dcrat | 79b24566d743b542e79e4db241fe21c380a7a4a727b6900767854e0eb14cb17a

Analysis

max time kernel
147s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
11/06/2024, 16:26

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
a230b93fca18aaa16370ce5969ca90ad.exe
Size 828KB
Sample240611-txh1gstdnj
SHA256 79b24566d743b542e79e4db241fe21c380a7a4a727b6900767854e0eb14cb17a
MD5 a230b93fca18aaa16370ce5969ca90ad
SHA1 0fa0279b55a899e44d47fe0539e0d3daf3422716
SHA512 dad9983b7355f3271b943bb795d6f4d1ed982a46bf7ed9ab637c7c3b5c1ae6afa2fb4476fb167b4f5f78b1625416219b08412bcff41da3b73aebca48e0db445b
SSDEEP 12288:uohTZpqQJCCw8rc/qGIfVTD/NOKLsBW3L+PQF5kMX7b:nFpqQDrc/q9VVLsBwcMLb
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

dcrat infostealer persistence rat

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat

Modifies WinLogon for persistence 2 TTPs 16 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files (x86)\\Microsoft\\winlogon.exe\", \"C:\\Windows\\Prefetch\\ReadyBoot\\taskhostw.exe\", \"C:\\Windows\\SchCache\\SppExtComObj.exe\", \"C:\\Windows\\Globalization\\ICU\\spoolsv.exe\", \"C:\\Windows\\ShellComponents\\upfc.exe\", \"C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\sysmon.exe\", \"C:\\Windows\\en-US\\csrss.exe\", \"C:\\Windows\\bcastdvr\\smss.exe\", \"C:\\Program Files (x86)\\Windows Defender\\uk-UA\\OfficeClickToRun.exe\", \"C:\\Users\\All Users\\Registry.exe\", \"C:\\Windows\\IdentityCRL\\INT\\dllhost.exe\""	a230b93fca18aaa16370ce5969ca90ad.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files (x86)\\Microsoft\\winlogon.exe\""	a230b93fca18aaa16370ce5969ca90ad.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files (x86)\\Microsoft\\winlogon.exe\", \"C:\\Windows\\Prefetch\\ReadyBoot\\taskhostw.exe\", \"C:\\Windows\\SchCache\\SppExtComObj.exe\", \"C:\\Windows\\Globalization\\ICU\\spoolsv.exe\", \"C:\\Windows\\ShellComponents\\upfc.exe\""	a230b93fca18aaa16370ce5969ca90ad.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files (x86)\\Microsoft\\winlogon.exe\", \"C:\\Windows\\Prefetch\\ReadyBoot\\taskhostw.exe\", \"C:\\Windows\\SchCache\\SppExtComObj.exe\", \"C:\\Windows\\Globalization\\ICU\\spoolsv.exe\", \"C:\\Windows\\ShellComponents\\upfc.exe\", \"C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\sysmon.exe\""	a230b93fca18aaa16370ce5969ca90ad.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files (x86)\\Microsoft\\winlogon.exe\", \"C:\\Windows\\Prefetch\\ReadyBoot\\taskhostw.exe\", \"C:\\Windows\\SchCache\\SppExtComObj.exe\", \"C:\\Windows\\Globalization\\ICU\\spoolsv.exe\", \"C:\\Windows\\ShellComponents\\upfc.exe\", \"C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\sysmon.exe\", \"C:\\Windows\\en-US\\csrss.exe\""	a230b93fca18aaa16370ce5969ca90ad.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files (x86)\\Microsoft\\winlogon.exe\", \"C:\\Windows\\Prefetch\\ReadyBoot\\taskhostw.exe\""	a230b93fca18aaa16370ce5969ca90ad.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files (x86)\\Microsoft\\winlogon.exe\", \"C:\\Windows\\Prefetch\\ReadyBoot\\taskhostw.exe\", \"C:\\Windows\\SchCache\\SppExtComObj.exe\""	a230b93fca18aaa16370ce5969ca90ad.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files (x86)\\Microsoft\\winlogon.exe\", \"C:\\Windows\\Prefetch\\ReadyBoot\\taskhostw.exe\", \"C:\\Windows\\SchCache\\SppExtComObj.exe\", \"C:\\Windows\\Globalization\\ICU\\spoolsv.exe\", \"C:\\Windows\\ShellComponents\\upfc.exe\", \"C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\sysmon.exe\", \"C:\\Windows\\en-US\\csrss.exe\", \"C:\\Windows\\bcastdvr\\smss.exe\", \"C:\\Program Files (x86)\\Windows Defender\\uk-UA\\OfficeClickToRun.exe\", \"C:\\Users\\All Users\\Registry.exe\", \"C:\\Windows\\IdentityCRL\\INT\\dllhost.exe\", \"C:\\Users\\Admin\\Desktop\\backgroundTaskHost.exe\", \"C:\\Users\\Public\\Documents\\My Videos\\winlogon.exe\", \"C:\\Recovery\\WindowsRE\\SearchApp.exe\", \"C:\\Recovery\\WindowsRE\\StartMenuExperienceHost.exe\""	a230b93fca18aaa16370ce5969ca90ad.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files (x86)\\Microsoft\\winlogon.exe\", \"C:\\Windows\\Prefetch\\ReadyBoot\\taskhostw.exe\", \"C:\\Windows\\SchCache\\SppExtComObj.exe\", \"C:\\Windows\\Globalization\\ICU\\spoolsv.exe\", \"C:\\Windows\\ShellComponents\\upfc.exe\", \"C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\sysmon.exe\", \"C:\\Windows\\en-US\\csrss.exe\", \"C:\\Windows\\bcastdvr\\smss.exe\", \"C:\\Program Files (x86)\\Windows Defender\\uk-UA\\OfficeClickToRun.exe\""	a230b93fca18aaa16370ce5969ca90ad.