dcrat | dc2a17964084118aad74ee22789ca6a771d00f1028451eea8947eb63365d2b9e

Analysis

max time kernel
300s
max time network
300s
platform
windows11-21h2_x64
resource
win11-20240426-en
resource tags

arch:x64arch:x86image:win11-20240426-enlocale:en-usos:windows11-21h2-x64system
submitted
18/05/2024, 09:38

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
skeet.cc.exe
Size 1.6MB
Sample240518-ll9easdf42
SHA256 dc2a17964084118aad74ee22789ca6a771d00f1028451eea8947eb63365d2b9e
MD5 ad0e2712fec29876b2c5794ef99b2254
SHA1 9e86419ddacfa04e20f4554dd34756844f3de25d
SHA512 2c1ddb88215cd81099ca6931d2535f1cad80f5e2fbf285892ce8efd4e9cc49b447ced100b2fd5208bde2713f6b4fcefe5b740e63c0f20268a110ee8796f90154
SSDEEP 24576:L2G/nvxW3WQgkdlESdayd3rFfezUTnrtDENS2i8SIq7bARyGrx0f7MHqeTMap:LbA3Nxd2SdtihITtKto7ij
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

dcrat execution infostealer persistence rat spyware stealer

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat

Modifies WinLogon for persistence 2 TTPs 15 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Recovery\\WindowsRE\\wininit.exe\", \"C:\\Program Files\\MSBuild\\conhost.exe\", \"C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework\\backgroundTaskHost.exe\", \"C:\\Surrogateprovidercomponentsessionmonitor\\SppExtComObj.exe\""	browserwinsvc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Recovery\\WindowsRE\\wininit.exe\", \"C:\\Program Files\\MSBuild\\conhost.exe\", \"C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework\\backgroundTaskHost.exe\", \"C:\\Surrogateprovidercomponentsessionmonitor\\SppExtComObj.exe\", \"C:\\Recovery\\WindowsRE\\csrss.exe\", \"C:\\Program Files (x86)\\MSBuild\\Microsoft\\Windows Workflow Foundation\\RuntimeBroker.exe\""	browserwinsvc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Recovery\\WindowsRE\\wininit.exe\", \"C:\\Program Files\\MSBuild\\conhost.exe\", \"C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework\\backgroundTaskHost.exe\", \"C:\\Surrogateprovidercomponentsessionmonitor\\SppExtComObj.exe\", \"C:\\Recovery\\WindowsRE\\csrss.exe\", \"C:\\Program Files (x86)\\MSBuild\\Microsoft\\Windows Workflow Foundation\\RuntimeBroker.exe\", \"C:\\Users\\Admin\\Links\\winlogon.exe\""	browserwinsvc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Recovery\\WindowsRE\\wininit.exe\", \"C:\\Program Files\\MSBuild\\conhost.exe\", \"C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework\\backgroundTaskHost.exe\", \"C:\\Surrogateprovidercomponentsessionmonitor\\SppExtComObj.exe\", \"C:\\Recovery\\WindowsRE\\csrss.exe\", \"C:\\Program Files (x86)\\MSBuild\\Microsoft\\Windows Workflow Foundation\\RuntimeBroker.exe\", \"C:\\Users\\Admin\\Links\\winlogon.exe\", \"C:\\Program Files (x86)\\Internet Explorer\\en-US\\dllhost.exe\""	browserwinsvc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Recovery\\WindowsRE\\wininit.exe\", \"C:\\Program Files\\MSBuild\\conhost.exe\", \"C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework\\backgroundTaskHost.exe\", \"C:\\Surrogateprovidercomponentsessionmonitor\\SppExtComObj.exe\", \"C:\\Recovery\\WindowsRE\\csrss.exe\", \"C:\\Program Files (x86)\\MSBuild\\Microsoft\\Windows Workflow Foundation\\RuntimeBroker.exe\", \"C:\\Users\\Admin\\Links\\winlogon.exe\", \"C:\\Program Files (x86)\\Internet Explorer\\en-US\\dllhost.exe\", \"C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\dllhost.exe\", \"C:\\Surrogateprovidercomponentsessionmonitor\\backgroundTaskHost.exe\", \"C:\\Windows\\Offline Web Pages\\SppExtComObj.exe\", \"C:\\Program Files\\Windows Photo Viewer\\en-US\\cmd.exe\", \"C:\\Recovery\\WindowsRE\\RuntimeBroker.exe\", \"C:\\Program Files\\Windows Photo Viewer\\en-US\\dwm.exe\""	browserwinsvc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Recovery\\WindowsRE\\wininit.exe\""	browserwinsvc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Recovery\\WindowsRE\\wininit.exe\", \"C:\\Program Files\\MSBuild\\conhost.exe\""	browserwinsvc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Recovery\\WindowsRE\\wininit.exe\", \"C:\\Program Files\\MSBuild\\conhost.exe\", \"C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework\\backgroundTaskHost.exe\", \"C:\\Surrogateprovidercomponentsessionmonitor\\SppExtComObj.exe\", \"C:\\Recovery\\WindowsRE\\csrss.exe\""	browserwinsvc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Recovery\\WindowsRE\\wininit.exe\", \"C:\\Program Files\\MSBuild\\conhost.exe\", \"C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework\\backgroundTaskHost.exe\", \"C:\\Surrogateprovidercomponentsessionmonitor\\SppExtComObj.exe\", \"C:\\Recovery\\WindowsRE\\csrss.exe\", \"C:\\Program