dcrat | 1eb7992ca97e8bb0b65faeaf69b30d9ac84406b1f35d6a900f8de748ab6a6a64

Analysis

max time kernel
148s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
17/06/2024, 01:02

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
1eb7992ca97e8bb0b65faeaf69b30d9ac84406b1f35d6a900f8de748ab6a6a64.exe
Size 1001KB
Sample240617-bd766a1dkq
SHA256 1eb7992ca97e8bb0b65faeaf69b30d9ac84406b1f35d6a900f8de748ab6a6a64
MD5 3146f2002112e5ba7562a28ff1883f9a
SHA1 9bd64b0954d746395e8080e563dbb39b254fac7d
SHA512 08e1e8c002269a4d611d21de3d037879abcbbf59f8f3744f27ee62b296adf61664f4f7afe0dc36bcdd4b5070fe6b7bf146ff94b0c682fee09e61bfa0935c3cfa
SSDEEP 12288:BiqbUK9S2Jhb/PZWzR6keiZAHOVEAKNZCKTh3VnGFOeRJmuHwj3x:hUK9SePZWzYrLHOdKRTh3heRJXQjx
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

dcrat infostealer rat

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat

Process spawned unexpected child process 39 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2580	2628	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3932	2628	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4480	2628	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2860	2628	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2252	2628	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5084	2628	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1216	2628	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1592	2628	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1560	2628	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3432	2628	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2648	2628	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1680	2628	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	960	2628	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1836	2628	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1016	2628	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2112	2628	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2676	2628	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3140	2628	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5008	2628	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1608	2628	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3520	2628	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2776	2628	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1224	2628	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3840	2628	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2264	2628	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	440	2628	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4384	2628	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	900	2628	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4044	2628	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3204	2628	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4744	2628	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4212	2628	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4716	2628	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3184	2628	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1464	2628	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3416	2628	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2748	2628	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4620	2628	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2632	2628	schtasks.exe	82

DCRat payload 2 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral2/memory/3696-1-0x0000000000DB0000-0x0000000000EB2000-memory.dmp	dcrat
behavioral2/files/0x00070000000233df-13.dat	dcrat

Checks computer location settings 2 TTPs 8 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\Control Panel\International\Geo\Nation	Idle.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\Control Panel\International\Geo\Nation	Idle.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\Control Panel\International\Geo\Nation	Idle.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\Control Panel\International\Geo\Nation	1eb7992ca97e8bb0b65faeaf69b30d9ac84406b1f35d6a900f8de748ab6a6a64.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\Control Panel\International\Geo\Nation	Idle.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\Control Panel\International\Geo\Nation	Idle.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\Control Panel\International\Geo\Nation	Idle.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\Control Panel\International\Geo\Nation	Idle.exe

Executes dropped EXE 7 IoCs

pid	Process
2460	Idle.exe
2664	Idle.exe
2244	Idle.exe
4936	Idle.exe
3776	Idle.exe
348	Idle.exe
1288	Idle.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 6 IoCs

Web Service

T1102

flow	ioc
14	pastebin.com
4	pastebin.com
10	pastebin.com
11	pastebin.com
12	pastebin.com
13	pastebin.com

