dcrat | 3b99c63e4974eae49eba3ac380fc4c75ba6a4e38cd381a00cc32cee95e7596ad

Analysis

max time kernel
150s
max time network
143s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
22-04-2024 21:03

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3b99c63e4974eae49eba3ac380fc4c75ba6a4e38cd381a00cc32cee95e7596ad.exe
Size

3.2MB
MD5

7ec98ffb225893aeee999179ca43380a
SHA1

d9ad6d24e771b5c2ebc4b4a70534329abfffe871
SHA256

3b99c63e4974eae49eba3ac380fc4c75ba6a4e38cd381a00cc32cee95e7596ad
SHA512

9b8e4d9123b1b1686fc88e17e02aa3d05b998ad21f9314cd15b2da8751906bc04c2f749e279d04f3a1a5b40074ed89b33bae749b8e0546f7e665b32ce6dbca05
SSDEEP

49152:nC0Fl8v/911bwaEYpdYUVsk3DZGAy55kBsfJGAW6KyWUcPmWQpE:nC0Fl8v/qXYrv5tG9uKJGAWl5N

Score

10^/10

dcrat evasion infostealer rat trojan

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat

Process spawned unexpected child process 12 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

Processes:

schtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exe

description	pid	pid_target	process
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2612	2472	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2464	2472	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	548	2472	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2564	2472	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2496	2472	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2904	2472	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2684	2472	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2764	2472	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2912	2472	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1300	2472	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1600	2472	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1964	2472	schtasks.exe

UAC bypass 3 TTPs 12 IoCs

evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Processes:

3b99c63e4974eae49eba3ac380fc4c75ba6a4e38cd381a00cc32cee95e7596ad.exeaudiodg.exeaudiodg.exeaudiodg.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	3b99c63e4974eae49eba3ac380fc4c75ba6a4e38cd381a00cc32cee95e7596ad.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	3b99c63e4974eae49eba3ac380fc4c75ba6a4e38cd381a00cc32cee95e7596ad.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	audiodg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	audiodg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	audiodg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	audiodg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	audiodg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	3b99c63e4974eae49eba3ac380fc4c75ba6a4e38cd381a00cc32cee95e7596ad.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	audiodg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	audiodg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	audiodg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	audiodg.exe

DCRat payload 4 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

Processes:

resource	yara_rule
behavioral1/memory/2868-0-0x0000000001270000-0x00000000015AC000-memory.dmp	dcrat
C:\Users\Admin\AppData\Local\Temp\RCX1D9F.tmp	dcrat
C:\Program Files (x86)\Windows Defender\audiodg.exe	dcrat
C:\Users\Default\dllhost.exe	dcrat

Detects executables packed with SmartAssembly 8 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2868-8-0x0000000000660000-0x0000000000670000-memory.dmp	INDICATOR_EXE_Packed_SmartAssembly
behavioral1/memory/2868-12-0x00000000006A0000-0x00000000006AA000-memory.dmp	INDICATOR_EXE_Packed_SmartAssembly
behavioral1/memory/2868-19-0x0000000000C30000-0x0000000000C3C000-memory.dmp	INDICATOR_EXE_Packed_SmartAssembly
behavioral1/memory/2868-20-0x0000000000C40000-0x0000000000C4C000-memory.dmp	INDICATOR_EXE_Packed_SmartAssembly
behavioral1/memory/2868-22-0x0000000000C60000-0x0000000000C6C000-memory.dmp	INDICATOR_EXE_Packed_SmartAssembly
behavioral1/memory/2868-24-0x0000000000C70000-0x0000000000C7A000-memory.dmp	INDICATOR_EXE_Packed_SmartAssembly
behavioral1/memory/2868-28-0x0000000001240000-0x000000000124C000-memory.dmp	INDICATOR_EXE_Packed_SmartAssembly
behavioral1/memory/2868-31-0x0000000001260000-0x000000000126A000-memory.dmp	INDICATOR_EXE_Packed_SmartAssembly

Executes dropped EXE 3 IoCs

Processes:

audiodg.exeaudiodg.exeaudiodg.exe

pid process

2020 audiodg.exe
1120 audiodg.exe
1560 audiodg.exe

pid	process
2020	audiodg.exe
1120	audiodg.exe
1560	audiodg.exe

Checks whether UAC is enabled 1 TTPs 8 IoCs

evasion trojan

System Information Discovery

T1082

Processes:

audiodg.exeaudiodg.exeaudiodg.exe3b99c63e4974eae49eba3ac380fc4c75ba6a4e38cd381a00cc32cee95e7596ad.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	audiodg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	audiodg.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	audiodg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	audiodg.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	audiodg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	audiodg.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	3b99c63e4974eae49eba3ac380fc4c75ba6a4e38cd381a00cc32cee95e7596ad.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	3b99c63e4974eae49eba3ac380fc4c75ba6a4e38cd381a00cc32cee95e7596ad.exe

Drops file in Program Files directory 10 IoCs

Processes:

