dcrat | ab07eea7bfd0a6fea819ab73e1bc6c75b681b7cf044199ed7c38d410b7c5d729

Analysis

max time kernel
150s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
19-11-2024 14:29

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ab07eea7bfd0a6fea819ab73e1bc6c75b681b7cf044199ed7c38d410b7c5d729.exe
Size

3.4MB
MD5

4626a1483d82cf0be9302c305f6b54c4
SHA1

7f16e6aee9e0967b26e36b11de4654cfbffe2675
SHA256

ab07eea7bfd0a6fea819ab73e1bc6c75b681b7cf044199ed7c38d410b7c5d729
SHA512

6381dab004c7d96449554626bbc53d4d7d20a55d21c930a987e1e866803c34a0f6e964ec7a74fc3649f7a9fe9d490a535a59280875605ef950673d83bdd15f54
SSDEEP

49152:xZXrXU/5+Zc5SVROVisjq7miG9vv2SNty1kIP2XMxARdpe:xZzU4c5SMXq7miAX2SNty1xPuMyHpe

Score

10^/10

dcrat evasion infostealer persistence rat trojan

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat
Dcrat family
dcrat

Modifies WinLogon for persistence 2 TTPs 7 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

Processes:

ab07eea7bfd0a6fea819ab73e1bc6c75b681b7cf044199ed7c38d410b7c5d729.exe

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Recovery\\WindowsRE\\unsecapp.exe\", \"C:\\Windows\\Panther\\actionqueue\\TextInputHost.exe\", \"C:\\Users\\Default\\SendTo\\upfc.exe\", \"C:\\Recovery\\WindowsRE\\dllhost.exe\""	ab07eea7bfd0a6fea819ab73e1bc6c75b681b7cf044199ed7c38d410b7c5d729.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Recovery\\WindowsRE\\unsecapp.exe\", \"C:\\Windows\\Panther\\actionqueue\\TextInputHost.exe\", \"C:\\Users\\Default\\SendTo\\upfc.exe\", \"C:\\Recovery\\WindowsRE\\dllhost.exe\", \"C:\\Users\\Public\\AccountPictures\\dwm.exe\""	ab07eea7bfd0a6fea819ab73e1bc6c75b681b7cf044199ed7c38d410b7c5d729.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Recovery\\WindowsRE\\unsecapp.exe\", \"C:\\Windows\\Panther\\actionqueue\\TextInputHost.exe\", \"C:\\Users\\Default\\SendTo\\upfc.exe\", \"C:\\Recovery\\WindowsRE\\dllhost.exe\", \"C:\\Users\\Public\\AccountPictures\\dwm.exe\", \"C:\\Windows\\Sun\\Java\\fontdrvhost.exe\""	ab07eea7bfd0a6fea819ab73e1bc6c75b681b7cf044199ed7c38d410b7c5d729.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Recovery\\WindowsRE\\unsecapp.exe\", \"C:\\Windows\\Panther\\actionqueue\\TextInputHost.exe\", \"C:\\Users\\Default\\SendTo\\upfc.exe\", \"C:\\Recovery\\WindowsRE\\dllhost.exe\", \"C:\\Users\\Public\\AccountPictures\\dwm.exe\", \"C:\\Windows\\Sun\\Java\\fontdrvhost.exe\", \"C:\\Program Files (x86)\\Windows Media Player\\services.exe\""	ab07eea7bfd0a6fea819ab73e1bc6c75b681b7cf044199ed7c38d410b7c5d729.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Recovery\\WindowsRE\\unsecapp.exe\""	ab07eea7bfd0a6fea819ab73e1bc6c75b681b7cf044199ed7c38d410b7c5d729.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Recovery\\WindowsRE\\unsecapp.exe\", \"C:\\Windows\\Panther\\actionqueue\\TextInputHost.exe\""	ab07eea7bfd0a6fea819ab73e1bc6c75b681b7cf044199ed7c38d410b7c5d729.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Recovery\\WindowsRE\\unsecapp.exe\", \"C:\\Windows\\Panther\\actionqueue\\TextInputHost.exe\", \"C:\\Users\\Default\\SendTo\\upfc.exe\""	ab07eea7bfd0a6fea819ab73e1bc6c75b681b7cf044199ed7c38d410b7c5d729.exe