Drops file in Program Files directory 14 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\wininit.exe	1eb7992ca97e8bb0b65faeaf69b30d9ac84406b1f35d6a900f8de748ab6a6a64.exe
File created	C:\Program Files (x86)\Microsoft.NET\RedistList\9e8d7a4ca61bd9	1eb7992ca97e8bb0b65faeaf69b30d9ac84406b1f35d6a900f8de748ab6a6a64.exe
File created	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_107921\RuntimeBroker.exe	1eb7992ca97e8bb0b65faeaf69b30d9ac84406b1f35d6a900f8de748ab6a6a64.exe
File created	C:\Program Files (x86)\Internet Explorer\fr-FR\ee2ad38f3d4382	1eb7992ca97e8bb0b65faeaf69b30d9ac84406b1f35d6a900f8de748ab6a6a64.exe
File created	C:\Program Files\Windows Security\System.exe	1eb7992ca97e8bb0b65faeaf69b30d9ac84406b1f35d6a900f8de748ab6a6a64.exe
File created	C:\Program Files (x86)\Internet Explorer\fr-FR\Registry.exe	1eb7992ca97e8bb0b65faeaf69b30d9ac84406b1f35d6a900f8de748ab6a6a64.exe
File created	C:\Program Files\dotnet\host\fxr\8.0.2\TextInputHost.exe	1eb7992ca97e8bb0b65faeaf69b30d9ac84406b1f35d6a900f8de748ab6a6a64.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\56085415360792	1eb7992ca97e8bb0b65faeaf69b30d9ac84406b1f35d6a900f8de748ab6a6a64.exe
File created	C:\Program Files (x86)\Microsoft.NET\RedistList\RuntimeBroker.exe	1eb7992ca97e8bb0b65faeaf69b30d9ac84406b1f35d6a900f8de748ab6a6a64.exe
File created	C:\Program Files\Windows Security\BrowserCore\en-US\56085415360792	1eb7992ca97e8bb0b65faeaf69b30d9ac84406b1f35d6a900f8de748ab6a6a64.exe
File created	C:\Program Files\dotnet\host\fxr\8.0.2\22eafd247d37c3	1eb7992ca97e8bb0b65faeaf69b30d9ac84406b1f35d6a900f8de748ab6a6a64.exe
File created	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_107921\9e8d7a4ca61bd9	1eb7992ca97e8bb0b65faeaf69b30d9ac84406b1f35d6a900f8de748ab6a6a64.exe
File created	C:\Program Files\Windows Security\27d1bcfc3c54e0	1eb7992ca97e8bb0b65faeaf69b30d9ac84406b1f35d6a900f8de748ab6a6a64.exe
File created	C:\Program Files\Windows Security\BrowserCore\en-US\wininit.exe	1eb7992ca97e8bb0b65faeaf69b30d9ac84406b1f35d6a900f8de748ab6a6a64.exe

Drops file in Windows directory 5 IoCs

description	ioc	Process
File created	C:\Windows\SystemResources\Windows-NFC-SEManagement\pris\RuntimeBroker.exe	1eb7992ca97e8bb0b65faeaf69b30d9ac84406b1f35d6a900f8de748ab6a6a64.exe
File created	C:\Windows\INF\Idle.exe	1eb7992ca97e8bb0b65faeaf69b30d9ac84406b1f35d6a900f8de748ab6a6a64.exe
File created	C:\Windows\INF\6ccacd8608530f	1eb7992ca97e8bb0b65faeaf69b30d9ac84406b1f35d6a900f8de748ab6a6a64.exe
File created	C:\Windows\ShellExperiences\taskhostw.exe	1eb7992ca97e8bb0b65faeaf69b30d9ac84406b1f35d6a900f8de748ab6a6a64.exe
File created	C:\Windows\ShellExperiences\ea9f0e6c9e2dcd	1eb7992ca97e8bb0b65faeaf69b30d9ac84406b1f35d6a900f8de748ab6a6a64.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 39 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
5084	schtasks.exe
1016	schtasks.exe
2264	schtasks.exe
3204	schtasks.exe
4212	schtasks.exe
1464	schtasks.exe
3520	schtasks.exe
1224	schtasks.exe
440	schtasks.exe
4044	schtasks.exe
4716	schtasks.exe
1216	schtasks.exe
3432	schtasks.exe
3840	schtasks.exe
900	schtasks.exe
3184	schtasks.exe
4480	schtasks.exe
2252	schtasks.exe
3416	schtasks.exe
2632	schtasks.exe
1836	schtasks.exe
2112	schtasks.exe
2676	schtasks.exe
2776	schtasks.exe
2580	schtasks.exe
1560	schtasks.exe
2648	schtasks.exe
960	schtasks.exe
4744	schtasks.exe
3932	schtasks.exe
1592	schtasks.exe
3140	schtasks.exe
4384	schtasks.exe
4620	schtasks.exe
2860	schtasks.exe
1680	schtasks.exe
5008	schtasks.exe
1608	schtasks.exe
2748	schtasks.exe

Modifies registry class 8 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000_Classes\Local Settings	1eb7992ca97e8bb0b65faeaf69b30d9ac84406b1f35d6a900f8de748ab6a6a64.exe
Key created	\REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000_Classes\Local Settings	Idle.exe
Key created	\REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000_Classes\Local Settings	Idle.exe
Key created	\REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000_Classes\Local Settings	Idle.exe
Key created	\REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000_Classes\Local Settings	Idle.exe
Key created	\REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000_Classes\Local Settings	Idle.exe
Key created	\REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000_Classes\Local Settings	Idle.exe
Key created	\REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000_Classes\Local Settings	Idle.exe

