dcrat | 88f80fbe352e5778eb8a9d0cb508c888d8a3c88c676455c5a5dc6348f7a427b1

Analysis

max time kernel
149s
max time network
139s
platform
windows10-2004_x64
resource
win10v2004-20240730-en
resource tags

arch:x64arch:x86image:win10v2004-20240730-enlocale:en-usos:windows10-2004-x64system
submitted
01/08/2024, 02:36

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
5bd5977e894914a21a401042805fec1a.exe
Size 3.6MB
Sample240801-c3kmtssbka
SHA256 88f80fbe352e5778eb8a9d0cb508c888d8a3c88c676455c5a5dc6348f7a427b1
MD5 5bd5977e894914a21a401042805fec1a
SHA1 7ee7c4ce0d5aebd9e608b503791a5a6bc9b60224
SHA512 20bfa21fe7f95d00e29528245c49f566484080c76a75ccf99160d81e4e2be5110daac728895f22f9e30c72954f0e0ce3eda8ae395d7c43a2801f083e1c262e56
SSDEEP 49152:A+Eb3Z7VnqvDcc43W0O8FUyyc4CeHkmCTaZ3PO0ac3q+Jrp4LdoRO3RLAics/Gav:3S3BNqAJtbeHkmCTg4c3q+Jrp/I5Nv
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

dcrat evasion infostealer rat trojan

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat

Process spawned unexpected child process 21 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4924	3212	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4968	3212	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3216	3212	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1312	3212	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4892	3212	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	940	3212	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	556	3212	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2404	3212	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4564	3212	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	384	3212	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1224	3212	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1372	3212	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3848	3212	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3940	3212	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	872	3212	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3428	3212	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1944	3212	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3108	3212	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2624	3212	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3208	3212	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1032	3212	schtasks.exe	86

UAC bypass 3 TTPs 21 IoCs

evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	5bd5977e894914a21a401042805fec1a.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	RuntimeBroker.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	RuntimeBroker.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	RuntimeBroker.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	RuntimeBroker.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	RuntimeBroker.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	RuntimeBroker.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	5bd5977e894914a21a401042805fec1a.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	RuntimeBroker.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	RuntimeBroker.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	RuntimeBroker.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	RuntimeBroker.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	RuntimeBroker.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	RuntimeBroker.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	RuntimeBroker.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	RuntimeBroker.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	RuntimeBroker.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	RuntimeBroker.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	RuntimeBroker.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	RuntimeBroker.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	5bd5977e894914a21a401042805fec1a.exe

DCRat payload 2 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral2/memory/4056-1-0x0000000000010000-0x00000000003BC000-memory.dmp	dcrat
behavioral2/files/0x00070000000233fa-31.dat	dcrat

Checks computer location settings 2 TTPs 7 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-807826884-2440573969-3755798217-1000\Control Panel\International\Geo\Nation	RuntimeBroker.exe
Key value queried	\REGISTRY\USER\S-1-5-21-807826884-2440573969-3755798217-1000\Control Panel\International\Geo\Nation	RuntimeBroker.exe
Key value queried	\REGISTRY\USER\S-1-5-21-807826884-2440573969-3755798217-1000\Control Panel\International\Geo\Nation	RuntimeBroker.exe
Key value queried	\REGISTRY\USER\S-1-5-21-807826884-2440573969-3755798217-1000\Control Panel\International\Geo\Nation	5bd5977e894914a21a401042805fec1a.exe
Key value queried	\REGISTRY\USER\S-1-5-21-807826884-2440573969-3755798217-1000\Control Panel\International\Geo\Nation	RuntimeBroker.exe
Key value queried	\REGISTRY\USER\S-1-5-21-807826884-2440573969-3755798217-1000\Control Panel\International\Geo\Nation	RuntimeBroker.exe
Key value queried	\REGISTRY\USER\S-1-5-21-807826884-2440573969-3755798217-1000\Control Panel\International\Geo\Nation	RuntimeBroker.exe

Executes dropped EXE 6 IoCs

pid	Process
2116	RuntimeBroker.exe
5024	RuntimeBroker.exe
4300	RuntimeBroker.exe
3504	RuntimeBroker.exe
3060	RuntimeBroker.exe
4904	RuntimeBroker.exe