3b99c63e4974eae49eba3ac380fc4c75ba6a4e38cd381a00cc32cee95e7596ad.exe

description	ioc	process
File opened for modification	C:\Program Files (x86)\Windows Defender\RCX2021.tmp	3b99c63e4974eae49eba3ac380fc4c75ba6a4e38cd381a00cc32cee95e7596ad.exe
File opened for modification	C:\Program Files\Java\jre7\lib\RCX2709.tmp	3b99c63e4974eae49eba3ac380fc4c75ba6a4e38cd381a00cc32cee95e7596ad.exe
File created	C:\Program Files (x86)\Windows Defender\audiodg.exe	3b99c63e4974eae49eba3ac380fc4c75ba6a4e38cd381a00cc32cee95e7596ad.exe
File created	C:\Program Files (x86)\Windows Defender\42af1c969fbb7b	3b99c63e4974eae49eba3ac380fc4c75ba6a4e38cd381a00cc32cee95e7596ad.exe
File created	C:\Program Files\Java\jre7\lib\explorer.exe	3b99c63e4974eae49eba3ac380fc4c75ba6a4e38cd381a00cc32cee95e7596ad.exe
File created	C:\Program Files\Java\jre7\lib\7a0fd90576e088	3b99c63e4974eae49eba3ac380fc4c75ba6a4e38cd381a00cc32cee95e7596ad.exe
File opened for modification	C:\Program Files (x86)\Windows Defender\RCX1FB3.tmp	3b99c63e4974eae49eba3ac380fc4c75ba6a4e38cd381a00cc32cee95e7596ad.exe
File opened for modification	C:\Program Files (x86)\Windows Defender\audiodg.exe	3b99c63e4974eae49eba3ac380fc4c75ba6a4e38cd381a00cc32cee95e7596ad.exe
File opened for modification	C:\Program Files\Java\jre7\lib\RCX270A.tmp	3b99c63e4974eae49eba3ac380fc4c75ba6a4e38cd381a00cc32cee95e7596ad.exe
File opened for modification	C:\Program Files\Java\jre7\lib\explorer.exe	3b99c63e4974eae49eba3ac380fc4c75ba6a4e38cd381a00cc32cee95e7596ad.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 12 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

Processes:

schtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exe

pid	process
2684	schtasks.exe
2912	schtasks.exe
1964	schtasks.exe
2496	schtasks.exe
2904	schtasks.exe
2764	schtasks.exe
1300	schtasks.exe
2612	schtasks.exe
2464	schtasks.exe
548	schtasks.exe
2564	schtasks.exe
1600	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

3b99c63e4974eae49eba3ac380fc4c75ba6a4e38cd381a00cc32cee95e7596ad.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exeaudiodg.exe

pid	process
2868	3b99c63e4974eae49eba3ac380fc4c75ba6a4e38cd381a00cc32cee95e7596ad.exe
2868	3b99c63e4974eae49eba3ac380fc4c75ba6a4e38cd381a00cc32cee95e7596ad.exe
2868	3b99c63e4974eae49eba3ac380fc4c75ba6a4e38cd381a00cc32cee95e7596ad.exe
2868	3b99c63e4974eae49eba3ac380fc4c75ba6a4e38cd381a00cc32cee95e7596ad.exe
2868	3b99c63e4974eae49eba3ac380fc4c75ba6a4e38cd381a00cc32cee95e7596ad.exe
2868	3b99c63e4974eae49eba3ac380fc4c75ba6a4e38cd381a00cc32cee95e7596ad.exe
2868	3b99c63e4974eae49eba3ac380fc4c75ba6a4e38cd381a00cc32cee95e7596ad.exe
2868	3b99c63e4974eae49eba3ac380fc4c75ba6a4e38cd381a00cc32cee95e7596ad.exe
2868	3b99c63e4974eae49eba3ac380fc4c75ba6a4e38cd381a00cc32cee95e7596ad.exe
2868	3b99c63e4974eae49eba3ac380fc4c75ba6a4e38cd381a00cc32cee95e7596ad.exe
2868	3b99c63e4974eae49eba3ac380fc4c75ba6a4e38cd381a00cc32cee95e7596ad.exe
2868	3b99c63e4974eae49eba3ac380fc4c75ba6a4e38cd381a00cc32cee95e7596ad.exe
2868	3b99c63e4974eae49eba3ac380fc4c75ba6a4e38cd381a00cc32cee95e7596ad.exe
2868	3b99c63e4974eae49eba3ac380fc4c75ba6a4e38cd381a00cc32cee95e7596ad.exe
2868	3b99c63e4974eae49eba3ac380fc4c75ba6a4e38cd381a00cc32cee95e7596ad.exe
2868	3b99c63e4974eae49eba3ac380fc4c75ba6a4e38cd381a00cc32cee95e7596ad.exe
2280	powershell.exe
1200	powershell.exe
1920	powershell.exe
880	powershell.exe
2980	powershell.exe
2036	powershell.exe
2308	powershell.exe
2028	powershell.exe
1292	powershell.exe
2284	powershell.exe
1252	powershell.exe
2068	powershell.exe
2020	audiodg.exe
2020	audiodg.exe
2020	audiodg.exe
2020	audiodg.exe
2020	audiodg.exe
2020	audiodg.exe
2020	audiodg.exe
2020	audiodg.exe
2020	audiodg.exe
2020	audiodg.exe
2020	audiodg.exe
2020	audiodg.exe
2020	audiodg.exe
2020	audiodg.exe
2020	audiodg.exe
2020	audiodg.exe
2020	audiodg.exe
2020	audiodg.exe
2020	audiodg.exe
2020	audiodg.exe
2020	audiodg.exe
2020	audiodg.exe
2020	audiodg.exe
2020	audiodg.exe
2020	audiodg.exe
2020	audiodg.exe
2020	audiodg.exe
2020	audiodg.exe
2020	audiodg.exe
2020	audiodg.exe
2020	audiodg.exe
2020	audiodg.exe
2020	audiodg.exe
2020	audiodg.exe
2020	audiodg.exe
2020	audiodg.exe

