dcrat | 277d73a3f82fe52428738a64f8cfdb8d8dc9c6fcba57de752cc69361bb8ee0b6

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
03-12-2024 01:13

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

fa78ac8f4c94923c7e53a3bf6936b46aff02f7746ee9518460c2d529ea2982d4.exe
Size

2.3MB
MD5

4e69fcf73418a08fcb8b3e7e2ecb43c4
SHA1

a3ecd09f65ca4e7821a0b7f8596edcd679573f5b
SHA256

fa78ac8f4c94923c7e53a3bf6936b46aff02f7746ee9518460c2d529ea2982d4
SHA512

a6d1a2b6363ad8a560567e6c11a48f8d1bc4cdfc36474902edf39f676440be82619aae52279121a776486d0edfe7a448f0fe9707b27ae760c1d6dd0201f6adc3
SSDEEP

49152:BwpUwcTZ0rUinysyVZl5LCCcG3RTXM34FIIPWYJxuQfUgtFneJ8BG5U:Bw1ctUyjTLC8puaX/neJ8BgU

Score

10^/10

dcrat infostealer persistence rat

Malware Config

Signatures

DcRat 53 IoCs

DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

rat infostealer dcrat

description	ioc	pid	Process
		448	schtasks.exe
		2836	schtasks.exe
		2280	schtasks.exe
		2080	schtasks.exe
		912	schtasks.exe
		2856	schtasks.exe
		1820	schtasks.exe
		352	schtasks.exe
		1160	schtasks.exe
		2792	schtasks.exe
		2772	schtasks.exe
		900	schtasks.exe
		1540	schtasks.exe
		2748	schtasks.exe
		1608	schtasks.exe
		2020	schtasks.exe
		2696	schtasks.exe
		1868	schtasks.exe
		1956	schtasks.exe
		1760	schtasks.exe
		2624	schtasks.exe
		1308	schtasks.exe
		2616	schtasks.exe
		2756	schtasks.exe
		1748	schtasks.exe
		2524	schtasks.exe
		2824	schtasks.exe
		1904	schtasks.exe
		1628	schtasks.exe
		2672	schtasks.exe
		2384	schtasks.exe
		2728	schtasks.exe
		2116	schtasks.exe
		1152	schtasks.exe
File created	C:\Program Files (x86)\Google\Temp\OSPPSVC.exe		fa78ac8f4c94923c7e53a3bf6936b46aff02f7746ee9518460c2d529ea2982d4.exe
		2988	schtasks.exe
		1472	schtasks.exe
		2348	schtasks.exe
		2592	schtasks.exe
		2104	schtasks.exe
		1944	schtasks.exe
		828	schtasks.exe
		2300	schtasks.exe
		568	schtasks.exe
		1916	schtasks.exe
		1656	schtasks.exe
		872	schtasks.exe
File created	C:\Program Files (x86)\Google\Temp\1610b97d3ab4a7		fa78ac8f4c94923c7e53a3bf6936b46aff02f7746ee9518460c2d529ea2982d4.exe
		2776	schtasks.exe
		1768	schtasks.exe
		2744	schtasks.exe
		2832	schtasks.exe
		2688	schtasks.exe

