dcrat | 7fd1dd60ec001addf3f66143d962dc393c68c00761257adbdc95bced6f4d684c

Analysis

max time kernel
1050s
max time network
1052s
platform
windows11-21h2_x64
resource
win11-20241007-en
resource tags

arch:x64arch:x86image:win11-20241007-enlocale:en-usos:windows11-21h2-x64system
submitted
19/11/2024, 18:23

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

fatality(ez cracked).exe
Size

2.6MB
MD5

56622002384049e2d2a6b70511c5e614
SHA1

8b1edded9e65ea88c555cd3d17a297f78e8862c4
SHA256

7fd1dd60ec001addf3f66143d962dc393c68c00761257adbdc95bced6f4d684c
SHA512

f4aa66667b578c510b99b6a464976fa6d0655f89165554f7fee4dfa4d03874007319ceb57316c73ac46c5d07961a9c198dd5866bfb6956d92895e91b54a68c7d
SSDEEP

49152:JbA3TLHcQogOnBJi/2Kw+gkKh2KXQ10fCB4h70ZE5v91aLAsOfM+JJ5tRTJUHt:JbK0gOn6/2Kw+gkKgmQ17Ba0Z8v91aLz

Score

10^/10

dcrat discovery infostealer rat spyware stealer

Malware Config

Signatures

DcRat 18 IoCs

DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

rat infostealer dcrat

description	ioc	pid	Process
		692	schtasks.exe
		3128	schtasks.exe
		2060	schtasks.exe
File created	C:\Program Files (x86)\Microsoft.NET\RedistList\886983d96e3d3e		BrokerMonitor.exe
		3524	schtasks.exe
		4472	schtasks.exe
		972	schtasks.exe
		2556	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language		fatality(ez cracked).exe
		1292	schtasks.exe
		3172	schtasks.exe
		4824	schtasks.exe
		2600	schtasks.exe
		4556	schtasks.exe
		3092	schtasks.exe
File created	C:\Windows\IME\6ccacd8608530f		BrokerMonitor.exe
		4340	schtasks.exe
		2688	schtasks.exe

Dcrat family
dcrat

Process spawned unexpected child process 15 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4556	2156	schtasks.exe	98
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3524	2156	schtasks.exe	98
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4472	2156	schtasks.exe	98
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4340	2156	schtasks.exe	98
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	692	2156	schtasks.exe	98
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3092	2156	schtasks.exe	98
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2688	2156	schtasks.exe	98
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1292	2156	schtasks.exe	98
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	972	2156	schtasks.exe	98
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2556	2156	schtasks.exe	98
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3172	2156	schtasks.exe	98
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2060	2156	schtasks.exe	98
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2600	2156	schtasks.exe	98
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3128	2156	schtasks.exe	98
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4824	2156	schtasks.exe	98

DCRat payload 2 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral1/files/0x001900000002aaee-382.dat	dcrat
behavioral1/memory/940-384-0x0000000000FF0000-0x000000000122A000-memory.dmp	dcrat

Executes dropped EXE 9 IoCs

pid	Process
940	BrokerMonitor.exe
1424	BrokerMonitor.exe
2764	dllhost.exe
1760	System.exe
3196	System.exe
4084	dllhost.exe
4592	explorer.exe
480	Idle.exe
4128	csrss.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
4	pastebin.com
24	pastebin.com

Drops file in Program Files directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Microsoft.NET\RedistList\csrss.exe	BrokerMonitor.exe
File created	C:\Program Files (x86)\Microsoft.NET\RedistList\886983d96e3d3e	BrokerMonitor.exe
File created	C:\Program Files (x86)\Microsoft.NET\RedistList\csrss.exe	BrokerMonitor.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File created	C:\Windows\IME\Idle.exe	BrokerMonitor.exe
File created	C:\Windows\IME\6ccacd8608530f	BrokerMonitor.exe
File created	C:\Windows\Help\Help\explorer.exe	BrokerMonitor.exe
File created	C:\Windows\Help\Help\7a0fd90576e088	BrokerMonitor.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fatality(ez cracked).exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Checks processor information in registry 2 TTPs 12 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe

Modifies registry class 4 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2253712635-4068079004-3870069674-1000_Classes\Local Settings	fatality(ez cracked).exe
Key created	\REGISTRY\USER\S-1-5-21-2253712635-4068079004-3870069674-1000_Classes\Local Settings	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-2253712635-4068079004-3870069674-1000_Classes\Local Settings	BrokerMonitor.exe
Key created	\REGISTRY\USER\S-1-5-21-2253712635-4068079004-3870069674-1000_Classes\Local Settings	BrokerMonitor.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 15 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
3172	schtasks.exe
4824	schtasks.exe
4340	schtasks.exe
2556	schtasks.exe
692	schtasks.exe
3092	schtasks.exe
972	schtasks.exe
2600	schtasks.exe
4556	schtasks.exe
4472	schtasks.exe
3128	schtasks.exe
3524	schtasks.exe
2688	schtasks.exe
1292	schtasks.exe
2060	schtasks.exe

Suspicious behavior: EnumeratesProcesses 17 IoCs

pid	Process
940	BrokerMonitor.exe
1424	BrokerMonitor.exe
1424	BrokerMonitor.exe
1424	BrokerMonitor.exe
2764	dllhost.exe
2764	dllhost.exe
2764	dllhost.exe
2764	dllhost.exe
2764	dllhost.exe
2764	dllhost.exe
2764	dllhost.exe
2764	dllhost.exe
2764	dllhost.exe
2764	dllhost.exe
2764	dllhost.exe
2764	dllhost.exe
2764	dllhost.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2764	dllhost.exe

Suspicious use of AdjustPrivilegeToken 11 IoCs

description	pid	Process
Token: SeDebugPrivilege	4000	firefox.exe
Token: SeDebugPrivilege	4000	firefox.exe
Token: SeDebugPrivilege	940	BrokerMonitor.exe
Token: SeDebugPrivilege	1424	BrokerMonitor.exe
Token: SeDebugPrivilege	2764	dllhost.exe
Token: SeDebugPrivilege	1760	System.exe
Token: SeDebugPrivilege	3196	System.exe
Token: SeDebugPrivilege	4592	explorer.exe
Token: SeDebugPrivilege	4084	dllhost.exe
Token: SeDebugPrivilege	480	Idle.exe
Token: SeDebugPrivilege	4128	csrss.exe