Suspicious use of AdjustPrivilegeToken 16 IoCs

Processes:

description	pid	process
Token: SeDebugPrivilege	2868	3b99c63e4974eae49eba3ac380fc4c75ba6a4e38cd381a00cc32cee95e7596ad.exe
Token: SeDebugPrivilege	2280	powershell.exe
Token: SeDebugPrivilege	1200	powershell.exe
Token: SeDebugPrivilege	1920	powershell.exe
Token: SeDebugPrivilege	880	powershell.exe
Token: SeDebugPrivilege	2980	powershell.exe
Token: SeDebugPrivilege	2036	powershell.exe
Token: SeDebugPrivilege	2308	powershell.exe
Token: SeDebugPrivilege	2028	powershell.exe
Token: SeDebugPrivilege	1292	powershell.exe
Token: SeDebugPrivilege	2284	powershell.exe
Token: SeDebugPrivilege	1252	powershell.exe
Token: SeDebugPrivilege	2068	powershell.exe
Token: SeDebugPrivilege	2020	audiodg.exe
Token: SeDebugPrivilege	1120	audiodg.exe
Token: SeDebugPrivilege	1560	audiodg.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

3b99c63e4974eae49eba3ac380fc4c75ba6a4e38cd381a00cc32cee95e7596ad.execmd.exeaudiodg.exeWScript.exeaudiodg.exeWScript.exeaudiodg.exe

