CHS\\OfficeClickToRun.exe\", \"C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Esl\\smss.exe\", \"C:\\Program Files\\Java\\jdk-1.8\\include\\RuntimeBroker.exe\", \"C:\\odt\\WmiPrvSE.exe\""	a4b6ae4a5718a076483089c71f90aaf9.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\csrss.exe\", \"C:\\Users\\Default\\NetHood\\services.exe\", \"C:\\Users\\All Users\\Documents\\RuntimeBroker.exe\", \"C:\\odt\\fontdrvhost.exe\", \"C:\\Program Files\\Windows Security\\BrowserCore\\en-US\\winlogon.exe\", \"C:\\Windows\\InputMethod\\CHS\\OfficeClickToRun.exe\", \"C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Esl\\smss.exe\", \"C:\\Program Files\\Java\\jdk-1.8\\include\\RuntimeBroker.exe\", \"C:\\odt\\WmiPrvSE.exe\", \"C:\\Program Files\\Internet Explorer\\ja-JP\\TextInputHost.exe\", \"C:\\Windows\\DiagTrack\\Settings\\OfficeClickToRun.exe\", \"C:\\odt\\lsass.exe\", \"C:\\Recovery\\WindowsRE\\csrss.exe\", \"C:\\Recovery\\WindowsRE\\backgroundTaskHost.exe\""	a4b6ae4a5718a076483089c71f90aaf9.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\csrss.exe\", \"C:\\Users\\Default\\NetHood\\services.exe\", \"C:\\Users\\All Users\\Documents\\RuntimeBroker.exe\", \"C:\\odt\\fontdrvhost.exe\", \"C:\\Program Files\\Windows Security\\BrowserCore\\en-US\\winlogon.exe\", \"C:\\Windows\\InputMethod\\CHS\\OfficeClickToRun.exe\", \"C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Esl\\smss.exe\", \"C:\\Program Files\\Java\\jdk-1.8\\include\\RuntimeBroker.exe\", \"C:\\odt\\WmiPrvSE.exe\", \"C:\\Program Files\\Internet Explorer\\ja-JP\\TextInputHost.exe\", \"C:\\Windows\\DiagTrack\\Settings\\OfficeClickToRun.exe\", \"C:\\odt\\lsass.exe\", \"C:\\Recovery\\WindowsRE\\csrss.exe\", \"C:\\Recovery\\WindowsRE\\backgroundTaskHost.exe\", \"C:\\Program Files (x86)\\Internet Explorer\\ja-JP\\dwm.exe\""	a4b6ae4a5718a076483089c71f90aaf9.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\csrss.exe\", \"C:\\Users\\Default\\NetHood\\services.exe\", \"C:\\Users\\All Users\\Documents\\RuntimeBroker.exe\", \"C:\\odt\\fontdrvhost.exe\", \"C:\\Program Files\\Windows Security\\BrowserCore\\en-US\\winlogon.exe\", \"C:\\Windows\\InputMethod\\CHS\\OfficeClickToRun.exe\", \"C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Esl\\smss.exe\", \"C:\\Program Files\\Java\\jdk-1.8\\include\\RuntimeBroker.exe\", \"C:\\odt\\WmiPrvSE.exe\", \"C:\\Program Files\\Internet Explorer\\ja-JP\\TextInputHost.exe\", \"C:\\Windows\\DiagTrack\\Settings\\OfficeClickToRun.exe\", \"C:\\odt\\lsass.exe\""	a4b6ae4a5718a076483089c71f90aaf9.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\csrss.exe\", \"C:\\Users\\Default\\NetHood\\services.exe\", \"C:\\Users\\All Users\\Documents\\RuntimeBroker.exe\", \"C:\\odt\\fontdrvhost.exe\", \"C:\\Program Files\\Windows Security\\BrowserCore\\en-US\\winlogon.exe\", \"C:\\Windows\\InputMethod\\CHS\\OfficeClickToRun.exe\", \"C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Esl\\smss.exe\", \"C:\\Program Files\\Java\\jdk-1.8\\include\\RuntimeBroker.exe\", \"C:\\odt\\WmiPrvSE.exe\", \"C:\\Program Files\\Internet Explorer\\ja-JP\\TextInputHost.exe\", \"C:\\Windows\\DiagTrack\\Settings\\OfficeClickToRun.exe\", \"C:\\odt\\lsass.exe\", \"C:\\Recovery\\WindowsRE\\csrss.exe\", \"C:\\Recovery\\WindowsRE\\backgroundTaskHost.exe\", \"C:\\Program Files (x86)\\Internet Explorer\\ja-JP\\dwm.exe\", \"C:\\Windows\\Speech_OneCore\\Engines\\Lexicon\\en-US\\System.exe\""	a4b6ae4a5718a076483089c71f90aaf9.