Files (x86)\\MSBuild\\Microsoft\\Windows Workflow Foundation\\RuntimeBroker.exe\", \"C:\\Users\\Admin\\Links\\winlogon.exe\", \"C:\\Program Files (x86)\\Internet Explorer\\en-US\\dllhost.exe\", \"C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\dllhost.exe\""	browserwinsvc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Recovery\\WindowsRE\\wininit.exe\", \"C:\\Program Files\\MSBuild\\conhost.exe\", \"C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework\\backgroundTaskHost.exe\", \"C:\\Surrogateprovidercomponentsessionmonitor\\SppExtComObj.exe\", \"C:\\Recovery\\WindowsRE\\csrss.exe\", \"C:\\Program Files (x86)\\MSBuild\\Microsoft\\Windows Workflow Foundation\\RuntimeBroker.exe\", \"C:\\Users\\Admin\\Links\\winlogon.exe\", \"C:\\Program Files (x86)\\Internet Explorer\\en-US\\dllhost.exe\", \"C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\dllhost.exe\", \"C:\\Surrogateprovidercomponentsessionmonitor\\backgroundTaskHost.exe\""	browserwinsvc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Recovery\\WindowsRE\\wininit.exe\", \"C:\\Program Files\\MSBuild\\conhost.exe\", \"C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework\\backgroundTaskHost.exe\", \"C:\\Surrogateprovidercomponentsessionmonitor\\SppExtComObj.exe\", \"C:\\Recovery\\WindowsRE\\csrss.exe\", \"C:\\Program Files (x86)\\MSBuild\\Microsoft\\Windows Workflow Foundation\\RuntimeBroker.exe\", \"C:\\Users\\Admin\\Links\\winlogon.exe\", \"C:\\Program Files (x86)\\Internet Explorer\\en-US\\dllhost.exe\", \"C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\dllhost.exe\", \"C:\\Surrogateprovidercomponentsessionmonitor\\backgroundTaskHost.exe\", \"C:\\Windows\\Offline Web Pages\\SppExtComObj.exe\""	browserwinsvc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Recovery\\WindowsRE\\wininit.exe\", \"C:\\Program Files\\MSBuild\\conhost.exe\", \"C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework\\backgroundTaskHost.exe\", \"C:\\Surrogateprovidercomponentsessionmonitor\\SppExtComObj.exe\", \"C:\\Recovery\\WindowsRE\\csrss.exe\", \"C:\\Program Files (x86)\\MSBuild\\Microsoft\\Windows Workflow Foundation\\RuntimeBroker.exe\", \"C:\\Users\\Admin\\Links\\winlogon.exe\", \"C:\\Program Files (x86)\\Internet Explorer\\en-US\\dllhost.exe\", \"C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\dllhost.exe\", \"C:\\Surrogateprovidercomponentsessionmonitor\\backgroundTaskHost.exe\", \"C:\\Windows\\Offline Web Pages\\SppExtComObj.exe\", \"C:\\Program Files\\Windows Photo Viewer\\en-US\\cmd.exe\""	browserwinsvc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Recovery\\WindowsRE\\wininit.exe\", \"C:\\Program Files\\MSBuild\\conhost.exe\", \"C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework\\backgroundTaskHost.exe\", \"C:\\Surrogateprovidercomponentsessionmonitor\\SppExtComObj.exe\", \"C:\\Recovery\\WindowsRE\\csrss.exe\", \"C:\\Program Files (x86)\\MSBuild\\Microsoft\\Windows Workflow Foundation\\RuntimeBroker.exe\", \"C:\\Users\\Admin\\Links\\winlogon.exe\", \"C:\\Program Files (x86)\\Internet Explorer\\en-US\\dllhost.exe\", \"C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\dllhost.exe\", \"C:\\Surrogateprovidercomponentsessionmonitor\\backgroundTaskHost.exe\", \"C:\\Windows\\Offline Web Pages\\SppExtComObj.exe\", \"C:\\Program Files\\Windows Photo Viewer\\en-US\\cmd.exe\", \"C:\\Recovery\\WindowsRE\\RuntimeBroker.exe\", \"C:\\Program Files\\Windows Photo Viewer\\en-US\\dwm.exe\", \"C:\\Recovery\\WindowsRE\\dllhost.exe\""	browserwinsvc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Recovery\\WindowsRE\\wininit.exe\", \"C:\\Program Files\\MSBuild\\conhost.exe\", \"C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework\\backgroundTaskHost.exe\""	browserwinsvc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Recovery\\WindowsRE\\wininit.exe\", \"C:\\Program Files\\MSBuild\\conhost.exe\", \"C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework\\backgroundTaskHost.exe\", \"C:\\Surrogateprovidercomponentsessionmonitor\\SppExtComObj.exe\", \"C:\\Recovery\\WindowsRE\\csrss.exe\", \"C:\\Program Files (x86)\\MSBuild\\Microsoft\\Windows Workflow Foundation\\RuntimeBroker.exe\", \"C:\\Users\\Admin\\Links\\winlogon.exe\", \"C:\\Program Files (x86)\\Internet Explorer\\en-US\\dllhost.exe\", \"C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\dllhost.exe\", \"C:\\Surrogateprovidercomponentsessionmonitor\\backgroundTaskHost.exe\", \"C:\\Windows\\Offline Web Pages\\SppExtComObj.exe\", \"C:\\Program Files\\Windows Photo Viewer\\en-US\\cmd.exe\", \"C:\\Recovery\\WindowsRE\\RuntimeBroker.exe\""	browserwinsvc.exe