Checks whether UAC is enabled 1 TTPs 14 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	RuntimeBroker.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	5bd5977e894914a21a401042805fec1a.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	5bd5977e894914a21a401042805fec1a.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	RuntimeBroker.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	RuntimeBroker.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	RuntimeBroker.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	RuntimeBroker.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	RuntimeBroker.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	RuntimeBroker.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	RuntimeBroker.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	RuntimeBroker.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	RuntimeBroker.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	RuntimeBroker.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	RuntimeBroker.exe

Drops file in Program Files directory 7 IoCs

description	ioc	Process
File created	C:\Program Files\Windows Multimedia Platform\9e8d7a4ca61bd9	5bd5977e894914a21a401042805fec1a.exe
File created	C:\Program Files\7-Zip\Lang\backgroundTaskHost.exe	5bd5977e894914a21a401042805fec1a.exe
File created	C:\Program Files\7-Zip\Lang\eddb19405b7ce1	5bd5977e894914a21a401042805fec1a.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\Font\Registry.exe	5bd5977e894914a21a401042805fec1a.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\Font\ee2ad38f3d4382	5bd5977e894914a21a401042805fec1a.exe
File created	C:\Program Files\Windows Multimedia Platform\RuntimeBroker.exe	5bd5977e894914a21a401042805fec1a.exe
File opened for modification	C:\Program Files\Windows Multimedia Platform\RuntimeBroker.exe	5bd5977e894914a21a401042805fec1a.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File created	C:\Windows\PrintDialog\fontdrvhost.exe	5bd5977e894914a21a401042805fec1a.exe
File created	C:\Windows\PrintDialog\5b884080fd4f94	5bd5977e894914a21a401042805fec1a.exe
File created	C:\Windows\es-ES\OfficeClickToRun.exe	5bd5977e894914a21a401042805fec1a.exe
File created	C:\Windows\es-ES\e6c9b481da804f	5bd5977e894914a21a401042805fec1a.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 7 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-807826884-2440573969-3755798217-1000_Classes\Local Settings	RuntimeBroker.exe
Key created	\REGISTRY\USER\S-1-5-21-807826884-2440573969-3755798217-1000_Classes\Local Settings	5bd5977e894914a21a401042805fec1a.exe
Key created	\REGISTRY\USER\S-1-5-21-807826884-2440573969-3755798217-1000_Classes\Local Settings	RuntimeBroker.exe
Key created	\REGISTRY\USER\S-1-5-21-807826884-2440573969-3755798217-1000_Classes\Local Settings	RuntimeBroker.exe
Key created	\REGISTRY\USER\S-1-5-21-807826884-2440573969-3755798217-1000_Classes\Local Settings	RuntimeBroker.exe
Key created	\REGISTRY\USER\S-1-5-21-807826884-2440573969-3755798217-1000_Classes\Local Settings	RuntimeBroker.exe
Key created	\REGISTRY\USER\S-1-5-21-807826884-2440573969-3755798217-1000_Classes\Local Settings	RuntimeBroker.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 21 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4892	schtasks.exe
1372	schtasks.exe
3848	schtasks.exe
3940	schtasks.exe
1312	schtasks.exe
940	schtasks.exe
384	schtasks.exe
1224	schtasks.exe
1944	schtasks.exe
4968	schtasks.exe
3428	schtasks.exe
2624	schtasks.exe
4924	schtasks.exe
3216	schtasks.exe
556	schtasks.exe
2404	schtasks.exe
4564	schtasks.exe
872	schtasks.exe
3108	schtasks.exe
3208	schtasks.exe
1032	schtasks.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
4056	5bd5977e894914a21a401042805fec1a.exe
4056	5bd5977e894914a21a401042805fec1a.exe
4056	5bd5977e894914a21a401042805fec1a.exe
4056	5bd5977e894914a21a401042805fec1a.exe
4056	5bd5977e894914a21a401042805fec1a.exe
4056	5bd5977e894914a21a401042805fec1a.exe
4056	5bd5977e894914a21a401042805fec1a.exe
2116	RuntimeBroker.exe
5024	RuntimeBroker.exe
4300	RuntimeBroker.exe
3504	RuntimeBroker.exe
3060	RuntimeBroker.exe
4904	RuntimeBroker.exe