Process spawned unexpected child process 21 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

Processes:

schtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exe

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3820	1120	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1000	1120	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3720	1120	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3736	1120	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3524	1120	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4800	1120	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1216	1120	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1932	1120	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4052	1120	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	216	1120	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3272	1120	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3772	1120	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	220	1120	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2216	1120	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3056	1120	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2676	1120	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5044	1120	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2220	1120	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	436	1120	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1764	1120	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2940	1120	schtasks.exe	86

UAC bypass 3 TTPs 12 IoCs

evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Processes:

ab07eea7bfd0a6fea819ab73e1bc6c75b681b7cf044199ed7c38d410b7c5d729.exedllhost.exedllhost.exedllhost.exe

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	ab07eea7bfd0a6fea819ab73e1bc6c75b681b7cf044199ed7c38d410b7c5d729.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	ab07eea7bfd0a6fea819ab73e1bc6c75b681b7cf044199ed7c38d410b7c5d729.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	ab07eea7bfd0a6fea819ab73e1bc6c75b681b7cf044199ed7c38d410b7c5d729.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	dllhost.exe

DCRat payload 2 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

Processes:

resource	yara_rule
behavioral2/memory/4548-1-0x0000000000E30000-0x000000000119A000-memory.dmp	dcrat
behavioral2/files/0x0007000000023cac-48.dat	dcrat

Checks computer location settings 2 TTPs 4 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

dllhost.exedllhost.exeab07eea7bfd0a6fea819ab73e1bc6c75b681b7cf044199ed7c38d410b7c5d729.exedllhost.exe

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\International\Geo\Nation	dllhost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\International\Geo\Nation	dllhost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\International\Geo\Nation	ab07eea7bfd0a6fea819ab73e1bc6c75b681b7cf044199ed7c38d410b7c5d729.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\International\Geo\Nation	dllhost.exe

Executes dropped EXE 3 IoCs

Processes:

dllhost.exedllhost.exedllhost.exe

pid	Process
4604	dllhost.exe
3624	dllhost.exe
856	dllhost.exe

Adds Run key to start application 2 TTPs 14 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

ab07eea7bfd0a6fea819ab73e1bc6c75b681b7cf044199ed7c38d410b7c5d729.exe

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\unsecapp = "\"C:\\Recovery\\WindowsRE\\unsecapp.exe\""	ab07eea7bfd0a6fea819ab73e1bc6c75b681b7cf044199ed7c38d410b7c5d729.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\upfc = "\"C:\\Users\\Default\\SendTo\\upfc.exe\""	ab07eea7bfd0a6fea819ab73e1bc6c75b681b7cf044199ed7c38d410b7c5d729.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\services = "\"C:\\Program Files (x86)\\Windows Media Player\\services.exe\""	ab07eea7bfd0a6fea819ab73e1bc6c75b681b7cf044199ed7c38d410b7c5d729.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\unsecapp = "\"C:\\Recovery\\WindowsRE\\unsecapp.exe\""	ab07eea7bfd0a6fea819ab73e1bc6c75b681b7cf044199ed7c38d410b7c5d729.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dwm = "\"C:\\Users\\Public\\AccountPictures\\dwm.exe\""	ab07eea7bfd0a6fea819ab73e1bc6c75b681b7cf044199ed7c38d410b7c5d729.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\fontdrvhost = "\"C:\\Windows\\Sun\\Java\\fontdrvhost.exe\""	ab07eea7bfd0a6fea819ab73e1bc6c75b681b7cf044199ed7c38d410b7c5d729.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dllhost = "\"C:\\Recovery\\WindowsRE\\dllhost.exe\""	ab07eea7bfd0a6fea819ab73e1bc6c75b681b7cf044199ed7c38d410b7c5d729.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dllhost = "\"C:\\Recovery\\WindowsRE\\dllhost.exe\""	ab07eea7bfd0a6fea819ab73e1bc6c75b681b7cf044199ed7c38d410b7c5d729.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dwm = "\"C:\\Users\\Public\\AccountPictures\\dwm.exe\""	ab07eea7bfd0a6fea819ab73e1bc6c75b681b7cf044199ed7c38d410b7c5d729.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\services = "\"C:\\Program Files (x86)\\Windows Media Player\\services.exe\""	ab07eea7bfd0a6fea819ab73e1bc6c75b681b7cf044199ed7c38d410b7c5d729.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\upfc = "\"C:\\Users\\Default\\SendTo\\upfc.exe\""	ab07eea7bfd0a6fea819ab73e1bc6c75b681b7cf044199ed7c38d410b7c5d729.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\TextInputHost = "\"C:\\Windows\\Panther\\actionqueue\\TextInputHost.exe\""	ab07eea7bfd0a6fea819ab73e1bc6c75b681b7cf044199ed7c38d410b7c5d729.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\fontdrvhost = "\"C:\\Windows\\Sun\\Java\\fontdrvhost.exe\""	ab07eea7bfd0a6fea819ab73e1bc6c75b681b7cf044199ed7c38d410b7c5d729.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\TextInputHost = "\"C:\\Windows\\Panther\\actionqueue\\TextInputHost.exe\""	ab07eea7bfd0a6fea819ab73e1bc6c75b681b7cf044199ed7c38d410b7c5d729.exe