Process spawned unexpected child process 45 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1992	1244	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2952	1244	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	756	1244	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1696	1244	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5032	1244	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3604	1244	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1364	1244	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4264	1244	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4080	1244	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5012	1244	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4024	1244	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1420	1244	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1816	1244	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3148	1244	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3476	1244	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1904	1244	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2040	1244	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4256	1244	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2872	1244	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1412	1244	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4852	1244	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4284	1244	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3752	1244	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3824	1244	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4880	1244	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2308	1244	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3560	1244	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3472	1244	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2716	1244	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3520	1244	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1760	1244	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3956	1244	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2212	1244	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4424	1244	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	388	1244	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1096	1244	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3704	1244	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2064	1244	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4816	1244	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1912	1244	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4956	1244	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5044	1244	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3936	1244	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3000	1244	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2936	1244	schtasks.exe	86

DCRat payload 2 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral5/files/0x000200000002a9e9-10.dat	dcrat
behavioral5/memory/4928-13-0x0000000000390000-0x00000000004E0000-memory.dmp	dcrat

Command and Scripting Interpreter: PowerShell 1 TTPs 16 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
4220	powershell.exe
2512	powershell.exe
1068	powershell.exe
2968	powershell.exe
2960	powershell.exe
3012	powershell.exe
1228	powershell.exe
2676	powershell.exe
2656	powershell.exe
2612	powershell.exe
1464	powershell.exe
2528	powershell.exe
2348	powershell.exe
2604	powershell.exe
2708	powershell.exe
3224	powershell.exe

Executes dropped EXE 2 IoCs

pid	Process
4928	browserwinsvc.exe
5364	cmd.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 30 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2994005945-4089876968-1367784197-1000\Software\Microsoft\Windows\CurrentVersion\Run\wininit = "\"C:\\Recovery\\WindowsRE\\wininit.exe\""	browserwinsvc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\winlogon = "\"C:\\Users\\Admin\\Links\\winlogon.exe\""	browserwinsvc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2994005945-4089876968-1367784197-1000\Software\Microsoft\Windows\CurrentVersion\Run\dllhost = "\"C:\\Program Files (x86)\\Internet Explorer\\en-US\\dllhost.exe\""	browserwinsvc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2994005945-4089876968-1367784197-1000\Software\Microsoft\Windows\CurrentVersion\Run\dllhost = "\"C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\dllhost.exe\""	browserwinsvc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2994005945-4089876968-1367784197-1000\Software\Microsoft\Windows\CurrentVersion\Run\backgroundTaskHost = "\"C:\\Surrogateprovidercomponentsessionmonitor\\backgroundTaskHost.exe\""	browserwinsvc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RuntimeBroker = "\"C:\\Recovery\\WindowsRE\\RuntimeBroker.exe\""	browserwinsvc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2994005945-4089876968-1367784197-1000\Software\Microsoft\Windows\CurrentVersion\Run\SppExtComObj = "\"C:\\Surrogateprovidercomponentsessionmonitor\\SppExtComObj.exe\""	browserwinsvc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Recovery\\WindowsRE\\csrss.exe\""	browserwinsvc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dllhost = "\"C:\\Program Files (x86)\\Internet Explorer\\en-US\\dllhost.exe\""	browserwinsvc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SppExtComObj = "\"C:\\Windows\\Offline Web Pages\\SppExtComObj.exe\""	browserwinsvc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2994005945-4089876968-1367784197-1000\Software\Microsoft\Windows\CurrentVersion\Run\cmd = "\"C:\\Program Files\\Windows Photo Viewer\\en-US\\cmd.exe\""	browserwinsvc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2994005945-4089876968-1367784197-1000\Software\Microsoft\Windows\CurrentVersion\Run\backgroundTaskHost = "\"C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework\\backgroundTaskHost.exe\""	browserwinsvc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SppExtComObj = "\"C:\\Surrogateprovidercomponentsessionmonitor\\SppExtComObj.exe\""	browserwinsvc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2994005945-4089876968-1367784197-1000\Software\Microsoft\Windows\CurrentVersion\Run\RuntimeBroker = "\"C:\\Program Files (x86)\\MSBuild\\Microsoft\\Windows Workflow Foundation\\RuntimeBroker.exe\""	browserwinsvc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2994005945-4089876968-1367784197-1000\Software\Microsoft\Windows\CurrentVersion\Run\winlogon = "\"C:\\Users\\Admin\\Links\\winlogon.exe\""	browserwinsvc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2994005945-4089876968-1367784197-1000\Software\Microsoft\Windows\CurrentVersion\Run\dllhost = "\"C:\\Recovery\\WindowsRE\\dllhost.exe\""	browserwinsvc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\backgroundTaskHost = "\"C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework\\backgroundTaskHost.exe\""	browserwinsvc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2994005945-4089876968-1367784197-1000\Software\Microsoft\Windows\CurrentVersion\Run\SppExtComObj = "\"C:\\Windows\\Offline Web Pages\\SppExtComObj.exe\""	browserwinsvc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2994005945-4089876968-1367784197-1000\Software\Microsoft\Windows\CurrentVersion\Run\RuntimeBroker = "\"C:\\Recovery\\WindowsRE\\RuntimeBroker.exe\""	browserwinsvc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2994005945-4089876968-1367784197-1000\Software\Microsoft\Windows\CurrentVersion\Run\dwm = "\"C:\\Program Files\\Windows Photo Viewer\\en-US\\dwm.exe\""	browserwinsvc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dllhost = "\"C:\\Recovery\\WindowsRE\\dllhost.exe\""	browserwinsvc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RuntimeBroker = "\"C:\\Program Files (x86)\\MSBuild\\Microsoft\\Windows Workflow Foundation\\RuntimeBroker.exe\""	browserwinsvc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dllhost = "\"C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\dllhost.exe\""	browserwinsvc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\backgroundTaskHost = "\"C:\\Surrogateprovidercomponentsessionmonitor\\backgroundTaskHost.exe\""	browserwinsvc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dwm = "\"C:\\Program Files\\Windows Photo Viewer\\en-US\\dwm.exe\""	browserwinsvc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\wininit = "\"C:\\Recovery\\WindowsRE\\wininit.exe\""	browserwinsvc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2994005945-4089876968-1367784197-1000\Software\Microsoft\Windows\CurrentVersion\Run\conhost = "\"C:\\Program Files\\MSBuild\\conhost.exe\""	browserwinsvc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\conhost = "\"C:\\Program Files\\MSBuild\\conhost.exe\""	browserwinsvc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2994005945-4089876968-1367784197-1000\Software\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Recovery\\WindowsRE\\csrss.exe\""	browserwinsvc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\cmd = "\"C:\\Program Files\\Windows Photo Viewer\\en-US\\cmd.exe\""	browserwinsvc.exe