Suspicious use of AdjustPrivilegeToken 7 IoCs

description	pid	Process
Token: SeDebugPrivilege	4056	5bd5977e894914a21a401042805fec1a.exe
Token: SeDebugPrivilege	2116	RuntimeBroker.exe
Token: SeDebugPrivilege	5024	RuntimeBroker.exe
Token: SeDebugPrivilege	4300	RuntimeBroker.exe
Token: SeDebugPrivilege	3504	RuntimeBroker.exe
Token: SeDebugPrivilege	3060	RuntimeBroker.exe
Token: SeDebugPrivilege	4904	RuntimeBroker.exe

Suspicious use of WriteProcessMemory 40 IoCs

description	pid	Process	procid_target
PID 4056 wrote to memory of 4436	4056	5bd5977e894914a21a401042805fec1a.exe	108
PID 4056 wrote to memory of 4436	4056	5bd5977e894914a21a401042805fec1a.exe	108
PID 4436 wrote to memory of 3136	4436	cmd.exe	110
PID 4436 wrote to memory of 3136	4436	cmd.exe	110
PID 4436 wrote to memory of 2116	4436	cmd.exe	111
PID 4436 wrote to memory of 2116	4436	cmd.exe	111
PID 2116 wrote to memory of 1132	2116	RuntimeBroker.exe	112
PID 2116 wrote to memory of 1132	2116	RuntimeBroker.exe	112
PID 2116 wrote to memory of 1672	2116	RuntimeBroker.exe	113
PID 2116 wrote to memory of 1672	2116	RuntimeBroker.exe	113
PID 1132 wrote to memory of 5024	1132	WScript.exe	114
PID 1132 wrote to memory of 5024	1132	WScript.exe	114
PID 5024 wrote to memory of 3604	5024	RuntimeBroker.exe	115
PID 5024 wrote to memory of 3604	5024	RuntimeBroker.exe	115
PID 5024 wrote to memory of 1100	5024	RuntimeBroker.exe	116
PID 5024 wrote to memory of 1100	5024	RuntimeBroker.exe	116
PID 3604 wrote to memory of 4300	3604	WScript.exe	118
PID 3604 wrote to memory of 4300	3604	WScript.exe	118
PID 4300 wrote to memory of 4892	4300	RuntimeBroker.exe	120
PID 4300 wrote to memory of 4892	4300	RuntimeBroker.exe	120
PID 4300 wrote to memory of 4560	4300	RuntimeBroker.exe	121
PID 4300 wrote to memory of 4560	4300	RuntimeBroker.exe	121
PID 4892 wrote to memory of 3504	4892	WScript.exe	123
PID 4892 wrote to memory of 3504	4892	WScript.exe	123
PID 3504 wrote to memory of 4588	3504	RuntimeBroker.exe	124
PID 3504 wrote to memory of 4588	3504	RuntimeBroker.exe	124
PID 3504 wrote to memory of 4044	3504	RuntimeBroker.exe	125
PID 3504 wrote to memory of 4044	3504	RuntimeBroker.exe	125
PID 4588 wrote to memory of 3060	4588	WScript.exe	126
PID 4588 wrote to memory of 3060	4588	WScript.exe	126
PID 3060 wrote to memory of 3720	3060	RuntimeBroker.exe	127
PID 3060 wrote to memory of 3720	3060	RuntimeBroker.exe	127
PID 3060 wrote to memory of 4272	3060	RuntimeBroker.exe	128
PID 3060 wrote to memory of 4272	3060	RuntimeBroker.exe	128
PID 3720 wrote to memory of 4904	3720	WScript.exe	129
PID 3720 wrote to memory of 4904	3720	WScript.exe	129
PID 4904 wrote to memory of 3732	4904	RuntimeBroker.exe	130
PID 4904 wrote to memory of 3732	4904	RuntimeBroker.exe	130
PID 4904 wrote to memory of 4408	4904	RuntimeBroker.exe	131
PID 4904 wrote to memory of 4408	4904	RuntimeBroker.exe	131