Dcrat family
dcrat

Modifies WinLogon for persistence 2 TTPs 17 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files (x86)\\Google\\Temp\\OSPPSVC.exe\", \"C:\\Program Files (x86)\\Internet Explorer\\fr-FR\\taskhost.exe\", \"C:\\Program Files (x86)\\Internet Explorer\\en-US\\wininit.exe\", \"C:\\Recovery\\f6a14ac2-8725-11ef-a9ab-dab21757c799\\services.exe\", \"C:\\Windows\\Media\\Garden\\System.exe\", \"C:\\Users\\Default User\\lsm.exe\", \"C:\\Program Files\\Windows Journal\\es-ES\\WMIADAP.exe\", \"C:\\Recovery\\f6a14ac2-8725-11ef-a9ab-dab21757c799\\explorer.exe\", \"C:\\MSOCache\\All Users\\{90140000-0116-0409-1000-0000000FF1CE}-C\\explorer.exe\", \"C:\\MSOCache\\All Users\\csrss.exe\", \"C:\\Program Files\\Microsoft Games\\Multiplayer\\Checkers\\sppsvc.exe\", \"C:\\Program Files\\Reference Assemblies\\Microsoft\\WMIADAP.exe\""	fa78ac8f4c94923c7e53a3bf6936b46aff02f7746ee9518460c2d529ea2982d4.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files (x86)\\Google\\Temp\\OSPPSVC.exe\", \"C:\\Program Files (x86)\\Internet Explorer\\fr-FR\\taskhost.exe\", \"C:\\Program Files (x86)\\Internet Explorer\\en-US\\wininit.exe\", \"C:\\Recovery\\f6a14ac2-8725-11ef-a9ab-dab21757c799\\services.exe\", \"C:\\Windows\\Media\\Garden\\System.exe\", \"C:\\Users\\Default User\\lsm.exe\", \"C:\\Program Files\\Windows Journal\\es-ES\\WMIADAP.exe\", \"C:\\Recovery\\f6a14ac2-8725-11ef-a9ab-dab21757c799\\explorer.exe\", \"C:\\MSOCache\\All Users\\{90140000-0116-0409-1000-0000000FF1CE}-C\\explorer.exe\", \"C:\\MSOCache\\All Users\\csrss.exe\", \"C:\\Program Files\\Microsoft Games\\Multiplayer\\Checkers\\sppsvc.exe\", \"C:\\Program Files\\Reference Assemblies\\Microsoft\\WMIADAP.exe\", \"C:\\Windows\\Setup\\State\\System.exe\", \"C:\\Users\\Default\\My Documents\\System.exe\", \"C:\\Users\\Default\\taskhost.exe\""	fa78ac8f4c94923c7e53a3bf6936b46aff02f7746ee9518460c2d529ea2982d4.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files (x86)\\Google\\Temp\\OSPPSVC.exe\""	fa78ac8f4c94923c7e53a3bf6936b46aff02f7746ee9518460c2d529ea2982d4.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files (x86)\\Google\\Temp\\OSPPSVC.exe\", \"C:\\Program Files (x86)\\Internet Explorer\\fr-FR\\taskhost.exe\", \"C:\\Program Files (x86)\\Internet Explorer\\en-US\\wininit.exe\", \"C:\\Recovery\\f6a14ac2-8725-11ef-a9ab-dab21757c799\\services.exe\", \"C:\\Windows\\Media\\Garden\\System.exe\", \"C:\\Users\\Default User\\lsm.exe\", \"C:\\Program Files\\Windows Journal\\es-ES\\WMIADAP.exe\", \"C:\\Recovery\\f6a14ac2-8725-11ef-a9ab-dab21757c799\\explorer.exe\""	fa78ac8f4c94923c7e53a3bf6936b46aff02f7746ee9518460c2d529ea2982d4.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files (x86)\\Google\\Temp\\OSPPSVC.exe\", \"C:\\Program Files (x86)\\Internet Explorer\\fr-FR\\taskhost.exe\", \"C:\\Program Files (x86)\\Internet Explorer\\en-US\\wininit.exe\", \"C:\\Recovery\\f6a14ac2-8725-11ef-a9ab-dab21757c799\\services.exe\", \"C:\\Windows\\Media\\Garden\\System.exe\", \"C:\\Users\\Default User\\lsm.exe\", \"C:\\Program Files\\Windows Journal\\es-ES\\WMIADAP.exe\", \"C:\\Recovery\\f6a14ac2-8725-11ef-a9ab-dab21757c799\\explorer.exe\", \"C:\\MSOCache\\All Users\\{90140000-0116-0409-1000-0000000FF1CE}-C\\explorer.exe\""	fa78ac8f4c94923c7e53a3bf6936b46aff02f7746ee9518460c2d529ea2982d4.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files (x86)\\Google\\Temp\\OSPPSVC.exe\", \"C:\\Program Files (x86)\\Internet Explorer\\fr-FR\\taskhost.exe\", \"C:\\Program Files (x86)\\Internet Explorer\\en-US\\wininit.exe\", \"C:\\Recovery\\f6a14ac2-8725-11ef-a9ab-dab21757c799\\services.exe\""	fa78ac8f4c94923c7e53a3bf6936b46aff02f7746ee9518460c2d529ea2982d4.