Looks up external IP address via web service 3 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
1	ip-api.com
1	ipinfo.io
7	ipinfo.io

Drops file in Program Files directory 14 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\9e8d7a4ca61bd9	browserwinsvc.exe
File created	C:\Program Files (x86)\Internet Explorer\en-US\dllhost.exe	browserwinsvc.exe
File created	C:\Program Files (x86)\Internet Explorer\en-US\5940a34987c991	browserwinsvc.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\dllhost.exe	browserwinsvc.exe
File created	C:\Program Files\Windows Photo Viewer\en-US\cmd.exe	browserwinsvc.exe
File created	C:\Program Files\Windows Photo Viewer\en-US\6cb0b6c459d5d3	browserwinsvc.exe
File created	C:\Program Files\MSBuild\088424020bedd6	browserwinsvc.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\5940a34987c991	browserwinsvc.exe
File created	C:\Program Files\Windows Photo Viewer\en-US\dwm.exe	browserwinsvc.exe
File created	C:\Program Files\MSBuild\conhost.exe	browserwinsvc.exe
File created	C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\backgroundTaskHost.exe	browserwinsvc.exe
File created	C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\eddb19405b7ce1	browserwinsvc.exe
File created	C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\RuntimeBroker.exe	browserwinsvc.exe
File created	C:\Program Files\Windows Photo Viewer\en-US\ebf1f9fa8afd6d	browserwinsvc.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\Offline Web Pages\SppExtComObj.exe	browserwinsvc.exe
File created	C:\Windows\Offline Web Pages\e1ef82546f0b02	browserwinsvc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 45 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
3752	schtasks.exe
3824	schtasks.exe
2936	schtasks.exe
4024	schtasks.exe
2040	schtasks.exe
1412	schtasks.exe
4852	schtasks.exe
4880	schtasks.exe
1760	schtasks.exe
3956	schtasks.exe
4816	schtasks.exe
2952	schtasks.exe
3476	schtasks.exe
1912	schtasks.exe
5044	schtasks.exe
3000	schtasks.exe
1992	schtasks.exe
2212	schtasks.exe
4256	schtasks.exe
2308	schtasks.exe
3560	schtasks.exe
2716	schtasks.exe
3604	schtasks.exe
1420	schtasks.exe
388	schtasks.exe
1696	schtasks.exe
4080	schtasks.exe
2064	schtasks.exe
4956	schtasks.exe
3936	schtasks.exe
4284	schtasks.exe
3520	schtasks.exe
1904	schtasks.exe
3472	schtasks.exe
4424	schtasks.exe
1096	schtasks.exe
3704	schtasks.exe
756	schtasks.exe
3148	schtasks.exe
4264	schtasks.exe
5012	schtasks.exe
1816	schtasks.exe
2872	schtasks.exe
5032	schtasks.exe
1364	schtasks.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2994005945-4089876968-1367784197-1000_Classes\Local Settings	browserwinsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-2994005945-4089876968-1367784197-1000_Classes\Local Settings	skeet.cc.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4928	browserwinsvc.exe
4928	browserwinsvc.exe
4928	browserwinsvc.exe
4928	browserwinsvc.exe
4928	browserwinsvc.exe
4928	browserwinsvc.exe
1228	powershell.exe
1228	powershell.exe
2604	powershell.exe
2604	powershell.exe
2708	powershell.exe
2708	powershell.exe
2676	powershell.exe
2676	powershell.exe
2348	powershell.exe
2348	powershell.exe
4220	powershell.exe
4220	powershell.exe
1464	powershell.exe
1464	powershell.exe
2960	powershell.exe
2960	powershell.exe
3224	powershell.exe
3224	powershell.exe
3012	powershell.exe
3012	powershell.exe
2528	powershell.exe
2528	powershell.exe
1068	powershell.exe
1068	powershell.exe
2612	powershell.exe
2612	powershell.exe
2656	powershell.exe
2656	powershell.exe
2968	powershell.exe
2968	powershell.exe
3012	powershell.exe
2512	powershell.exe
2512	powershell.exe
2512	powershell.exe
1228	powershell.exe
1228	powershell.exe
2708	powershell.exe
2528	powershell.exe
2968	powershell.exe
2612	powershell.exe
2604	powershell.exe
2604	powershell.exe
4220	powershell.exe
2960	powershell.exe
2676	powershell.exe
1464	powershell.exe
2348	powershell.exe
3224	powershell.exe
1068	powershell.exe
2656	powershell.exe
5364	cmd.exe
5364	cmd.exe
5364	cmd.exe
5364	cmd.exe
5364	cmd.exe
5364	cmd.exe
5364	cmd.exe
5364	cmd.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
5364	cmd.exe