System policy modification 1 TTPs 21 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	RuntimeBroker.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	RuntimeBroker.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	RuntimeBroker.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	RuntimeBroker.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	RuntimeBroker.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	RuntimeBroker.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	RuntimeBroker.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	5bd5977e894914a21a401042805fec1a.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	5bd5977e894914a21a401042805fec1a.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	RuntimeBroker.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	RuntimeBroker.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	RuntimeBroker.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	RuntimeBroker.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	RuntimeBroker.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	RuntimeBroker.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	RuntimeBroker.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	RuntimeBroker.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	5bd5977e894914a21a401042805fec1a.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	RuntimeBroker.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	RuntimeBroker.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	RuntimeBroker.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\5bd5977e894914a21a401042805fec1a.exe
"C:\Users\Admin\AppData\Local\Temp\5bd5977e894914a21a401042805fec1a.exe"
1⤵
- UAC bypass
- Checks computer location settings
- Checks whether UAC is enabled
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:4056
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\pThaEkwbyi.bat"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4436
- - C:\Windows\system32\w32tm.exe
    w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
    3⤵
    PID:3136
- - C:\Program Files\Windows Multimedia Platform\RuntimeBroker.exe
    "C:\Program Files\Windows Multimedia Platform\RuntimeBroker.exe"
    3⤵
    - UAC bypass
    - Checks computer location settings
    - Executes dropped EXE
    - Checks whether UAC is enabled
    - Modifies registry class
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    - System policy modification
    PID:2116
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\bed638dd-82a8-4570-911e-01daa542e147.vbs"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:1132
    - - C:\Program Files\Windows Multimedia Platform\RuntimeBroker.exe
        
        "C:\Program Files\Windows Multimedia Platform\RuntimeBroker.exe"
        5⤵
        UAC bypass
        Checks computer location settings
        Executes dropped EXE
        Checks whether UAC is enabled
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        System policy modification
        
        PID:5024
      - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\5812943d-5a53-4dfd-864a-929651884e35.vbs"
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:3604
        
        C:\Program Files\Windows Multimedia Platform\RuntimeBroker.exe
        
        "C:\Program Files\Windows Multimedia Platform\RuntimeBroker.exe"
        7⤵
        UAC bypass
        Checks computer location settings
        Executes dropped EXE
        Checks whether UAC is enabled
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        System policy modification
        
        PID:4300
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\547b7465-5087-437c-ba87-55f44b49a5cb.vbs"
        8⤵
        Suspicious use of WriteProcessMemory
        
        PID:4892
        
        C:\Program Files\Windows Multimedia Platform\RuntimeBroker.exe
        
        "C:\Program Files\Windows Multimedia Platform\RuntimeBroker.exe"
        9⤵
        UAC bypass
        Checks computer location settings
        Executes dropped EXE
        Checks whether UAC is enabled
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        System policy modification
        
        PID:3504
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\a1d155ec-a6d1-402d-b038-6bccc9f4dc5f.vbs"
        10⤵
        Suspicious use of WriteProcessMemory
        
        PID:4588
        
        C:\Program Files\Windows Multimedia Platform\RuntimeBroker.exe
        
        "C:\Program Files\Windows Multimedia Platform\RuntimeBroker.exe"
        11⤵
        UAC bypass
        Checks computer location settings
        Executes dropped EXE
        Checks whether UAC is enabled
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        System policy modification
        
        PID:3060
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\5d7f481e-c94a-460a-bdf7-c08c78005660.vbs"
        12⤵
        Suspicious use of WriteProcessMemory
        
        PID:3720
        
        C:\Program Files\Windows Multimedia Platform\RuntimeBroker.exe
        
        "C:\Program Files\Windows Multimedia Platform\RuntimeBroker.exe"
        13⤵
        UAC bypass
        Checks computer location settings
        Executes dropped EXE
        Checks whether UAC is enabled
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        System policy modification
        
        PID:4904
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\f5641d3a-cc8b-46da-ad01-9c87775b2f78.vbs"
        14⤵
        
        PID:3732
        
        C:\Program Files\Windows Multimedia Platform\RuntimeBroker.exe
        
        "C:\Program Files\Windows Multimedia Platform\RuntimeBroker.exe"
        15⤵
        
        PID:3676
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\5b034f62-9ce9-46d4-8877-1ce1f666fdff.vbs"
        14⤵
        
