dcrat | 0e1ea55667ec6d7ed658718be1528ce3f5e5ac464113e114a96379004137787b

Analysis

max time kernel
150s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
08-12-2024 12:47

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

голые фотографии акима.exe
Size

3.7MB
MD5

934f077da68d3fda26839f06286b71e4
SHA1

f805ec2e43d7518d420b94b954fd6b4e640ef64d
SHA256

0e1ea55667ec6d7ed658718be1528ce3f5e5ac464113e114a96379004137787b
SHA512

85e2bff55ce5aa6569d50146a3d95c611f774605fa9a8ee041cede3a928bf7585943e63aaf9eb5b14dc4d25fe6bee3e57d58c9b586653322300aaa67e87dd714
SSDEEP

49152:UbA30FDlon6ZtXRUNAtf3zkDcpigc4Jp8+bF5BxiLFHqzQ6yQH2lJwtYv2:UbZ7tXyNAtf3Rigc4n58xHqzQ6TH2Lel

Score

10^/10

dcrat discovery evasion infostealer rat trojan

Malware Config

Signatures

DcRat 21 IoCs

DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

rat infostealer dcrat

description	ioc	pid	Process
		4676	schtasks.exe
		756	schtasks.exe
		1736	schtasks.exe
		4628	schtasks.exe
		688	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language		голые фотографии акима.exe
		3468	schtasks.exe
		3464	schtasks.exe
		744	schtasks.exe
		3832	schtasks.exe
		4344	schtasks.exe
		2164	schtasks.exe
		5056	schtasks.exe
		436	schtasks.exe
		4964	schtasks.exe
		1224	schtasks.exe
		4348	schtasks.exe
File created	C:\Program Files\Microsoft Office\Office16\7a0fd90576e088		hyperblockDll.exe
File created	C:\Program Files\Common Files\cc11b995f2a76d		hyperblockDll.exe
		1116	schtasks.exe
		1252	schtasks.exe

Dcrat family
dcrat

Process spawned unexpected child process 18 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1736	1416	schtasks.exe	93
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2164	1416	schtasks.exe	93
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4676	1416	schtasks.exe	93
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1116	1416	schtasks.exe	93
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5056	1416	schtasks.exe	93
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	756	1416	schtasks.exe	93
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4964	1416	schtasks.exe	93
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	436	1416	schtasks.exe	93
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3468	1416	schtasks.exe	93
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3464	1416	schtasks.exe	93
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	744	1416	schtasks.exe	93
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3832	1416	schtasks.exe	93
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1252	1416	schtasks.exe	93
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1224	1416	schtasks.exe	93
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4628	1416	schtasks.exe	93
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4348	1416	schtasks.exe	93
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4344	1416	schtasks.exe	93
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	688	1416	schtasks.exe	93

UAC bypass 3 TTPs 15 IoCs

evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	hyperblockDll.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	hyperblockDll.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	RuntimeBroker.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	RuntimeBroker.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	RuntimeBroker.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	RuntimeBroker.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	hyperblockDll.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	hyperblockDll.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	hyperblockDll.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	RuntimeBroker.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	RuntimeBroker.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	hyperblockDll.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	RuntimeBroker.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	RuntimeBroker.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	RuntimeBroker.exe

DCRat payload 2 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral2/files/0x0007000000023c7f-15.dat	dcrat
behavioral2/memory/4800-17-0x0000000000F40000-0x00000000012AA000-memory.dmp	dcrat

Checks computer location settings 2 TTPs 7 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Control Panel\International\Geo\Nation	голые фотографии акима.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Control Panel\International\Geo\Nation	WScript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Control Panel\International\Geo\Nation	hyperblockDll.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Control Panel\International\Geo\Nation	hyperblockDll.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Control Panel\International\Geo\Nation	RuntimeBroker.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Control Panel\International\Geo\Nation	RuntimeBroker.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Control Panel\International\Geo\Nation	RuntimeBroker.exe

Executes dropped EXE 9 IoCs

pid	Process
4800	hyperblockDll.exe
4000	hyperblockDll.exe
1160	RuntimeBroker.exe
3836	RuntimeBroker.exe
3540	RuntimeBroker.exe
744	RuntimeBroker.exe
1500	RuntimeBroker.exe
680	RuntimeBroker.exe
3988	RuntimeBroker.exe

Checks whether UAC is enabled 1 TTPs 10 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	hyperblockDll.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	hyperblockDll.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	RuntimeBroker.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	RuntimeBroker.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	RuntimeBroker.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	RuntimeBroker.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	hyperblockDll.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	hyperblockDll.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	RuntimeBroker.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	RuntimeBroker.exe

Drops file in Program Files directory 10 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Microsoft Office\Office16\explorer.exe	hyperblockDll.exe
File created	C:\Program Files\Microsoft Office\Office16\7a0fd90576e088	hyperblockDll.exe
File created	C:\Program Files\Common Files\winlogon.exe	hyperblockDll.exe
File created	C:\Program Files\Common Files\cc11b995f2a76d	hyperblockDll.exe
File created	C:\Program Files\WindowsPowerShell\9e8d7a4ca61bd9	hyperblockDll.exe
File created	C:\Program Files\Microsoft Office\Office16\explorer.exe	hyperblockDll.exe
File created	C:\Program Files\WindowsApps\Microsoft.GetHelp_10.1706.13331.0_neutral_split.scale-100_8wekyb3d8bbwe\microsoft.system.package.metadata\conhost.exe	hyperblockDll.exe
File created	C:\Program Files (x86)\Common Files\Adobe\Reader\dwm.exe	hyperblockDll.exe
File created	C:\Program Files (x86)\Common Files\Adobe\Reader\6cb0b6c459d5d3	hyperblockDll.exe
File created	C:\Program Files\WindowsPowerShell\RuntimeBroker.exe	hyperblockDll.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	голые фотографии акима.exe