Suspicious use of FindShellTrayWindow 21 IoCs

pid	Process
4000	firefox.exe
4000	firefox.exe
4000	firefox.exe
4000	firefox.exe
4000	firefox.exe
4000	firefox.exe
4000	firefox.exe
4000	firefox.exe
4000	firefox.exe
4000	firefox.exe
4000	firefox.exe
4000	firefox.exe
4000	firefox.exe
4000	firefox.exe
4000	firefox.exe
4000	firefox.exe
4000	firefox.exe
4000	firefox.exe
4000	firefox.exe
4000	firefox.exe
4000	firefox.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4000	firefox.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4824 wrote to memory of 4624	4824	fatality(ez cracked).exe	79
PID 4824 wrote to memory of 4624	4824	fatality(ez cracked).exe	79
PID 4824 wrote to memory of 4624	4824	fatality(ez cracked).exe	79
PID 4824 wrote to memory of 4168	4824	fatality(ez cracked).exe	80
PID 4824 wrote to memory of 4168	4824	fatality(ez cracked).exe	80
PID 4824 wrote to memory of 4168	4824	fatality(ez cracked).exe	80
PID 4824 wrote to memory of 1724	4824	fatality(ez cracked).exe	81
PID 4824 wrote to memory of 1724	4824	fatality(ez cracked).exe	81
PID 4824 wrote to memory of 1724	4824	fatality(ez cracked).exe	81
PID 1724 wrote to memory of 3460	1724	cmd.exe	85
PID 1724 wrote to memory of 3460	1724	cmd.exe	85
PID 1724 wrote to memory of 3460	1724	cmd.exe	85
PID 3572 wrote to memory of 4000	3572	firefox.exe	87
PID 3572 wrote to memory of 4000	3572	firefox.exe	87
PID 3572 wrote to memory of 4000	3572	firefox.exe	87
PID 3572 wrote to memory of 4000	3572	firefox.exe	87
PID 3572 wrote to memory of 4000	3572	firefox.exe	87
PID 3572 wrote to memory of 4000	3572	firefox.exe	87
PID 3572 wrote to memory of 4000	3572	firefox.exe	87
PID 3572 wrote to memory of 4000	3572	firefox.exe	87
PID 3572 wrote to memory of 4000	3572	firefox.exe	87
PID 3572 wrote to memory of 4000	3572	firefox.exe	87
PID 3572 wrote to memory of 4000	3572	firefox.exe	87
PID 4000 wrote to memory of 2024	4000	firefox.exe	88
PID 4000 wrote to memory of 2024	4000	firefox.exe	88
PID 4000 wrote to memory of 2024	4000	firefox.exe	88
PID 4000 wrote to memory of 2024	4000	firefox.exe	88
PID 4000 wrote to memory of 2024	4000	firefox.exe	88
PID 4000 wrote to memory of 2024	4000	firefox.exe	88
PID 4000 wrote to memory of 2024	4000	firefox.exe	88
PID 4000 wrote to memory of 2024	4000	firefox.exe	88
PID 4000 wrote to memory of 2024	4000	firefox.exe	88
PID 4000 wrote to memory of 2024	4000	firefox.exe	88
PID 4000 wrote to memory of 2024	4000	firefox.exe	88
PID 4000 wrote to memory of 2024	4000	firefox.exe	88
PID 4000 wrote to memory of 2024	4000	firefox.exe	88
PID 4000 wrote to memory of 2024	4000	firefox.exe	88
PID 4000 wrote to memory of 2024	4000	firefox.exe	88
PID 4000 wrote to memory of 2024	4000	firefox.exe	88
PID 4000 wrote to memory of 2024	4000	firefox.exe	88
PID 4000 wrote to memory of 2024	4000	firefox.exe	88
PID 4000 wrote to memory of 2024	4000	firefox.exe	88
PID 4000 wrote to memory of 2024	4000	firefox.exe	88
PID 4000 wrote to memory of 2024	4000	firefox.exe	88
PID 4000 wrote to memory of 2024	4000	firefox.exe	88
PID 4000 wrote to memory of 2024	4000	firefox.exe	88
PID 4000 wrote to memory of 2024	4000	firefox.exe	88
PID 4000 wrote to memory of 2024	4000	firefox.exe	88
PID 4000 wrote to memory of 2024	4000	firefox.exe	88
PID 4000 wrote to memory of 2024	4000	firefox.exe	88
PID 4000 wrote to memory of 2024	4000	firefox.exe	88
PID 4000 wrote to memory of 2024	4000	firefox.exe	88
PID 4000 wrote to memory of 2024	4000	firefox.exe	88
PID 4000 wrote to memory of 2024	4000	firefox.exe	88
PID 4000 wrote to memory of 2024	4000	firefox.exe	88
PID 4000 wrote to memory of 2024	4000	firefox.exe	88
PID 4000 wrote to memory of 2024	4000	firefox.exe	88
PID 4000 wrote to memory of 2024	4000	firefox.exe	88
PID 4000 wrote to memory of 2024	4000	firefox.exe	88
PID 4000 wrote to memory of 2024	4000	firefox.exe	88
PID 4000 wrote to memory of 2024	4000	firefox.exe	88
PID 4000 wrote to memory of 2024	4000	firefox.exe	88
PID 4000 wrote to memory of 2024	4000	firefox.exe	88
PID 4000 wrote to memory of 2024	4000	firefox.exe	88

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\fatality(ez cracked).exe
"C:\Users\Admin\AppData\Local\Temp\fatality(ez cracked).exe"
1⤵
- DcRat
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4824
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\MsintoNet\nHRdjr.vbe"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4624
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\MsintoNet\mIOQQzlA02ZU24pF0jGuEQEycJkgNN.bat" "
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4048
  - - C:\MsintoNet\BrokerMonitor.exe
      "C:\MsintoNet\BrokerMonitor.exe"
      4⤵
      DcRat
      Executes dropped EXE
      Drops file in Program Files directory
      Drops file in Windows directory
      Modifies registry class
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:940
    - - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\UvH15lHOqc.bat"
        5⤵
        
        PID:3404
      - C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        6⤵
        
        PID:2448
      - C:\MsintoNet\BrokerMonitor.exe
        
        "C:\MsintoNet\BrokerMonitor.exe"
        6⤵
        Executes dropped EXE
        Drops file in Windows directory
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1424
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\tYfs0lTf2Z.bat"
        7⤵
        
        PID:1976
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        8⤵
        
        PID:652
        
        C:\MsintoNet\dllhost.exe
        
        "C:\MsintoNet\dllhost.exe"
        8⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious behavior: GetForegroundWindowSpam
        Suspicious use of AdjustPrivilegeToken
        
