dcrat | 0b4aa6685967ac49d493aa595578c445dd75bf839dc95aa48604825c1eef0ee9

Analysis

max time kernel
150s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
26/05/2024, 14:56

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
0b4aa6685967ac49d493aa595578c445dd75bf839dc95aa48604825c1eef0ee9.exe
Size 3.4MB
Sample240526-sbe62aba99
SHA256 0b4aa6685967ac49d493aa595578c445dd75bf839dc95aa48604825c1eef0ee9
MD5 0718b2656d9730a5e356773497e24462
SHA1 e97957b4eaccd7b4600e9ed7fae0bf4a0cfdfe33
SHA512 f58f7c4577021376a83e704dfcd4af91ec33a82619e8618d1a19eb33de201024219851fc4e554c27f74bdbc94a069ee6a922b395b46943c5d87b2a5356deb8a5
SSDEEP 98304:ubIXaItAdMSUEVtrCcvt0pI5oVzYik21D0Dxm3tQT4:u0KIadKEVt5vL5oZYiNyDWM4
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

dcrat evasion infostealer rat spyware stealer trojan

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat

Process spawned unexpected child process 51 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1432	4200	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4740	4200	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2828	4200	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4184	4200	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1436	4200	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4676	4200	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2552	4200	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4416	4200	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3392	4200	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3968	4200	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3080	4200	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	684	4200	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2228	4200	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	656	4200	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4992	4200	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4508	4200	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2144	4200	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3268	4200	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2328	4200	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1224	4200	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2536	4200	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1288	4200	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2612	4200	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5072	4200	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3152	4200	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2948	4200	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3736	4200	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4360	4200	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4532	4200	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3680	4200	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2512	4200	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4072	4200	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3648	4200	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	748	4200	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2860	4200	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4068	4200	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3028	4200	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3988	4200	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4316	4200	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3272	4200	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1684	4200	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1752	4200	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2916	4200	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2044	4200	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4628	4200	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1108	4200	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1792	4200	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4636	4200	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2800	4200	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3732	4200	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	452	4200	schtasks.exe	87

UAC bypass 3 TTPs 6 IoCs

evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	Xsec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	RuntimeBroker.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	RuntimeBroker.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	RuntimeBroker.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	Xsec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	Xsec.exe

DCRat payload 2 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral2/files/0x00070000000233a3-10.dat	dcrat
behavioral2/memory/3316-13-0x0000000000370000-0x0000000000684000-memory.dmp	dcrat

Disables Task Manager via registry modification
evasion

Checks computer location settings 2 TTPs 4 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Control Panel\International\Geo\Nation	0b4aa6685967ac49d493aa595578c445dd75bf839dc95aa48604825c1eef0ee9.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Control Panel\International\Geo\Nation	WScript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Control Panel\International\Geo\Nation	Xsec.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Control Panel\International\Geo\Nation	RuntimeBroker.exe

Executes dropped EXE 2 IoCs

pid	Process
3316	Xsec.exe
4548	RuntimeBroker.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Checks whether UAC is enabled 1 TTPs 4 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	RuntimeBroker.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Xsec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	Xsec.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	RuntimeBroker.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
22	pastebin.com
23	pastebin.com