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files (x86)\\Google\\Temp\\OSPPSVC.exe\", \"C:\\Program Files (x86)\\Internet Explorer\\fr-FR\\taskhost.exe\", \"C:\\Program Files (x86)\\Internet Explorer\\en-US\\wininit.exe\", \"C:\\Recovery\\f6a14ac2-8725-11ef-a9ab-dab21757c799\\services.exe\", \"C:\\Windows\\Media\\Garden\\System.exe\", \"C:\\Users\\Default User\\lsm.exe\", \"C:\\Program Files\\Windows Journal\\es-ES\\WMIADAP.exe\""	fa78ac8f4c94923c7e53a3bf6936b46aff02f7746ee9518460c2d529ea2982d4.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files (x86)\\Google\\Temp\\OSPPSVC.exe\", \"C:\\Program Files (x86)\\Internet Explorer\\fr-FR\\taskhost.exe\", \"C:\\Program Files (x86)\\Internet Explorer\\en-US\\wininit.exe\", \"C:\\Recovery\\f6a14ac2-8725-11ef-a9ab-dab21757c799\\services.exe\", \"C:\\Windows\\Media\\Garden\\System.exe\", \"C:\\Users\\Default User\\lsm.exe\", \"C:\\Program Files\\Windows Journal\\es-ES\\WMIADAP.exe\", \"C:\\Recovery\\f6a14ac2-8725-11ef-a9ab-dab21757c799\\explorer.exe\", \"C:\\MSOCache\\All Users\\{90140000-0116-0409-1000-0000000FF1CE}-C\\explorer.exe\", \"C:\\MSOCache\\All Users\\csrss.exe\", \"C:\\Program Files\\Microsoft Games\\Multiplayer\\Checkers\\sppsvc.exe\", \"C:\\Program Files\\Reference Assemblies\\Microsoft\\WMIADAP.exe\", \"C:\\Windows\\Setup\\State\\System.exe\", \"C:\\Users\\Default\\My Documents\\System.exe\", \"C:\\Users\\Default\\taskhost.exe\", \"C:\\Program Files\\Google\\Chrome\\Application\\Idle.exe\", \"C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.0\\explorer.exe\""	fa78ac8f4c94923c7e53a3bf6936b46aff02f7746ee9518460c2d529ea2982d4.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files (x86)\\Google\\Temp\\OSPPSVC.exe\", \"C:\\Program Files (x86)\\Internet Explorer\\fr-FR\\taskhost.exe\", \"C:\\Program Files (x86)\\Internet Explorer\\en-US\\wininit.exe\", \"C:\\Recovery\\f6a14ac2-8725-11ef-a9ab-dab21757c799\\services.exe\", \"C:\\Windows\\Media\\Garden\\System.exe\", \"C:\\Users\\Default User\\lsm.exe\", \"C:\\Program Files\\Windows Journal\\es-ES\\WMIADAP.exe\", \"C:\\Recovery\\f6a14ac2-8725-11ef-a9ab-dab21757c799\\explorer.exe\", \"C:\\MSOCache\\All Users\\{90140000-0116-0409-1000-0000000FF1CE}-C\\explorer.exe\", \"C:\\MSOCache\\All Users\\csrss.exe\", \"C:\\Program Files\\Microsoft Games\\Multiplayer\\Checkers\\sppsvc.exe\""	fa78ac8f4c94923c7e53a3bf6936b46aff02f7746ee9518460c2d529ea2982d4.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files (x86)\\Google\\Temp\\OSPPSVC.exe\", \"C:\\Program Files (x86)\\Internet Explorer\\fr-FR\\taskhost.exe\", \"C:\\Program Files (x86)\\Internet Explorer\\en-US\\wininit.exe\", \"C:\\Recovery\\f6a14ac2-8725-11ef-a9ab-dab21757c799\\services.exe\", \"C:\\Windows\\Media\\Garden\\System.exe\", \"C:\\Users\\Default User\\lsm.exe\", \"C:\\Program Files\\Windows Journal\\es-ES\\WMIADAP.exe\", \"C:\\Recovery\\f6a14ac2-8725-11ef-a9ab-dab21757c799\\explorer.exe\", \"C:\\MSOCache\\All Users\\{90140000-0116-0409-1000-0000000FF1CE}-C\\explorer.exe\", \"C:\\MSOCache\\All Users\\csrss.exe\", \"C:\\Program Files\\Microsoft Games\\Multiplayer\\Checkers\\sppsvc.exe\", \"C:\\Program Files\\Reference Assemblies\\Microsoft\\WMIADAP.exe\", \"C:\\Windows\\Setup\\State\\System.exe\""	fa78ac8f4c94923c7e53a3bf6936b46aff02f7746ee9518460c2d529ea2982d4.