        PID:2764
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\MsintoNet\file.vbs"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4168
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\MsintoNet\nrQ99sdYMIej7R1eVOn.bat" "
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1724
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c "echo Cheat broken. Reinstall"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3460

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3572
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - Checks processor information in registry
  - Modifies registry class
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4000
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=1948 -parentBuildID 20240401114208 -prefsHandle 1876 -prefMapHandle 1868 -prefsLen 23678 -prefMapSize 244658 -appDir "C:\Program Files\Mozilla Firefox\browser" - {db877134-5eff-4aba-aa0a-2f01e269045f} 4000 "\\.\pipe\gecko-crash-server-pipe.4000" gpu
    3⤵
    PID:2024
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2348 -parentBuildID 20240401114208 -prefsHandle 2340 -prefMapHandle 2336 -prefsLen 23714 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {4a274d03-56ef-4b5b-ba82-07ed50c5d172} 4000 "\\.\pipe\gecko-crash-server-pipe.4000" socket
    3⤵
    - Checks processor information in registry
    PID:5020
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3220 -childID 1 -isForBrowser -prefsHandle 3248 -prefMapHandle 2932 -prefsLen 23855 -prefMapSize 244658 -jsInitHandle 1300 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {529361f5-81c1-41f0-91d0-bbb161f79608} 4000 "\\.\pipe\gecko-crash-server-pipe.4000" tab
    3⤵
    PID:3944
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3688 -childID 2 -isForBrowser -prefsHandle 3680 -prefMapHandle 3672 -prefsLen 29088 -prefMapSize 244658 -jsInitHandle 1300 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {078a6f2a-2509-41cc-804e-aef5cf16e7e9} 4000 "\\.\pipe\gecko-crash-server-pipe.4000" tab
    3⤵
    PID:3132
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4612 -parentBuildID 20240401114208 -sandboxingKind 0 -prefsHandle 4748 -prefMapHandle 4652 -prefsLen 29088 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {6b4f08d3-99c7-4dae-bdc1-e5ff3877b68c} 4000 "\\.\pipe\gecko-crash-server-pipe.4000" utility
    3⤵
    - Checks processor information in registry
    PID:4128

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 11 /tr "'C:\Program Files (x86)\Microsoft.NET\RedistList\csrss.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3524

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Program Files (x86)\Microsoft.NET\RedistList\csrss.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4556

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 10 /tr "'C:\Program Files (x86)\Microsoft.NET\RedistList\csrss.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3092

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 9 /tr "'C:\Windows\IME\Idle.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:692

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Idle" /sc ONLOGON /tr "'C:\Windows\IME\Idle.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4340

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 9 /tr "'C:\Windows\IME\Idle.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4472

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 10 /tr "'C:\Users\Public\Desktop\System.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2688

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "System" /sc ONLOGON /tr "'C:\Users\Public\Desktop\System.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1292

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 9 /tr "'C:\Users\Public\Desktop\System.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2556

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 9 /tr "'C:\MsintoNet\dllhost.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:972

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\MsintoNet\dllhost.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2060

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 9 /tr "'C:\MsintoNet\dllhost.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3172

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 12 /tr "'C:\Windows\Help\Help\explorer.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2600

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorer" /sc ONLOGON /tr "'C:\Windows\Help\Help\explorer.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4824

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 9 /tr "'C:\Windows\Help\Help\explorer.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3128

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4548

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s NPSMSvc
1⤵
PID:644

C:\Users\Public\Desktop\System.exe
"C:\Users\Public\Desktop\System.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1760

C:\Users\Public\Desktop\System.exe
C:\Users\Public\Desktop\System.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3196

C:\MsintoNet\dllhost.exe
C:\MsintoNet\dllhost.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4084

C:\Windows\Help\Help\explorer.exe
C:\Windows\Help\Help\explorer.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4592

C:\Windows\IME\Idle.exe
C:\Windows\IME\Idle.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:480

C:\Program Files (x86)\Microsoft.NET\RedistList\csrss.exe
"C:\Program Files (x86)\Microsoft.NET\RedistList\csrss.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4128

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\MsintoNet\BrokerMonitor.exe

Filesize
2.2MB

MD5
5dad48abf6a08af9901b21354338aa30

SHA1
8e0b275979fcb32c5bae5fa477a377d107d3667f

SHA256
6baabc2e0b5cd8b060225d61eb62cad086fafa50a6137cee4329ebf6546ec3bd

SHA512
e7bb25f4c7b2c2586138af9d732d8cfebe2eb9f8c07c3dab8aad464f9967f06b7e36fbe4db65659a506783904056fc8424121a3c14b7189994d65da57c9270d8