Drops file in Program Files directory 14 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Windows Defender\de-DE\System.exe	Xsec.exe
File created	C:\Program Files\Microsoft Office 15\ClientX64\22eafd247d37c3	Xsec.exe
File created	C:\Program Files (x86)\Windows Photo Viewer\en-US\sppsvc.exe	Xsec.exe
File created	C:\Program Files (x86)\Microsoft.NET\Primary Interop Assemblies\RuntimeBroker.exe	Xsec.exe
File created	C:\Program Files (x86)\Windows Sidebar\Gadgets\22eafd247d37c3	Xsec.exe
File created	C:\Program Files (x86)\Windows Photo Viewer\en-US\0a1fd5f707cd16	Xsec.exe
File created	C:\Program Files\7-Zip\TextInputHost.exe	Xsec.exe
File created	C:\Program Files\Microsoft Office 15\ClientX64\TextInputHost.exe	Xsec.exe
File created	C:\Program Files (x86)\Windows Defender\de-DE\27d1bcfc3c54e0	Xsec.exe
File created	C:\Program Files\Windows Security\BrowserCore\explorer.exe	Xsec.exe
File created	C:\Program Files\Windows Security\BrowserCore\7a0fd90576e088	Xsec.exe
File created	C:\Program Files (x86)\Windows Sidebar\Gadgets\TextInputHost.exe	Xsec.exe
File created	C:\Program Files\7-Zip\22eafd247d37c3	Xsec.exe
File created	C:\Program Files (x86)\Microsoft.NET\Primary Interop Assemblies\9e8d7a4ca61bd9	Xsec.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\appcompat\appraiser\csrss.exe	Xsec.exe
File created	C:\Windows\appcompat\appraiser\886983d96e3d3e	Xsec.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 51 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
2612	schtasks.exe
3736	schtasks.exe
4532	schtasks.exe
1792	schtasks.exe
4416	schtasks.exe
3392	schtasks.exe
5072	schtasks.exe
3680	schtasks.exe
2916	schtasks.exe
2144	schtasks.exe
3028	schtasks.exe
4740	schtasks.exe
4184	schtasks.exe
3080	schtasks.exe
452	schtasks.exe
2860	schtasks.exe
2512	schtasks.exe
748	schtasks.exe
3272	schtasks.exe
1752	schtasks.exe
1432	schtasks.exe
2552	schtasks.exe
2948	schtasks.exe
4072	schtasks.exe
4636	schtasks.exe
3732	schtasks.exe
4676	schtasks.exe
1224	schtasks.exe
2536	schtasks.exe
1436	schtasks.exe
4316	schtasks.exe
2044	schtasks.exe
4628	schtasks.exe
2828	schtasks.exe
4508	schtasks.exe
4068	schtasks.exe
684	schtasks.exe
4360	schtasks.exe
2800	schtasks.exe
656	schtasks.exe
3152	schtasks.exe
3988	schtasks.exe
1288	schtasks.exe
1108	schtasks.exe
3648	schtasks.exe
2228	schtasks.exe
2328	schtasks.exe
1684	schtasks.exe
3968	schtasks.exe
4992	schtasks.exe
3268	schtasks.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000_Classes\Local Settings	0b4aa6685967ac49d493aa595578c445dd75bf839dc95aa48604825c1eef0ee9.exe
Key created	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000_Classes\Local Settings	Xsec.exe
Key created	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000_Classes\Local Settings	RuntimeBroker.exe

Modifies registry key 1 TTPs 1 IoCs

Modify Registry

T1112

pid	Process
3540	reg.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3316	Xsec.exe
3316	Xsec.exe
3316	Xsec.exe
3316	Xsec.exe
3316	Xsec.exe
3316	Xsec.exe
3316	Xsec.exe
3316	Xsec.exe
3316	Xsec.exe
4548	RuntimeBroker.exe
4548	RuntimeBroker.exe
4548	RuntimeBroker.exe
4548	RuntimeBroker.exe
4548	RuntimeBroker.exe
4548	RuntimeBroker.exe
4548	RuntimeBroker.exe
4548	RuntimeBroker.exe
4548	RuntimeBroker.exe
4548	RuntimeBroker.exe
4548	RuntimeBroker.exe
4548	RuntimeBroker.exe
4548	RuntimeBroker.exe
4548	RuntimeBroker.exe
4548	RuntimeBroker.exe
4548	RuntimeBroker.exe
4548	RuntimeBroker.exe
4548	RuntimeBroker.exe
4548	RuntimeBroker.exe
4548	RuntimeBroker.exe
4548	RuntimeBroker.exe
4548	RuntimeBroker.exe
4548	RuntimeBroker.exe
4548	RuntimeBroker.exe
4548	RuntimeBroker.exe
4548	RuntimeBroker.exe
4548	RuntimeBroker.exe
4548	RuntimeBroker.exe
4548	RuntimeBroker.exe
4548	RuntimeBroker.exe
4548	RuntimeBroker.exe
4548	RuntimeBroker.exe
4548	RuntimeBroker.exe
4548	RuntimeBroker.exe
4548	RuntimeBroker.exe
4548	RuntimeBroker.exe
4548	RuntimeBroker.exe
4548	RuntimeBroker.exe
4548	RuntimeBroker.exe
4548	RuntimeBroker.exe
4548	RuntimeBroker.exe
4548	RuntimeBroker.exe
4548	RuntimeBroker.exe
4548	RuntimeBroker.exe
4548	RuntimeBroker.exe
4548	RuntimeBroker.exe
4548	RuntimeBroker.exe
4548	RuntimeBroker.exe
4548	RuntimeBroker.exe
4548	RuntimeBroker.exe
4548	RuntimeBroker.exe
4548	RuntimeBroker.exe
4548	RuntimeBroker.exe
4548	RuntimeBroker.exe
4548	RuntimeBroker.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
4548	RuntimeBroker.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeDebugPrivilege	3316	Xsec.exe
Token: SeDebugPrivilege	4548	RuntimeBroker.exe
Token: SeBackupPrivilege	4508	vssvc.exe
Token: SeRestorePrivilege	4508	vssvc.exe
Token: SeAuditPrivilege	4508	vssvc.exe