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files (x86)\\Google\\Temp\\OSPPSVC.exe\", \"C:\\Program Files (x86)\\Internet Explorer\\fr-FR\\taskhost.exe\", \"C:\\Program Files (x86)\\Internet Explorer\\en-US\\wininit.exe\", \"C:\\Recovery\\f6a14ac2-8725-11ef-a9ab-dab21757c799\\services.exe\", \"C:\\Windows\\Media\\Garden\\System.exe\", \"C:\\Users\\Default User\\lsm.exe\", \"C:\\Program Files\\Windows Journal\\es-ES\\WMIADAP.exe\", \"C:\\Recovery\\f6a14ac2-8725-11ef-a9ab-dab21757c799\\explorer.exe\", \"C:\\MSOCache\\All Users\\{90140000-0116-0409-1000-0000000FF1CE}-C\\explorer.exe\", \"C:\\MSOCache\\All Users\\csrss.exe\", \"C:\\Program Files\\Microsoft Games\\Multiplayer\\Checkers\\sppsvc.exe\", \"C:\\Program Files\\Reference Assemblies\\Microsoft\\WMIADAP.exe\", \"C:\\Windows\\Setup\\State\\System.exe\", \"C:\\Users\\Default\\My Documents\\System.exe\""	fa78ac8f4c94923c7e53a3bf6936b46aff02f7746ee9518460c2d529ea2982d4.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files (x86)\\Google\\Temp\\OSPPSVC.exe\", \"C:\\Program Files (x86)\\Internet Explorer\\fr-FR\\taskhost.exe\""	fa78ac8f4c94923c7e53a3bf6936b46aff02f7746ee9518460c2d529ea2982d4.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files (x86)\\Google\\Temp\\OSPPSVC.exe\", \"C:\\Program Files (x86)\\Internet Explorer\\fr-FR\\taskhost.exe\", \"C:\\Program Files (x86)\\Internet Explorer\\en-US\\wininit.exe\""	fa78ac8f4c94923c7e53a3bf6936b46aff02f7746ee9518460c2d529ea2982d4.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files (x86)\\Google\\Temp\\OSPPSVC.exe\", \"C:\\Program Files (x86)\\Internet Explorer\\fr-FR\\taskhost.exe\", \"C:\\Program Files (x86)\\Internet Explorer\\en-US\\wininit.exe\", \"C:\\Recovery\\f6a14ac2-8725-11ef-a9ab-dab21757c799\\services.exe\", \"C:\\Windows\\Media\\Garden\\System.exe\", \"C:\\Users\\Default User\\lsm.exe\", \"C:\\Program Files\\Windows Journal\\es-ES\\WMIADAP.exe\", \"C:\\Recovery\\f6a14ac2-8725-11ef-a9ab-dab21757c799\\explorer.exe\", \"C:\\MSOCache\\All Users\\{90140000-0116-0409-1000-0000000FF1CE}-C\\explorer.exe\", \"C:\\MSOCache\\All Users\\csrss.exe\""	fa78ac8f4c94923c7e53a3bf6936b46aff02f7746ee9518460c2d529ea2982d4.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files (x86)\\Google\\Temp\\OSPPSVC.exe\", \"C:\\Program Files (x86)\\Internet Explorer\\fr-FR\\taskhost.exe\", \"C:\\Program Files (x86)\\Internet Explorer\\en-US\\wininit.exe\", \"C:\\Recovery\\f6a14ac2-8725-11ef-a9ab-dab21757c799\\services.exe\", \"C:\\Windows\\Media\\Garden\\System.exe\""	fa78ac8f4c94923c7e53a3bf6936b46aff02f7746ee9518460c2d529ea2982d4.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files (x86)\\Google\\Temp\\OSPPSVC.exe\", \"C:\\Program Files (x86)\\Internet Explorer\\fr-FR\\taskhost.exe\", \"C:\\Program Files (x86)\\Internet Explorer\\en-US\\wininit.exe\", \"C:\\Recovery\\f6a14ac2-8725-11ef-a9ab-dab21757c799\\services.exe\", \"C:\\Windows\\Media\\Garden\\System.exe\", \"C:\\Users\\Default User\\lsm.exe\""	fa78ac8f4c94923c7e53a3bf6936b46aff02f7746ee9518460c2d529ea2982d4.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files (x86)\\Google\\Temp\\OSPPSVC.exe\", \"C:\\Program Files (x86)\\Internet Explorer\\fr-FR\\taskhost.exe\", \"C:\\Program Files (x86)\\Internet Explorer\\en-US\\wininit.exe\", \"C:\\Recovery\\f6a14ac2-8725-11ef-a9ab-dab21757c799\\services.exe\", \"C:\\Windows\\Media\\Garden\\System.exe\", \"C:\\Users\\Default User\\lsm.exe\", \"C:\\Program Files\\Windows Journal\\es-ES\\WMIADAP.exe\", \"C:\\Recovery\\f6a14ac2-8725-11ef-a9ab-dab21757c799\\explorer.exe\", \"C:\\MSOCache\\All Users\\{90140000-0116-0409-1000-0000000FF1CE}-C\\explorer.exe\", \"C:\\MSOCache\\All Users\\csrss.exe\", \"C:\\Program Files\\Microsoft Games\\Multiplayer\\Checkers\\sppsvc.exe\", \"C:\\Program Files\\Reference Assemblies\\Microsoft\\WMIADAP.exe\", \"C:\\Windows\\Setup\\State\\System.exe\", \"C:\\Users\\Default\\My Documents\\System.exe\", \"C:\\Users\\Default\\taskhost.exe\", \"C:\\Program Files\\Google\\Chrome\\Application\\Idle.exe\""	fa78ac8f4c94923c7e53a3bf6936b46aff02f7746ee9518460c2d529ea2982d4.exe