Download Submit
C:\MsintoNet\file.vbs

Filesize
34B

MD5
677cc4360477c72cb0ce00406a949c61

SHA1
b679e8c3427f6c5fc47c8ac46cd0e56c9424de05

SHA256
f1cccb5ae4aa51d293bd3c7d2a1a04cb7847d22c5db8e05ac64e9a6d7455aa0b

SHA512
7cfe2cc92f9e659f0a15a295624d611b3363bd01eb5bcf9bc7681ea9b70b0564d192d570d294657c8dc2c93497fa3b4526c975a9bf35d69617c31d9936573c6a

Download Submit
C:\MsintoNet\mIOQQzlA02ZU24pF0jGuEQEycJkgNN.bat

Filesize
32B

MD5
af2588f35c830f0576b666f81cb23a03

SHA1
4492c3dc6ce0cac0ff0eff2312a9a57919e39041

SHA256
5aa41b30140a305e598523ccd646b3fa92bd1c3fdb61797e2d64fa0dde191b63

SHA512
7d57468b8f2965a1ac184cbf91cff5a664e2ce9a1679a9c0af7f69b36a547509c35f15c43c9d1ab0f0e568ae53c04d0e4edca2972b9a7a2edbac191d330e7e7f

Download Submit
C:\MsintoNet\nHRdjr.vbe

Filesize
217B

MD5
08b7454316740f2927ea707a5ba3c79c

SHA1
c9f00505ba4cbd8b1a330d2e67ca76c14b73ce4c

SHA256
3f8d0e7e8c3822b1c4867d44543ed1d03e1f7c3c6d1a481524cced05900fd5ea

SHA512
c303c7a1069b88315a0645e88e6668b8fd6e8fa80550bd98389ceed70fb872cc974db15315764eb8bbe16c7f0eb2cd75c28c3838c2211f253d65f63bd54c6628

Download Submit
C:\MsintoNet\nrQ99sdYMIej7R1eVOn.bat

Filesize
41B

MD5
97b3f1e56dad34be4cb84e244cfd4a4e

SHA1
818bdc90e169c9bbc4f4562bd0969062b026ecb7

SHA256
f226101fdf7399badc937d237887e4257d59277ac33de6dff6704866889ee2c7

SHA512
ce79928b03564978bd53201c63f1fb2f1ac7d3a3794705fbf6a9b790f8339d875c37890052639bbd84261b545eb8ca5d7f89345f4377eb9137283aa3884ec97e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\BrokerMonitor.exe.log

Filesize
1KB

MD5
4a154b138b22d8614bea6d4aa8bffecf

SHA1
e234d740d83d68c2233e8bf3ffd65406d5ca9563

SHA256
0c84f439b774b18f2f98ff2bd65b31a7540a064ec20aed0b5cd5fdd7546d56f6

SHA512
c3f7dabc72ddc377d50843b5e3a2bdc1600cee7d5dcdc52b7db9c675fbc5cb510be01ffe911462fd4e5af95737108ae1b19d006c00be5217f489c3772b7a68ec

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\System.exe.log

Filesize
1KB

MD5
b4e91d2e5f40d5e2586a86cf3bb4df24

SHA1
31920b3a41aa4400d4a0230a7622848789b38672

SHA256
5d8af3c7519874ed42a0d74ee559ae30d9cc6930aef213079347e2b47092c210

SHA512
968751b79a98961f145de48d425ea820fd1875bae79a725adf35fc8f4706c103ee0c7babd4838166d8a0dda9fbce3728c0265a04c4b37f335ec4eaa110a2b319

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\jj59r4xg.default-release\activity-stream.discovery_stream.json

Filesize
18KB

MD5
96aeedd8049e1813763e852ed877506e

SHA1
73069b0430124c75718160312c7e31019cc6e713

SHA256
35682e542a821a8f08ec664ab28641cab48b57d23a5ede07d5bdfed0a4edec1e

SHA512
7f91f56904087f0f37d1970cc9774bfda93ff1596d74e815f3d7a36eacfe476e183e0a9beaa0b2e4d47c7c9aa44fa84ba60ee359c6e8b1cf23621f952ac8c309