Suspicious behavior: EnumeratesProcesses 25 IoCs

pid	Process
3696	1eb7992ca97e8bb0b65faeaf69b30d9ac84406b1f35d6a900f8de748ab6a6a64.exe
3696	1eb7992ca97e8bb0b65faeaf69b30d9ac84406b1f35d6a900f8de748ab6a6a64.exe
3696	1eb7992ca97e8bb0b65faeaf69b30d9ac84406b1f35d6a900f8de748ab6a6a64.exe
3696	1eb7992ca97e8bb0b65faeaf69b30d9ac84406b1f35d6a900f8de748ab6a6a64.exe
3696	1eb7992ca97e8bb0b65faeaf69b30d9ac84406b1f35d6a900f8de748ab6a6a64.exe
3696	1eb7992ca97e8bb0b65faeaf69b30d9ac84406b1f35d6a900f8de748ab6a6a64.exe
3696	1eb7992ca97e8bb0b65faeaf69b30d9ac84406b1f35d6a900f8de748ab6a6a64.exe
3696	1eb7992ca97e8bb0b65faeaf69b30d9ac84406b1f35d6a900f8de748ab6a6a64.exe
3696	1eb7992ca97e8bb0b65faeaf69b30d9ac84406b1f35d6a900f8de748ab6a6a64.exe
3696	1eb7992ca97e8bb0b65faeaf69b30d9ac84406b1f35d6a900f8de748ab6a6a64.exe
3696	1eb7992ca97e8bb0b65faeaf69b30d9ac84406b1f35d6a900f8de748ab6a6a64.exe
3696	1eb7992ca97e8bb0b65faeaf69b30d9ac84406b1f35d6a900f8de748ab6a6a64.exe
3696	1eb7992ca97e8bb0b65faeaf69b30d9ac84406b1f35d6a900f8de748ab6a6a64.exe
3696	1eb7992ca97e8bb0b65faeaf69b30d9ac84406b1f35d6a900f8de748ab6a6a64.exe
3696	1eb7992ca97e8bb0b65faeaf69b30d9ac84406b1f35d6a900f8de748ab6a6a64.exe
3696	1eb7992ca97e8bb0b65faeaf69b30d9ac84406b1f35d6a900f8de748ab6a6a64.exe
3696	1eb7992ca97e8bb0b65faeaf69b30d9ac84406b1f35d6a900f8de748ab6a6a64.exe
3696	1eb7992ca97e8bb0b65faeaf69b30d9ac84406b1f35d6a900f8de748ab6a6a64.exe
2460	Idle.exe
2664	Idle.exe
2244	Idle.exe
4936	Idle.exe
3776	Idle.exe
348	Idle.exe
1288	Idle.exe

Suspicious use of AdjustPrivilegeToken 8 IoCs

description	pid	Process
Token: SeDebugPrivilege	3696	1eb7992ca97e8bb0b65faeaf69b30d9ac84406b1f35d6a900f8de748ab6a6a64.exe
Token: SeDebugPrivilege	2460	Idle.exe
Token: SeDebugPrivilege	2664	Idle.exe
Token: SeDebugPrivilege	2244	Idle.exe
Token: SeDebugPrivilege	4936	Idle.exe
Token: SeDebugPrivilege	3776	Idle.exe
Token: SeDebugPrivilege	348	Idle.exe
Token: SeDebugPrivilege	1288	Idle.exe