Process spawned unexpected child process 51 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2748	2820	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2744	2820	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2856	2820	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2792	2820	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2772	2820	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2756	2820	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2836	2820	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2832	2820	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2776	2820	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2696	2820	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2672	2820	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2524	2820	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2688	2820	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2384	2820	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2104	2820	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2728	2820	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2824	2820	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2116	2820	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1768	2820	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2300	2820	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2988	2820	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1916	2820	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1904	2820	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1944	2820	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2280	2820	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2348	2820	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	448	2820	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2624	2820	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1472	2820	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	828	2820	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1820	2820	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1308	2820	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1868	2820	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	352	2820	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	912	2820	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	900	2820	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1656	2820	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1540	2820	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1748	2820	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1956	2820	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1628	2820	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	568	2820	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1152	2820	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2592	2820	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1760	2820	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	872	2820	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1160	2820	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1608	2820	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2080	2820	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2616	2820	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2020	2820	schtasks.exe	31

DCRat payload 3 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral1/memory/2372-1-0x0000000000CD0000-0x0000000000F22000-memory.dmp	dcrat
behavioral1/files/0x000500000001a4ab-18.dat	dcrat
behavioral1/memory/2976-29-0x0000000000050000-0x00000000002A2000-memory.dmp	dcrat

Executes dropped EXE 1 IoCs

pid	Process
3028	WMIADAP.exe

Adds Run key to start application 2 TTPs 34 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\explorer = "\"C:\\MSOCache\\All Users\\{90140000-0116-0409-1000-0000000FF1CE}-C\\explorer.exe\""	fa78ac8f4c94923c7e53a3bf6936b46aff02f7746ee9518460c2d529ea2982d4.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Windows\CurrentVersion\Run\System = "\"C:\\Windows\\Setup\\State\\System.exe\""	fa78ac8f4c94923c7e53a3bf6936b46aff02f7746ee9518460c2d529ea2982d4.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\explorer = "\"C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.0\\explorer.exe\""	fa78ac8f4c94923c7e53a3bf6936b46aff02f7746ee9518460c2d529ea2982d4.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Windows\CurrentVersion\Run\taskhost = "\"C:\\Program Files (x86)\\Internet Explorer\\fr-FR\\taskhost.exe\""	fa78ac8f4c94923c7e53a3bf6936b46aff02f7746ee9518460c2d529ea2982d4.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\wininit = "\"C:\\Program Files (x86)\\Internet Explorer\\en-US\\wininit.exe\""	fa78ac8f4c94923c7e53a3bf6936b46aff02f7746ee9518460c2d529ea2982d4.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Windows\CurrentVersion\Run\WMIADAP = "\"C:\\Program Files\\Windows Journal\\es-ES\\WMIADAP.exe\""	fa78ac8f4c94923c7e53a3bf6936b46aff02f7746ee9518460c2d529ea2982d4.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WMIADAP = "\"C:\\Program Files\\Windows Journal\\es-ES\\WMIADAP.exe\""	fa78ac8f4c94923c7e53a3bf6936b46aff02f7746ee9518460c2d529ea2982d4.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Windows\CurrentVersion\Run\explorer = "\"C:\\Recovery\\f6a14ac2-8725-11ef-a9ab-dab21757c799\\explorer.exe\""	fa78ac8f4c94923c7e53a3bf6936b46aff02f7746ee9518460c2d529ea2982d4.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WMIADAP = "\"C:\\Program Files\\Reference Assemblies\\Microsoft\\WMIADAP.exe\""	fa78ac8f4c94923c7e53a3bf6936b46aff02f7746ee9518460c2d529ea2982d4.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\System = "\"C:\\Users\\Default\\My Documents\\System.exe\""	fa78ac8f4c94923c7e53a3bf6936b46aff02f7746ee9518460c2d529ea2982d4.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Windows\CurrentVersion\Run\explorer = "\"C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.0\\explorer.exe\""	fa78ac8f4c94923c7e53a3bf6936b46aff02f7746ee9518460c2d529ea2982d4.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Windows\CurrentVersion\Run\Idle = "\"C:\\Program Files\\Google\\Chrome\\Application\\Idle.exe\""	fa78ac8f4c94923c7e53a3bf6936b46aff02f7746ee9518460c2d529ea2982d4.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Windows\CurrentVersion\Run\lsm = "\"C:\\Users\\Default User\\lsm.exe\""	fa78ac8f4c94923c7e53a3bf6936b46aff02f7746ee9518460c2d529ea2982d4.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\lsm = "\"C:\\Users\\Default User\\lsm.exe\""	fa78ac8f4c94923c7e53a3bf6936b46aff02f7746ee9518460c2d529ea2982d4.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Windows\CurrentVersion\Run\sppsvc = "\"C:\\Program Files\\Microsoft Games\\Multiplayer\\Checkers\\sppsvc.exe\""	fa78ac8f4c94923c7e53a3bf6936b46aff02f7746ee9518460c2d529ea2982d4.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\System = "\"C:\\Windows\\Setup\\State\\System.exe\""	fa78ac8f4c94923c7e53a3bf6936b46aff02f7746ee9518460c2d529ea2982d4.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Windows\CurrentVersion\Run\OSPPSVC = "\"C:\\Program Files (x86)\\Google\\Temp\\OSPPSVC.exe\""	fa78ac8f4c94923c7e53a3bf6936b46aff02f7746ee9518460c2d529ea2982d4.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Windows\CurrentVersion\Run\taskhost = "\"C:\\Users\\Default\\taskhost.exe\""	fa78ac8f4c94923c7e53a3bf6936b46aff02f7746ee9518460c2d529ea2982d4.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\taskhost = "\"C:\\Users\\Default\\taskhost.exe\""	fa78ac8f4c94923c7e53a3bf6936b46aff02f7746ee9518460c2d529ea2982d4.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Idle = "\"C:\\Program Files\\Google\\Chrome\\Application\\Idle.exe\""	fa78ac8f4c94923c7e53a3bf6936b46aff02f7746ee9518460c2d529ea2982d4.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OSPPSVC = "\"C:\\Program Files (x86)\\Google\\Temp\\OSPPSVC.exe\""	fa78ac8f4c94923c7e53a3bf6936b46aff02f7746ee9518460c2d529ea2982d4.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Windows\CurrentVersion\Run\services = "\"C:\\Recovery\\f6a14ac2-8725-11ef-a9ab-dab21757c799\\services.exe\""	fa78ac8f4c94923c7e53a3bf6936b46aff02f7746ee9518460c2d529ea2982d4.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\services = "\"C:\\Recovery\\f6a14ac2-8725-11ef-a9ab-dab21757c799\\services.exe\""	fa78ac8f4c94923c7e53a3bf6936b46aff02f7746ee9518460c2d529ea2982d4.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Windows\CurrentVersion\Run\System = "\"C:\\Windows\\Media\\Garden\\System.exe\""	fa78ac8f4c94923c7e53a3bf6936b46aff02f7746ee9518460c2d529ea2982d4.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\System = "\"C:\\Windows\\Media\\Garden\\System.exe\""	fa78ac8f4c94923c7e53a3bf6936b46aff02f7746ee9518460c2d529ea2982d4.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Windows\CurrentVersion\Run\WMIADAP = "\"C:\\Program Files\\Reference Assemblies\\Microsoft\\WMIADAP.exe\""	fa78ac8f4c94923c7e53a3bf6936b46aff02f7746ee9518460c2d529ea2982d4.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sppsvc = "\"C:\\Program Files\\Microsoft Games\\Multiplayer\\Checkers\\sppsvc.exe\""	fa78ac8f4c94923c7e53a3bf6936b46aff02f7746ee9518460c2d529ea2982d4.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\taskhost = "\"C:\\Program Files (x86)\\Internet Explorer\\fr-FR\\taskhost.exe\""	fa78ac8f4c94923c7e53a3bf6936b46aff02f7746ee9518460c2d529ea2982d4.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\explorer = "\"C:\\Recovery\\f6a14ac2-8725-11ef-a9ab-dab21757c799\\explorer.exe\""	fa78ac8f4c94923c7e53a3bf6936b46aff02f7746ee9518460c2d529ea2982d4.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\MSOCache\\All Users\\csrss.exe\""	fa78ac8f4c94923c7e53a3bf6936b46aff02f7746ee9518460c2d529ea2982d4.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\MSOCache\\All Users\\csrss.exe\""	fa78ac8f4c94923c7e53a3bf6936b46aff02f7746ee9518460c2d529ea2982d4.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Windows\CurrentVersion\Run\wininit = "\"C:\\Program Files (x86)\\Internet Explorer\\en-US\\wininit.exe\""	fa78ac8f4c94923c7e53a3bf6936b46aff02f7746ee9518460c2d529ea2982d4.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Windows\CurrentVersion\Run\explorer = "\"C:\\MSOCache\\All Users\\{90140000-0116-0409-1000-0000000FF1CE}-C\\explorer.exe\""	fa78ac8f4c94923c7e53a3bf6936b46aff02f7746ee9518460c2d529ea2982d4.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Windows\CurrentVersion\Run\System = "\"C:\\Users\\Default\\My Documents\\System.exe\""	fa78ac8f4c94923c7e53a3bf6936b46aff02f7746ee9518460c2d529ea2982d4.exe