Suspicious use of AdjustPrivilegeToken 18 IoCs

description	pid	Process
Token: SeDebugPrivilege	4928	browserwinsvc.exe
Token: SeDebugPrivilege	1228	powershell.exe
Token: SeDebugPrivilege	2604	powershell.exe
Token: SeDebugPrivilege	2708	powershell.exe
Token: SeDebugPrivilege	2528	powershell.exe
Token: SeDebugPrivilege	2676	powershell.exe
Token: SeDebugPrivilege	2348	powershell.exe
Token: SeDebugPrivilege	4220	powershell.exe
Token: SeDebugPrivilege	1464	powershell.exe
Token: SeDebugPrivilege	2960	powershell.exe
Token: SeDebugPrivilege	3224	powershell.exe
Token: SeDebugPrivilege	3012	powershell.exe
Token: SeDebugPrivilege	2968	powershell.exe
Token: SeDebugPrivilege	1068	powershell.exe
Token: SeDebugPrivilege	2612	powershell.exe
Token: SeDebugPrivilege	2512	powershell.exe
Token: SeDebugPrivilege	2656	powershell.exe
Token: SeDebugPrivilege	5364	cmd.exe

Suspicious use of WriteProcessMemory 46 IoCs

description	pid	Process	procid_target
PID 1700 wrote to memory of 4972	1700	skeet.cc.exe	80
PID 1700 wrote to memory of 4972	1700	skeet.cc.exe	80
PID 1700 wrote to memory of 4972	1700	skeet.cc.exe	80
PID 4972 wrote to memory of 4144	4972	WScript.exe	83
PID 4972 wrote to memory of 4144	4972	WScript.exe	83
PID 4972 wrote to memory of 4144	4972	WScript.exe	83
PID 4144 wrote to memory of 4928	4144	cmd.exe	85
PID 4144 wrote to memory of 4928	4144	cmd.exe	85
PID 4928 wrote to memory of 3224	4928	browserwinsvc.exe	132
PID 4928 wrote to memory of 3224	4928	browserwinsvc.exe	132
PID 4928 wrote to memory of 4220	4928	browserwinsvc.exe	133
PID 4928 wrote to memory of 4220	4928	browserwinsvc.exe	133
PID 4928 wrote to memory of 1228	4928	browserwinsvc.exe	134
PID 4928 wrote to memory of 1228	4928	browserwinsvc.exe	134
PID 4928 wrote to memory of 3012	4928	browserwinsvc.exe	135
PID 4928 wrote to memory of 3012	4928	browserwinsvc.exe	135
PID 4928 wrote to memory of 1464	4928	browserwinsvc.exe	136
PID 4928 wrote to memory of 1464	4928	browserwinsvc.exe	136
PID 4928 wrote to memory of 2960	4928	browserwinsvc.exe	137
PID 4928 wrote to memory of 2960	4928	browserwinsvc.exe	137
PID 4928 wrote to memory of 2612	4928	browserwinsvc.exe	138
PID 4928 wrote to memory of 2612	4928	browserwinsvc.exe	138
PID 4928 wrote to memory of 2968	4928	browserwinsvc.exe	140
PID 4928 wrote to memory of 2968	4928	browserwinsvc.exe	140
PID 4928 wrote to memory of 1068	4928	browserwinsvc.exe	141
PID 4928 wrote to memory of 1068	4928	browserwinsvc.exe	141
PID 4928 wrote to memory of 2348	4928	browserwinsvc.exe	142
PID 4928 wrote to memory of 2348	4928	browserwinsvc.exe	142
PID 4928 wrote to memory of 2708	4928	browserwinsvc.exe	143
PID 4928 wrote to memory of 2708	4928	browserwinsvc.exe	143
PID 4928 wrote to memory of 2528	4928	browserwinsvc.exe	145
PID 4928 wrote to memory of 2528	4928	browserwinsvc.exe	145
PID 4928 wrote to memory of 2512	4928	browserwinsvc.exe	146
PID 4928 wrote to memory of 2512	4928	browserwinsvc.exe	146
PID 4928 wrote to memory of 2604	4928	browserwinsvc.exe	147
PID 4928 wrote to memory of 2604	4928	browserwinsvc.exe	147
PID 4928 wrote to memory of 2676	4928	browserwinsvc.exe	149
PID 4928 wrote to memory of 2676	4928	browserwinsvc.exe	149
PID 4928 wrote to memory of 2656	4928	browserwinsvc.exe	150
PID 4928 wrote to memory of 2656	4928	browserwinsvc.exe	150
PID 4928 wrote to memory of 840	4928	browserwinsvc.exe	164
PID 4928 wrote to memory of 840	4928	browserwinsvc.exe	164
PID 840 wrote to memory of 1360	840	cmd.exe	166
PID 840 wrote to memory of 1360	840	cmd.exe	166
PID 840 wrote to memory of 5364	840	cmd.exe	167
PID 840 wrote to memory of 5364	840	cmd.exe	167