        PID:4408
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\ba31ed11-9938-4345-a089-abe657834e56.vbs"
        12⤵
        
        PID:4272
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\b89b66ef-ba1b-45ee-92d0-ab5eb856aab3.vbs"
        10⤵
        
        PID:4044
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\29a22c75-c2f7-42bc-bbdb-1c772b5ba6fe.vbs"
        8⤵
        
        PID:4560
      - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\2058113e-44fb-4ad3-8986-43327165f9b5.vbs"
        6⤵
        
        PID:1100
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\43bb70ba-2f0e-42ad-8b1a-e83a6b809258.vbs"
      4⤵
      PID:1672

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 14 /tr "'C:\Program Files\Windows Multimedia Platform\RuntimeBroker.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4924

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Program Files\Windows Multimedia Platform\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4968

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 11 /tr "'C:\Program Files\Windows Multimedia Platform\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3216

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 5 /tr "'C:\Windows\PrintDialog\fontdrvhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1312

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\Windows\PrintDialog\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4892

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 13 /tr "'C:\Windows\PrintDialog\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:940

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "backgroundTaskHostb" /sc MINUTE /mo 14 /tr "'C:\Program Files\7-Zip\Lang\backgroundTaskHost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:556

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "backgroundTaskHost" /sc ONLOGON /tr "'C:\Program Files\7-Zip\Lang\backgroundTaskHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2404

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "backgroundTaskHostb" /sc MINUTE /mo 9 /tr "'C:\Program Files\7-Zip\Lang\backgroundTaskHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4564

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "upfcu" /sc MINUTE /mo 12 /tr "'C:\Recovery\WindowsRE\upfc.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:384

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "upfc" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\upfc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1224

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "upfcu" /sc MINUTE /mo 8 /tr "'C:\Recovery\WindowsRE\upfc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1372

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RegistryR" /sc MINUTE /mo 5 /tr "'C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\Font\Registry.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3848

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Registry" /sc ONLOGON /tr "'C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\Font\Registry.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3940

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RegistryR" /sc MINUTE /mo 12 /tr "'C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\Font\Registry.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:872

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OfficeClickToRunO" /sc MINUTE /mo 11 /tr "'C:\Windows\es-ES\OfficeClickToRun.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3428

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OfficeClickToRun" /sc ONLOGON /tr "'C:\Windows\es-ES\OfficeClickToRun.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1944

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OfficeClickToRunO" /sc MINUTE /mo 9 /tr "'C:\Windows\es-ES\OfficeClickToRun.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3108

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 11 /tr "'C:\Recovery\WindowsRE\Idle.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2624

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Idle" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\Idle.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1032

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 10 /tr "'C:\Recovery\WindowsRE\Idle.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3208

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Registry.exe

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\Font\Registry.exe
Size 3.6MB
SHA256 88f80fbe352e5778eb8a9d0cb508c888d8a3c88c676455c5a5dc6348f7a427b1
MD5 5bd5977e894914a21a401042805fec1a
SHA1 7ee7c4ce0d5aebd9e608b503791a5a6bc9b60224
SHA512 20bfa21fe7f95d00e29528245c49f566484080c76a75ccf99160d81e4e2be5110daac728895f22f9e30c72954f0e0ce3eda8ae395d7c43a2801f083e1c262e56
SSDEEP 49152:A+Eb3Z7VnqvDcc43W0O8FUyyc4CeHkmCTaZ3PO0ac3q+Jrp4LdoRO3RLAics/Gav:3S3BNqAJtbeHkmCTg4c3q+Jrp/I5Nv
MD5 SHA1 SHA512 SSDEEP

Submit Download

RuntimeBroker.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\RuntimeBroker.exe.log
Size 1KB
SHA256 2a5d403a2e649d8eceef8f785eeb0f6d33888ec6bbf251b3c347e34cb32b1e77
MD5 49b64127208271d8f797256057d0b006
SHA1 b99bd7e2b4e9ed24de47fb3341ea67660b84cca1
SHA512 f7c728923c893dc9bc88ad2159e0abcda41e1b40ff7e7756e6252d135ed238a2248a2662b3392449836dd1b0b580f0c866cc33e409527484fe4602e3d3f10e3e
MD5 SHA1 SHA512