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\csrss.exe\", \"C:\\Users\\Default\\NetHood\\services.exe\", \"C:\\Users\\All Users\\Documents\\RuntimeBroker.exe\", \"C:\\odt\\fontdrvhost.exe\", \"C:\\Program Files\\Windows Security\\BrowserCore\\en-US\\winlogon.exe\", \"C:\\Windows\\InputMethod\\CHS\\OfficeClickToRun.exe\", \"C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Esl\\smss.exe\", \"C:\\Program Files\\Java\\jdk-1.8\\include\\RuntimeBroker.exe\", \"C:\\odt\\WmiPrvSE.exe\", \"C:\\Program Files\\Internet Explorer\\ja-JP\\TextInputHost.exe\", \"C:\\Windows\\DiagTrack\\Settings\\OfficeClickToRun.exe\", \"C:\\odt\\lsass.exe\", \"C:\\Recovery\\WindowsRE\\csrss.exe\", \"C:\\Recovery\\WindowsRE\\backgroundTaskHost.exe\", \"C:\\Program Files (x86)\\Internet Explorer\\ja-JP\\dwm.exe\", \"C:\\Windows\\Speech_OneCore\\Engines\\Lexicon\\en-US\\System.exe\", \"C:\\odt\\sysmon.exe\", \"C:\\odt\\System.exe\""	a4b6ae4a5718a076483089c71f90aaf9.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\csrss.exe\", \"C:\\Users\\Default\\NetHood\\services.exe\", \"C:\\Users\\All Users\\Documents\\RuntimeBroker.exe\", \"C:\\odt\\fontdrvhost.exe\", \"C:\\Program Files\\Windows Security\\BrowserCore\\en-US\\winlogon.exe\", \"C:\\Windows\\InputMethod\\CHS\\OfficeClickToRun.exe\", \"C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Esl\\smss.exe\", \"C:\\Program Files\\Java\\jdk-1.8\\include\\RuntimeBroker.exe\", \"C:\\odt\\WmiPrvSE.exe\", \"C:\\Program Files\\Internet Explorer\\ja-JP\\TextInputHost.exe\", \"C:\\Windows\\DiagTrack\\Settings\\OfficeClickToRun.exe\", \"C:\\odt\\lsass.exe\", \"C:\\Recovery\\WindowsRE\\csrss.exe\", \"C:\\Recovery\\WindowsRE\\backgroundTaskHost.exe\", \"C:\\Program Files (x86)\\Internet Explorer\\ja-JP\\dwm.exe\", \"C:\\Windows\\Speech_OneCore\\Engines\\Lexicon\\en-US\\System.exe\", \"C:\\odt\\sysmon.exe\", \"C:\\odt\\System.exe\", \"C:\\Windows\\Microsoft.NET\\Framework64\\3082\\wininit.exe\""	a4b6ae4a5718a076483089c71f90aaf9.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\csrss.exe\""	a4b6ae4a5718a076483089c71f90aaf9.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\csrss.exe\", \"C:\\Users\\Default\\NetHood\\services.exe\", \"C:\\Users\\All Users\\Documents\\RuntimeBroker.exe\", \"C:\\odt\\fontdrvhost.exe\", \"C:\\Program Files\\Windows Security\\BrowserCore\\en-US\\winlogon.exe\", \"C:\\Windows\\InputMethod\\CHS\\OfficeClickToRun.exe\""	a4b6ae4a5718a076483089c71f90aaf9.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\csrss.exe\", \"C:\\Users\\Default\\NetHood\\services.exe\", \"C:\\Users\\All Users\\Documents\\RuntimeBroker.exe\", \"C:\\odt\\fontdrvhost.exe\", \"C:\\Program Files\\Windows Security\\BrowserCore\\en-US\\winlogon.exe\", \"C:\\Windows\\InputMethod\\CHS\\OfficeClickToRun.exe\", \"C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Esl\\smss.exe\""	a4b6ae4a5718a076483089c71f90aaf9.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\csrss.exe\", \"C:\\Users\\Default\\NetHood\\services.exe\", \"C:\\Users\\All Users\\Documents\\RuntimeBroker.exe\", \"C:\\odt\\fontdrvhost.exe\", \"C:\\Program Files\\Windows Security\\BrowserCore\\en-US\\winlogon.exe\", \"C:\\Windows\\InputMethod\\CHS\\OfficeClickToRun.exe\", \"C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Esl\\smss.exe\", \"C:\\Program Files\\Java\\jdk-1.8\\include\\RuntimeBroker.exe\""	a4b6ae4a5718a076483089c71f90aaf9.exe