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files (x86)\\Microsoft\\winlogon.exe\", \"C:\\Windows\\Prefetch\\ReadyBoot\\taskhostw.exe\", \"C:\\Windows\\SchCache\\SppExtComObj.exe\", \"C:\\Windows\\Globalization\\ICU\\spoolsv.exe\", \"C:\\Windows\\ShellComponents\\upfc.exe\", \"C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\sysmon.exe\", \"C:\\Windows\\en-US\\csrss.exe\", \"C:\\Windows\\bcastdvr\\smss.exe\", \"C:\\Program Files (x86)\\Windows Defender\\uk-UA\\OfficeClickToRun.exe\", \"C:\\Users\\All Users\\Registry.exe\", \"C:\\Windows\\IdentityCRL\\INT\\dllhost.exe\", \"C:\\Users\\Admin\\Desktop\\backgroundTaskHost.exe\""	a230b93fca18aaa16370ce5969ca90ad.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files (x86)\\Microsoft\\winlogon.exe\", \"C:\\Windows\\Prefetch\\ReadyBoot\\taskhostw.exe\", \"C:\\Windows\\SchCache\\SppExtComObj.exe\", \"C:\\Windows\\Globalization\\ICU\\spoolsv.exe\", \"C:\\Windows\\ShellComponents\\upfc.exe\", \"C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\sysmon.exe\", \"C:\\Windows\\en-US\\csrss.exe\", \"C:\\Windows\\bcastdvr\\smss.exe\", \"C:\\Program Files (x86)\\Windows Defender\\uk-UA\\OfficeClickToRun.exe\", \"C:\\Users\\All Users\\Registry.exe\", \"C:\\Windows\\IdentityCRL\\INT\\dllhost.exe\", \"C:\\Users\\Admin\\Desktop\\backgroundTaskHost.exe\", \"C:\\Users\\Public\\Documents\\My Videos\\winlogon.exe\", \"C:\\Recovery\\WindowsRE\\SearchApp.exe\""	a230b93fca18aaa16370ce5969ca90ad.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files (x86)\\Microsoft\\winlogon.exe\", \"C:\\Windows\\Prefetch\\ReadyBoot\\taskhostw.exe\", \"C:\\Windows\\SchCache\\SppExtComObj.exe\", \"C:\\Windows\\Globalization\\ICU\\spoolsv.exe\", \"C:\\Windows\\ShellComponents\\upfc.exe\", \"C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\sysmon.exe\", \"C:\\Windows\\en-US\\csrss.exe\", \"C:\\Windows\\bcastdvr\\smss.exe\", \"C:\\Program Files (x86)\\Windows Defender\\uk-UA\\OfficeClickToRun.exe\", \"C:\\Users\\All Users\\Registry.exe\", \"C:\\Windows\\IdentityCRL\\INT\\dllhost.exe\", \"C:\\Users\\Admin\\Desktop\\backgroundTaskHost.exe\", \"C:\\Users\\Public\\Documents\\My Videos\\winlogon.exe\", \"C:\\Recovery\\WindowsRE\\SearchApp.exe\", \"C:\\Recovery\\WindowsRE\\StartMenuExperienceHost.exe\", \"C:\\Recovery\\WindowsRE\\RuntimeBroker.exe\""	a230b93fca18aaa16370ce5969ca90ad.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files (x86)\\Microsoft\\winlogon.exe\", \"C:\\Windows\\Prefetch\\ReadyBoot\\taskhostw.exe\", \"C:\\Windows\\SchCache\\SppExtComObj.exe\", \"C:\\Windows\\Globalization\\ICU\\spoolsv.exe\""	a230b93fca18aaa16370ce5969ca90ad.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files (x86)\\Microsoft\\winlogon.exe\", \"C:\\Windows\\Prefetch\\ReadyBoot\\taskhostw.exe\", \"C:\\Windows\\SchCache\\SppExtComObj.exe\", \"C:\\Windows\\Globalization\\ICU\\spoolsv.exe\", \"C:\\Windows\\ShellComponents\\upfc.exe\", \"C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\sysmon.exe\", \"C:\\Windows\\en-US\\csrss.exe\", \"C:\\Windows\\bcastdvr\\smss.exe\""	a230b93fca18aaa16370ce5969ca90ad.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files (x86)\\Microsoft\\winlogon.exe\", \"C:\\Windows\\Prefetch\\ReadyBoot\\taskhostw.exe\", \"C:\\Windows\\SchCache\\SppExtComObj.exe\", \"C:\\Windows\\Globalization\\ICU\\spoolsv.exe\", \"C:\\Windows\\ShellComponents\\upfc.exe\", \"C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\sysmon.exe\", \"C:\\Windows\\en-US\\csrss.exe\", \"C:\\Windows\\bcastdvr\\smss.exe\", \"C:\\Program Files (x86)\\Windows Defender\\uk-UA\\OfficeClickToRun.exe\", \"C:\\Users\\All Users\\Registry.exe\""	a230b93fca18aaa16370ce5969ca90ad.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files (x86)\\Microsoft\\winlogon.exe\", \"C:\\Windows\\Prefetch\\ReadyBoot\\taskhostw.exe\", \"C:\\Windows\\SchCache\\SppExtComObj.exe\", \"C:\\Windows\\Globalization\\ICU\\spoolsv.exe\", \"C:\\Windows\\ShellComponents\\upfc.exe\", \"C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\sysmon.exe\", \"C:\\Windows\\en-US\\csrss.exe\", \"C:\\Windows\\bcastdvr\\smss.exe\", \"C:\\Program Files (x86)\\Windows Defender\\uk-UA\\OfficeClickToRun.exe\", \"C:\\Users\\All Users\\Registry.exe\", \"C:\\Windows\\IdentityCRL\\INT\\dllhost.exe\", \"C:\\Users\\Admin\\Desktop\\backgroundTaskHost.exe\", \"C:\\Users\\Public\\Documents\\My Videos\\winlogon.exe\""	a230b93fca18aaa16370ce5969ca90ad.exe