Checks whether UAC is enabled 1 TTPs 8 IoCs

evasion trojan

System Information Discovery

T1082

Processes:

dllhost.exedllhost.exeab07eea7bfd0a6fea819ab73e1bc6c75b681b7cf044199ed7c38d410b7c5d729.exedllhost.exe

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	dllhost.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	dllhost.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	ab07eea7bfd0a6fea819ab73e1bc6c75b681b7cf044199ed7c38d410b7c5d729.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	ab07eea7bfd0a6fea819ab73e1bc6c75b681b7cf044199ed7c38d410b7c5d729.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	dllhost.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	dllhost.exe

Drops file in Program Files directory 2 IoCs

Processes:

ab07eea7bfd0a6fea819ab73e1bc6c75b681b7cf044199ed7c38d410b7c5d729.exe

description	ioc	Process
File created	C:\Program Files (x86)\Windows Media Player\services.exe	ab07eea7bfd0a6fea819ab73e1bc6c75b681b7cf044199ed7c38d410b7c5d729.exe
File created	C:\Program Files (x86)\Windows Media Player\c5b4cb5e9653cc	ab07eea7bfd0a6fea819ab73e1bc6c75b681b7cf044199ed7c38d410b7c5d729.exe

Drops file in Windows directory 6 IoCs

Processes:

ab07eea7bfd0a6fea819ab73e1bc6c75b681b7cf044199ed7c38d410b7c5d729.exe

description	ioc	Process
File created	C:\Windows\Panther\actionqueue\TextInputHost.exe	ab07eea7bfd0a6fea819ab73e1bc6c75b681b7cf044199ed7c38d410b7c5d729.exe
File created	C:\Windows\Panther\actionqueue\22eafd247d37c3	ab07eea7bfd0a6fea819ab73e1bc6c75b681b7cf044199ed7c38d410b7c5d729.exe
File created	C:\Windows\schemas\VpnProfile\csrss.exe	ab07eea7bfd0a6fea819ab73e1bc6c75b681b7cf044199ed7c38d410b7c5d729.exe
File created	C:\Windows\ImmersiveControlPanel\es-ES\csrss.exe	ab07eea7bfd0a6fea819ab73e1bc6c75b681b7cf044199ed7c38d410b7c5d729.exe
File created	C:\Windows\Sun\Java\fontdrvhost.exe	ab07eea7bfd0a6fea819ab73e1bc6c75b681b7cf044199ed7c38d410b7c5d729.exe
File created	C:\Windows\Sun\Java\5b884080fd4f94	ab07eea7bfd0a6fea819ab73e1bc6c75b681b7cf044199ed7c38d410b7c5d729.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 4 IoCs

Processes:

ab07eea7bfd0a6fea819ab73e1bc6c75b681b7cf044199ed7c38d410b7c5d729.exedllhost.exedllhost.exedllhost.exe