description	pid	process	target process
PID 2868 wrote to memory of 1200	2868	3b99c63e4974eae49eba3ac380fc4c75ba6a4e38cd381a00cc32cee95e7596ad.exe	powershell.exe
PID 2868 wrote to memory of 1200	2868	3b99c63e4974eae49eba3ac380fc4c75ba6a4e38cd381a00cc32cee95e7596ad.exe	powershell.exe
PID 2868 wrote to memory of 1200	2868	3b99c63e4974eae49eba3ac380fc4c75ba6a4e38cd381a00cc32cee95e7596ad.exe	powershell.exe
PID 2868 wrote to memory of 880	2868	3b99c63e4974eae49eba3ac380fc4c75ba6a4e38cd381a00cc32cee95e7596ad.exe	powershell.exe
PID 2868 wrote to memory of 880	2868	3b99c63e4974eae49eba3ac380fc4c75ba6a4e38cd381a00cc32cee95e7596ad.exe	powershell.exe
PID 2868 wrote to memory of 880	2868	3b99c63e4974eae49eba3ac380fc4c75ba6a4e38cd381a00cc32cee95e7596ad.exe	powershell.exe
PID 2868 wrote to memory of 1252	2868	3b99c63e4974eae49eba3ac380fc4c75ba6a4e38cd381a00cc32cee95e7596ad.exe	powershell.exe
PID 2868 wrote to memory of 1252	2868	3b99c63e4974eae49eba3ac380fc4c75ba6a4e38cd381a00cc32cee95e7596ad.exe	powershell.exe
PID 2868 wrote to memory of 1252	2868	3b99c63e4974eae49eba3ac380fc4c75ba6a4e38cd381a00cc32cee95e7596ad.exe	powershell.exe
PID 2868 wrote to memory of 2308	2868	3b99c63e4974eae49eba3ac380fc4c75ba6a4e38cd381a00cc32cee95e7596ad.exe	powershell.exe
PID 2868 wrote to memory of 2308	2868	3b99c63e4974eae49eba3ac380fc4c75ba6a4e38cd381a00cc32cee95e7596ad.exe	powershell.exe
PID 2868 wrote to memory of 2308	2868	3b99c63e4974eae49eba3ac380fc4c75ba6a4e38cd381a00cc32cee95e7596ad.exe	powershell.exe
PID 2868 wrote to memory of 2028	2868	3b99c63e4974eae49eba3ac380fc4c75ba6a4e38cd381a00cc32cee95e7596ad.exe	powershell.exe
PID 2868 wrote to memory of 2028	2868	3b99c63e4974eae49eba3ac380fc4c75ba6a4e38cd381a00cc32cee95e7596ad.exe	powershell.exe
PID 2868 wrote to memory of 2028	2868	3b99c63e4974eae49eba3ac380fc4c75ba6a4e38cd381a00cc32cee95e7596ad.exe	powershell.exe
PID 2868 wrote to memory of 1292	2868	3b99c63e4974eae49eba3ac380fc4c75ba6a4e38cd381a00cc32cee95e7596ad.exe	powershell.exe
PID 2868 wrote to memory of 1292	2868	3b99c63e4974eae49eba3ac380fc4c75ba6a4e38cd381a00cc32cee95e7596ad.exe	powershell.exe
PID 2868 wrote to memory of 1292	2868	3b99c63e4974eae49eba3ac380fc4c75ba6a4e38cd381a00cc32cee95e7596ad.exe	powershell.exe
PID 2868 wrote to memory of 2280	2868	3b99c63e4974eae49eba3ac380fc4c75ba6a4e38cd381a00cc32cee95e7596ad.exe	powershell.exe
PID 2868 wrote to memory of 2280	2868	3b99c63e4974eae49eba3ac380fc4c75ba6a4e38cd381a00cc32cee95e7596ad.exe	powershell.exe
PID 2868 wrote to memory of 2280	2868	3b99c63e4974eae49eba3ac380fc4c75ba6a4e38cd381a00cc32cee95e7596ad.exe	powershell.exe
PID 2868 wrote to memory of 2036	2868	3b99c63e4974eae49eba3ac380fc4c75ba6a4e38cd381a00cc32cee95e7596ad.exe	powershell.exe
PID 2868 wrote to memory of 2036	2868	3b99c63e4974eae49eba3ac380fc4c75ba6a4e38cd381a00cc32cee95e7596ad.exe	powershell.exe
PID 2868 wrote to memory of 2036	2868	3b99c63e4974eae49eba3ac380fc4c75ba6a4e38cd381a00cc32cee95e7596ad.exe	powershell.exe
PID 2868 wrote to memory of 2284	2868	3b99c63e4974eae49eba3ac380fc4c75ba6a4e38cd381a00cc32cee95e7596ad.exe	powershell.exe
PID 2868 wrote to memory of 2284	2868	3b99c63e4974eae49eba3ac380fc4c75ba6a4e38cd381a00cc32cee95e7596ad.exe	powershell.exe
PID 2868 wrote to memory of 2284	2868	3b99c63e4974eae49eba3ac380fc4c75ba6a4e38cd381a00cc32cee95e7596ad.exe	powershell.exe
PID 2868 wrote to memory of 2068	2868	3b99c63e4974eae49eba3ac380fc4c75ba6a4e38cd381a00cc32cee95e7596ad.exe	powershell.exe
PID 2868 wrote to memory of 2068	2868	3b99c63e4974eae49eba3ac380fc4c75ba6a4e38cd381a00cc32cee95e7596ad.exe	powershell.exe
PID 2868 wrote to memory of 2068	2868	3b99c63e4974eae49eba3ac380fc4c75ba6a4e38cd381a00cc32cee95e7596ad.exe	powershell.exe
PID 2868 wrote to memory of 1920	2868	3b99c63e4974eae49eba3ac380fc4c75ba6a4e38cd381a00cc32cee95e7596ad.exe	powershell.exe
PID 2868 wrote to memory of 1920	2868	3b99c63e4974eae49eba3ac380fc4c75ba6a4e38cd381a00cc32cee95e7596ad.exe	powershell.exe
PID 2868 wrote to memory of 1920	2868	3b99c63e4974eae49eba3ac380fc4c75ba6a4e38cd381a00cc32cee95e7596ad.exe	powershell.exe
PID 2868 wrote to memory of 2980	2868	3b99c63e4974eae49eba3ac380fc4c75ba6a4e38cd381a00cc32cee95e7596ad.exe	powershell.exe
PID 2868 wrote to memory of 2980	2868	3b99c63e4974eae49eba3ac380fc4c75ba6a4e38cd381a00cc32cee95e7596ad.exe	powershell.exe
PID 2868 wrote to memory of 2980	2868	3b99c63e4974eae49eba3ac380fc4c75ba6a4e38cd381a00cc32cee95e7596ad.exe	powershell.exe
PID 2868 wrote to memory of 1868	2868	3b99c63e4974eae49eba3ac380fc4c75ba6a4e38cd381a00cc32cee95e7596ad.exe	cmd.exe
PID 2868 wrote to memory of 1868	2868	3b99c63e4974eae49eba3ac380fc4c75ba6a4e38cd381a00cc32cee95e7596ad.exe	cmd.exe
PID 2868 wrote to memory of 1868	2868	3b99c63e4974eae49eba3ac380fc4c75ba6a4e38cd381a00cc32cee95e7596ad.exe	cmd.exe
PID 1868 wrote to memory of 2700	1868	cmd.exe	w32tm.exe
PID 1868 wrote to memory of 2700	1868	cmd.exe	w32tm.exe
PID 1868 wrote to memory of 2700	1868	cmd.exe	w32tm.exe
PID 1868 wrote to memory of 2020	1868	cmd.exe	audiodg.exe
PID 1868 wrote to memory of 2020	1868	cmd.exe	audiodg.exe
PID 1868 wrote to memory of 2020	1868	cmd.exe	audiodg.exe
PID 2020 wrote to memory of 596	2020	audiodg.exe	WScript.exe
PID 2020 wrote to memory of 596	2020	audiodg.exe	WScript.exe
PID 2020 wrote to memory of 596	2020	audiodg.exe	WScript.exe
PID 2020 wrote to memory of 624	2020	audiodg.exe	WScript.exe
PID 2020 wrote to memory of 624	2020	audiodg.exe	WScript.exe
PID 2020 wrote to memory of 624	2020	audiodg.exe	WScript.exe
PID 596 wrote to memory of 1120	596	WScript.exe	audiodg.exe
PID 596 wrote to memory of 1120	596	WScript.exe	audiodg.exe
PID 596 wrote to memory of 1120	596	WScript.exe	audiodg.exe
PID 1120 wrote to memory of 1808	1120	audiodg.exe	WScript.exe
PID 1120 wrote to memory of 1808	1120	audiodg.exe	WScript.exe
PID 1120 wrote to memory of 1808	1120	audiodg.exe	WScript.exe
PID 1120 wrote to memory of 948	1120	audiodg.exe	WScript.exe
PID 1120 wrote to memory of 948	1120	audiodg.exe	WScript.exe
PID 1120 wrote to memory of 948	1120	audiodg.exe	WScript.exe
PID 1808 wrote to memory of 1560	1808	WScript.exe	audiodg.exe
PID 1808 wrote to memory of 1560	1808	WScript.exe	audiodg.exe
PID 1808 wrote to memory of 1560	1808	WScript.exe	audiodg.exe
PID 1560 wrote to memory of 2704	1560	audiodg.exe	WScript.exe