Download Submit
C:\Users\Admin\AppData\Local\Temp\UvH15lHOqc.bat

Filesize
195B

MD5
ea5aefd51eda404e8e7055e0dcef4695

SHA1
d3cd4eaa42c22e34aa800a94e43c82213f9a9460

SHA256
b8209795bf9ffdce4fe4d6f71581701f3bf32d76d93cfccbc490d31cabce664f

SHA512
fead3fe9a320e059679e74be2243748fdeeb3b828da2d8543351571f9e54a71637f58d907cd8440ca4fd64366b9341a64f4f219d3f8d14c4be2731930de1353e

Download Submit
C:\Users\Admin\AppData\Local\Temp\tYfs0lTf2Z.bat

Filesize
189B

MD5
172a1789c8ebaae82fa0ba0cee6b2ff7

SHA1
fe5dde333b52e23138bb5dcbbe7b51abaf31a701

SHA256
f4bba75f035ae10d2cb129139d263d851c86944d3e9eed65407cc5a4cca271c7

SHA512
10011d8e232c38410dd22aaca984a0a6c5a228aeb9ee6f27cd3dafc5a3cd207609eaa4406cbfd631dc78150f71d9c451cdb61bf38398ad9eb8573d3f71c5ff07

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jj59r4xg.default-release\AlternateServices.bin

Filesize
6KB

MD5
c041a35e65f4269f0c5d67c86eb40d8a

SHA1
d873e62e54c1cc8ce9168ad08a0e912d0ba0d9ae

SHA256
fb1871484f81da2b9ed3e38334b74eeca8ff00adb397f43550be34e062aef3db

SHA512
996dcd87d71e6321f21aea8efb14bdab958beb11f7e4369f8fd5d9d5956f5e1aa3f636499055348d8b099ab03d4e113886c9074b4bec14ba7e95e3d8f61186af

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jj59r4xg.default-release\datareporting\glean\db\data.safe.tmp

Filesize
5KB

MD5
c88f781238abfe0ecd337e513ac2b469

SHA1
3d0d3072695295b1e85f6fa58eab422debb8a237

SHA256
4bd36f6ecbe0380f2b5ff23cc1728db42b5fa1b58e7f2860bf78066332aae55e

SHA512
42bac15f4a5f3489f59c38ea1f6a7d5225f2939788642f442a5db76dc3efcfe80dc832d385c7dd81f43f418c67ff22c12e84bbdf4b108bd3105d118fdbddc411

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jj59r4xg.default-release\datareporting\glean\pending_pings\8e2c2690-644f-4194-8cea-6b43779cc2be

Filesize
26KB

MD5
70dbb28146790d3d59b55764ce55eca9

SHA1
dd2ef2e24b17dd45eab7e14f7f019474446e35a2

SHA256
e452dfba0c8ac576b0b39cdbc392b3bdd0a73f019196697e2a0c5df68af8c408

SHA512
7e26422a182cb024d725bf71212585b8f5db05406f91cba4cbb254c1e2982457e93024a6c3cad73e4cd037d6c70bd264c71323234a33aa8eb4caf9865186f748

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jj59r4xg.default-release\datareporting\glean\pending_pings\99591659-2a86-442f-8cf0-49fc243f5fbc

Filesize
982B

MD5
745131c980b80bd928077ca53a5f0db6

SHA1
3f8d8d5f9f2f802b24921a669d76db68843edc43

SHA256
debd0d3154f614b410a467cd710d599487a6d9daf48ade002d73b51435dbabff

SHA512
5a4276fefebdc7a38261857324bbab8abbfe5b2af63130f1e6da121258793b2f3a764e8a95000be732cd241e35617be3a4cf817a6b71827eccb128e8befede12

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jj59r4xg.default-release\datareporting\glean\pending_pings\ea26a1c9-6696-4807-b64c-2d129f2f1f12

Filesize
671B

MD5
255f90276b2ccaa829fe7b963a440a77

SHA1
d48aeb75e01c84dd69cb998d64afd0d694b3e790

SHA256
6fd1a73568e3fedbb9d420cf2a68475bf1cc5d19eea4db7f67d019cc12f0ae02

SHA512
ca8a6337cdf63f07ab9b34528afda490322661d07c7a18df4d74b245b72ff68511138aac98b92bac5866811350fec7ecd07839d065f6f0f249a6fc2047559cc3

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jj59r4xg.default-release\prefs-1.js