Suspicious use of WriteProcessMemory 21 IoCs

description	pid	Process	procid_target
PID 528 wrote to memory of 2392	528	0b4aa6685967ac49d493aa595578c445dd75bf839dc95aa48604825c1eef0ee9.exe	83
PID 528 wrote to memory of 2392	528	0b4aa6685967ac49d493aa595578c445dd75bf839dc95aa48604825c1eef0ee9.exe	83
PID 528 wrote to memory of 2392	528	0b4aa6685967ac49d493aa595578c445dd75bf839dc95aa48604825c1eef0ee9.exe	83
PID 2392 wrote to memory of 1272	2392	WScript.exe	88
PID 2392 wrote to memory of 1272	2392	WScript.exe	88
PID 2392 wrote to memory of 1272	2392	WScript.exe	88
PID 1272 wrote to memory of 3316	1272	cmd.exe	90
PID 1272 wrote to memory of 3316	1272	cmd.exe	90
PID 3316 wrote to memory of 1124	3316	Xsec.exe	143
PID 3316 wrote to memory of 1124	3316	Xsec.exe	143
PID 1272 wrote to memory of 3540	1272	cmd.exe	145
PID 1272 wrote to memory of 3540	1272	cmd.exe	145
PID 1272 wrote to memory of 3540	1272	cmd.exe	145
PID 1124 wrote to memory of 528	1124	cmd.exe	146
PID 1124 wrote to memory of 528	1124	cmd.exe	146
PID 1124 wrote to memory of 4548	1124	cmd.exe	149
PID 1124 wrote to memory of 4548	1124	cmd.exe	149
PID 4548 wrote to memory of 4184	4548	RuntimeBroker.exe	150
PID 4548 wrote to memory of 4184	4548	RuntimeBroker.exe	150
PID 4548 wrote to memory of 2968	4548	RuntimeBroker.exe	151
PID 4548 wrote to memory of 2968	4548	RuntimeBroker.exe	151

System policy modification 1 TTPs 6 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	Xsec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	RuntimeBroker.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	RuntimeBroker.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	RuntimeBroker.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	Xsec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	Xsec.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\0b4aa6685967ac49d493aa595578c445dd75bf839dc95aa48604825c1eef0ee9.exe
"C:\Users\Admin\AppData\Local\Temp\0b4aa6685967ac49d493aa595578c445dd75bf839dc95aa48604825c1eef0ee9.exe"
1⤵
- Checks computer location settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:528
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\BlockWinHostnet\Hostnet\Sec_Exec\EuTvLCPQkcrvAlZ1rIR5sP2f.vbe"
  2⤵
  - Checks computer location settings
  - Suspicious use of WriteProcessMemory
  PID:2392
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\BlockWinHostnet\Hostnet\Sec_Exec\TKgbn4JzaGo.bat" "
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1272
  - - C:\Users\Admin\AppData\Roaming\BlockWinHostnet\Hostnet\Sec_Exec\Xsec.exe
      "C:\Users\Admin\AppData\Roaming\BlockWinHostnet\Hostnet\Sec_Exec\Xsec.exe"
      4⤵
      UAC bypass
      Checks computer location settings
      Executes dropped EXE
      Checks whether UAC is enabled
      Drops file in Program Files directory
      Drops file in Windows directory
      Modifies registry class
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      System policy modification
      PID:3316
    - - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\Oj7zvfZzUa.bat"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:1124
      - C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        6⤵
        
        PID:528
      - C:\Program Files (x86)\Microsoft.NET\Primary Interop Assemblies\RuntimeBroker.exe
        
        "C:\Program Files (x86)\Microsoft.NET\Primary Interop Assemblies\RuntimeBroker.exe"
        6⤵
        UAC bypass
        Checks computer location settings
        Executes dropped EXE
        Checks whether UAC is enabled
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious behavior: GetForegroundWindowSpam
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        System policy modification
        