System policy modification 1 TTPs 12 IoCs

evasion

Modify Registry

T1112

Processes:

3b99c63e4974eae49eba3ac380fc4c75ba6a4e38cd381a00cc32cee95e7596ad.exeaudiodg.exeaudiodg.exeaudiodg.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	3b99c63e4974eae49eba3ac380fc4c75ba6a4e38cd381a00cc32cee95e7596ad.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	3b99c63e4974eae49eba3ac380fc4c75ba6a4e38cd381a00cc32cee95e7596ad.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	audiodg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	audiodg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	audiodg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	audiodg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	audiodg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	audiodg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	audiodg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	3b99c63e4974eae49eba3ac380fc4c75ba6a4e38cd381a00cc32cee95e7596ad.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	audiodg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	audiodg.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\3b99c63e4974eae49eba3ac380fc4c75ba6a4e38cd381a00cc32cee95e7596ad.exe
"C:\Users\Admin\AppData\Local\Temp\3b99c63e4974eae49eba3ac380fc4c75ba6a4e38cd381a00cc32cee95e7596ad.exe"
1⤵
- UAC bypass
- Checks whether UAC is enabled
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2868

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell" -Command Add-MpPreference -ExclusionPath 'C:/'
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1200

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell" -Command Add-MpPreference -ExclusionPath 'C:/$Recycle.Bin/'
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:880

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell" -Command Add-MpPreference -ExclusionPath 'C:/Documents and Settings/'
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1252

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell" -Command Add-MpPreference -ExclusionPath 'C:/MSOCache/'
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2308

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell" -Command Add-MpPreference -ExclusionPath 'C:/PerfLogs/'
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2028

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files/'
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1292

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files (x86)/'
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2280

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell" -Command Add-MpPreference -ExclusionPath 'C:/ProgramData/'
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2036

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell" -Command Add-MpPreference -ExclusionPath 'C:/Recovery/'
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2284

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell" -Command Add-MpPreference -ExclusionPath 'C:/System Volume Information/'
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2068

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell" -Command Add-MpPreference -ExclusionPath 'C:/Users/'
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1920

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell" -Command Add-MpPreference -ExclusionPath 'C:/Windows/'
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2980

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\6uMYZ5DmT2.bat"
2⤵
- Suspicious use of WriteProcessMemory
PID:1868

C:\Windows\system32\w32tm.exe
w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
3⤵
PID:2700

C:\Program Files (x86)\Windows Defender\audiodg.exe
"C:\Program Files (x86)\Windows Defender\audiodg.exe"
3⤵
- UAC bypass
- Executes dropped EXE
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2020

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\40469aec-22a3-47b5-832b-c7a16d699758.vbs"
4⤵
- Suspicious use of WriteProcessMemory
PID:596

C:\Program Files (x86)\Windows Defender\audiodg.exe
"C:\Program Files (x86)\Windows Defender\audiodg.exe"
5⤵
- UAC bypass
- Executes dropped EXE
- Checks whether UAC is enabled
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1120

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\745ee968-13ad-463b-8abe-9a79bdf283eb.vbs"
6⤵
- Suspicious use of WriteProcessMemory
PID:1808

C:\Program Files (x86)\Windows Defender\audiodg.exe
"C:\Program Files (x86)\Windows Defender\audiodg.exe"
7⤵
- UAC bypass
- Executes dropped EXE
- Checks whether UAC is enabled
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1560