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000_Classes\Local Settings	ab07eea7bfd0a6fea819ab73e1bc6c75b681b7cf044199ed7c38d410b7c5d729.exe
Key created	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000_Classes\Local Settings	dllhost.exe
Key created	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000_Classes\Local Settings	dllhost.exe
Key created	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000_Classes\Local Settings	dllhost.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 21 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

Processes:

pid	Process
1216	schtasks.exe
3056	schtasks.exe
5044	schtasks.exe
436	schtasks.exe
1764	schtasks.exe
2940	schtasks.exe
3820	schtasks.exe
3524	schtasks.exe
216	schtasks.exe
3272	schtasks.exe
2216	schtasks.exe
3720	schtasks.exe
3736	schtasks.exe
4800	schtasks.exe
3772	schtasks.exe
220	schtasks.exe
1000	schtasks.exe
1932	schtasks.exe
4052	schtasks.exe
2676	schtasks.exe
2220	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

ab07eea7bfd0a6fea819ab73e1bc6c75b681b7cf044199ed7c38d410b7c5d729.exedllhost.exe

pid	Process
4548	ab07eea7bfd0a6fea819ab73e1bc6c75b681b7cf044199ed7c38d410b7c5d729.exe
4548	ab07eea7bfd0a6fea819ab73e1bc6c75b681b7cf044199ed7c38d410b7c5d729.exe
4548	ab07eea7bfd0a6fea819ab73e1bc6c75b681b7cf044199ed7c38d410b7c5d729.exe
4548	ab07eea7bfd0a6fea819ab73e1bc6c75b681b7cf044199ed7c38d410b7c5d729.exe
4548	ab07eea7bfd0a6fea819ab73e1bc6c75b681b7cf044199ed7c38d410b7c5d729.exe
4604	dllhost.exe
4604	dllhost.exe
4604	dllhost.exe
4604	dllhost.exe
4604	dllhost.exe
4604	dllhost.exe
4604	dllhost.exe
4604	dllhost.exe
4604	dllhost.exe
4604	dllhost.exe
4604	dllhost.exe
4604	dllhost.exe
4604	dllhost.exe
4604	dllhost.exe
4604	dllhost.exe
4604	dllhost.exe
4604	dllhost.exe
4604	dllhost.exe
4604	dllhost.exe
4604	dllhost.exe
4604	dllhost.exe
4604	dllhost.exe
4604	dllhost.exe
4604	dllhost.exe
4604	dllhost.exe
4604	dllhost.exe
4604	dllhost.exe
4604	dllhost.exe
4604	dllhost.exe
4604	dllhost.exe
4604	dllhost.exe
4604	dllhost.exe
4604	dllhost.exe
4604	dllhost.exe
4604	dllhost.exe
4604	dllhost.exe
4604	dllhost.exe
4604	dllhost.exe
4604	dllhost.exe
4604	dllhost.exe
4604	dllhost.exe
4604	dllhost.exe
4604	dllhost.exe
4604	dllhost.exe
4604	dllhost.exe
4604	dllhost.exe
4604	dllhost.exe
4604	dllhost.exe
4604	dllhost.exe
4604	dllhost.exe
4604	dllhost.exe
4604	dllhost.exe
4604	dllhost.exe
4604	dllhost.exe
4604	dllhost.exe
4604	dllhost.exe
4604	dllhost.exe
4604	dllhost.exe
4604	dllhost.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

Processes:

ab07eea7bfd0a6fea819ab73e1bc6c75b681b7cf044199ed7c38d410b7c5d729.exedllhost.exedllhost.exedllhost.exe

description	pid	Process
Token: SeDebugPrivilege	4548	ab07eea7bfd0a6fea819ab73e1bc6c75b681b7cf044199ed7c38d410b7c5d729.exe
Token: SeDebugPrivilege	4604	dllhost.exe
Token: SeDebugPrivilege	3624	dllhost.exe
Token: SeDebugPrivilege	856	dllhost.exe