Process spawned unexpected child process 48 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5076	876	schtasks.exe	81
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1752	876	schtasks.exe	81
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3500	876	schtasks.exe	81
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4624	876	schtasks.exe	81
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4772	876	schtasks.exe	81
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3748	876	schtasks.exe	81
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4748	876	schtasks.exe	81
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3884	876	schtasks.exe	81
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3052	876	schtasks.exe	81
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1560	876	schtasks.exe	81
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1388	876	schtasks.exe	81
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3144	876	schtasks.exe	81
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2204	876	schtasks.exe	81
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2940	876	schtasks.exe	81
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4996	876	schtasks.exe	81
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4392	876	schtasks.exe	81
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4608	876	schtasks.exe	81
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3448	876	schtasks.exe	81
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3868	876	schtasks.exe	81
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4920	876	schtasks.exe	81
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1472	876	schtasks.exe	81
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1916	876	schtasks.exe	81
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1824	876	schtasks.exe	81
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1460	876	schtasks.exe	81
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4308	876	schtasks.exe	81
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	512	876	schtasks.exe	81
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3520	876	schtasks.exe	81
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2680	876	schtasks.exe	81
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4180	876	schtasks.exe	81
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4652	876	schtasks.exe	81
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5104	876	schtasks.exe	81
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4820	876	schtasks.exe	81
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	868	876	schtasks.exe	81
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3200	876	schtasks.exe	81
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4168	876	schtasks.exe	81
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1900	876	schtasks.exe	81
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2748	876	schtasks.exe	81
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1532	876	schtasks.exe	81
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2100	876	schtasks.exe	81
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5068	876	schtasks.exe	81
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3172	876	schtasks.exe	81
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3924	876	schtasks.exe	81
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3264	876	schtasks.exe	81
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4252	876	schtasks.exe	81
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4720	876	schtasks.exe	81
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2968	876	schtasks.exe	81
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1424	876	schtasks.exe	81
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1004	876	schtasks.exe	81

DCRat payload 2 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral2/memory/1976-1-0x0000000000330000-0x0000000000406000-memory.dmp	dcrat
behavioral2/files/0x0007000000023404-11.dat	dcrat

Checks computer location settings 2 TTPs 8 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation	Registry.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation	Registry.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation	Registry.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation	Registry.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation	Registry.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation	Registry.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation	Registry.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation	a230b93fca18aaa16370ce5969ca90ad.exe

Executes dropped EXE 8 IoCs

pid	Process
1744	Registry.exe
4944	Registry.exe
4608	Registry.exe
1800	Registry.exe
4412	Registry.exe
3432	Registry.exe
2200	Registry.exe
2216	Registry.exe