Submit Download

43bb70ba-2f0e-42ad-8b1a-e83a6b809258.vbs

Path C:\Users\Admin\AppData\Local\Temp\43bb70ba-2f0e-42ad-8b1a-e83a6b809258.vbs
Size 514B
SHA256 fbe1771bd8efbf9e23dac1df854a8f23a8eeab414c608a4d67a818289a5e29cc
MD5 26a6ce64fe68d0ad367fd0f8993f0d86
SHA1 8a673eb6952b929d3d49437184e0418116a043bf
SHA512 7a581cb8a9ea21619b5bdeb5fac08b0ccbf61cdae20380b8befb6e1c6f473cc7e6f826822cde2abe5f6547b074b5524bea2594edaaba044e43ee021e8dc362fd
MD5 SHA1 SHA512

Submit Download

547b7465-5087-437c-ba87-55f44b49a5cb.vbs

Path C:\Users\Admin\AppData\Local\Temp\547b7465-5087-437c-ba87-55f44b49a5cb.vbs
Size 738B
SHA256 d47b42d0d05f09da35b60d2c371db4b41f88c5e270bcf509bd8c659e9d1a0784
MD5 7c4ce92458ee74c5b6c13ee47d7f9fa5
SHA1 10cac80229404bacd477d39fb3aaabc82f6453d1
SHA512 c70c314e6fd9c306de5b586de05caa31da43443dca553cd03f0bb99609bcbd0a35e2393d214e3b59590682c5dedc0b59b94c18597a2e9f5d3fecb0369509cd88
MD5 SHA1 SHA512

Submit Download

5812943d-5a53-4dfd-864a-929651884e35.vbs

Path C:\Users\Admin\AppData\Local\Temp\5812943d-5a53-4dfd-864a-929651884e35.vbs
Size 738B
SHA256 cfa444075c69e02837e1d56f979a55d9c80b04eddd13d9262f895db75c3d6943
MD5 2e92d7b9de8c5aa75f041b98e5049381
SHA1 020485e7dcadf0b9e3affb7d3416805bc08a26f5
SHA512 93a9dd47849a8a7cbca3a3b0f62105828a63701bfd96f966612757a3185d777546413dc84cbfe87ab36a57ad142da75331ccc788291c4c54f9c32f492386d3b2
MD5 SHA1 SHA512

Submit Download

5d7f481e-c94a-460a-bdf7-c08c78005660.vbs

Path C:\Users\Admin\AppData\Local\Temp\5d7f481e-c94a-460a-bdf7-c08c78005660.vbs
Size 738B
SHA256 8bd11cb75058402d6270ea3d99b1e558138c3425484560a7672e4f822666779b
MD5 a159b3888196b1d47d482a0e9fe5274c
SHA1 ce4e145b3c8a5b3ee16b4edf79c1d2d481743405
SHA512 005e68f7e2e8ed7da08958ba527a72690bd7ac79539b870b220363281b2208f3029f92b9181882262e11de7d5c7ce95740afba741b971d81a9384ae43d8578f7
MD5 SHA1 SHA512

Submit Download

a1d155ec-a6d1-402d-b038-6bccc9f4dc5f.vbs

Path C:\Users\Admin\AppData\Local\Temp\a1d155ec-a6d1-402d-b038-6bccc9f4dc5f.vbs
Size 738B
SHA256 7617f1b3b6571e470935895cbcc60c6bd025f950b1f3f9919e168a1ef079877e
MD5 a382acb7385d0c8fe97a117d363f49f1
SHA1 b1409c14c3a6ba6fcf4dced69b0335f6ae0708fc
SHA512 9159f33f9e03c08c0755f277746bf276d4a2112da07049535fdc22486f26d9e3d1cec4faa3b8105cecc35a9af7e9e6cd538bbffcb6d52b0c1c969bc63813fda9
MD5 SHA1 SHA512