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\skeet.cc.exe
"C:\Users\Admin\AppData\Local\Temp\skeet.cc.exe"
1⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1700
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Surrogateprovidercomponentsessionmonitor\GdYaNq.vbe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4972
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Surrogateprovidercomponentsessionmonitor\RS64buulixvrgn.bat" "
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4144
  - - C:\Surrogateprovidercomponentsessionmonitor\browserwinsvc.exe
      "C:\Surrogateprovidercomponentsessionmonitor\browserwinsvc.exe"
      4⤵
      Modifies WinLogon for persistence
      Executes dropped EXE
      Adds Run key to start application
      Drops file in Program Files directory
      Drops file in Windows directory
      Modifies registry class
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:4928
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Surrogateprovidercomponentsessionmonitor\browserwinsvc.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3224
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\WindowsRE\wininit.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4220
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\MSBuild\conhost.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1228
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\backgroundTaskHost.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3012
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Surrogateprovidercomponentsessionmonitor\SppExtComObj.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1464
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\WindowsRE\csrss.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2960
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\RuntimeBroker.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2612
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\Links\winlogon.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2968
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Internet Explorer\en-US\dllhost.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1068
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Adobe\Acrobat Reader DC\dllhost.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2348
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Surrogateprovidercomponentsessionmonitor\backgroundTaskHost.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2708
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\Offline Web Pages\SppExtComObj.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2528
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Windows Photo Viewer\en-US\cmd.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2512
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\WindowsRE\RuntimeBroker.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2604
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Windows Photo Viewer\en-US\dwm.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2676
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\WindowsRE\dllhost.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2656
    - - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\9X9hV07snH.bat"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:840
      - C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        6⤵
        
        PID:1360
      - C:\Program Files\Windows Photo Viewer\en-US\cmd.exe
        
        "C:\Program Files\Windows Photo Viewer\en-US\cmd.exe"
        6⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious behavior: GetForegroundWindowSpam
        Suspicious use of AdjustPrivilegeToken
        
        PID:5364

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 14 /tr "'C:\Recovery\WindowsRE\wininit.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1992

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininit" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\wininit.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2952

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 6 /tr "'C:\Recovery\WindowsRE\wininit.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:756

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 14 /tr "'C:\Program Files\MSBuild\conhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1696

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhost" /sc ONLOGON /tr "'C:\Program Files\MSBuild\conhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:5032

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 9 /tr "'C:\Program Files\MSBuild\conhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3604

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "backgroundTaskHostb" /sc MINUTE /mo 6 /tr "'C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\backgroundTaskHost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1364

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "backgroundTaskHost" /sc ONLOGON /tr "'C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\backgroundTaskHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4264

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "backgroundTaskHostb" /sc MINUTE /mo 9 /tr "'C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\backgroundTaskHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4080

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SppExtComObjS" /sc MINUTE /mo 14 /tr "'C:\Surrogateprovidercomponentsessionmonitor\SppExtComObj.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:5012

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SppExtComObj" /sc ONLOGON /tr "'C:\Surrogateprovidercomponentsessionmonitor\SppExtComObj.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4024

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SppExtComObjS" /sc MINUTE /mo 7 /tr "'C:\Surrogateprovidercomponentsessionmonitor\SppExtComObj.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1420

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 10 /tr "'C:\Recovery\WindowsRE\csrss.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1816

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3148

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 8 /tr "'C:\Recovery\WindowsRE\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3476

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 12 /tr "'C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\RuntimeBroker.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1904

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2040

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 9 /tr "'C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4256

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 9 /tr "'C:\Users\Admin\Links\winlogon.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2872

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogon" /sc ONLOGON /tr "'C:\Users\Admin\Links\winlogon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1412

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 11 /tr "'C:\Users\Admin\Links\winlogon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4852

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 8 /tr "'C:\Program Files (x86)\Internet Explorer\en-US\dllhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4284

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Program Files (x86)\Internet Explorer\en-US\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3752

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 12 /tr "'C:\Program Files (x86)\Internet Explorer\en-US\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3824

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 10 /tr "'C:\Program Files (x86)\Adobe\Acrobat Reader DC\dllhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4880

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Program Files (x86)\Adobe\Acrobat Reader DC\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2308

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 11 /tr "'C:\Program Files (x86)\Adobe\Acrobat Reader DC\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3560

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "backgroundTaskHostb" /sc MINUTE /mo 10 /tr "'C:\Surrogateprovidercomponentsessionmonitor\backgroundTaskHost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3472

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "backgroundTaskHost" /sc ONLOGON /tr "'C:\Surrogateprovidercomponentsessionmonitor\backgroundTaskHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2716

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "backgroundTaskHostb" /sc MINUTE /mo 9 /tr "'C:\Surrogateprovidercomponentsessionmonitor\backgroundTaskHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3520