        PID:4548
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\d680be45-736a-4984-92c4-398971288b43.vbs"
        7⤵
        
        PID:4184
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\c64749e7-df28-40be-bbd6-7c973c7dc81c.vbs"
        7⤵
        
        PID:2968
  - - C:\Windows\SysWOW64\reg.exe
      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f
      4⤵
      Modifies registry key
      PID:3540

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "upfcu" /sc MINUTE /mo 9 /tr "'C:\Recovery\WindowsRE\upfc.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1432

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "upfc" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\upfc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4740

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "upfcu" /sc MINUTE /mo 14 /tr "'C:\Recovery\WindowsRE\upfc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2828

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 14 /tr "'C:\Users\Admin\My Documents\RuntimeBroker.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4184

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Users\Admin\My Documents\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1436

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 5 /tr "'C:\Users\Admin\My Documents\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4676

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "TextInputHostT" /sc MINUTE /mo 7 /tr "'C:\Program Files\Microsoft Office 15\ClientX64\TextInputHost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2552

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "TextInputHost" /sc ONLOGON /tr "'C:\Program Files\Microsoft Office 15\ClientX64\TextInputHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4416

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "TextInputHostT" /sc MINUTE /mo 11 /tr "'C:\Program Files\Microsoft Office 15\ClientX64\TextInputHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3392

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 5 /tr "'C:\Recovery\WindowsRE\csrss.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3968

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3080

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 5 /tr "'C:\Recovery\WindowsRE\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:684

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 8 /tr "'C:\Recovery\WindowsRE\services.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2228

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "services" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\services.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:656

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 12 /tr "'C:\Recovery\WindowsRE\services.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4992

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 6 /tr "'C:\Program Files (x86)\Windows Defender\de-DE\System.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4508

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "System" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Defender\de-DE\System.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2144

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 8 /tr "'C:\Program Files (x86)\Windows Defender\de-DE\System.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3268

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "XsecX" /sc MINUTE /mo 5 /tr "'C:\Users\Default User\Xsec.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2328

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Xsec" /sc ONLOGON /tr "'C:\Users\Default User\Xsec.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1224

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "XsecX" /sc MINUTE /mo 13 /tr "'C:\Users\Default User\Xsec.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2536

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 8 /tr "'C:\Program Files\Windows Security\BrowserCore\explorer.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1288

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorer" /sc ONLOGON /tr "'C:\Program Files\Windows Security\BrowserCore\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2612

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 9 /tr "'C:\Program Files\Windows Security\BrowserCore\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:5072

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 6 /tr "'C:\Users\All Users\Documents\lsass.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3152

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsass" /sc ONLOGON /tr "'C:\Users\All Users\Documents\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2948

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 10 /tr "'C:\Users\All Users\Documents\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3736

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 8 /tr "'C:\Windows\appcompat\appraiser\csrss.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4360

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Windows\appcompat\appraiser\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4532

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 13 /tr "'C:\Windows\appcompat\appraiser\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3680

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "TextInputHostT" /sc MINUTE /mo 7 /tr "'C:\Program Files (x86)\Windows Sidebar\Gadgets\TextInputHost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2512

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "TextInputHost" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Sidebar\Gadgets\TextInputHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4072

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "TextInputHostT" /sc MINUTE /mo 9 /tr "'C:\Program Files (x86)\Windows Sidebar\Gadgets\TextInputHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3648

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sihosts" /sc MINUTE /mo 7 /tr "'C:\Users\Default\Local Settings\sihost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:748

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sihost" /sc ONLOGON /tr "'C:\Users\Default\Local Settings\sihost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2860

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sihosts" /sc MINUTE /mo 13 /tr "'C:\Users\Default\Local Settings\sihost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4068

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 6 /tr "'C:\Program Files (x86)\Windows Photo Viewer\en-US\sppsvc.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3028

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvc" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Photo Viewer\en-US\sppsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3988

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 14 /tr "'C:\Program Files (x86)\Windows Photo Viewer\en-US\sppsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4316

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "TextInputHostT" /sc MINUTE /mo 11 /tr "'C:\Program Files\7-Zip\TextInputHost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3272

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "TextInputHost" /sc ONLOGON /tr "'C:\Program Files\7-Zip\TextInputHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1684

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "TextInputHostT" /sc MINUTE /mo 7 /tr "'C:\Program Files\7-Zip\TextInputHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1752