Process spawned unexpected child process 57 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5104	2420	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4364	2420	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2608	2420	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2980	2420	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3440	2420	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2772	2420	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4820	2420	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	384	2420	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4720	2420	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4344	2420	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1892	2420	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2424	2420	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1592	2420	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3964	2420	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	404	2420	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5084	2420	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3660	2420	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1400	2420	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2364	2420	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3992	2420	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	880	2420	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2224	2420	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4812	2420	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3816	2420	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4912	2420	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3960	2420	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4620	2420	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3088	2420	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2888	2420	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2788	2420	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2952	2420	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4004	2420	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2672	2420	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	60	2420	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	916	2420	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2912	2420	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4476	2420	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4988	2420	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1404	2420	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1888	2420	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3928	2420	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4628	2420	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	952	2420	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1732	2420	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1832	2420	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4656	2420	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1012	2420	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3352	2420	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3468	2420	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4764	2420	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4580	2420	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5060	2420	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	64	2420	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1240	2420	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4704	2420	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4268	2420	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4964	2420	schtasks.exe	90

DCRat payload 2 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral2/memory/4188-0-0x0000000000B10000-0x0000000000C96000-memory.dmp	dcrat
behavioral2/files/0x000600000002313d-24.dat	dcrat

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\Control Panel\International\Geo\Nation	a4b6ae4a5718a076483089c71f90aaf9.exe