Suspicious use of WriteProcessMemory 22 IoCs

Processes:

ab07eea7bfd0a6fea819ab73e1bc6c75b681b7cf044199ed7c38d410b7c5d729.execmd.exedllhost.exeWScript.exedllhost.exeWScript.exedllhost.exe

description	pid	Process	procid_target
PID 4548 wrote to memory of 4136	4548	ab07eea7bfd0a6fea819ab73e1bc6c75b681b7cf044199ed7c38d410b7c5d729.exe	108
PID 4548 wrote to memory of 4136	4548	ab07eea7bfd0a6fea819ab73e1bc6c75b681b7cf044199ed7c38d410b7c5d729.exe	108
PID 4136 wrote to memory of 736	4136	cmd.exe	110
PID 4136 wrote to memory of 736	4136	cmd.exe	110
PID 4136 wrote to memory of 4604	4136	cmd.exe	114
PID 4136 wrote to memory of 4604	4136	cmd.exe	114
PID 4604 wrote to memory of 2464	4604	dllhost.exe	116
PID 4604 wrote to memory of 2464	4604	dllhost.exe	116
PID 4604 wrote to memory of 3532	4604	dllhost.exe	117
PID 4604 wrote to memory of 3532	4604	dllhost.exe	117
PID 2464 wrote to memory of 3624	2464	WScript.exe	122
PID 2464 wrote to memory of 3624	2464	WScript.exe	122
PID 3624 wrote to memory of 2068	3624	dllhost.exe	123
PID 3624 wrote to memory of 2068	3624	dllhost.exe	123
PID 3624 wrote to memory of 3288	3624	dllhost.exe	124
PID 3624 wrote to memory of 3288	3624	dllhost.exe	124
PID 2068 wrote to memory of 856	2068	WScript.exe	125
PID 2068 wrote to memory of 856	2068	WScript.exe	125
PID 856 wrote to memory of 1264	856	dllhost.exe	126
PID 856 wrote to memory of 1264	856	dllhost.exe	126
PID 856 wrote to memory of 2300	856	dllhost.exe	127
PID 856 wrote to memory of 2300	856	dllhost.exe	127

System policy modification 1 TTPs 12 IoCs

evasion

Modify Registry

T1112

Processes:

dllhost.exeab07eea7bfd0a6fea819ab73e1bc6c75b681b7cf044199ed7c38d410b7c5d729.exedllhost.exedllhost.exe

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	ab07eea7bfd0a6fea819ab73e1bc6c75b681b7cf044199ed7c38d410b7c5d729.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	ab07eea7bfd0a6fea819ab73e1bc6c75b681b7cf044199ed7c38d410b7c5d729.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	ab07eea7bfd0a6fea819ab73e1bc6c75b681b7cf044199ed7c38d410b7c5d729.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	dllhost.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\ab07eea7bfd0a6fea819ab73e1bc6c75b681b7cf044199ed7c38d410b7c5d729.exe
"C:\Users\Admin\AppData\Local\Temp\ab07eea7bfd0a6fea819ab73e1bc6c75b681b7cf044199ed7c38d410b7c5d729.exe"
1⤵
- Modifies WinLogon for persistence
- UAC bypass
- Checks computer location settings
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:4548
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\SajAHqgZ0I.bat"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4136
- - C:\Windows\system32\w32tm.exe
    w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
    3⤵
    PID:736
- - C:\Recovery\WindowsRE\dllhost.exe
    "C:\Recovery\WindowsRE\dllhost.exe"
    3⤵
    - UAC bypass
    - Checks computer location settings
    - Executes dropped EXE
    - Checks whether UAC is enabled
    - Modifies registry class
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    - System policy modification
    PID:4604
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\3c36fbac-416d-40d4-8d01-1277e37a1905.vbs"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:2464
    - - C:\Recovery\WindowsRE\dllhost.exe
        
        C:\Recovery\WindowsRE\dllhost.exe
        5⤵
        UAC bypass
        Checks computer location settings
        Executes dropped EXE
        Checks whether UAC is enabled
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        System policy modification
        
        PID:3624
      - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\cbd5f2b3-1f96-4e44-8225-3c1431995616.vbs"
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:2068
        