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\411915e5-4792-4b68-a2bf-b2f4294c429e.vbs"
8⤵
PID:2704

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\06c2bb4f-c5aa-4b8e-b233-aa0dd7f2363f.vbs"
8⤵
PID:1044

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\b277ca58-d53f-4d00-a962-0965f5ee166a.vbs"
6⤵
PID:948

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\377dc1cb-08e3-41fe-800b-7b3950b6c762.vbs"
4⤵
PID:624

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "audiodga" /sc MINUTE /mo 8 /tr "'C:\Program Files (x86)\Windows Defender\audiodg.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2612

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "audiodg" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Defender\audiodg.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:548

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "audiodga" /sc MINUTE /mo 13 /tr "'C:\Program Files (x86)\Windows Defender\audiodg.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2464

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "3b99c63e4974eae49eba3ac380fc4c75ba6a4e38cd381a00cc32cee95e7596ad3" /sc MINUTE /mo 9 /tr "'C:\Users\Default\SendTo\3b99c63e4974eae49eba3ac380fc4c75ba6a4e38cd381a00cc32cee95e7596ad.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2564

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "3b99c63e4974eae49eba3ac380fc4c75ba6a4e38cd381a00cc32cee95e7596ad" /sc ONLOGON /tr "'C:\Users\Default\SendTo\3b99c63e4974eae49eba3ac380fc4c75ba6a4e38cd381a00cc32cee95e7596ad.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2496

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "3b99c63e4974eae49eba3ac380fc4c75ba6a4e38cd381a00cc32cee95e7596ad3" /sc MINUTE /mo 10 /tr "'C:\Users\Default\SendTo\3b99c63e4974eae49eba3ac380fc4c75ba6a4e38cd381a00cc32cee95e7596ad.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2904

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 7 /tr "'C:\Users\Default User\dllhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2684

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Users\Default User\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2764

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 8 /tr "'C:\Users\Default User\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2912

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 8 /tr "'C:\Program Files\Java\jre7\lib\explorer.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1300

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorer" /sc ONLOGON /tr "'C:\Program Files\Java\jre7\lib\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1600

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 11 /tr "'C:\Program Files\Java\jre7\lib\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1964

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Scheduled Task/Job

T1053

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Scheduled Task/Job

T1053

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Query Registry

T1012

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Windows Defender\audiodg.exe
Filesize
3.2MB

MD5
cf29d8ca465ff6812aa95db04090a9c0

SHA1
716464024376e14db08a4d150313692eb6fea476

SHA256
6f549320053ad85f9bbf44afba7686872407b6883b23936d7629940a7f307f2a

SHA512
46b83baf26d1eee55d039cae12df62550d894851604049613580ce7a6d1f4168440378a1e135071244fabdf8fadc004cb48be3f4ade42fab5d7af22730c630af

Download Submit
C:\Users\Admin\AppData\Local\Temp\377dc1cb-08e3-41fe-800b-7b3950b6c762.vbs
Filesize
503B

MD5
900d612f362613eb51f76c4280e4ba5e

SHA1
0adf5fdf96e9755b150e0ce979eb3279f734bb90

SHA256
9a79724b0436ef44d26b7f997d582bc4f7b472c7eb4548e939be933f4d2ac18e

SHA512
bdaad89ff608516f149cae0ed177ddf7184ec1a211e39cc70898024d1dbec654db2e482a1d7beb493b1558608494e99bae7e1b2c658a9779b09a8d6daddce72c

Download Submit
C:\Users\Admin\AppData\Local\Temp\40469aec-22a3-47b5-832b-c7a16d699758.vbs
Filesize
727B

MD5
f536f1d2953cc8478f0f333dbdea536b

SHA1
bc2df5ed5d7afb0596954d8c2612eda1a1d559f7

SHA256
89662301cfca9c3a36bb4a78c7f5fa8ceafd8fa419b6c36b2bb638d0be93614f

SHA512
d052aff4ae4889781430aba6d255d93d93dbb5697c3958d82820b373b35d7ba9ef7962343017d61ec559f9867313728c7e0ff5518404ae50cb9f0de645800905

Download Submit
C:\Users\Admin\AppData\Local\Temp\411915e5-4792-4b68-a2bf-b2f4294c429e.vbs
Filesize
727B

MD5
5f6d3b2ac11b838e2f3ce06d6dc25047

SHA1
8dc7612934245faf7ebad9e1463255939246e507

SHA256
5903918f0db2d399e886b7031f37d21a28f26b6737689a67343bae76da3f7b8a

SHA512
95ed675f88d1c4f818ce24c0559fb49e34f2d56e9938afd4b292a9af29333fcf51424c41dd4d040461e9a5cc809622ca15c3a67dff1ee3795db6d44973b9aa75

Download Submit
C:\Users\Admin\AppData\Local\Temp\6uMYZ5DmT2.bat
Filesize
216B

MD5
e8418630f40929229009f89a126d485c

SHA1
ecc6c50d074e840577e25dd6f43db1d09b0e1b2b

SHA256
54157c8e880d9610a97da6955271f0865ad749e678563a429c174055dd6d732d

SHA512
1d568d12fac63af7bbafd38f9caa2ff5e71daeaa3b20426ce4a6f6348b63c23c113fb383de74628f53464843850a086d77b4e06c24281ab15a60fa8933d56068