Suspicious use of WriteProcessMemory 46 IoCs

description	pid	Process	procid_target
PID 3696 wrote to memory of 4688	3696	1eb7992ca97e8bb0b65faeaf69b30d9ac84406b1f35d6a900f8de748ab6a6a64.exe	124
PID 3696 wrote to memory of 4688	3696	1eb7992ca97e8bb0b65faeaf69b30d9ac84406b1f35d6a900f8de748ab6a6a64.exe	124
PID 4688 wrote to memory of 2036	4688	cmd.exe	126
PID 4688 wrote to memory of 2036	4688	cmd.exe	126
PID 4688 wrote to memory of 2460	4688	cmd.exe	129
PID 4688 wrote to memory of 2460	4688	cmd.exe	129
PID 2460 wrote to memory of 4984	2460	Idle.exe	130
PID 2460 wrote to memory of 4984	2460	Idle.exe	130
PID 4984 wrote to memory of 4876	4984	cmd.exe	132
PID 4984 wrote to memory of 4876	4984	cmd.exe	132
PID 4984 wrote to memory of 2664	4984	cmd.exe	136
PID 4984 wrote to memory of 2664	4984	cmd.exe	136
PID 2664 wrote to memory of 540	2664	Idle.exe	141
PID 2664 wrote to memory of 540	2664	Idle.exe	141
PID 540 wrote to memory of 2020	540	cmd.exe	143
PID 540 wrote to memory of 2020	540	cmd.exe	143
PID 540 wrote to memory of 2244	540	cmd.exe	144
PID 540 wrote to memory of 2244	540	cmd.exe	144
PID 2244 wrote to memory of 368	2244	Idle.exe	145
PID 2244 wrote to memory of 368	2244	Idle.exe	145
PID 368 wrote to memory of 1316	368	cmd.exe	147
PID 368 wrote to memory of 1316	368	cmd.exe	147
PID 368 wrote to memory of 4936	368	cmd.exe	148
PID 368 wrote to memory of 4936	368	cmd.exe	148
PID 4936 wrote to memory of 2124	4936	Idle.exe	149
PID 4936 wrote to memory of 2124	4936	Idle.exe	149
PID 2124 wrote to memory of 2116	2124	cmd.exe	151
PID 2124 wrote to memory of 2116	2124	cmd.exe	151
PID 2124 wrote to memory of 3776	2124	cmd.exe	152
PID 2124 wrote to memory of 3776	2124	cmd.exe	152
PID 3776 wrote to memory of 3540	3776	Idle.exe	153
PID 3776 wrote to memory of 3540	3776	Idle.exe	153
PID 3540 wrote to memory of 4084	3540	cmd.exe	155
PID 3540 wrote to memory of 4084	3540	cmd.exe	155
PID 3540 wrote to memory of 348	3540	cmd.exe	156
PID 3540 wrote to memory of 348	3540	cmd.exe	156
PID 348 wrote to memory of 4984	348	Idle.exe	157
PID 348 wrote to memory of 4984	348	Idle.exe	157
PID 4984 wrote to memory of 2864	4984	cmd.exe	159
PID 4984 wrote to memory of 2864	4984	cmd.exe	159
PID 4984 wrote to memory of 1288	4984	cmd.exe	160
PID 4984 wrote to memory of 1288	4984	cmd.exe	160
PID 1288 wrote to memory of 4588	1288	Idle.exe	161
PID 1288 wrote to memory of 4588	1288	Idle.exe	161
PID 4588 wrote to memory of 1112	4588	cmd.exe	163
PID 4588 wrote to memory of 1112	4588	cmd.exe	163

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\1eb7992ca97e8bb0b65faeaf69b30d9ac84406b1f35d6a900f8de748ab6a6a64.exe
"C:\Users\Admin\AppData\Local\Temp\1eb7992ca97e8bb0b65faeaf69b30d9ac84406b1f35d6a900f8de748ab6a6a64.exe"
1⤵
- Checks computer location settings
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3696
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\SPWvGcMwiP.bat"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4688
- - C:\Windows\system32\w32tm.exe
    w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
    3⤵
    PID:2036
- - C:\Windows\INF\Idle.exe
    "C:\Windows\INF\Idle.exe"
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Modifies registry class
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:2460
  - - C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\Jobc5AEC9X.bat"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:4984
    - - C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        5⤵
        
        PID:4876
    - - C:\Windows\INF\Idle.exe
        
        "C:\Windows\INF\Idle.exe"
        5⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2664
      - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\hJP5Gj8VmP.bat"
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:540
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        7⤵
        
        PID:2020
        
        C:\Windows\INF\Idle.exe
        
        "C:\Windows\INF\Idle.exe"
        7⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2244
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\vCRFnHZZKP.bat"
        8⤵
        Suspicious use of WriteProcessMemory
        
        PID:368
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        9⤵
        
        PID:1316
        
        C:\Windows\INF\Idle.exe
        
        "C:\Windows\INF\Idle.exe"
        9⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4936
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\gSW9k5bhgR.bat"
        10⤵
        Suspicious use of WriteProcessMemory
        