        C:\Recovery\WindowsRE\dllhost.exe
        
        C:\Recovery\WindowsRE\dllhost.exe
        7⤵
        UAC bypass
        Checks computer location settings
        Executes dropped EXE
        Checks whether UAC is enabled
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        System policy modification
        
        PID:856
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\2c34e5f4-84d2-4fdc-a0e9-52108d2ee5b4.vbs"
        8⤵
        
        PID:1264
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\478202cb-fcb9-4fbd-a475-b9dafd73c821.vbs"
        8⤵
        
        PID:2300
      - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\cc7af76c-6cf6-488f-aabf-e195e02b3140.vbs"
        6⤵
        
        PID:3288
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\a4862033-52d7-4c3d-acb8-a83119d2adb9.vbs"
      4⤵
      PID:3532

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "unsecappu" /sc MINUTE /mo 6 /tr "'C:\Recovery\WindowsRE\unsecapp.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3820

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "unsecapp" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\unsecapp.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1000

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "unsecappu" /sc MINUTE /mo 14 /tr "'C:\Recovery\WindowsRE\unsecapp.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3720

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "TextInputHostT" /sc MINUTE /mo 8 /tr "'C:\Windows\Panther\actionqueue\TextInputHost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3736

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "TextInputHost" /sc ONLOGON /tr "'C:\Windows\Panther\actionqueue\TextInputHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3524

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "TextInputHostT" /sc MINUTE /mo 6 /tr "'C:\Windows\Panther\actionqueue\TextInputHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4800

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "upfcu" /sc MINUTE /mo 10 /tr "'C:\Users\Default\SendTo\upfc.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1216

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "upfc" /sc ONLOGON /tr "'C:\Users\Default\SendTo\upfc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1932

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "upfcu" /sc MINUTE /mo 9 /tr "'C:\Users\Default\SendTo\upfc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4052

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 8 /tr "'C:\Recovery\WindowsRE\dllhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:216

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3272

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 9 /tr "'C:\Recovery\WindowsRE\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3772

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 10 /tr "'C:\Users\Public\AccountPictures\dwm.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:220

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwm" /sc ONLOGON /tr "'C:\Users\Public\AccountPictures\dwm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2216

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 6 /tr "'C:\Users\Public\AccountPictures\dwm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3056

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 6 /tr "'C:\Windows\Sun\Java\fontdrvhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2676

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\Windows\Sun\Java\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5044

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 7 /tr "'C:\Windows\Sun\Java\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2220

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 8 /tr "'C:\Program Files (x86)\Windows Media Player\services.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:436

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "services" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Media Player\services.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1764

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 6 /tr "'C:\Program Files (x86)\Windows Media Player\services.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2940

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\dllhost.exe.log

Filesize
1KB

MD5
49b64127208271d8f797256057d0b006

SHA1
b99bd7e2b4e9ed24de47fb3341ea67660b84cca1

SHA256
2a5d403a2e649d8eceef8f785eeb0f6d33888ec6bbf251b3c347e34cb32b1e77

SHA512
f7c728923c893dc9bc88ad2159e0abcda41e1b40ff7e7756e6252d135ed238a2248a2662b3392449836dd1b0b580f0c866cc33e409527484fe4602e3d3f10e3e

Download Submit
C:\Users\Admin\AppData\Local\Temp\2c34e5f4-84d2-4fdc-a0e9-52108d2ee5b4.vbs

Filesize
708B

MD5
285964ff35ed1285913f5f457c750783

SHA1
c796c5109f3c7b4cdce08ed4576f8a7926d1e5f2

SHA256
8c28a7a3aa424403f94052cd4c2ba59c48bb0fe0369fbf10bc1528df8fb2dfae

SHA512
829ac78505af6b8f58fd1c3b07112a083f109125b20c3bcd510b31aeb43c5447286d2171d9d792e5bd6028c5854d6070d2fec67477ca652d91569912b346e9ec

Download Submit
C:\Users\Admin\AppData\Local\Temp\3c36fbac-416d-40d4-8d01-1277e37a1905.vbs