Submit Download

bed638dd-82a8-4570-911e-01daa542e147.vbs

Path C:\Users\Admin\AppData\Local\Temp\bed638dd-82a8-4570-911e-01daa542e147.vbs
Size 738B
SHA256 2c65b704bf37f153f2135950bb8d46854b8f2921f3978f385aac32d344361db1
MD5 dd1d2b5a215f0eb33706803ef8d34e24
SHA1 08a41b1fd7174c4fc654e0a724562acd37e0ddf2
SHA512 3ef83de84ae1778777a06e71c13b19194366158d6a64a6dd940d7ccb8a36a80dc495cf0c0f48503b918d5220dfb7d8b696a7d06c0ca423bd3eca32268eddfcbd
MD5 SHA1 SHA512

Submit Download

f5641d3a-cc8b-46da-ad01-9c87775b2f78.vbs

Path C:\Users\Admin\AppData\Local\Temp\f5641d3a-cc8b-46da-ad01-9c87775b2f78.vbs
Size 738B
SHA256 6c399f5bc05e50cecf8be3c1b7e09a8c184cc6d4d6366ed2b7b90a0f62c5be4f
MD5 b43689570b37930d799676dc60a109b3
SHA1 0e969de876eb23d180edf40e981429789aea946a
SHA512 271405ba305371a00489171efa23218ccb1314d10f77852aa2d05e01f00f9d59996809fa9d7262eb2677885957d25abbdb942a0cef5910e3cea193a02f9eb1c0
MD5 SHA1 SHA512

Submit Download

pThaEkwbyi.bat

Path C:\Users\Admin\AppData\Local\Temp\pThaEkwbyi.bat
Size 227B
SHA256 c435b7514b35c9d325326d8002a766ab5f52b3754289dfe2e44e66d7db826220
MD5 2c53ecdca8d074f654ab117033654849
SHA1 0ab51f4e4e4490741010e7911eddfcefe6998aa8
SHA512 013c614b0d1340d0cc1163fdba0b832e4c1224a07963f64c4491c522aae4a872fd5d53f083cc37f136d66e06fb7e4693b3f5a205d122aee11e68532a3ae4e475
MD5 SHA1 SHA512

Submit Download

memory/2116-47-0x000000001D160000-0x000000001D172000-memory.dmp

Download

memory/4056-9-0x000000001B840000-0x000000001B896000-memory.dmp

Download

memory/4056-12-0x000000001BE00000-0x000000001C328000-memory.dmp

Download

memory/4056-17-0x000000001B960000-0x000000001B96E000-memory.dmp

Download

memory/4056-16-0x000000001B950000-0x000000001B95A000-memory.dmp

Download

memory/4056-19-0x000000001B980000-0x000000001B98E000-memory.dmp

Download

memory/4056-18-0x000000001B970000-0x000000001B978000-memory.dmp

Download

memory/4056-15-0x000000001B940000-0x000000001B948000-memory.dmp

Download

memory/4056-13-0x000000001B8D0000-0x000000001B8D8000-memory.dmp

Download

memory/4056-21-0x000000001B9B0000-0x000000001B9BA000-memory.dmp

Download

memory/4056-22-0x000000001B9C0000-0x000000001B9CC000-memory.dmp

Download

memory/4056-20-0x000000001B990000-0x000000001B998000-memory.dmp

Download

memory/4056-14-0x000000001B8E0000-0x000000001B8E8000-memory.dmp

Download

memory/4056-11-0x000000001B8A0000-0x000000001B8B2000-memory.dmp

Download

memory/4056-43-0x00007FFA94DE0000-0x00007FFA958A1000-memory.dmp

Download

memory/4056-10-0x000000001B890000-0x000000001B89C000-memory.dmp

Download

memory/4056-0-0x00007FFA94DE3000-0x00007FFA94DE5000-memory.dmp

Download

memory/4056-8-0x000000001B830000-0x000000001B83A000-memory.dmp

Download

memory/4056-7-0x000000001B810000-0x000000001B826000-memory.dmp

Download

memory/4056-6-0x00000000025D0000-0x00000000025D8000-memory.dmp

Download

memory/4056-5-0x000000001B680000-0x000000001B6D0000-memory.dmp

Download

memory/4056-4-0x00000000025A0000-0x00000000025BC000-memory.dmp

Download

memory/4056-3-0x0000000002530000-0x000000000253E000-memory.dmp

Download

memory/4056-2-0x00007FFA94DE0000-0x00007FFA958A1000-memory.dmp

Download

memory/4056-1-0x0000000000010000-0x00000000003BC000-memory.dmp

Download