        PID:2124
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        11⤵
        
        PID:2116
        
        C:\Windows\INF\Idle.exe
        
        "C:\Windows\INF\Idle.exe"
        11⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3776
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\4vYRXbn8bW.bat"
        12⤵
        Suspicious use of WriteProcessMemory
        
        PID:3540
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        13⤵
        
        PID:4084
        
        C:\Windows\INF\Idle.exe
        
        "C:\Windows\INF\Idle.exe"
        13⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:348
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\F1gdtReUkn.bat"
        14⤵
        Suspicious use of WriteProcessMemory
        
        PID:4984
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        15⤵
        
        PID:2864
        
        C:\Windows\INF\Idle.exe
        
        "C:\Windows\INF\Idle.exe"
        15⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1288
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\VeFqpJq3BV.bat"
        16⤵
        Suspicious use of WriteProcessMemory
        
        PID:4588
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        17⤵
        
        PID:1112

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 7 /tr "'C:\Users\Default\Favorites\wininit.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2580

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininit" /sc ONLOGON /tr "'C:\Users\Default\Favorites\wininit.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3932

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 13 /tr "'C:\Users\Default\Favorites\wininit.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4480

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "TextInputHostT" /sc MINUTE /mo 6 /tr "'C:\Program Files\dotnet\host\fxr\8.0.2\TextInputHost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2860

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "TextInputHost" /sc ONLOGON /tr "'C:\Program Files\dotnet\host\fxr\8.0.2\TextInputHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2252

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "TextInputHostT" /sc MINUTE /mo 9 /tr "'C:\Program Files\dotnet\host\fxr\8.0.2\TextInputHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:5084

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sihosts" /sc MINUTE /mo 8 /tr "'C:\Users\All Users\Desktop\sihost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1216

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sihost" /sc ONLOGON /tr "'C:\Users\All Users\Desktop\sihost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1592

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sihosts" /sc MINUTE /mo 5 /tr "'C:\Users\All Users\Desktop\sihost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1560

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 14 /tr "'C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\wininit.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3432

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininit" /sc ONLOGON /tr "'C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\wininit.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2648

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 11 /tr "'C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\wininit.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1680

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "StartMenuExperienceHostS" /sc MINUTE /mo 5 /tr "'C:\Recovery\WindowsRE\StartMenuExperienceHost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:960

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "StartMenuExperienceHost" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\StartMenuExperienceHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1836

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "StartMenuExperienceHostS" /sc MINUTE /mo 5 /tr "'C:\Recovery\WindowsRE\StartMenuExperienceHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1016

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 11 /tr "'C:\Program Files (x86)\Microsoft.NET\RedistList\RuntimeBroker.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2112

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Program Files (x86)\Microsoft.NET\RedistList\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2676

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 12 /tr "'C:\Program Files (x86)\Microsoft.NET\RedistList\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3140

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 13 /tr "'C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_107921\RuntimeBroker.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:5008

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_107921\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1608

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 6 /tr "'C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_107921\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3520

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RegistryR" /sc MINUTE /mo 13 /tr "'C:\Program Files (x86)\Internet Explorer\fr-FR\Registry.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2776

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Registry" /sc ONLOGON /tr "'C:\Program Files (x86)\Internet Explorer\fr-FR\Registry.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1224

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RegistryR" /sc MINUTE /mo 12 /tr "'C:\Program Files (x86)\Internet Explorer\fr-FR\Registry.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3840

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 14 /tr "'C:\Recovery\WindowsRE\System.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2264

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "System" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\System.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:440

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 8 /tr "'C:\Recovery\WindowsRE\System.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4384

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 11 /tr "'C:\Windows\INF\Idle.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:900

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Idle" /sc ONLOGON /tr "'C:\Windows\INF\Idle.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4044

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 7 /tr "'C:\Windows\INF\Idle.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3204

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostwt" /sc MINUTE /mo 14 /tr "'C:\Windows\ShellExperiences\taskhostw.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4744

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostw" /sc ONLOGON /tr "'C:\Windows\ShellExperiences\taskhostw.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4212

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostwt" /sc MINUTE /mo 7 /tr "'C:\Windows\ShellExperiences\taskhostw.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4716

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 10 /tr "'C:\Program Files\Windows Security\System.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3184

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "System" /sc ONLOGON /tr "'C:\Program Files\Windows Security\System.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1464