Filesize
709B

MD5
bee135c0a2e9449c92aec656da45fb25

SHA1
7babd6c2c270c8cab535ddd96891a6db049bb2c2

SHA256
9f1321c299477c493af441285ed032f90681285098104d4834e596d0e3afed62

SHA512
165cd9a6aca2a9560090db942b6c8d885e6d8068bd281280154a2a02a7cf9353fe339bf3117b2f8b443268a77119b9fcf89346976f6711aab0e43b9975d9a363

Download Submit
C:\Users\Admin\AppData\Local\Temp\SajAHqgZ0I.bat

Filesize
198B

MD5
71a18bfddd40751f58e74330a1fc9fbc

SHA1
d8982478fc96bc04f5b6294aef75c35a8893fd3f

SHA256
f3f8e662a1625b55cf2f6323502d5935529d99ecf121b4bfd194c6648e2f1aaa

SHA512
9415dbbf2ec1998797b59b846f7ac350b591ac0b908093d624a9fdd68890203c9d09079f58f04e9eb4c83202677fa11be4413d2f4ffe7507d7f5ab98a70b448b

Download Submit
C:\Users\Admin\AppData\Local\Temp\a4862033-52d7-4c3d-acb8-a83119d2adb9.vbs

Filesize
485B

MD5
7751d44f699409b4fb053bf3bc26defd

SHA1
01bbfc600f73d5c72facc9e2d9181d2089f1c660

SHA256
5549afe5676f0fd103e920f3b60fad7001956dfbcbb4cb1ceba1c6726dc92240

SHA512
06396481e665a2dd4706ab9529694ec3b79b45d3d6fcf551dc7679b3e006aa3ed7e9249a0700ab8d9686940b45d6201fc34e36608dd0409c2ef583694d2dfbd5

Download Submit
C:\Users\Admin\AppData\Local\Temp\cbd5f2b3-1f96-4e44-8225-3c1431995616.vbs

Filesize
709B

MD5
a8327e7dfd1aebb3555762811991b9fa

SHA1
a3dbcd4bcbbea65c9de6a43ca01dcd45fe2a261b

SHA256
d04b981be5f17848f7da293864f0047cbc22dfd316d1c38d3aba777440895063

SHA512
f63135ec9c02a5e044a4047059571d881e22efa1dadbfff3b8ca4eb495a4e619adbc6005a3ba5e5689f229fd12be8751585db6ab61738a9723c821f4f196d17b

Download Submit
C:\Users\Public\AccountPictures\dwm.exe

Filesize
3.4MB

MD5
4626a1483d82cf0be9302c305f6b54c4

SHA1
7f16e6aee9e0967b26e36b11de4654cfbffe2675

SHA256
ab07eea7bfd0a6fea819ab73e1bc6c75b681b7cf044199ed7c38d410b7c5d729

SHA512
6381dab004c7d96449554626bbc53d4d7d20a55d21c930a987e1e866803c34a0f6e964ec7a74fc3649f7a9fe9d490a535a59280875605ef950673d83bdd15f54