Drops file in Program Files directory 18 IoCs

description	ioc	Process
File created	C:\Program Files\Microsoft Games\Multiplayer\Checkers\sppsvc.exe	fa78ac8f4c94923c7e53a3bf6936b46aff02f7746ee9518460c2d529ea2982d4.exe
File opened for modification	C:\Program Files (x86)\Google\Temp\OSPPSVC.exe	fa78ac8f4c94923c7e53a3bf6936b46aff02f7746ee9518460c2d529ea2982d4.exe
File created	C:\Program Files (x86)\Internet Explorer\en-US\wininit.exe	fa78ac8f4c94923c7e53a3bf6936b46aff02f7746ee9518460c2d529ea2982d4.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\75a57c1bdf437c	fa78ac8f4c94923c7e53a3bf6936b46aff02f7746ee9518460c2d529ea2982d4.exe
File created	C:\Program Files\Google\Chrome\Application\Idle.exe	fa78ac8f4c94923c7e53a3bf6936b46aff02f7746ee9518460c2d529ea2982d4.exe
File created	C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\7a0fd90576e088	fa78ac8f4c94923c7e53a3bf6936b46aff02f7746ee9518460c2d529ea2982d4.exe
File created	C:\Program Files (x86)\Google\Temp\OSPPSVC.exe	fa78ac8f4c94923c7e53a3bf6936b46aff02f7746ee9518460c2d529ea2982d4.exe
File created	C:\Program Files (x86)\Internet Explorer\fr-FR\b75386f1303e64	fa78ac8f4c94923c7e53a3bf6936b46aff02f7746ee9518460c2d529ea2982d4.exe
File created	C:\Program Files\Windows Journal\es-ES\WMIADAP.exe	fa78ac8f4c94923c7e53a3bf6936b46aff02f7746ee9518460c2d529ea2982d4.exe
File opened for modification	C:\Program Files\Windows Journal\es-ES\WMIADAP.exe	fa78ac8f4c94923c7e53a3bf6936b46aff02f7746ee9518460c2d529ea2982d4.exe
File created	C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\explorer.exe	fa78ac8f4c94923c7e53a3bf6936b46aff02f7746ee9518460c2d529ea2982d4.exe
File created	C:\Program Files (x86)\Google\Temp\1610b97d3ab4a7	fa78ac8f4c94923c7e53a3bf6936b46aff02f7746ee9518460c2d529ea2982d4.exe
File created	C:\Program Files (x86)\Internet Explorer\en-US\56085415360792	fa78ac8f4c94923c7e53a3bf6936b46aff02f7746ee9518460c2d529ea2982d4.exe
File created	C:\Program Files\Windows Journal\es-ES\75a57c1bdf437c	fa78ac8f4c94923c7e53a3bf6936b46aff02f7746ee9518460c2d529ea2982d4.exe
File created	C:\Program Files\Microsoft Games\Multiplayer\Checkers\0a1fd5f707cd16	fa78ac8f4c94923c7e53a3bf6936b46aff02f7746ee9518460c2d529ea2982d4.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\WMIADAP.exe	fa78ac8f4c94923c7e53a3bf6936b46aff02f7746ee9518460c2d529ea2982d4.exe
File created	C:\Program Files\Google\Chrome\Application\6ccacd8608530f	fa78ac8f4c94923c7e53a3bf6936b46aff02f7746ee9518460c2d529ea2982d4.exe
File created	C:\Program Files (x86)\Internet Explorer\fr-FR\taskhost.exe	fa78ac8f4c94923c7e53a3bf6936b46aff02f7746ee9518460c2d529ea2982d4.exe

Drops file in Windows directory 5 IoCs

description	ioc	Process
File created	C:\Windows\Setup\State\System.exe	fa78ac8f4c94923c7e53a3bf6936b46aff02f7746ee9518460c2d529ea2982d4.exe
File created	C:\Windows\Setup\State\27d1bcfc3c54e0	fa78ac8f4c94923c7e53a3bf6936b46aff02f7746ee9518460c2d529ea2982d4.exe
File created	C:\Windows\rescache\rc0005\fa78ac8f4c94923c7e53a3bf6936b46aff02f7746ee9518460c2d529ea2982d4.exe	fa78ac8f4c94923c7e53a3bf6936b46aff02f7746ee9518460c2d529ea2982d4.exe
File created	C:\Windows\Media\Garden\System.exe	fa78ac8f4c94923c7e53a3bf6936b46aff02f7746ee9518460c2d529ea2982d4.exe
File created	C:\Windows\Media\Garden\27d1bcfc3c54e0	fa78ac8f4c94923c7e53a3bf6936b46aff02f7746ee9518460c2d529ea2982d4.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Scheduled Task/Job: Scheduled Task 1 TTPs 51 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
1540	schtasks.exe
2836	schtasks.exe
2524	schtasks.exe
2824	schtasks.exe
1768	schtasks.exe
1944	schtasks.exe
1472	schtasks.exe
1820	schtasks.exe
1628	schtasks.exe
352	schtasks.exe
2748	schtasks.exe
2776	schtasks.exe
2116	schtasks.exe
2988	schtasks.exe
1904	schtasks.exe
2348	schtasks.exe
448	schtasks.exe
912	schtasks.exe
1956	schtasks.exe
2616	schtasks.exe
2744	schtasks.exe
2756	schtasks.exe
2672	schtasks.exe
1916	schtasks.exe
1656	schtasks.exe
1748	schtasks.exe
2080	schtasks.exe
1152	schtasks.exe
1160	schtasks.exe
2688	schtasks.exe
2624	schtasks.exe
568	schtasks.exe
1760	schtasks.exe
2020	schtasks.exe
2792	schtasks.exe
2696	schtasks.exe
828	schtasks.exe
1308	schtasks.exe
1868	schtasks.exe
1608	schtasks.exe
2832	schtasks.exe
2384	schtasks.exe
2728	schtasks.exe
2300	schtasks.exe
2280	schtasks.exe
2592	schtasks.exe
2856	schtasks.exe
2772	schtasks.exe
2104	schtasks.exe
900	schtasks.exe
872	schtasks.exe