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 7 /tr "'C:\Program Files\Windows Security\System.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3416

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 12 /tr "'C:\Program Files\Windows Security\BrowserCore\en-US\wininit.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2748

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininit" /sc ONLOGON /tr "'C:\Program Files\Windows Security\BrowserCore\en-US\wininit.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4620

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 6 /tr "'C:\Program Files\Windows Security\BrowserCore\en-US\wininit.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2632

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Scheduled Task/Job

T1053

Privilege Escalation

Scheduled Task/Job

T1053

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

StartMenuExperienceHost.exe

Path C:\Recovery\WindowsRE\StartMenuExperienceHost.exe
Size 1001KB
SHA256 1eb7992ca97e8bb0b65faeaf69b30d9ac84406b1f35d6a900f8de748ab6a6a64
MD5 3146f2002112e5ba7562a28ff1883f9a
SHA1 9bd64b0954d746395e8080e563dbb39b254fac7d
SHA512 08e1e8c002269a4d611d21de3d037879abcbbf59f8f3744f27ee62b296adf61664f4f7afe0dc36bcdd4b5070fe6b7bf146ff94b0c682fee09e61bfa0935c3cfa
SSDEEP 12288:BiqbUK9S2Jhb/PZWzR6keiZAHOVEAKNZCKTh3VnGFOeRJmuHwj3x:hUK9SePZWzYrLHOdKRTh3heRJXQjx
MD5 SHA1 SHA512 SSDEEP

Submit Download

Idle.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\Idle.exe.log
Size 1KB
SHA256 27525f5fc7871c6828ab5173315e95b5c7e918d2ee532781c562c378584b5249
MD5 3ad9a5252966a3ab5b1b3222424717be
SHA1 5397522c86c74ddbfb2585b9613c794f4b4c3410
SHA512 b1a745f7a0f33b777ffc34f74f42752144d9f2d06b8bc613e703570494762b3af87e153212c3274b18af14f17b8619e2f350b7c3cc11228f7d4208d4251e90e6
MD5 SHA1 SHA512

Submit Download

4vYRXbn8bW.bat

Path C:\Users\Admin\AppData\Local\Temp\4vYRXbn8bW.bat
Size 188B
SHA256 16e66a4400e804e2d13ed2a2fa69d536c4df266d516ed0d23e60e08aaf4fd5c5
MD5 58ecd5edd6c3fe00887a3db90276ecfe
SHA1 06d70bbd240382adea051d03e26424b8dc4b27d0
SHA512 a0683c022c556e9b4b370a231a3a08d0fe64a79de9ba7c225d03f874ae61030f81b998c7b41df3b05096c98ea701eca896c85c18fdd080294321a67201bf0533
MD5 SHA1 SHA512

Submit Download

F1gdtReUkn.bat

Path C:\Users\Admin\AppData\Local\Temp\F1gdtReUkn.bat
Size 188B
SHA256 1bda6360c3bb9f4791598544c40a7eaf7b08db99f2706c37d00920d1596779bf
MD5 1566aa43d294e3a71209d21eacd2d9aa
SHA1 b7897cf07642ee735cb1ed96a24fe75d250e59c2
SHA512 c5b51824dc10c93d1cd5bcfd4f836b53fcd6e8340d16f7dd51d3e1ee92d711b9e2ea07d553f6f92adec31f9577e41bc6a58563e8741ecfdb159b6ee8683bd1a3
MD5 SHA1 SHA512

Submit Download

Jobc5AEC9X.bat

Path C:\Users\Admin\AppData\Local\Temp\Jobc5AEC9X.bat
Size 188B
SHA256 9c8b965cb9e164b2c7584d5326a9be33945553095f18eb500094b198d2740dbc
MD5 fa11aed05ee2487f05e9b7a99f2623d5
SHA1 867142e7edceaa691994c1b83691b99072012c3d
SHA512 4a0ae4586ea13fe25046b3e2d348f57b1226f3de2a8cfed804560ec8046d63cbb0dba9b6dc664d14fd81e0c15181ce161b1780ebcbfd3ead4d0fecf808921526
MD5 SHA1 SHA512