Executes dropped EXE 1 IoCs

pid	Process
3148	TextInputHost.exe

Adds Run key to start application 2 TTPs 38 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\fontdrvhost = "\"C:\\odt\\fontdrvhost.exe\""	a4b6ae4a5718a076483089c71f90aaf9.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\winlogon = "\"C:\\Program Files\\Windows Security\\BrowserCore\\en-US\\winlogon.exe\""	a4b6ae4a5718a076483089c71f90aaf9.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OfficeClickToRun = "\"C:\\Windows\\DiagTrack\\Settings\\OfficeClickToRun.exe\""	a4b6ae4a5718a076483089c71f90aaf9.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Recovery\\WindowsRE\\csrss.exe\""	a4b6ae4a5718a076483089c71f90aaf9.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dwm = "\"C:\\Program Files (x86)\\Internet Explorer\\ja-JP\\dwm.exe\""	a4b6ae4a5718a076483089c71f90aaf9.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\wininit = "\"C:\\Windows\\Microsoft.NET\\Framework64\\3082\\wininit.exe\""	a4b6ae4a5718a076483089c71f90aaf9.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OfficeClickToRun = "\"C:\\Windows\\InputMethod\\CHS\\OfficeClickToRun.exe\""	a4b6ae4a5718a076483089c71f90aaf9.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\smss = "\"C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Esl\\smss.exe\""	a4b6ae4a5718a076483089c71f90aaf9.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WmiPrvSE = "\"C:\\odt\\WmiPrvSE.exe\""	a4b6ae4a5718a076483089c71f90aaf9.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OfficeClickToRun = "\"C:\\Windows\\DiagTrack\\Settings\\OfficeClickToRun.exe\""	a4b6ae4a5718a076483089c71f90aaf9.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Recovery\\WindowsRE\\csrss.exe\""	a4b6ae4a5718a076483089c71f90aaf9.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\System = "\"C:\\odt\\System.exe\""	a4b6ae4a5718a076483089c71f90aaf9.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RuntimeBroker = "\"C:\\Users\\All Users\\Documents\\RuntimeBroker.exe\""	a4b6ae4a5718a076483089c71f90aaf9.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\smss = "\"C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Esl\\smss.exe\""	a4b6ae4a5718a076483089c71f90aaf9.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\backgroundTaskHost = "\"C:\\Recovery\\WindowsRE\\backgroundTaskHost.exe\""	a4b6ae4a5718a076483089c71f90aaf9.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\fontdrvhost = "\"C:\\odt\\fontdrvhost.exe\""	a4b6ae4a5718a076483089c71f90aaf9.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\winlogon = "\"C:\\Program Files\\Windows Security\\BrowserCore\\en-US\\winlogon.exe\""	a4b6ae4a5718a076483089c71f90aaf9.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WmiPrvSE = "\"C:\\odt\\WmiPrvSE.exe\""	a4b6ae4a5718a076483089c71f90aaf9.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\lsass = "\"C:\\odt\\lsass.exe\""	a4b6ae4a5718a076483089c71f90aaf9.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\backgroundTaskHost = "\"C:\\Recovery\\WindowsRE\\backgroundTaskHost.exe\""	a4b6ae4a5718a076483089c71f90aaf9.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dwm = "\"C:\\Program Files (x86)\\Internet Explorer\\ja-JP\\dwm.exe\""	a4b6ae4a5718a076483089c71f90aaf9.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RuntimeBroker = "\"C:\\Users\\All Users\\Documents\\RuntimeBroker.exe\""	a4b6ae4a5718a076483089c71f90aaf9.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\TextInputHost = "\"C:\\Program Files\\Internet Explorer\\ja-JP\\TextInputHost.exe\""	a4b6ae4a5718a076483089c71f90aaf9.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\TextInputHost = "\"C:\\Program Files\\Internet Explorer\\ja-JP\\TextInputHost.exe\""	a4b6ae4a5718a076483089c71f90aaf9.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sysmon = "\"C:\\odt\\sysmon.exe\""	a4b6ae4a5718a076483089c71f90aaf9.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sysmon = "\"C:\\odt\\sysmon.exe\""	a4b6ae4a5718a076483089c71f90aaf9.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\services = "\"C:\\Users\\Default\\NetHood\\services.exe\""	a4b6ae4a5718a076483089c71f90aaf9.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\services = "\"C:\\Users\\Default\\NetHood\\services.exe\""	a4b6ae4a5718a076483089c71f90aaf9.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RuntimeBroker = "\"C:\\Program Files\\Java\\jdk-1.8\\include\\RuntimeBroker.exe\""	a4b6ae4a5718a076483089c71f90aaf9.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RuntimeBroker = "\"C:\\Program Files\\Java\\jdk-1.8\\include\\RuntimeBroker.exe\""	a4b6ae4a5718a076483089c71f90aaf9.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\lsass = "\"C:\\odt\\lsass.exe\""	a4b6ae4a5718a076483089c71f90aaf9.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\System = "\"C:\\Windows\\Speech_OneCore\\Engines\\Lexicon\\en-US\\System.exe\""	a4b6ae4a5718a076483089c71f90aaf9.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\wininit = "\"C:\\Windows\\Microsoft.NET\\Framework64\\3082\\wininit.exe\""	a4b6ae4a5718a076483089c71f90aaf9.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\csrss.exe\""	a4b6ae4a5718a076483089c71f90aaf9.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\csrss.exe\""	a4b6ae4a5718a076483089c71f90aaf9.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OfficeClickToRun = "\"C:\\Windows\\InputMethod\\CHS\\OfficeClickToRun.exe\""	a4b6ae4a5718a076483089c71f90aaf9.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\System = "\"C:\\Windows\\Speech_OneCore\\Engines\\Lexicon\\en-US\\System.exe\""	a4b6ae4a5718a076483089c71f90aaf9.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\System = "\"C:\\odt\\System.exe\""	a4b6ae4a5718a076483089c71f90aaf9.exe