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SppExtComObjS" /sc MINUTE /mo 5 /tr "'C:\Windows\Offline Web Pages\SppExtComObj.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1760

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SppExtComObj" /sc ONLOGON /tr "'C:\Windows\Offline Web Pages\SppExtComObj.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3956

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SppExtComObjS" /sc MINUTE /mo 9 /tr "'C:\Windows\Offline Web Pages\SppExtComObj.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2212

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "cmdc" /sc MINUTE /mo 9 /tr "'C:\Program Files\Windows Photo Viewer\en-US\cmd.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4424

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "cmd" /sc ONLOGON /tr "'C:\Program Files\Windows Photo Viewer\en-US\cmd.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:388

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "cmdc" /sc MINUTE /mo 10 /tr "'C:\Program Files\Windows Photo Viewer\en-US\cmd.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1096

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 5 /tr "'C:\Recovery\WindowsRE\RuntimeBroker.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3704

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2064

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 7 /tr "'C:\Recovery\WindowsRE\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4816

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 7 /tr "'C:\Program Files\Windows Photo Viewer\en-US\dwm.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1912

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwm" /sc ONLOGON /tr "'C:\Program Files\Windows Photo Viewer\en-US\dwm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4956

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 11 /tr "'C:\Program Files\Windows Photo Viewer\en-US\dwm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:5044

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 8 /tr "'C:\Recovery\WindowsRE\dllhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3936

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3000

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 9 /tr "'C:\Recovery\WindowsRE\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2936

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Scheduled Task/Job

T1053

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Scheduled Task/Job

T1053

Defense Evasion

Modify Registry

T1112

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

GdYaNq.vbe

Path C:\Surrogateprovidercomponentsessionmonitor\GdYaNq.vbe
Size 231B
SHA256 3f7ab00980558804600b2f6d048923ef4c3f541504ec929ddeaf64c84e9e5ea2
MD5 5883718a5a7d15442c10bb5f0ec73490
SHA1 debc58b4e3cd5121a51b1ac23108a3a10993227f
SHA512 0e261e1571f828f9e93778a5c98b7e9669383568d5a915a1b4af1b8273ca17f11ee47f6957b3768bca01ea88936da4541f318f7b91542a65e51db3ab03e62502
MD5 SHA1 SHA512

Submit Download

RS64buulixvrgn.bat

Path C:\Surrogateprovidercomponentsessionmonitor\RS64buulixvrgn.bat
Size 63B
SHA256 80d02a1cb8e68ffbc609a6c4914600604153ce929d46994200f837d354a5a611
MD5 6de687cf7ca366429c953cb49905b70a
SHA1 58e2c1823c038d8da8a2f042672027184066279e
SHA512 6bfa7a07d6adf167458cece0ba3a110479ee7677feb58c0ae9ba5c8913bcdda13664060ce0261abc1668c18831d5c73f6bc570be8595323d46704b810fc024ef
MD5 SHA1 SHA512

Submit Download

browserwinsvc.exe

Path C:\Surrogateprovidercomponentsessionmonitor\browserwinsvc.exe
Size 1.3MB
SHA256 604d318dd35c84d75e070b534558a3f7f5a52e1bfedee8e77fc1d756ac684ca2
MD5 3110f5c22dfea46122ca06ddabd3f84c
SHA1 57de9aa7bfe69bec5a9ba747e6ec0c2f105c256f
SHA512 045787765b26d81346bc4818c1e58520b5c920182e9b84e15e1c0e123d475222420a6114fd56b4ecbb10ac4d34f333dc3c055f9396b39cc8707cf1bf207b4130
SSDEEP 24576:OlESdayd3rFfezUTnrtDENS2i8SIq7bARyGrx0f7MHqeTMa:O2SdtihITtKto7i
MD5 SHA1 SHA512 SSDEEP

Submit Download

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 2KB
SHA256 85b280a39fc31ba1e15fb06102a05b8405ff3b82feb181d4170f04e466dd647c
MD5 627073ee3ca9676911bee35548eff2b8
SHA1 4c4b68c65e2cab9864b51167d710aa29ebdcff2e
SHA512 3c5f6c03e253b83c57e8d6f0334187dbdcdf4fa549eecd36cbc1322dca6d3ca891dc6a019c49ec2eafb88f82d0434299c31e4dfaab123acb42e0546218f311fb
MD5 SHA1 SHA512

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 944B
SHA256 96bfd9dd5883329927fe8c08b8956355a1a6ceb30ceeb5d4252b346df32bc864
MD5 2e8eb51096d6f6781456fef7df731d97
SHA1 ec2aaf851a618fb43c3d040a13a71997c25bda43
SHA512 0a73dc9a49f92d9dd556c2ca2e36761890b3538f355ee1f013e7cf648d8c4d065f28046cd4a167db3dea304d1fbcbcea68d11ce6e12a3f20f8b6c018a60422d2
MD5 SHA1 SHA512

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 944B
SHA256 5c362b53c4a4578d8b57c51e1eac15f7f3b2447e43e0dad5102ecd003d5b41d4
MD5 7d760ca2472bcb9fe9310090d91318ce
SHA1 cb316b8560b38ea16a17626e685d5a501cd31c4a
SHA512 141e8661d7348ebbc1f74f828df956a0c6e4cdb70f3b9d52623c9a30993bfd91da9ed7d8d284b84f173d3e6f47c876fb4a8295110895f44d97fd6cc4c5659c35
MD5 SHA1 SHA512