Adds Run key to start application 2 TTPs 32 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\taskhostw = "\"C:\\Windows\\Prefetch\\ReadyBoot\\taskhostw.exe\""	a230b93fca18aaa16370ce5969ca90ad.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SppExtComObj = "\"C:\\Windows\\SchCache\\SppExtComObj.exe\""	a230b93fca18aaa16370ce5969ca90ad.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\upfc = "\"C:\\Windows\\ShellComponents\\upfc.exe\""	a230b93fca18aaa16370ce5969ca90ad.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OfficeClickToRun = "\"C:\\Program Files (x86)\\Windows Defender\\uk-UA\\OfficeClickToRun.exe\""	a230b93fca18aaa16370ce5969ca90ad.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SearchApp = "\"C:\\Recovery\\WindowsRE\\SearchApp.exe\""	a230b93fca18aaa16370ce5969ca90ad.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RuntimeBroker = "\"C:\\Recovery\\WindowsRE\\RuntimeBroker.exe\""	a230b93fca18aaa16370ce5969ca90ad.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\smss = "\"C:\\Windows\\bcastdvr\\smss.exe\""	a230b93fca18aaa16370ce5969ca90ad.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\taskhostw = "\"C:\\Windows\\Prefetch\\ReadyBoot\\taskhostw.exe\""	a230b93fca18aaa16370ce5969ca90ad.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\backgroundTaskHost = "\"C:\\Users\\Admin\\Desktop\\backgroundTaskHost.exe\""	a230b93fca18aaa16370ce5969ca90ad.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SppExtComObj = "\"C:\\Windows\\SchCache\\SppExtComObj.exe\""	a230b93fca18aaa16370ce5969ca90ad.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\upfc = "\"C:\\Windows\\ShellComponents\\upfc.exe\""	a230b93fca18aaa16370ce5969ca90ad.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\winlogon = "\"C:\\Users\\Public\\Documents\\My Videos\\winlogon.exe\""	a230b93fca18aaa16370ce5969ca90ad.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\StartMenuExperienceHost = "\"C:\\Recovery\\WindowsRE\\StartMenuExperienceHost.exe\""	a230b93fca18aaa16370ce5969ca90ad.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SearchApp = "\"C:\\Recovery\\WindowsRE\\SearchApp.exe\""	a230b93fca18aaa16370ce5969ca90ad.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\winlogon = "\"C:\\Program Files (x86)\\Microsoft\\winlogon.exe\""	a230b93fca18aaa16370ce5969ca90ad.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sysmon = "\"C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\sysmon.exe\""	a230b93fca18aaa16370ce5969ca90ad.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sysmon = "\"C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\sysmon.exe\""	a230b93fca18aaa16370ce5969ca90ad.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\en-US\\csrss.exe\""	a230b93fca18aaa16370ce5969ca90ad.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OfficeClickToRun = "\"C:\\Program Files (x86)\\Windows Defender\\uk-UA\\OfficeClickToRun.exe\""	a230b93fca18aaa16370ce5969ca90ad.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\backgroundTaskHost = "\"C:\\Users\\Admin\\Desktop\\backgroundTaskHost.exe\""	a230b93fca18aaa16370ce5969ca90ad.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Registry = "\"C:\\Users\\All Users\\Registry.exe\""	a230b93fca18aaa16370ce5969ca90ad.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Registry = "\"C:\\Users\\All Users\\Registry.exe\""	a230b93fca18aaa16370ce5969ca90ad.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dllhost = "\"C:\\Windows\\IdentityCRL\\INT\\dllhost.exe\""	a230b93fca18aaa16370ce5969ca90ad.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\winlogon = "\"C:\\Program Files (x86)\\Microsoft\\winlogon.exe\""	a230b93fca18aaa16370ce5969ca90ad.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\spoolsv = "\"C:\\Windows\\Globalization\\ICU\\spoolsv.exe\""	a230b93fca18aaa16370ce5969ca90ad.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\en-US\\csrss.exe\""	a230b93fca18aaa16370ce5969ca90ad.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RuntimeBroker = "\"C:\\Recovery\\WindowsRE\\RuntimeBroker.exe\""	a230b93fca18aaa16370ce5969ca90ad.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\spoolsv = "\"C:\\Windows\\Globalization\\ICU\\spoolsv.exe\""	a230b93fca18aaa16370ce5969ca90ad.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\smss = "\"C:\\Windows\\bcastdvr\\smss.exe\""	a230b93fca18aaa16370ce5969ca90ad.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dllhost = "\"C:\\Windows\\IdentityCRL\\INT\\dllhost.exe\""	a230b93fca18aaa16370ce5969ca90ad.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\winlogon = "\"C:\\Users\\Public\\Documents\\My Videos\\winlogon.exe\""	a230b93fca18aaa16370ce5969ca90ad.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\StartMenuExperienceHost = "\"C:\\Recovery\\WindowsRE\\StartMenuExperienceHost.exe\""	a230b93fca18aaa16370ce5969ca90ad.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 7 IoCs

Web Service

T1102

flow	ioc
3	pastebin.com
10	pastebin.com
12	pastebin.com
13	pastebin.com
14	pastebin.com
15	pastebin.com
16	pastebin.com

Drops file in Program Files directory 7 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Windows Defender\uk-UA\e6c9b481da804f	a230b93fca18aaa16370ce5969ca90ad.exe
File created	C:\Program Files (x86)\Microsoft\winlogon.exe	a230b93fca18aaa16370ce5969ca90ad.exe
File opened for modification	C:\Program Files (x86)\Microsoft\winlogon.exe	a230b93fca18aaa16370ce5969ca90ad.exe
File created	C:\Program Files (x86)\Microsoft\cc11b995f2a76d	a230b93fca18aaa16370ce5969ca90ad.exe
File created	C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\sysmon.exe	a230b93fca18aaa16370ce5969ca90ad.exe
File created	C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\121e5b5079f7c0	a230b93fca18aaa16370ce5969ca90ad.exe
File created	C:\Program Files (x86)\Windows Defender\uk-UA\OfficeClickToRun.exe	a230b93fca18aaa16370ce5969ca90ad.exe