Drops file in Program Files directory 13 IoCs

description	ioc	Process
File created	C:\Program Files\Java\jdk-1.8\include\RuntimeBroker.exe	a4b6ae4a5718a076483089c71f90aaf9.exe
File created	C:\Program Files\Java\jdk-1.8\include\9e8d7a4ca61bd9	a4b6ae4a5718a076483089c71f90aaf9.exe
File created	C:\Program Files (x86)\Internet Explorer\ja-JP\dwm.exe	a4b6ae4a5718a076483089c71f90aaf9.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Esl\smss.exe	a4b6ae4a5718a076483089c71f90aaf9.exe
File created	C:\Program Files\Internet Explorer\ja-JP\TextInputHost.exe	a4b6ae4a5718a076483089c71f90aaf9.exe
File created	C:\Program Files (x86)\Reference Assemblies\Microsoft\886983d96e3d3e	a4b6ae4a5718a076483089c71f90aaf9.exe
File created	C:\Program Files\Windows Security\BrowserCore\en-US\cc11b995f2a76d	a4b6ae4a5718a076483089c71f90aaf9.exe
File created	C:\Program Files (x86)\Internet Explorer\ja-JP\6cb0b6c459d5d3	a4b6ae4a5718a076483089c71f90aaf9.exe
File created	C:\Program Files (x86)\Reference Assemblies\Microsoft\csrss.exe	a4b6ae4a5718a076483089c71f90aaf9.exe
File opened for modification	C:\Program Files (x86)\Reference Assemblies\Microsoft\csrss.exe	a4b6ae4a5718a076483089c71f90aaf9.exe
File created	C:\Program Files\Windows Security\BrowserCore\en-US\winlogon.exe	a4b6ae4a5718a076483089c71f90aaf9.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Esl\69ddcba757bf72	a4b6ae4a5718a076483089c71f90aaf9.exe
File created	C:\Program Files\Internet Explorer\ja-JP\22eafd247d37c3	a4b6ae4a5718a076483089c71f90aaf9.exe

Drops file in Windows directory 8 IoCs

description	ioc	Process
File created	C:\Windows\DiagTrack\Settings\e6c9b481da804f	a4b6ae4a5718a076483089c71f90aaf9.exe
File created	C:\Windows\Speech_OneCore\Engines\Lexicon\en-US\System.exe	a4b6ae4a5718a076483089c71f90aaf9.exe
File created	C:\Windows\Speech_OneCore\Engines\Lexicon\en-US\27d1bcfc3c54e0	a4b6ae4a5718a076483089c71f90aaf9.exe
File created	C:\Windows\Microsoft.NET\Framework64\3082\wininit.exe	a4b6ae4a5718a076483089c71f90aaf9.exe
File created	C:\Windows\Microsoft.NET\Framework64\3082\56085415360792	a4b6ae4a5718a076483089c71f90aaf9.exe
File created	C:\Windows\InputMethod\CHS\OfficeClickToRun.exe	a4b6ae4a5718a076483089c71f90aaf9.exe
File created	C:\Windows\InputMethod\CHS\e6c9b481da804f	a4b6ae4a5718a076483089c71f90aaf9.exe
File created	C:\Windows\DiagTrack\Settings\OfficeClickToRun.exe	a4b6ae4a5718a076483089c71f90aaf9.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 57 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
2424	schtasks.exe
2364	schtasks.exe
952	schtasks.exe
1732	schtasks.exe
4344	schtasks.exe
4704	schtasks.exe
4620	schtasks.exe
3440	schtasks.exe
3088	schtasks.exe
2672	schtasks.exe
4268	schtasks.exe
2980	schtasks.exe
880	schtasks.exe
2888	schtasks.exe
2788	schtasks.exe
2952	schtasks.exe
4476	schtasks.exe
2772	schtasks.exe
1892	schtasks.exe
2608	schtasks.exe
60	schtasks.exe
4988	schtasks.exe
5060	schtasks.exe
3660	schtasks.exe
916	schtasks.exe
1404	schtasks.exe
1832	schtasks.exe
3352	schtasks.exe
3960	schtasks.exe
5104	schtasks.exe
4912	schtasks.exe
4628	schtasks.exe
4656	schtasks.exe
4820	schtasks.exe
1400	schtasks.exe
2224	schtasks.exe
3816	schtasks.exe
3468	schtasks.exe
4580	schtasks.exe
5084	schtasks.exe
2912	schtasks.exe
64	schtasks.exe
1240	schtasks.exe
3964	schtasks.exe
3992	schtasks.exe
384	schtasks.exe
1592	schtasks.exe
4364	schtasks.exe
1012	schtasks.exe
4764	schtasks.exe
3928	schtasks.exe
4964	schtasks.exe
4004	schtasks.exe
404	schtasks.exe
4812	schtasks.exe
1888	schtasks.exe
4720	schtasks.exe