Submit Download

SPWvGcMwiP.bat

Path C:\Users\Admin\AppData\Local\Temp\SPWvGcMwiP.bat
Size 188B
SHA256 a3052f01eb0c4c2d68d3ef1de86eabb206acac24ae8888045fe89828d14083b1
MD5 7ad5bbe64650354b09dc30134af60fd3
SHA1 e88384c3ad102832a2c2a75f7ae9180ad07444f6
SHA512 8325d572ba62e9fe10e54e136e5c60a048b37d69310d32fd07333e2b4de194cc5941c10f7b4a52754f0f35faf48c96f64f1e0c86ce66b12aac653e5ca24ca037
MD5 SHA1 SHA512

Submit Download

VeFqpJq3BV.bat

Path C:\Users\Admin\AppData\Local\Temp\VeFqpJq3BV.bat
Size 188B
SHA256 181645b67afb3c26c5451b07a48c6b0a627422b41db029a01848e2995bc45572
MD5 baa33e0ff25178f970b20cb1ca47c69b
SHA1 d5de02f98ab73655d9d79a39344857c817962f21
SHA512 c3d548265d950a8653374e1d2d209e61d51e8d6e042b0d0cd583e961319ddb0c948bb43d2271f36ed3b23e5d66d169084b59bc06c6f82f0127193557fb273e96
MD5 SHA1 SHA512

Submit Download

gSW9k5bhgR.bat

Path C:\Users\Admin\AppData\Local\Temp\gSW9k5bhgR.bat
Size 188B
SHA256 32cadbad737f0ed23cccc502da26196421b28b10653e0735639e3239606d7c94
MD5 c023e5c144ed9a1cf6d6f33bdda8b22c
SHA1 447e9ed9c1b0f9c6dbfa08fe9b0384e49a548930
SHA512 d5a6eb71f0b0533a903368be1b7358d9391ac1ed6cf44346030cb78a2fc87872007cf0dcb2c2c54d0ff3a2d65edd29b3b1131e72186b490e21df52762298d86e
MD5 SHA1 SHA512

Submit Download

hJP5Gj8VmP.bat

Path C:\Users\Admin\AppData\Local\Temp\hJP5Gj8VmP.bat
Size 188B
SHA256 baed645abfd94ad19a09320968d9f56583bb5a2614a70cc0c30e3146edd8370a
MD5 158daafbbe9d4bec00e5217e40a9bb76
SHA1 c2c912e980b48869c3520ea3707e8bf701ca533a
SHA512 2c33fe6083b56f8ce2af8e606e0e1c3df4eed61afd77cc15e5e14828dba9b645dfd5ea61e4995ff3aec1fb915c81e8a252e3773faf4a40aa84c5bd1794bd9675
MD5 SHA1 SHA512

Submit Download

vCRFnHZZKP.bat

Path C:\Users\Admin\AppData\Local\Temp\vCRFnHZZKP.bat
Size 188B
SHA256 9d16a515a1443207f71c47f4a7cc60b007f89582a9b6a0f46721c7d16f0f7db1
MD5 327b537a7b1894962fde861cfc2fd994
SHA1 f0f103adf9c7758d0b98faff29b26aca034577f3
SHA512 60a9d20364a48c779641d065ccee247afbe3bc01bde990394c14ec7954d1c840ea118b89bbf1b8a10885574b1772a9d83ec31ed0b28455c2bb421095d3f39d8c
MD5 SHA1 SHA512

Submit Download

memory/2244-62-0x000000001BD90000-0x000000001BEFA000-memory.dmp

Download

memory/2460-47-0x000000001BA00000-0x000000001BB02000-memory.dmp

Download

memory/2460-41-0x000000001BA00000-0x000000001BB02000-memory.dmp

Download

memory/2664-55-0x000000001C1B0000-0x000000001C31A000-memory.dmp

Download

memory/3696-0-0x00007FF8D81B3000-0x00007FF8D81B5000-memory.dmp

Download

memory/3696-3-0x00000000016F0000-0x000000000170C000-memory.dmp

Download

memory/3696-4-0x000000001BC40000-0x000000001BC90000-memory.dmp

Download

memory/3696-2-0x00007FF8D81B0000-0x00007FF8D8C71000-memory.dmp

Download

memory/3696-1-0x0000000000DB0000-0x0000000000EB2000-memory.dmp

Download

memory/3696-36-0x00007FF8D81B0000-0x00007FF8D8C71000-memory.dmp

Download

memory/4936-69-0x000000001BC20000-0x000000001BD8A000-memory.dmp

Download