Drops file in Windows directory 14 IoCs

description	ioc	Process
File created	C:\Windows\Prefetch\ReadyBoot\taskhostw.exe	a230b93fca18aaa16370ce5969ca90ad.exe
File created	C:\Windows\SchCache\e1ef82546f0b02	a230b93fca18aaa16370ce5969ca90ad.exe
File created	C:\Windows\bcastdvr\69ddcba757bf72	a230b93fca18aaa16370ce5969ca90ad.exe
File created	C:\Windows\SchCache\SppExtComObj.exe	a230b93fca18aaa16370ce5969ca90ad.exe
File created	C:\Windows\Prefetch\ReadyBoot\ea9f0e6c9e2dcd	a230b93fca18aaa16370ce5969ca90ad.exe
File created	C:\Windows\Globalization\ICU\f3b6ecef712a24	a230b93fca18aaa16370ce5969ca90ad.exe
File created	C:\Windows\ShellComponents\ea1d8f6d871115	a230b93fca18aaa16370ce5969ca90ad.exe
File created	C:\Windows\en-US\886983d96e3d3e	a230b93fca18aaa16370ce5969ca90ad.exe
File created	C:\Windows\bcastdvr\smss.exe	a230b93fca18aaa16370ce5969ca90ad.exe
File created	C:\Windows\Globalization\ICU\spoolsv.exe	a230b93fca18aaa16370ce5969ca90ad.exe
File created	C:\Windows\ShellComponents\upfc.exe	a230b93fca18aaa16370ce5969ca90ad.exe
File created	C:\Windows\en-US\csrss.exe	a230b93fca18aaa16370ce5969ca90ad.exe
File created	C:\Windows\IdentityCRL\INT\dllhost.exe	a230b93fca18aaa16370ce5969ca90ad.exe
File created	C:\Windows\IdentityCRL\INT\5940a34987c991	a230b93fca18aaa16370ce5969ca90ad.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 48 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
3144	schtasks.exe
3868	schtasks.exe
4920	schtasks.exe
1460	schtasks.exe
3520	schtasks.exe
2968	schtasks.exe
5068	schtasks.exe
4252	schtasks.exe
5076	schtasks.exe
1752	schtasks.exe
3500	schtasks.exe
4624	schtasks.exe
4608	schtasks.exe
2748	schtasks.exe
3924	schtasks.exe
1424	schtasks.exe
4772	schtasks.exe
3748	schtasks.exe
1560	schtasks.exe
3448	schtasks.exe
1916	schtasks.exe
1532	schtasks.exe
868	schtasks.exe
2100	schtasks.exe
3884	schtasks.exe
1472	schtasks.exe
1824	schtasks.exe
512	schtasks.exe
2680	schtasks.exe
4820	schtasks.exe
4180	schtasks.exe
3172	schtasks.exe
1388	schtasks.exe
1900	schtasks.exe
2940	schtasks.exe
4392	schtasks.exe
5104	schtasks.exe
1004	schtasks.exe
3200	schtasks.exe
4168	schtasks.exe
4748	schtasks.exe
3052	schtasks.exe
2204	schtasks.exe
4996	schtasks.exe
4308	schtasks.exe
4652	schtasks.exe
3264	schtasks.exe
4720	schtasks.exe

Modifies registry class 8 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000_Classes\Local Settings	a230b93fca18aaa16370ce5969ca90ad.exe
Key created	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000_Classes\Local Settings	Registry.exe
Key created	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000_Classes\Local Settings	Registry.exe
Key created	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000_Classes\Local Settings	Registry.exe
Key created	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000_Classes\Local Settings	Registry.exe
Key created	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000_Classes\Local Settings	Registry.exe
Key created	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000_Classes\Local Settings	Registry.exe
Key created	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000_Classes\Local Settings	Registry.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
1976	a230b93fca18aaa16370ce5969ca90ad.exe
1976	a230b93fca18aaa16370ce5969ca90ad.exe
1976	a230b93fca18aaa16370ce5969ca90ad.exe
1976	a230b93fca18aaa16370ce5969ca90ad.exe
1976	a230b93fca18aaa16370ce5969ca90ad.exe
1744	Registry.exe
4944	Registry.exe
4608	Registry.exe
1800	Registry.exe
4412	Registry.exe
3432	Registry.exe
2200	Registry.exe
2216	Registry.exe

Suspicious use of AdjustPrivilegeToken 9 IoCs

description	pid	Process
Token: SeDebugPrivilege	1976	a230b93fca18aaa16370ce5969ca90ad.exe
Token: SeDebugPrivilege	1744	Registry.exe
Token: SeDebugPrivilege	4944	Registry.exe
Token: SeDebugPrivilege	4608	Registry.exe
Token: SeDebugPrivilege	1800	Registry.exe
Token: SeDebugPrivilege	4412	Registry.exe
Token: SeDebugPrivilege	3432	Registry.exe
Token: SeDebugPrivilege	2200	Registry.exe
Token: SeDebugPrivilege	2216	Registry.exe