Filesize
10KB

MD5
6208dac37332f87ce18d699ec941971e

SHA1
fb24dc5d250e27e851b8a63b070e2e62705e5e48

SHA256
0bd6075c4fa68ef9968c51b019b3334e149d6b1827a71c86bf7d494917f0b090

SHA512
c0b68bdc7310dbb86298d1e3d714e8053a96aa242f7ff39897e264c16d9dade19be5fd6761697af51b8fd09678259669f9ec21eec508893d760f93619980e671

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jj59r4xg.default-release\prefs.js

Filesize
10KB

MD5
cc07b8eda2a02fcdd0f66d6df3362ba3

SHA1
c5990de13630f83d37ff5616dbb8be301674ad02

SHA256
5c77cb18bcfee1c4c690e2abb869d6598b5cfdee9a5505a8763b2303c491568d

SHA512
30263607048b1b8a8a8e26460507cf419c082637c6ed20ff596078e10b14a66b26ccd43fb58a55771b03d90008125d59652b9b4e7e9bb51e1387ff58decbd777

Download Submit
memory/940-388-0x0000000003520000-0x0000000003576000-memory.dmp

Filesize
344KB

Download
memory/940-390-0x0000000003400000-0x0000000003408000-memory.dmp

Filesize
32KB

Download
memory/940-389-0x00000000033F0000-0x00000000033FE000-memory.dmp

Filesize
56KB

Download
memory/940-391-0x000000001BEA0000-0x000000001BEA8000-memory.dmp

Filesize
32KB

Download
memory/940-387-0x00000000033D0000-0x00000000033E6000-memory.dmp

Filesize
88KB

Download
memory/940-384-0x0000000000FF0000-0x000000000122A000-memory.dmp

Filesize
2.2MB

Download
memory/940-386-0x0000000003570000-0x00000000035C0000-memory.dmp

Filesize
320KB

Download
memory/940-385-0x00000000033B0000-0x00000000033CC000-memory.dmp

Filesize
112KB

Download
memory/1424-404-0x000000001B100000-0x000000001B156000-memory.dmp

Filesize
344KB

Download
memory/2764-499-0x000000001D600000-0x000000001D7B3000-memory.dmp

Filesize
1.7MB

Download
memory/2764-513-0x000000001D600000-0x000000001D7B3000-memory.dmp

Filesize
1.7MB

Download
memory/2764-488-0x000000001D600000-0x000000001D7B3000-memory.dmp

Filesize
1.7MB

Download
memory/2764-489-0x000000001D600000-0x000000001D7B3000-memory.dmp

Filesize
1.7MB

Download
memory/2764-490-0x000000001D600000-0x000000001D7B3000-memory.dmp

Filesize
1.7MB

Download
memory/2764-491-0x000000001D600000-0x000000001D7B3000-memory.dmp

Filesize
1.7MB

Download
memory/2764-492-0x000000001D600000-0x000000001D7B3000-memory.dmp

Filesize
1.7MB

Download
memory/2764-493-0x000000001D600000-0x000000001D7B3000-memory.dmp

Filesize
1.7MB

Download
memory/2764-494-0x000000001D600000-0x000000001D7B3000-memory.dmp

Filesize
1.7MB

Download
memory/2764-495-0x000000001D600000-0x000000001D7B3000-memory.dmp

Filesize
1.7MB

Download
memory/2764-496-0x000000001D600000-0x000000001D7B3000-memory.dmp

Filesize
1.7MB

Download
memory/2764-497-0x000000001D600000-0x000000001D7B3000-memory.dmp

Filesize
1.7MB

Download
memory/2764-498-0x000000001D600000-0x000000001D7B3000-memory.dmp

Filesize
1.7MB

Download
memory/2764-485-0x000000001D600000-0x000000001D7B3000-memory.dmp

Filesize
1.7MB

Download
memory/2764-500-0x000000001D600000-0x000000001D7B3000-memory.dmp

Filesize
1.7MB

Download
memory/2764-501-0x000000001D600000-0x000000001D7B3000-memory.dmp

Filesize
1.7MB

Download
memory/2764-502-0x000000001D600000-0x000000001D7B3000-memory.dmp

Filesize
1.7MB

Download
memory/2764-503-0x000000001D600000-0x000000001D7B3000-memory.dmp

Filesize
1.7MB

Download
memory/2764-504-0x000000001D600000-0x000000001D7B3000-memory.dmp

Filesize
1.7MB

Download