Suspicious behavior: EnumeratesProcesses 27 IoCs

pid	Process
4188	a4b6ae4a5718a076483089c71f90aaf9.exe
4188	a4b6ae4a5718a076483089c71f90aaf9.exe
4188	a4b6ae4a5718a076483089c71f90aaf9.exe
4188	a4b6ae4a5718a076483089c71f90aaf9.exe
4188	a4b6ae4a5718a076483089c71f90aaf9.exe
4188	a4b6ae4a5718a076483089c71f90aaf9.exe
4188	a4b6ae4a5718a076483089c71f90aaf9.exe
4188	a4b6ae4a5718a076483089c71f90aaf9.exe
4188	a4b6ae4a5718a076483089c71f90aaf9.exe
4188	a4b6ae4a5718a076483089c71f90aaf9.exe
4188	a4b6ae4a5718a076483089c71f90aaf9.exe
4188	a4b6ae4a5718a076483089c71f90aaf9.exe
4188	a4b6ae4a5718a076483089c71f90aaf9.exe
4188	a4b6ae4a5718a076483089c71f90aaf9.exe
4188	a4b6ae4a5718a076483089c71f90aaf9.exe
4188	a4b6ae4a5718a076483089c71f90aaf9.exe
4188	a4b6ae4a5718a076483089c71f90aaf9.exe
4188	a4b6ae4a5718a076483089c71f90aaf9.exe
3148	TextInputHost.exe
3148	TextInputHost.exe
3148	TextInputHost.exe
3148	TextInputHost.exe
3148	TextInputHost.exe
3148	TextInputHost.exe
3148	TextInputHost.exe
3148	TextInputHost.exe
3148	TextInputHost.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3148	TextInputHost.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeDebugPrivilege	4188	a4b6ae4a5718a076483089c71f90aaf9.exe
Token: SeDebugPrivilege	3148	TextInputHost.exe
Token: SeBackupPrivilege	4820	vssvc.exe
Token: SeRestorePrivilege	4820	vssvc.exe
Token: SeAuditPrivilege	4820	vssvc.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4188 wrote to memory of 3148	4188	a4b6ae4a5718a076483089c71f90aaf9.exe	148
PID 4188 wrote to memory of 3148	4188	a4b6ae4a5718a076483089c71f90aaf9.exe	148

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\a4b6ae4a5718a076483089c71f90aaf9.exe
"C:\Users\Admin\AppData\Local\Temp\a4b6ae4a5718a076483089c71f90aaf9.exe"
1⤵
- DcRat
- Modifies WinLogon for persistence
- Checks computer location settings
- Adds Run key to start application
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4188
- C:\Program Files\Internet Explorer\ja-JP\TextInputHost.exe
  "C:\Program Files\Internet Explorer\ja-JP\TextInputHost.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of AdjustPrivilegeToken
  PID:3148

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 13 /tr "'C:\Program Files (x86)\Reference Assemblies\Microsoft\csrss.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:5104

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Program Files (x86)\Reference Assemblies\Microsoft\csrss.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4364

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 10 /tr "'C:\Program Files (x86)\Reference Assemblies\Microsoft\csrss.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2608

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 5 /tr "'C:\Users\Default\NetHood\services.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2980

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "services" /sc ONLOGON /tr "'C:\Users\Default\NetHood\services.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3440