Download Submit
C:\Users\Admin\AppData\Local\Temp\745ee968-13ad-463b-8abe-9a79bdf283eb.vbs
Filesize
727B

MD5
7bfa5da8b09793c86230d054912f6a23

SHA1
ab5b42055dc96430cc2c22e3d72e247168f7b87d

SHA256
95be8bd53af92b0ab959c0b2a99b23f098684d09139dde0f122c63ba338e12fe

SHA512
2504d43be4754b9eba6017d327f69ce8baff3968476ffd111983475fe3b458aacfd9286fbed8da721d30a061a17da50989a18879fb95117f3c170ab4aed2e2f8

Download Submit
C:\Users\Admin\AppData\Local\Temp\RCX1D9F.tmp
Filesize
3.2MB

MD5
7ec98ffb225893aeee999179ca43380a

SHA1
d9ad6d24e771b5c2ebc4b4a70534329abfffe871

SHA256
3b99c63e4974eae49eba3ac380fc4c75ba6a4e38cd381a00cc32cee95e7596ad

SHA512
9b8e4d9123b1b1686fc88e17e02aa3d05b998ad21f9314cd15b2da8751906bc04c2f749e279d04f3a1a5b40074ed89b33bae749b8e0546f7e665b32ce6dbca05

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms
Filesize
7KB

MD5
5edce2ebf135ad3a5f738b2a741e44f2

SHA1
4527fbc3dbf7c591e7b9a0d131454fe5a60b9947

SHA256
66b98c6ad60e67e1bc4b40b7e668bd24b5c09bbbca3f905ed1098ac54588c6fb

SHA512
a22f2e53e3d2d2cd39d7dbfe8383a63366648a75e9fca26ba53fedac2b722f9c57a13565409dbc3fe8ab9f5ccd5b892928899a197304b77559cc8162a9ae6dad

Download Submit
C:\Users\Default\dllhost.exe
Filesize
3.2MB

MD5
4d447f188928957c24fd574d5311818b

SHA1
7ea3fa4da1dbdb40e03cc69983f8937c3d0e67d2

SHA256
d498bda55d78ada61a1b83ddd5c23f64acb4246ba8ae9e12d5798363af4672d8

SHA512
152db28c9a04404ea15b3464be8f477739b223edcb5b9cb507219e4b235af2445a31a638b44bc84e85231b03b6c94ac967add1683245a310a063497e3cb8c91c