memory/2764-505-0x000000001D600000-0x000000001D7B3000-memory.dmp

Filesize
1.7MB

Download
memory/2764-506-0x000000001D600000-0x000000001D7B3000-memory.dmp

Filesize
1.7MB

Download
memory/2764-507-0x000000001D600000-0x000000001D7B3000-memory.dmp

Filesize
1.7MB

Download
memory/2764-508-0x000000001D600000-0x000000001D7B3000-memory.dmp

Filesize
1.7MB

Download
memory/2764-509-0x000000001D600000-0x000000001D7B3000-memory.dmp

Filesize
1.7MB

Download
memory/2764-510-0x000000001D600000-0x000000001D7B3000-memory.dmp

Filesize
1.7MB

Download
memory/2764-511-0x000000001D600000-0x000000001D7B3000-memory.dmp

Filesize
1.7MB

Download
memory/2764-512-0x000000001D600000-0x000000001D7B3000-memory.dmp

Filesize
1.7MB

Download
memory/2764-487-0x000000001D600000-0x000000001D7B3000-memory.dmp

Filesize
1.7MB

Download
memory/2764-514-0x000000001D600000-0x000000001D7B3000-memory.dmp

Filesize
1.7MB

Download
memory/2764-515-0x000000001D600000-0x000000001D7B3000-memory.dmp

Filesize
1.7MB

Download
memory/2764-516-0x000000001D600000-0x000000001D7B3000-memory.dmp

Filesize
1.7MB

Download
memory/2764-517-0x000000001D600000-0x000000001D7B3000-memory.dmp

Filesize
1.7MB

Download
memory/2764-518-0x000000001D600000-0x000000001D7B3000-memory.dmp

Filesize
1.7MB

Download
memory/2764-519-0x000000001D600000-0x000000001D7B3000-memory.dmp

Filesize
1.7MB

Download
memory/2764-520-0x000000001D600000-0x000000001D7B3000-memory.dmp

Filesize
1.7MB

Download
memory/2764-521-0x000000001D600000-0x000000001D7B3000-memory.dmp

Filesize
1.7MB

Download
memory/2764-522-0x000000001D600000-0x000000001D7B3000-memory.dmp

Filesize
1.7MB

Download
memory/2764-523-0x000000001D600000-0x000000001D7B3000-memory.dmp

Filesize
1.7MB

Download
memory/2764-524-0x000000001D600000-0x000000001D7B3000-memory.dmp

Filesize
1.7MB

Download
memory/2764-525-0x000000001D600000-0x000000001D7B3000-memory.dmp

Filesize
1.7MB

Download
memory/2764-472-0x000000001D600000-0x000000001D7B3000-memory.dmp

Filesize
1.7MB

Download
memory/2764-531-0x000000001D600000-0x000000001D7B3000-memory.dmp

Filesize
1.7MB

Download
memory/2764-537-0x000000001D600000-0x000000001D7B3000-memory.dmp

Filesize
1.7MB

Download
memory/2764-538-0x000000001D600000-0x000000001D7B3000-memory.dmp

Filesize
1.7MB

Download
memory/2764-539-0x000000001D600000-0x000000001D7B3000-memory.dmp

Filesize
1.7MB

Download
memory/2764-540-0x000000001D600000-0x000000001D7B3000-memory.dmp

Filesize
1.7MB

Download
memory/2764-541-0x000000001D600000-0x000000001D7B3000-memory.dmp

Filesize
1.7MB

Download
memory/2764-544-0x000000001D600000-0x000000001D7B3000-memory.dmp

Filesize
1.7MB

Download
memory/2764-546-0x000000001D600000-0x000000001D7B3000-memory.dmp

Filesize
1.7MB

Download
memory/2764-547-0x000000001D600000-0x000000001D7B3000-memory.dmp

Filesize
1.7MB

Download
memory/2764-548-0x000000001D600000-0x000000001D7B3000-memory.dmp

Filesize
1.7MB

Download
memory/2764-549-0x000000001D600000-0x000000001D7B3000-memory.dmp

Filesize
1.7MB

Download
memory/2764-550-0x000000001D600000-0x000000001D7B3000-memory.dmp

Filesize
1.7MB

Download
memory/2764-551-0x000000001D600000-0x000000001D7B3000-memory.dmp

Filesize
1.7MB

Download
memory/2764-552-0x000000001D600000-0x000000001D7B3000-memory.dmp

Filesize
1.7MB

Download