Suspicious behavior: EnumeratesProcesses 9 IoCs

pid	Process
2372	fa78ac8f4c94923c7e53a3bf6936b46aff02f7746ee9518460c2d529ea2982d4.exe
2372	fa78ac8f4c94923c7e53a3bf6936b46aff02f7746ee9518460c2d529ea2982d4.exe
2372	fa78ac8f4c94923c7e53a3bf6936b46aff02f7746ee9518460c2d529ea2982d4.exe
2372	fa78ac8f4c94923c7e53a3bf6936b46aff02f7746ee9518460c2d529ea2982d4.exe
2372	fa78ac8f4c94923c7e53a3bf6936b46aff02f7746ee9518460c2d529ea2982d4.exe
2976	fa78ac8f4c94923c7e53a3bf6936b46aff02f7746ee9518460c2d529ea2982d4.exe
2976	fa78ac8f4c94923c7e53a3bf6936b46aff02f7746ee9518460c2d529ea2982d4.exe
2976	fa78ac8f4c94923c7e53a3bf6936b46aff02f7746ee9518460c2d529ea2982d4.exe
3028	WMIADAP.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	2372	fa78ac8f4c94923c7e53a3bf6936b46aff02f7746ee9518460c2d529ea2982d4.exe
Token: SeDebugPrivilege	2976	fa78ac8f4c94923c7e53a3bf6936b46aff02f7746ee9518460c2d529ea2982d4.exe
Token: SeDebugPrivilege	3028	WMIADAP.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 2372 wrote to memory of 1908	2372	fa78ac8f4c94923c7e53a3bf6936b46aff02f7746ee9518460c2d529ea2982d4.exe	50
PID 2372 wrote to memory of 1908	2372	fa78ac8f4c94923c7e53a3bf6936b46aff02f7746ee9518460c2d529ea2982d4.exe	50
PID 2372 wrote to memory of 1908	2372	fa78ac8f4c94923c7e53a3bf6936b46aff02f7746ee9518460c2d529ea2982d4.exe	50
PID 1908 wrote to memory of 1984	1908	cmd.exe	52
PID 1908 wrote to memory of 1984	1908	cmd.exe	52
PID 1908 wrote to memory of 1984	1908	cmd.exe	52
PID 1908 wrote to memory of 2976	1908	cmd.exe	53
PID 1908 wrote to memory of 2976	1908	cmd.exe	53
PID 1908 wrote to memory of 2976	1908	cmd.exe	53
PID 2976 wrote to memory of 3028	2976	fa78ac8f4c94923c7e53a3bf6936b46aff02f7746ee9518460c2d529ea2982d4.exe	87
PID 2976 wrote to memory of 3028	2976	fa78ac8f4c94923c7e53a3bf6936b46aff02f7746ee9518460c2d529ea2982d4.exe	87
PID 2976 wrote to memory of 3028	2976	fa78ac8f4c94923c7e53a3bf6936b46aff02f7746ee9518460c2d529ea2982d4.exe	87

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\fa78ac8f4c94923c7e53a3bf6936b46aff02f7746ee9518460c2d529ea2982d4.exe
"C:\Users\Admin\AppData\Local\Temp\fa78ac8f4c94923c7e53a3bf6936b46aff02f7746ee9518460c2d529ea2982d4.exe"
1⤵
- DcRat
- Modifies WinLogon for persistence
- Adds Run key to start application
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2372
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\Kikze6bnAR.bat"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1908
- - C:\Windows\system32\w32tm.exe
    w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
    3⤵
    PID:1984
- - C:\Users\Admin\AppData\Local\Temp\fa78ac8f4c94923c7e53a3bf6936b46aff02f7746ee9518460c2d529ea2982d4.exe
    "C:\Users\Admin\AppData\Local\Temp\fa78ac8f4c94923c7e53a3bf6936b46aff02f7746ee9518460c2d529ea2982d4.exe"
    3⤵
    - Modifies WinLogon for persistence
    - Adds Run key to start application
    - Drops file in Program Files directory
    - Drops file in Windows directory
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:2976
  - - C:\Program Files\Reference Assemblies\Microsoft\WMIADAP.exe
      "C:\Program Files\Reference Assemblies\Microsoft\WMIADAP.exe"
      4⤵
      Executes dropped EXE
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:3028

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OSPPSVCO" /sc MINUTE /mo 9 /tr "'C:\Program Files (x86)\Google\Temp\OSPPSVC.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2748

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OSPPSVC" /sc ONLOGON /tr "'C:\Program Files (x86)\Google\Temp\OSPPSVC.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2744

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OSPPSVCO" /sc MINUTE /mo 5 /tr "'C:\Program Files (x86)\Google\Temp\OSPPSVC.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2856

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostt" /sc MINUTE /mo 11 /tr "'C:\Program Files (x86)\Internet Explorer\fr-FR\taskhost.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2792

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhost" /sc ONLOGON /tr "'C:\Program Files (x86)\Internet Explorer\fr-FR\taskhost.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2772

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostt" /sc MINUTE /mo 11 /tr "'C:\Program Files (x86)\Internet Explorer\fr-FR\taskhost.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2756

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 8 /tr "'C:\Program Files (x86)\Internet Explorer\en-US\wininit.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2836

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininit" /sc ONLOGON /tr "'C:\Program Files (x86)\Internet Explorer\en-US\wininit.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2832

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 5 /tr "'C:\Program Files (x86)\Internet Explorer\en-US\wininit.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2776

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 6 /tr "'C:\Recovery\f6a14ac2-8725-11ef-a9ab-dab21757c799\services.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2696

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "services" /sc ONLOGON /tr "'C:\Recovery\f6a14ac2-8725-11ef-a9ab-dab21757c799\services.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2672

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 7 /tr "'C:\Recovery\f6a14ac2-8725-11ef-a9ab-dab21757c799\services.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2524

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 10 /tr "'C:\Windows\Media\Garden\System.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2688

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "System" /sc ONLOGON /tr "'C:\Windows\Media\Garden\System.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2384

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 8 /tr "'C:\Windows\Media\Garden\System.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2104

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsml" /sc MINUTE /mo 9 /tr "'C:\Users\Default User\lsm.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2728

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsm" /sc ONLOGON /tr "'C:\Users\Default User\lsm.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2824

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsml" /sc MINUTE /mo 9 /tr "'C:\Users\Default User\lsm.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2116

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WMIADAPW" /sc MINUTE /mo 11 /tr "'C:\Program Files\Windows Journal\es-ES\WMIADAP.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1768

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WMIADAP" /sc ONLOGON /tr "'C:\Program Files\Windows Journal\es-ES\WMIADAP.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2300

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WMIADAPW" /sc MINUTE /mo 12 /tr "'C:\Program Files\Windows Journal\es-ES\WMIADAP.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2988

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 11 /tr "'C:\Recovery\f6a14ac2-8725-11ef-a9ab-dab21757c799\explorer.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1916

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorer" /sc ONLOGON /tr "'C:\Recovery\f6a14ac2-8725-11ef-a9ab-dab21757c799\explorer.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1904

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 11 /tr "'C:\Recovery\f6a14ac2-8725-11ef-a9ab-dab21757c799\explorer.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1944

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 5 /tr "'C:\MSOCache\All Users\{90140000-0116-0409-1000-0000000FF1CE}-C\explorer.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2280

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorer" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-0116-0409-1000-0000000FF1CE}-C\explorer.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2348