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 8 /tr "'C:\Users\Default User\WmiPrvSE.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2916

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSE" /sc ONLOGON /tr "'C:\Users\Default User\WmiPrvSE.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2044

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 6 /tr "'C:\Users\Default User\WmiPrvSE.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4628

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 14 /tr "'C:\Program Files (x86)\Microsoft.NET\Primary Interop Assemblies\RuntimeBroker.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1792

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Program Files (x86)\Microsoft.NET\Primary Interop Assemblies\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1108

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 6 /tr "'C:\Program Files (x86)\Microsoft.NET\Primary Interop Assemblies\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4636

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "TextInputHostT" /sc MINUTE /mo 7 /tr "'C:\Users\All Users\regid.1991-06.com.microsoft\TextInputHost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2800

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "TextInputHost" /sc ONLOGON /tr "'C:\Users\All Users\regid.1991-06.com.microsoft\TextInputHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3732

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "TextInputHostT" /sc MINUTE /mo 11 /tr "'C:\Users\All Users\regid.1991-06.com.microsoft\TextInputHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:452

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4508

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
PID:3164

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Scheduled Task/Job

T1053

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Scheduled Task/Job

T1053

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Oj7zvfZzUa.bat

Path C:\Users\Admin\AppData\Local\Temp\Oj7zvfZzUa.bat
Size 246B
SHA256 71fa8f7b39d76319c118907fb5d1201b3c5b6609046c86f7d08f25c80953e570
MD5 83b313d0cfac277034684611837012e7
SHA1 807d8d5613aadaaa2b14145c8b97ef31b58312fb
SHA512 33b9d704f98684fccff1cb33589ae961444d922a920732b45ee93a4c84dfd83790297c80b45eef7642fbfd34db3049ed3207624a2621d6b3f1365017320a7008
MD5 SHA1 SHA512

Submit Download

c64749e7-df28-40be-bbd6-7c973c7dc81c.vbs

Path C:\Users\Admin\AppData\Local\Temp\c64749e7-df28-40be-bbd6-7c973c7dc81c.vbs
Size 533B
SHA256 770a9a9d197ed615845e58531d25e0331e1a27165208daf4be15bfd8268afb1d
MD5 2903c10f6ec6d9bc8fd6c1ff1f3ccc64
SHA1 00f062d2a355b266b2fc3974fca03d4239b84364
SHA512 eafa83758a9f47dce04976274879e58725bcec39535ca43482dc5755e321ca457e6920d9a3ff4a55df8e0779d702a1ec574a2f6d02d2057ff6dd99433073b790
MD5 SHA1 SHA512

Submit Download

d680be45-736a-4984-92c4-398971288b43.vbs

Path C:\Users\Admin\AppData\Local\Temp\d680be45-736a-4984-92c4-398971288b43.vbs
Size 757B
SHA256 2331319dc04971e33094bbe7e0fd0d23c8f04d74e8e46c86568bbb4eedfa6cb3
MD5 9e41c5b2d2c19d85a684c3d12b78bee8
SHA1 ac6ddec8868bbd613100fe95db2e390147de4ce6
SHA512 7b7e0cdf3c386d70586a2d9d22b7aae4bfa5dae836c08d9dcb06b3de50bfb3eb9ce91b1ef697c566e6046b71ecc988b804178a36c10d52aecd0e5b3cbdc06fe0
MD5 SHA1 SHA512

Submit Download

EuTvLCPQkcrvAlZ1rIR5sP2f.vbe

Path C:\Users\Admin\AppData\Roaming\BlockWinHostnet\Hostnet\Sec_Exec\EuTvLCPQkcrvAlZ1rIR5sP2f.vbe
Size 227B
SHA256 b1db61ec04e4ce9e14e903ef0dab6bbb44da57f390f899130b1d7302a96bbde9
MD5 e5e4945a3acda8504795cbcba7f7ab39
SHA1 8c9b430ab5028430ee52bc66b8171fc86dbd0152
SHA512 c672570240e0ba421f52428d71455d3d1f6a4e7b9fa4cbc4fd0bb2ed9890fd8deb61cd10be8bd73f197f1dc93822b5638be96ed452c9c61f64be70a2cef207df
MD5 SHA1 SHA512