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 944B
SHA256 9a7f8ca5a6bfcd5839a1cd029a116378bec3be1baec9db19bbe4f127199fb322
MD5 2ab9885ed803576dfcb4df976a3e7ca0
SHA1 49a54d1bb797dca76c41f6af288f9df6c705cf56
SHA512 b1f90e17c21425cd94a7f00438386ae40c7414784a96694432e340e35ba6a60e1176a2871a732474db4bd7080ebdbf4c476b61efa49fedf8208b382252ae25ba
MD5 SHA1 SHA512

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 944B
SHA256 46cf691b4f643e595afd0d9647eab12b858918d679d82617c6609b687628a0a7
MD5 ae67abe49ef8ab8e76e1ca80d8344de1
SHA1 f2b538bbcd7097f414563e512eeef3c83d7963d6
SHA512 101b5ef9d6f834fdc2983f3107bb241b9f5cafefdc7859a664fb569b7d592de70db5c8d16abdc29a430103d20d2f15a20b1b99a895d2c7f0d8e2250d87c8f29a
MD5 SHA1 SHA512

Submit Download

9X9hV07snH.bat

Path C:\Users\Admin\AppData\Local\Temp\9X9hV07snH.bat
Size 216B
SHA256 db076ada7ee69580f6ca6a5b3e36b1b67690ffe23bcf9efa16d7449599b2601c
MD5 a322de135ea39cfa755286e8774bbbdd
SHA1 a1539d897c7d5f30e666ee905e5d1a88bb80ce71
SHA512 b899b2cb4ff33f98e82f04d87cf612f7ea042d331407e37a9d4f1f39e51ac1c1fc8a4654ee09b852188eb31ebbd1a8995c7c24c327b9cb12f38b186a20b3b0fc
MD5 SHA1 SHA512

Submit Download

__PSScriptPolicyTest_1oicu4zr.4xa.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_1oicu4zr.4xa.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
MD5 SHA1 SHA512

Submit Download

memory/1068-223-0x0000018FCF430000-0x0000018FCF59A000-memory.dmp

Download

memory/1228-206-0x000002C3E9F00000-0x000002C3EA06A000-memory.dmp

Download

memory/1228-73-0x000002C3E9BA0000-0x000002C3E9BC2000-memory.dmp

Download

memory/1464-231-0x0000018555B20000-0x0000018555C8A000-memory.dmp

Download

memory/2348-226-0x000002104DF60000-0x000002104E0CA000-memory.dmp

Download

memory/2512-204-0x0000024552200000-0x000002455236A000-memory.dmp

Download

memory/2528-205-0x000001BFFB360000-0x000001BFFB4CA000-memory.dmp

Download

memory/2604-207-0x000002A1AE9C0000-0x000002A1AEB2A000-memory.dmp

Download

memory/2612-219-0x000001DBD0E10000-0x000001DBD0F7A000-memory.dmp

Download

memory/2656-220-0x00000154F2B10000-0x00000154F2C7A000-memory.dmp

Download

memory/2676-211-0x000001C799B00000-0x000001C799C6A000-memory.dmp

Download

memory/2708-203-0x0000025B76A10000-0x0000025B76B7A000-memory.dmp

Download

memory/2960-235-0x000002006C5D0000-0x000002006C73A000-memory.dmp

Download

memory/2968-208-0x00000202784A0000-0x000002027860A000-memory.dmp

Download

memory/3012-202-0x00000279730C0000-0x000002797322A000-memory.dmp

Download

memory/3224-232-0x000002271B540000-0x000002271B6AA000-memory.dmp

Download

memory/4220-218-0x000001D4735C0000-0x000001D47372A000-memory.dmp

Download

memory/4928-15-0x00000000026B0000-0x00000000026CC000-memory.dmp

Download

memory/4928-12-0x00007FFA43393000-0x00007FFA43395000-memory.dmp

Download

memory/4928-16-0x000000001B780000-0x000000001B7D0000-memory.dmp

Download

memory/4928-17-0x0000000000D60000-0x0000000000D68000-memory.dmp

Download

memory/4928-20-0x0000000002800000-0x000000000280A000-memory.dmp

Download

memory/4928-18-0x00000000026D0000-0x00000000026E0000-memory.dmp

Download

memory/4928-21-0x0000000002810000-0x000000000281C000-memory.dmp

Download

memory/4928-14-0x0000000000D10000-0x0000000000D1E000-memory.dmp

Download

memory/4928-13-0x0000000000390000-0x00000000004E0000-memory.dmp

Download

memory/4928-19-0x00000000027F0000-0x00000000027FE000-memory.dmp

Download

memory/5364-239-0x000000001C5B0000-0x000000001C772000-memory.dmp

Download

memory/5364-240-0x000000001CFB0000-0x000000001D4D8000-memory.dmp

Download

memory/5364-244-0x000000001C4E0000-0x000000001C4FE000-memory.dmp

Download

memory/5364-245-0x000000001C500000-0x000000001C50B000-memory.dmp

Download

memory/5364-243-0x000000001B980000-0x000000001B98D000-memory.dmp

Download

memory/5364-242-0x000000001B360000-0x000000001B369000-memory.dmp

Download

memory/5364-241-0x000000001B930000-0x000000001B976000-memory.dmp

Download