Download Submit
memory/856-89-0x000000001BDE0000-0x000000001BDF2000-memory.dmp

Filesize
72KB

Download
memory/3624-77-0x000000001BFA0000-0x000000001BFB2000-memory.dmp

Filesize
72KB

Download
memory/4548-19-0x000000001BF40000-0x000000001BF48000-memory.dmp

Filesize
32KB

Download
memory/4548-25-0x000000001C6C0000-0x000000001C6CC000-memory.dmp

Filesize
48KB

Download
memory/4548-6-0x00000000032E0000-0x00000000032FC000-memory.dmp

Filesize
112KB

Download
memory/4548-7-0x000000001BD30000-0x000000001BD80000-memory.dmp

Filesize
320KB

Download
memory/4548-8-0x0000000003300000-0x0000000003308000-memory.dmp

Filesize
32KB

Download
memory/4548-9-0x0000000003310000-0x0000000003320000-memory.dmp

Filesize
64KB

Download
memory/4548-10-0x0000000003320000-0x0000000003336000-memory.dmp

Filesize
88KB

Download
memory/4548-11-0x0000000003340000-0x0000000003348000-memory.dmp

Filesize
32KB

Download
memory/4548-12-0x000000001BDA0000-0x000000001BDB2000-memory.dmp

Filesize
72KB

Download
memory/4548-13-0x000000001BD90000-0x000000001BD9C000-memory.dmp

Filesize
48KB

Download
memory/4548-14-0x000000001BD80000-0x000000001BD88000-memory.dmp

Filesize
32KB

Download
memory/4548-15-0x000000001BDB0000-0x000000001BDC0000-memory.dmp

Filesize
64KB

Download
memory/4548-16-0x000000001BDC0000-0x000000001BDCA000-memory.dmp

Filesize
40KB

Download
memory/4548-17-0x000000001BDD0000-0x000000001BE26000-memory.dmp

Filesize
344KB

Download
memory/4548-18-0x000000001BF30000-0x000000001BF3C000-memory.dmp

Filesize
48KB

Download
memory/4548-4-0x00000000032C0000-0x00000000032CE000-memory.dmp

Filesize
56KB

Download
memory/4548-20-0x000000001BF50000-0x000000001BF5C000-memory.dmp

Filesize
48KB

Download
memory/4548-22-0x000000001BF70000-0x000000001BF82000-memory.dmp

Filesize
72KB

Download
memory/4548-21-0x000000001BF60000-0x000000001BF68000-memory.dmp

Filesize
32KB

Download
memory/4548-23-0x000000001CBF0000-0x000000001D118000-memory.dmp

Filesize
5.2MB

Download
memory/4548-24-0x000000001BFA0000-0x000000001BFAC000-memory.dmp

Filesize
48KB

Download
memory/4548-5-0x00000000032D0000-0x00000000032D8000-memory.dmp

Filesize
32KB

Download
memory/4548-27-0x000000001C6E0000-0x000000001C6EC000-memory.dmp

Filesize
48KB

Download
memory/4548-26-0x000000001C6D0000-0x000000001C6D8000-memory.dmp

Filesize
32KB

Download
memory/4548-28-0x000000001C6F0000-0x000000001C6FC000-memory.dmp

Filesize
48KB

Download
memory/4548-29-0x000000001C800000-0x000000001C808000-memory.dmp

Filesize
32KB

Download
memory/4548-30-0x000000001C810000-0x000000001C81C000-memory.dmp

Filesize
48KB

Download
memory/4548-34-0x000000001C950000-0x000000001C95E000-memory.dmp

Filesize
56KB

Download
memory/4548-33-0x000000001C940000-0x000000001C948000-memory.dmp

Filesize
32KB

Download
memory/4548-32-0x000000001C930000-0x000000001C93E000-memory.dmp

Filesize
56KB

Download
memory/4548-31-0x000000001C820000-0x000000001C82A000-memory.dmp

Filesize
40KB

Download
memory/4548-39-0x000000001C990000-0x000000001C99C000-memory.dmp

Filesize
48KB

Download
memory/4548-38-0x000000001CA90000-0x000000001CA9A000-memory.dmp

Filesize
40KB

Download
memory/4548-37-0x000000001C980000-0x000000001C988000-memory.dmp

Filesize
32KB

Download
memory/4548-36-0x000000001C970000-0x000000001C97C000-memory.dmp

Filesize
48KB

Download
memory/4548-3-0x00000000032B0000-0x00000000032BE000-memory.dmp

Filesize
56KB

Download
memory/4548-2-0x00007FFFAC460000-0x00007FFFACF21000-memory.dmp

Filesize
10.8MB

Download
memory/4548-1-0x0000000000E30000-0x000000000119A000-memory.dmp

Filesize
3.4MB

Download
memory/4548-0-0x00007FFFAC463000-0x00007FFFAC465000-memory.dmp

Filesize
8KB

Download
memory/4548-35-0x000000001C960000-0x000000001C968000-memory.dmp

Filesize
32KB

Download
memory/4548-59-0x00007FFFAC460000-0x00007FFFACF21000-memory.dmp

Filesize
10.8MB

Download
memory/4604-64-0x000000001BCB0000-0x000000001BD06000-memory.dmp

Filesize
344KB

Download