Download Submit
memory/1200-171-0x000007FEECAF0000-0x000007FEED48D000-memory.dmp

Filesize
9.6MB

Download
memory/1200-101-0x000000001B800000-0x000000001BAE2000-memory.dmp

Filesize
2.9MB

Download
memory/1200-167-0x000000000297B000-0x00000000029E2000-memory.dmp

Filesize
412KB

Download
memory/1200-158-0x000007FEECAF0000-0x000007FEED48D000-memory.dmp

Filesize
9.6MB

Download
memory/1200-161-0x000007FEECAF0000-0x000007FEED48D000-memory.dmp

Filesize
9.6MB

Download
memory/1200-164-0x0000000002974000-0x0000000002977000-memory.dmp

Filesize
12KB

Download
memory/1200-159-0x0000000002970000-0x00000000029F0000-memory.dmp

Filesize
512KB

Download
memory/1200-162-0x0000000002970000-0x00000000029F0000-memory.dmp

Filesize
512KB

Download
memory/1252-183-0x0000000002D7B000-0x0000000002DE2000-memory.dmp

Filesize
412KB

Download
memory/1292-185-0x000007FEECAF0000-0x000007FEED48D000-memory.dmp

Filesize
9.6MB

Download
memory/1292-182-0x0000000002E2B000-0x0000000002E92000-memory.dmp

Filesize
412KB

Download
memory/1920-177-0x000007FEECAF0000-0x000007FEED48D000-memory.dmp

Filesize
9.6MB

Download
memory/1920-181-0x0000000002830000-0x00000000028B0000-memory.dmp

Filesize
512KB

Download
memory/2036-165-0x000007FEECAF0000-0x000007FEED48D000-memory.dmp

Filesize
9.6MB

Download
memory/2036-169-0x0000000002304000-0x0000000002307000-memory.dmp

Filesize
12KB

Download
memory/2036-172-0x000000000230B000-0x0000000002372000-memory.dmp

Filesize
412KB

Download
memory/2280-176-0x0000000002C60000-0x0000000002CE0000-memory.dmp

Filesize
512KB

Download
memory/2280-107-0x0000000002220000-0x0000000002228000-memory.dmp

Filesize
32KB

Download
memory/2280-173-0x000007FEECAF0000-0x000007FEED48D000-memory.dmp

Filesize
9.6MB

Download
memory/2280-179-0x000007FEECAF0000-0x000007FEED48D000-memory.dmp

Filesize
9.6MB

Download
memory/2280-184-0x0000000002C6B000-0x0000000002CD2000-memory.dmp

Filesize
412KB

Download
memory/2280-175-0x0000000002C60000-0x0000000002CE0000-memory.dmp

Filesize
512KB

Download
memory/2280-168-0x0000000002C60000-0x0000000002CE0000-memory.dmp

Filesize
512KB

Download
memory/2280-163-0x000007FEECAF0000-0x000007FEED48D000-memory.dmp

Filesize
9.6MB

Download
memory/2308-166-0x000007FEECAF0000-0x000007FEED48D000-memory.dmp

Filesize
9.6MB

Download
memory/2308-174-0x0000000001F2B000-0x0000000001F92000-memory.dmp

Filesize
412KB

Download
memory/2308-170-0x0000000001F24000-0x0000000001F27000-memory.dmp

Filesize
12KB

Download
memory/2868-22-0x0000000000C60000-0x0000000000C6C000-memory.dmp

Filesize
48KB

Download
memory/2868-1-0x000007FEF57C0000-0x000007FEF61AC000-memory.dmp

Filesize
9.9MB

Download
memory/2868-21-0x0000000000C50000-0x0000000000C5C000-memory.dmp

Filesize
48KB

Download
memory/2868-20-0x0000000000C40000-0x0000000000C4C000-memory.dmp

Filesize
48KB

Download
memory/2868-19-0x0000000000C30000-0x0000000000C3C000-memory.dmp

Filesize
48KB

Download
memory/2868-18-0x0000000000B80000-0x0000000000B92000-memory.dmp

Filesize
72KB

Download
memory/2868-17-0x0000000000B70000-0x0000000000B78000-memory.dmp

Filesize
32KB

Download
memory/2868-16-0x0000000000B60000-0x0000000000B6C000-memory.dmp

Filesize
48KB

Download
memory/2868-15-0x00000000006D0000-0x00000000006D8000-memory.dmp

Filesize
32KB

Download
memory/2868-23-0x0000000000D20000-0x0000000000D28000-memory.dmp

Filesize
32KB

Download
memory/2868-25-0x0000000000C80000-0x0000000000C8E000-memory.dmp

Filesize
56KB

Download
memory/2868-14-0x00000000006B0000-0x00000000006BC000-memory.dmp

Filesize
48KB

Download
memory/2868-13-0x0000000000B10000-0x0000000000B66000-memory.dmp

Filesize
344KB

Download
memory/2868-12-0x00000000006A0000-0x00000000006AA000-memory.dmp

Filesize
40KB

Download
memory/2868-53-0x000000001B3F0000-0x000000001B470000-memory.dmp

Filesize
512KB

Download
memory/2868-24-0x0000000000C70000-0x0000000000C7A000-memory.dmp

Filesize
40KB

Download
memory/2868-11-0x00000000006C0000-0x00000000006D0000-memory.dmp

Filesize
64KB

Download
memory/2868-32-0x000000001ABA0000-0x000000001ABAC000-memory.dmp

Filesize
48KB

Download
memory/2868-31-0x0000000001260000-0x000000000126A000-memory.dmp

Filesize
40KB

Download
memory/2868-26-0x0000000000D10000-0x0000000000D18000-memory.dmp

Filesize
32KB

Download
memory/2868-0-0x0000000001270000-0x00000000015AC000-memory.dmp

Filesize
3.2MB

Download
memory/2868-10-0x0000000000690000-0x0000000000698000-memory.dmp

Filesize
32KB

Download
memory/2868-9-0x0000000000670000-0x0000000000686000-memory.dmp

Filesize
88KB

Download
memory/2868-30-0x0000000001250000-0x0000000001258000-memory.dmp

Filesize
32KB

Download
memory/2868-8-0x0000000000660000-0x0000000000670000-memory.dmp

Filesize
64KB

Download
memory/2868-7-0x0000000000650000-0x0000000000658000-memory.dmp

Filesize
32KB

Download
memory/2868-2-0x000000001B3F0000-0x000000001B470000-memory.dmp

Filesize
512KB

Download
memory/2868-29-0x000000001B3F0000-0x000000001B470000-memory.dmp

Filesize
512KB

Download
memory/2868-6-0x0000000000630000-0x000000000064C000-memory.dmp

Filesize
112KB

Download
memory/2868-28-0x0000000001240000-0x000000000124C000-memory.dmp

Filesize
48KB

Download
memory/2868-5-0x0000000000620000-0x0000000000628000-memory.dmp

Filesize
32KB

Download
memory/2868-112-0x000007FEF57C0000-0x000007FEF61AC000-memory.dmp

Filesize
9.9MB

Download
memory/2868-27-0x0000000000DB0000-0x0000000000DBE000-memory.dmp

Filesize
56KB

Download
memory/2868-4-0x0000000000500000-0x000000000050E000-memory.dmp

Filesize
56KB

Download
memory/2868-3-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/2980-180-0x000007FEECAF0000-0x000007FEED48D000-memory.dmp

Filesize
9.6MB

Download
memory/2980-178-0x00000000027FB000-0x0000000002862000-memory.dmp

Filesize
412KB

Download