Suspicious use of WriteProcessMemory 48 IoCs

description	pid	Process	procid_target
PID 1976 wrote to memory of 432	1976	a230b93fca18aaa16370ce5969ca90ad.exe	130
PID 1976 wrote to memory of 432	1976	a230b93fca18aaa16370ce5969ca90ad.exe	130
PID 432 wrote to memory of 4532	432	cmd.exe	132
PID 432 wrote to memory of 4532	432	cmd.exe	132
PID 432 wrote to memory of 1744	432	cmd.exe	137
PID 432 wrote to memory of 1744	432	cmd.exe	137
PID 1744 wrote to memory of 364	1744	Registry.exe	138
PID 1744 wrote to memory of 364	1744	Registry.exe	138
PID 364 wrote to memory of 4476	364	cmd.exe	140
PID 364 wrote to memory of 4476	364	cmd.exe	140
PID 364 wrote to memory of 4944	364	cmd.exe	141
PID 364 wrote to memory of 4944	364	cmd.exe	141
PID 4944 wrote to memory of 3968	4944	Registry.exe	143
PID 4944 wrote to memory of 3968	4944	Registry.exe	143
PID 3968 wrote to memory of 4976	3968	cmd.exe	145
PID 3968 wrote to memory of 4976	3968	cmd.exe	145
PID 3968 wrote to memory of 4608	3968	cmd.exe	148
PID 3968 wrote to memory of 4608	3968	cmd.exe	148
PID 4608 wrote to memory of 3312	4608	Registry.exe	150
PID 4608 wrote to memory of 3312	4608	Registry.exe	150
PID 3312 wrote to memory of 3608	3312	cmd.exe	152
PID 3312 wrote to memory of 3608	3312	cmd.exe	152
PID 3312 wrote to memory of 1800	3312	cmd.exe	155
PID 3312 wrote to memory of 1800	3312	cmd.exe	155
PID 1800 wrote to memory of 4892	1800	Registry.exe	156
PID 1800 wrote to memory of 4892	1800	Registry.exe	156
PID 4892 wrote to memory of 5024	4892	cmd.exe	158
PID 4892 wrote to memory of 5024	4892	cmd.exe	158
PID 4892 wrote to memory of 4412	4892	cmd.exe	159
PID 4892 wrote to memory of 4412	4892	cmd.exe	159
PID 4412 wrote to memory of 2524	4412	Registry.exe	160
PID 4412 wrote to memory of 2524	4412	Registry.exe	160
PID 2524 wrote to memory of 4756	2524	cmd.exe	162
PID 2524 wrote to memory of 4756	2524	cmd.exe	162
PID 2524 wrote to memory of 3432	2524	cmd.exe	163
PID 2524 wrote to memory of 3432	2524	cmd.exe	163
PID 3432 wrote to memory of 2080	3432	Registry.exe	164
PID 3432 wrote to memory of 2080	3432	Registry.exe	164
PID 2080 wrote to memory of 3388	2080	cmd.exe	166
PID 2080 wrote to memory of 3388	2080	cmd.exe	166
PID 2080 wrote to memory of 2200	2080	cmd.exe	167
PID 2080 wrote to memory of 2200	2080	cmd.exe	167
PID 2200 wrote to memory of 4448	2200	Registry.exe	168
PID 2200 wrote to memory of 4448	2200	Registry.exe	168
PID 4448 wrote to memory of 1416	4448	cmd.exe	170
PID 4448 wrote to memory of 1416	4448	cmd.exe	170
PID 4448 wrote to memory of 2216	4448	cmd.exe	171
PID 4448 wrote to memory of 2216	4448	cmd.exe	171

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\a230b93fca18aaa16370ce5969ca90ad.exe
"C:\Users\Admin\AppData\Local\Temp\a230b93fca18aaa16370ce5969ca90ad.exe"
1⤵
- Modifies WinLogon for persistence
- Checks computer location settings
- Adds Run key to start application
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1976
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\rQxrSJBmtZ.bat"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:432
- - C:\Windows\system32\w32tm.exe
    w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
    3⤵
    PID:4532
- - C:\Users\All Users\Registry.exe
    "C:\Users\All Users\Registry.exe"
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Modifies registry class
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:1744
  - - C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\zAqEIlSfAD.bat"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:364
    - - C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        5⤵
        
        PID:4476
    - - C:\Users\All Users\Registry.exe
        
        "C:\Users\All Users\Registry.exe"
        5⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4944
      - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\iVu5YTRuDT.bat"
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:3968
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        7⤵
        
        PID:4976
        
        C:\Users\All Users\Registry.exe
        
        "C:\Users\All Users\Registry.exe"
        7⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4608
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\gQkyN2upze.bat"
        8⤵
        Suspicious use of WriteProcessMemory
        
        PID:3312
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        9⤵
        
        PID:3608
        
        C:\Users\All Users\Registry.exe
        
        "C:\Users\All Users\Registry.exe"
        9⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1800
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\zAqEIlSfAD.bat"
        10⤵
        Suspicious use of WriteProcessMemory
        
        PID:4892
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        11⤵
        
        PID:5024
        
        C:\Users\All Users\Registry.exe
        
        "C:\Users\All Users\Registry.exe"
        11⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4412
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\IxigaWiN4Z.bat"
        12⤵
        Suspicious use of WriteProcessMemory
        
        PID:2524
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        13⤵
        
        PID:4756
        
        C:\Users\All Users\Registry.exe
        
        "C:\Users\All Users\Registry.exe"
        13⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3432
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\Kz6bOuYaab.bat"
        14⤵
        Suspicious use of WriteProcessMemory
        
        PID:2080
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        15⤵
        
        PID:3388
        
        C:\Users\All Users\Registry.exe
        
        "C:\Users\All Users\Registry.exe"
        15⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2200
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\vCRFnHZZKP.bat"
        16⤵
        Suspicious use of WriteProcessMemory
        
        PID:4448
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        17⤵
        
        PID:1416
        
        C:\Users\All Users\Registry.exe
        
        "C:\Users\All Users\Registry.exe"
        17⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2216

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 6 /tr "'C:\Program Files (x86)\Microsoft\winlogon.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:5076

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogon" /sc ONLOGON /tr "'C:\Program Files (x86)\Microsoft\winlogon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1752

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 5 /tr "'C:\Program Files (x86)\Microsoft\winlogon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3500

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostwt" /sc MINUTE /mo 7 /tr "'C:\Windows\Prefetch\ReadyBoot\taskhostw.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4624

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostw" /sc ONLOGON /tr "'C:\Windows\Prefetch\ReadyBoot\taskhostw.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4772

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostwt" /sc MINUTE /mo 13 /tr "'C:\Windows\Prefetch\ReadyBoot\taskhostw.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3748

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SppExtComObjS" /sc MINUTE /mo 13 /tr "'C:\Windows\SchCache\SppExtComObj.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4748