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 10 /tr "'C:\Users\Default\NetHood\services.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2772

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 7 /tr "'C:\Users\All Users\Documents\RuntimeBroker.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4820

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Users\All Users\Documents\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:384

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 11 /tr "'C:\Users\All Users\Documents\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4720

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 6 /tr "'C:\odt\fontdrvhost.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4344

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\odt\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1892

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 11 /tr "'C:\odt\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2424

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 5 /tr "'C:\Program Files\Windows Security\BrowserCore\en-US\winlogon.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1592

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogon" /sc ONLOGON /tr "'C:\Program Files\Windows Security\BrowserCore\en-US\winlogon.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3964

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 14 /tr "'C:\Program Files\Windows Security\BrowserCore\en-US\winlogon.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:404

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OfficeClickToRunO" /sc MINUTE /mo 12 /tr "'C:\Windows\InputMethod\CHS\OfficeClickToRun.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:5084

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OfficeClickToRun" /sc ONLOGON /tr "'C:\Windows\InputMethod\CHS\OfficeClickToRun.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3660

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OfficeClickToRunO" /sc MINUTE /mo 8 /tr "'C:\Windows\InputMethod\CHS\OfficeClickToRun.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1400

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 10 /tr "'C:\Program Files (x86)\Adobe\Acrobat Reader DC\Esl\smss.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2364

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smss" /sc ONLOGON /tr "'C:\Program Files (x86)\Adobe\Acrobat Reader DC\Esl\smss.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3992

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 7 /tr "'C:\Program Files (x86)\Adobe\Acrobat Reader DC\Esl\smss.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:880

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 5 /tr "'C:\Program Files\Java\jdk-1.8\include\RuntimeBroker.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2224

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Program Files\Java\jdk-1.8\include\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4812

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 7 /tr "'C:\Program Files\Java\jdk-1.8\include\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3816

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 8 /tr "'C:\odt\WmiPrvSE.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4912

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSE" /sc ONLOGON /tr "'C:\odt\WmiPrvSE.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3960

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 11 /tr "'C:\odt\WmiPrvSE.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4620

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "TextInputHostT" /sc MINUTE /mo 11 /tr "'C:\Program Files\Internet Explorer\ja-JP\TextInputHost.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3088

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "TextInputHost" /sc ONLOGON /tr "'C:\Program Files\Internet Explorer\ja-JP\TextInputHost.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2888

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "TextInputHostT" /sc MINUTE /mo 7 /tr "'C:\Program Files\Internet Explorer\ja-JP\TextInputHost.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2788

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OfficeClickToRunO" /sc MINUTE /mo 7 /tr "'C:\Windows\DiagTrack\Settings\OfficeClickToRun.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2952

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OfficeClickToRun" /sc ONLOGON /tr "'C:\Windows\DiagTrack\Settings\OfficeClickToRun.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4004

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OfficeClickToRunO" /sc MINUTE /mo 9 /tr "'C:\Windows\DiagTrack\Settings\OfficeClickToRun.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2672

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 9 /tr "'C:\odt\lsass.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:60

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsass" /sc ONLOGON /tr "'C:\odt\lsass.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:916

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 14 /tr "'C:\odt\lsass.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2912

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 13 /tr "'C:\Recovery\WindowsRE\csrss.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4476

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\csrss.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4988

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 8 /tr "'C:\Recovery\WindowsRE\csrss.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1404

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "backgroundTaskHostb" /sc MINUTE /mo 13 /tr "'C:\Recovery\WindowsRE\backgroundTaskHost.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1888

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "backgroundTaskHost" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\backgroundTaskHost.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3928

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "backgroundTaskHostb" /sc MINUTE /mo 12 /tr "'C:\Recovery\WindowsRE\backgroundTaskHost.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4628

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 8 /tr "'C:\Program Files (x86)\Internet Explorer\ja-JP\dwm.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:952

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwm" /sc ONLOGON /tr "'C:\Program Files (x86)\Internet Explorer\ja-JP\dwm.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1732

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 8 /tr "'C:\Program Files (x86)\Internet Explorer\ja-JP\dwm.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1832

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 11 /tr "'C:\Windows\Speech_OneCore\Engines\Lexicon\en-US\System.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4656