Submit Download

TKgbn4JzaGo.bat

Path C:\Users\Admin\AppData\Roaming\BlockWinHostnet\Hostnet\Sec_Exec\TKgbn4JzaGo.bat
Size 165B
SHA256 c1921bd76587dfebca55b8fe6ad4baf45cd189b1f2d93f803327ae9d3cca3a8a
MD5 eda5df5294922ff3df9a1838907d99bf
SHA1 3421763abeca4c9486a4603e107d1c9b5d36d99c
SHA512 145500d4623d5c631fdcbc3315bc1af2a34301a528f02b747476890b246ce765e0b7af3aa898e1204b6de9afc762932690476039684dc3c7d9d3b2bb887e2e17
MD5 SHA1 SHA512

Submit Download

Xsec.exe

Path C:\Users\Admin\AppData\Roaming\BlockWinHostnet\Hostnet\Sec_Exec\Xsec.exe
Size 3.1MB
SHA256 276ff9f0bc857f8cba727cb86ca4289cca4be1bb8c7c31c0c9c65f5b98a36821
MD5 ae38336481097a8262174b70bb3d65ef
SHA1 248c710a7a87ade1e7fa40815fa71e78e999c34f
SHA512 85d95d7ae46c45c8721d672f6849ab8255dda688751aa60c30f6898338a78fd539ec1974fe8faad1143d6211dfe693cb7ff0b315fbc505c5a90020ca128c2b19
SSDEEP 98304:7XaItAdMSUEVtrCcvt0pI5oVzYik21D0Dxm3tQT:7KIadKEVt5vL5oZYiNyDWM
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/3316-27-0x000000001B2B0000-0x000000001B2B8000-memory.dmp

Download

memory/3316-30-0x000000001B2E0000-0x000000001B2F2000-memory.dmp

Download

memory/3316-17-0x000000001B260000-0x000000001B2B0000-memory.dmp

Download

memory/3316-19-0x000000001B1D0000-0x000000001B1E0000-memory.dmp

Download

memory/3316-20-0x000000001B1E0000-0x000000001B1F6000-memory.dmp

Download

memory/3316-18-0x000000001B1C0000-0x000000001B1C8000-memory.dmp

Download

memory/3316-21-0x000000001B210000-0x000000001B218000-memory.dmp

Download

memory/3316-22-0x000000001B220000-0x000000001B232000-memory.dmp

Download

memory/3316-23-0x000000001B230000-0x000000001B240000-memory.dmp

Download

memory/3316-24-0x000000001B240000-0x000000001B24A000-memory.dmp

Download

memory/3316-25-0x000000001BB00000-0x000000001BB56000-memory.dmp

Download

memory/3316-26-0x000000001B250000-0x000000001B25C000-memory.dmp

Download

memory/3316-15-0x0000000002710000-0x0000000002718000-memory.dmp

Download

memory/3316-28-0x000000001B2C0000-0x000000001B2CC000-memory.dmp

Download

memory/3316-29-0x000000001B2D0000-0x000000001B2D8000-memory.dmp

Download

memory/3316-16-0x000000001B1A0000-0x000000001B1BC000-memory.dmp

Download

memory/3316-31-0x000000001C0A0000-0x000000001C5C8000-memory.dmp

Download

memory/3316-32-0x000000001BB70000-0x000000001BB7C000-memory.dmp

Download

memory/3316-33-0x000000001BB80000-0x000000001BB8C000-memory.dmp

Download

memory/3316-34-0x000000001BB90000-0x000000001BB9C000-memory.dmp

Download

memory/3316-36-0x000000001BDA0000-0x000000001BDAA000-memory.dmp

Download

memory/3316-35-0x000000001BE10000-0x000000001BE18000-memory.dmp

Download

memory/3316-40-0x000000001BDE0000-0x000000001BDEA000-memory.dmp

Download

memory/3316-39-0x000000001BDD0000-0x000000001BDD8000-memory.dmp

Download

memory/3316-38-0x000000001BDC0000-0x000000001BDC8000-memory.dmp

Download

memory/3316-37-0x000000001BDB0000-0x000000001BDBE000-memory.dmp

Download

memory/3316-41-0x000000001BDF0000-0x000000001BDFC000-memory.dmp

Download

memory/3316-14-0x0000000002700000-0x000000000270E000-memory.dmp

Download

memory/3316-12-0x00007FF8B1603000-0x00007FF8B1605000-memory.dmp

Download

memory/3316-13-0x0000000000370000-0x0000000000684000-memory.dmp

Download

memory/4548-85-0x000000001D480000-0x000000001D492000-memory.dmp

Download