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SppExtComObj" /sc ONLOGON /tr "'C:\Windows\SchCache\SppExtComObj.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3884

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SppExtComObjS" /sc MINUTE /mo 7 /tr "'C:\Windows\SchCache\SppExtComObj.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3052

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 7 /tr "'C:\Windows\Globalization\ICU\spoolsv.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1560

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsv" /sc ONLOGON /tr "'C:\Windows\Globalization\ICU\spoolsv.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1388

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 6 /tr "'C:\Windows\Globalization\ICU\spoolsv.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3144

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "upfcu" /sc MINUTE /mo 14 /tr "'C:\Windows\ShellComponents\upfc.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2204

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "upfc" /sc ONLOGON /tr "'C:\Windows\ShellComponents\upfc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2940

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "upfcu" /sc MINUTE /mo 11 /tr "'C:\Windows\ShellComponents\upfc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4996

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sysmons" /sc MINUTE /mo 8 /tr "'C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\sysmon.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4392

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sysmon" /sc ONLOGON /tr "'C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\sysmon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4608

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sysmons" /sc MINUTE /mo 13 /tr "'C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\sysmon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3448

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 8 /tr "'C:\Windows\en-US\csrss.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3868

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Windows\en-US\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4920

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 6 /tr "'C:\Windows\en-US\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1472

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 10 /tr "'C:\Windows\bcastdvr\smss.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1916

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smss" /sc ONLOGON /tr "'C:\Windows\bcastdvr\smss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1824

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 6 /tr "'C:\Windows\bcastdvr\smss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1460

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OfficeClickToRunO" /sc MINUTE /mo 5 /tr "'C:\Program Files (x86)\Windows Defender\uk-UA\OfficeClickToRun.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4308

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OfficeClickToRun" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Defender\uk-UA\OfficeClickToRun.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:512

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OfficeClickToRunO" /sc MINUTE /mo 13 /tr "'C:\Program Files (x86)\Windows Defender\uk-UA\OfficeClickToRun.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3520

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RegistryR" /sc MINUTE /mo 8 /tr "'C:\Users\All Users\Registry.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2680

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Registry" /sc ONLOGON /tr "'C:\Users\All Users\Registry.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4180

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RegistryR" /sc MINUTE /mo 5 /tr "'C:\Users\All Users\Registry.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4652

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 9 /tr "'C:\Windows\IdentityCRL\INT\dllhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:5104

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Windows\IdentityCRL\INT\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4820

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 13 /tr "'C:\Windows\IdentityCRL\INT\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:868

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "backgroundTaskHostb" /sc MINUTE /mo 6 /tr "'C:\Users\Admin\Desktop\backgroundTaskHost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3200

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "backgroundTaskHost" /sc ONLOGON /tr "'C:\Users\Admin\Desktop\backgroundTaskHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4168

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "backgroundTaskHostb" /sc MINUTE /mo 10 /tr "'C:\Users\Admin\Desktop\backgroundTaskHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1900

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 8 /tr "'C:\Users\Public\Documents\My Videos\winlogon.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2748

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogon" /sc ONLOGON /tr "'C:\Users\Public\Documents\My Videos\winlogon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1532

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 12 /tr "'C:\Users\Public\Documents\My Videos\winlogon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2100

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SearchAppS" /sc MINUTE /mo 10 /tr "'C:\Recovery\WindowsRE\SearchApp.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:5068

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SearchApp" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\SearchApp.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3172

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SearchAppS" /sc MINUTE /mo 9 /tr "'C:\Recovery\WindowsRE\SearchApp.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3924

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "StartMenuExperienceHostS" /sc MINUTE /mo 13 /tr "'C:\Recovery\WindowsRE\StartMenuExperienceHost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3264

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "StartMenuExperienceHost" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\StartMenuExperienceHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4252

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "StartMenuExperienceHostS" /sc MINUTE /mo 14 /tr "'C:\Recovery\WindowsRE\StartMenuExperienceHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4720

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 13 /tr "'C:\Recovery\WindowsRE\RuntimeBroker.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2968

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1424

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 5 /tr "'C:\Recovery\WindowsRE\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1004

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Scheduled Task/Job

T1053

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Scheduled Task/Job

T1053

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Registry.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\Registry.exe.log
Size 1KB
SHA256 ee954c5d8156fd8890e582c716e5758ed9b33721258f10e758bdc31ccbcb1924
MD5 baf55b95da4a601229647f25dad12878
SHA1 abc16954ebfd213733c4493fc1910164d825cac8
SHA512 24f502fedb1a305d0d7b08857ffc1db9b2359ff34e06d5748ecc84e35c985f29a20d9f0a533bea32d234ab37097ec0481620c63b14ac89b280e75e14d19fd545
MD5 SHA1 SHA512

Submit Download

IxigaWiN4Z.bat

Path C:\Users\Admin\AppData\Local\Temp\IxigaWiN4Z.bat
Size 196B
SHA256 b29a7412f161ed74fcc28ae47325b0caf9440857a6e2331f7190bba62ac25b89
MD5 202d8f10294ebe00971ae75f847e69d8
SHA1 13f0803f8ceed5b1120b7f8820bef09dab732dac
SHA512 5c329931a262728a873e51422c39b191b87435bee3617fa7ba402991a529b0b1c4426cf26e417125fa40d6d65275e0c34772b3690e8947cdfc69c707a26749bd
MD5 SHA1 SHA512