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "System" /sc ONLOGON /tr "'C:\Windows\Speech_OneCore\Engines\Lexicon\en-US\System.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1012

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 10 /tr "'C:\Windows\Speech_OneCore\Engines\Lexicon\en-US\System.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3352

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sysmons" /sc MINUTE /mo 11 /tr "'C:\odt\sysmon.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3468

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sysmon" /sc ONLOGON /tr "'C:\odt\sysmon.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4764

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sysmons" /sc MINUTE /mo 12 /tr "'C:\odt\sysmon.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4580

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 5 /tr "'C:\odt\System.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:5060

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "System" /sc ONLOGON /tr "'C:\odt\System.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:64

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 10 /tr "'C:\odt\System.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1240

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 13 /tr "'C:\Windows\Microsoft.NET\Framework64\3082\wininit.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4704

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininit" /sc ONLOGON /tr "'C:\Windows\Microsoft.NET\Framework64\3082\wininit.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4268

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 7 /tr "'C:\Windows\Microsoft.NET\Framework64\3082\wininit.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4964

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4820

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Scheduled Task/Job

T1053

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Scheduled Task/Job

T1053

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

winlogon.exe

Path C:\Program Files\Windows Security\BrowserCore\en-US\winlogon.exe
Size 1.5MB
SHA256 fdaa21ae214d6212d81b966051fa320b9b6cea4181f8e8b64776f4bface87e4f
MD5 a4b6ae4a5718a076483089c71f90aaf9
SHA1 68605bcaed4de8a26b2c45d4124b9db098cdc0cf
SHA512 219e7365a9c36c019a5d2345e483bb03bde686b0c13b501391ff44ca3bf361eacf21b15f20193db75917c27886eed750f7c52cd10c432ef4c94bf571ad986817
SSDEEP 24576:KZ8oMOMwiZhlVTfkG+3DFk83Hsv17ZEQmNHpFWjOCMGDahtjVV:KZ8oezAprsv1ZROCMGDah5
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/3148-70-0x0000000002390000-0x00000000023A0000-memory.dmp

Download

memory/3148-69-0x00007FF997820000-0x00007FF9982E1000-memory.dmp

Download

memory/3148-68-0x000000001AF30000-0x000000001AF42000-memory.dmp

Download

memory/3148-67-0x0000000002390000-0x00000000023A0000-memory.dmp

Download

memory/3148-65-0x00007FF997820000-0x00007FF9982E1000-memory.dmp

Download

memory/4188-10-0x000000001C720000-0x000000001CC48000-memory.dmp

Download

memory/4188-15-0x000000001BAD0000-0x000000001BADC000-memory.dmp

Download

memory/4188-8-0x0000000002E00000-0x0000000002E0C000-memory.dmp

Download

memory/4188-9-0x0000000002E10000-0x0000000002E22000-memory.dmp

Download

memory/4188-0-0x0000000000B10000-0x0000000000C96000-memory.dmp

Download

memory/4188-12-0x000000001B990000-0x000000001B998000-memory.dmp

Download

memory/4188-11-0x000000001B980000-0x000000001B98E000-memory.dmp

Download

memory/4188-14-0x000000001B9B0000-0x000000001B9BA000-memory.dmp

Download

memory/4188-13-0x000000001B9A0000-0x000000001B9A8000-memory.dmp

Download

memory/4188-7-0x0000000002DE0000-0x0000000002DF6000-memory.dmp

Download

memory/4188-5-0x0000000002E20000-0x0000000002E70000-memory.dmp

Download

memory/4188-6-0x0000000002DD0000-0x0000000002DD8000-memory.dmp

Download

memory/4188-66-0x00007FF997820000-0x00007FF9982E1000-memory.dmp

Download

memory/4188-4-0x0000000002DB0000-0x0000000002DCC000-memory.dmp

Download

memory/4188-3-0x0000000002DA0000-0x0000000002DAE000-memory.dmp

Download

memory/4188-2-0x000000001BB90000-0x000000001BBA0000-memory.dmp

Download

memory/4188-1-0x00007FF997820000-0x00007FF9982E1000-memory.dmp

Download