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 7 /tr "'C:\MSOCache\All Users\{90140000-0116-0409-1000-0000000FF1CE}-C\explorer.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:448

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 6 /tr "'C:\MSOCache\All Users\csrss.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2624

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\MSOCache\All Users\csrss.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1472

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 13 /tr "'C:\MSOCache\All Users\csrss.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:828

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 11 /tr "'C:\Program Files\Microsoft Games\Multiplayer\Checkers\sppsvc.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1820

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvc" /sc ONLOGON /tr "'C:\Program Files\Microsoft Games\Multiplayer\Checkers\sppsvc.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1308

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 14 /tr "'C:\Program Files\Microsoft Games\Multiplayer\Checkers\sppsvc.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1868

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WMIADAPW" /sc MINUTE /mo 6 /tr "'C:\Program Files\Reference Assemblies\Microsoft\WMIADAP.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:352

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WMIADAP" /sc ONLOGON /tr "'C:\Program Files\Reference Assemblies\Microsoft\WMIADAP.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:912

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WMIADAPW" /sc MINUTE /mo 14 /tr "'C:\Program Files\Reference Assemblies\Microsoft\WMIADAP.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:900

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 7 /tr "'C:\Windows\Setup\State\System.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1656

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "System" /sc ONLOGON /tr "'C:\Windows\Setup\State\System.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1540

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 6 /tr "'C:\Windows\Setup\State\System.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1748

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 12 /tr "'C:\Users\Default\My Documents\System.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1956

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "System" /sc ONLOGON /tr "'C:\Users\Default\My Documents\System.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1628

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 12 /tr "'C:\Users\Default\My Documents\System.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:568

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostt" /sc MINUTE /mo 8 /tr "'C:\Users\Default\taskhost.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2592

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhost" /sc ONLOGON /tr "'C:\Users\Default\taskhost.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1152

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostt" /sc MINUTE /mo 13 /tr "'C:\Users\Default\taskhost.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1760

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 9 /tr "'C:\Program Files\Google\Chrome\Application\Idle.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:872

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Idle" /sc ONLOGON /tr "'C:\Program Files\Google\Chrome\Application\Idle.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1160

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 5 /tr "'C:\Program Files\Google\Chrome\Application\Idle.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1608

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 11 /tr "'C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\explorer.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2080

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorer" /sc ONLOGON /tr "'C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\explorer.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2616

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 13 /tr "'C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\explorer.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2020

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\3afbd30b939f55f45d129c7b61b03737ca46b2654.5.32144592a011a543d8eda902c9c49d53ec922af603

Filesize
1020B

MD5
0f613b330b37cadf2186ed42a5255a3c

SHA1
9b2b6d13c62b7c3ea8873ecf491b20f45c03ef06

SHA256
5d6be6bceefe6670034e0a68c323790cb0c291c1807c95c6c9da1244a2c6bc4f

SHA512
635c3b45f172dde9860d287055c6e94d07c3c89391d77accb6b70720f997e08f00035a11d2760f73ee58383edb0f0d7712075dac6eca1494c62c2b99a9449db9

Download Submit
C:\Users\Admin\AppData\Local\Temp\Kikze6bnAR.bat

Filesize
267B

MD5
23b8168163d3c7a6b2ceab0e4140f44e

SHA1
0c8141923dc82543cf615de513fd9b172b05495b

SHA256
db66131694b6328ac399e117d814c013420f7efe4ef583f1f557e575dc51a994

SHA512
a3b3c7125b374c7c7895059d3ce72d051649607ea72a571f21f32d148bca87d8db287456b71552410f6762c2feb8ea4c91f6ebff43f83efe76ad8ec88ffa1f86

Download Submit
C:\Windows\Media\Garden\System.exe

Filesize
2.3MB

MD5
4e69fcf73418a08fcb8b3e7e2ecb43c4

SHA1
a3ecd09f65ca4e7821a0b7f8596edcd679573f5b

SHA256
fa78ac8f4c94923c7e53a3bf6936b46aff02f7746ee9518460c2d529ea2982d4

SHA512
a6d1a2b6363ad8a560567e6c11a48f8d1bc4cdfc36474902edf39f676440be82619aae52279121a776486d0edfe7a448f0fe9707b27ae760c1d6dd0201f6adc3

Download Submit
memory/2372-4-0x00000000002F0000-0x0000000000306000-memory.dmp

Filesize
88KB

Download
memory/2372-3-0x00000000002D0000-0x00000000002EC000-memory.dmp

Filesize
112KB

Download
memory/2372-5-0x0000000000C40000-0x0000000000C96000-memory.dmp

Filesize
344KB

Download
memory/2372-6-0x0000000000310000-0x0000000000322000-memory.dmp

Filesize
72KB

Download
memory/2372-7-0x0000000000320000-0x000000000032E000-memory.dmp

Filesize
56KB

Download
memory/2372-8-0x00000000005D0000-0x00000000005D8000-memory.dmp

Filesize
32KB

Download
memory/2372-9-0x00000000005E0000-0x00000000005E8000-memory.dmp

Filesize
32KB

Download
memory/2372-0-0x000007FEF5AB3000-0x000007FEF5AB4000-memory.dmp

Filesize
4KB

Download
memory/2372-28-0x000007FEF5AB0000-0x000007FEF649C000-memory.dmp

Filesize
9.9MB

Download
memory/2372-2-0x000007FEF5AB0000-0x000007FEF649C000-memory.dmp

Filesize
9.9MB

Download
memory/2372-1-0x0000000000CD0000-0x0000000000F22000-memory.dmp

Filesize
2.3MB

Download
memory/2976-30-0x00000000004A0000-0x00000000004B2000-memory.dmp

Filesize
72KB

Download
memory/2976-29-0x0000000000050000-0x00000000002A2000-memory.dmp

Filesize
2.3MB

Download
memory/3028-61-0x0000000000600000-0x0000000000612000-memory.dmp

Filesize
72KB

Download