Submit Download

Kz6bOuYaab.bat

Path C:\Users\Admin\AppData\Local\Temp\Kz6bOuYaab.bat
Size 196B
SHA256 f14f64c564fc8fb5b35d5ab8ea56847d20c154e0bdced9c4a931689c78ee7db6
MD5 26e6242d2cf3a97d9bfd875ac09a56b2
SHA1 7032300480f2d99650bb2d54714f53e7f3a96da4
SHA512 e2550fe0aa5879eb5dd945cf5a6d0b2b8bc54de915ee2c4f18a28a422023c32e88a1f6100a06c53ef8a2e48fd62f551dfa4a8f2905ef0fe07494e5c4a85efcd2
MD5 SHA1 SHA512

Submit Download

gQkyN2upze.bat

Path C:\Users\Admin\AppData\Local\Temp\gQkyN2upze.bat
Size 196B
SHA256 f6a144d63b2665a0e5cae78bd4d1562adb0d11f11576dab3eeba062e9185488c
MD5 62cb33367e6353a2606633b9aa08b005
SHA1 36639a8a578f3a8577dd0a48de34a1148c6a3f04
SHA512 ea31389cd4b030602d63d0e0885a91bc3f34d62e8d9a1cb1d8f1c26f4ad076faa967113eb250e3fd1401010b2a7a0d66ba94708b828f08a1ff9c245197e5fe9f
MD5 SHA1 SHA512

Submit Download

iVu5YTRuDT.bat

Path C:\Users\Admin\AppData\Local\Temp\iVu5YTRuDT.bat
Size 196B
SHA256 d2b6a4d13f19805d65abaf7f987d876d6c5005ce91e79bfabf7cb9a83550c0a0
MD5 5b28d1c1fb7271372b5abebbd869c384
SHA1 35b9bbd1f2063ba251e2f60094d40136b6b0b3b0
SHA512 b317ecd47b968eccbb3be0802164683aba1648001d7ab36f680fbd4d0f619f6947bbf5d93bc803353b22dc828744e0fc2f38d5f4ed02f19e64703f5c381d4275
MD5 SHA1 SHA512

Submit Download

rQxrSJBmtZ.bat

Path C:\Users\Admin\AppData\Local\Temp\rQxrSJBmtZ.bat
Size 196B
SHA256 73984e00121bdc2d82fe9f614280a4c461f5a69375685c74bb5aa9590089fe1a
MD5 0e7c3fafff20721b1ab7206025ef5416
SHA1 697195025489a6c3192a70c04b9de86374eb11ba
SHA512 38f382da6ece544cc5d9c99aa1ec973a7df2968a9b21a7ac02c7e2a7e4059476f9c876b7179e995e4c679044714a144095a719d9f1411c3467e231a01b70afe7
MD5 SHA1 SHA512

Submit Download

vCRFnHZZKP.bat

Path C:\Users\Admin\AppData\Local\Temp\vCRFnHZZKP.bat
Size 196B
SHA256 859e6c6bfe700963727864041dfa20e07ca5ccfe82452037734894f30c3551de
MD5 4e112a2fed4dfa1221a8a3855bec9e9e
SHA1 7ba99096a20755170e4449074e0e342309a0bbdc
SHA512 6b90e299c6002908a9a703a26ee39284756897765916bc66edbddc5f9e19fcdff270c955af33a30e8663858d49a923afc18fa81328d892f584eb9482b7581ead
MD5 SHA1 SHA512

Submit Download

zAqEIlSfAD.bat

Path C:\Users\Admin\AppData\Local\Temp\zAqEIlSfAD.bat
Size 196B
SHA256 1566f45553f2e85dd2b563fbb714f1f37f60bab05f9fd9a9e827d256266f0ce5
MD5 db8fbdb12fcd949fb8fffc307ce244ac
SHA1 9c3eb1993ac4c00a65ca29885a25904d90d3276c
SHA512 be6985beb525db69f46232f028bbd16882ada0f093f1adea7bdd65abf8da407e513ad4a03ca02af23c63c41dc605fa2f159b0e0bf64c7e4187d552d46b19fc18
MD5 SHA1 SHA512

Submit Download

upfc.exe

Path C:\Windows\ShellComponents\upfc.exe
Size 828KB
SHA256 79b24566d743b542e79e4db241fe21c380a7a4a727b6900767854e0eb14cb17a
MD5 a230b93fca18aaa16370ce5969ca90ad
SHA1 0fa0279b55a899e44d47fe0539e0d3daf3422716
SHA512 dad9983b7355f3271b943bb795d6f4d1ed982a46bf7ed9ab637c7c3b5c1ae6afa2fb4476fb167b4f5f78b1625416219b08412bcff41da3b73aebca48e0db445b
SSDEEP 12288:uohTZpqQJCCw8rc/qGIfVTD/NOKLsBW3L+PQF5kMX7b:nFpqQDrc/q9VVLsBwcMLb
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1976-0-0x00007FFC9B8F3000-0x00007FFC9B8F5000-memory.dmp

Download

memory/1976-40-0x00007FFC9B8F0000-0x00007FFC9C3B1000-memory.dmp

Download

memory/1976-4-0x00007FFC9B8F0000-0x00007FFC9C3B1000-memory.dmp

Download

memory/1976-1-0x0000000000330000-0x0000000000406000-memory.dmp

Download

memory/2200-87-0x000000001B990000-0x000000001BAFA000-memory.dmp

Download

memory/2200-88-0x000000001BB00000-0x000000001BCA9000-memory.dmp

Download