Modifies registry class 6 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000_Classes\Local Settings	RuntimeBroker.exe
Key created	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000_Classes\Local Settings	голые фотографии акима.exe
Key created	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000_Classes\Local Settings	hyperblockDll.exe
Key created	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000_Classes\Local Settings	hyperblockDll.exe
Key created	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000_Classes\Local Settings	RuntimeBroker.exe
Key created	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000_Classes\Local Settings	RuntimeBroker.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 18 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
5056	schtasks.exe
436	schtasks.exe
1224	schtasks.exe
4348	schtasks.exe
1736	schtasks.exe
2164	schtasks.exe
744	schtasks.exe
1252	schtasks.exe
4344	schtasks.exe
4676	schtasks.exe
756	schtasks.exe
4964	schtasks.exe
3464	schtasks.exe
4628	schtasks.exe
688	schtasks.exe
1116	schtasks.exe
3468	schtasks.exe
3832	schtasks.exe

Suspicious behavior: EnumeratesProcesses 45 IoCs

pid	Process
4800	hyperblockDll.exe
4800	hyperblockDll.exe
4800	hyperblockDll.exe
4800	hyperblockDll.exe
4800	hyperblockDll.exe
4800	hyperblockDll.exe
4800	hyperblockDll.exe
4800	hyperblockDll.exe
4800	hyperblockDll.exe
4000	hyperblockDll.exe
4000	hyperblockDll.exe
4000	hyperblockDll.exe
4000	hyperblockDll.exe
4000	hyperblockDll.exe
4000	hyperblockDll.exe
4000	hyperblockDll.exe
4000	hyperblockDll.exe
4000	hyperblockDll.exe
1160	RuntimeBroker.exe
1160	RuntimeBroker.exe
1160	RuntimeBroker.exe
1160	RuntimeBroker.exe
1160	RuntimeBroker.exe
1160	RuntimeBroker.exe
1160	RuntimeBroker.exe
1160	RuntimeBroker.exe
1160	RuntimeBroker.exe
3836	RuntimeBroker.exe
3836	RuntimeBroker.exe
3836	RuntimeBroker.exe
3836	RuntimeBroker.exe
3836	RuntimeBroker.exe
3836	RuntimeBroker.exe
3836	RuntimeBroker.exe
3836	RuntimeBroker.exe
3836	RuntimeBroker.exe
3540	RuntimeBroker.exe
3540	RuntimeBroker.exe
3540	RuntimeBroker.exe
3540	RuntimeBroker.exe
3540	RuntimeBroker.exe
3540	RuntimeBroker.exe
3540	RuntimeBroker.exe
3540	RuntimeBroker.exe
3540	RuntimeBroker.exe

Suspicious use of AdjustPrivilegeToken 9 IoCs

description	pid	Process
Token: SeDebugPrivilege	4800	hyperblockDll.exe
Token: SeDebugPrivilege	4000	hyperblockDll.exe
Token: SeDebugPrivilege	1160	RuntimeBroker.exe
Token: SeDebugPrivilege	3836	RuntimeBroker.exe
Token: SeDebugPrivilege	3540	RuntimeBroker.exe
Token: SeDebugPrivilege	744	RuntimeBroker.exe
Token: SeDebugPrivilege	1500	RuntimeBroker.exe
Token: SeDebugPrivilege	680	RuntimeBroker.exe
Token: SeDebugPrivilege	3988	RuntimeBroker.exe

Suspicious use of WriteProcessMemory 57 IoCs

description	pid	Process	procid_target
PID 4784 wrote to memory of 2720	4784	голые фотографии акима.exe	83
PID 4784 wrote to memory of 2720	4784	голые фотографии акима.exe	83
PID 4784 wrote to memory of 2720	4784	голые фотографии акима.exe	83
PID 4784 wrote to memory of 2072	4784	голые фотографии акима.exe	84
PID 4784 wrote to memory of 2072	4784	голые фотографии акима.exe	84
PID 4784 wrote to memory of 2072	4784	голые фотографии акима.exe	84
PID 2720 wrote to memory of 2512	2720	WScript.exe	87
PID 2720 wrote to memory of 2512	2720	WScript.exe	87
PID 2720 wrote to memory of 2512	2720	WScript.exe	87
PID 2512 wrote to memory of 4800	2512	cmd.exe	90
PID 2512 wrote to memory of 4800	2512	cmd.exe	90
PID 4800 wrote to memory of 1528	4800	hyperblockDll.exe	103
PID 4800 wrote to memory of 1528	4800	hyperblockDll.exe	103
PID 1528 wrote to memory of 3284	1528	cmd.exe	105
PID 1528 wrote to memory of 3284	1528	cmd.exe	105
PID 1528 wrote to memory of 4000	1528	cmd.exe	113
PID 1528 wrote to memory of 4000	1528	cmd.exe	113
PID 4000 wrote to memory of 680	4000	hyperblockDll.exe	123
PID 4000 wrote to memory of 680	4000	hyperblockDll.exe	123
PID 680 wrote to memory of 1352	680	cmd.exe	125
PID 680 wrote to memory of 1352	680	cmd.exe	125
PID 680 wrote to memory of 1160	680	cmd.exe	127
PID 680 wrote to memory of 1160	680	cmd.exe	127
PID 1160 wrote to memory of 1184	1160	RuntimeBroker.exe	129
PID 1160 wrote to memory of 1184	1160	RuntimeBroker.exe	129
PID 1160 wrote to memory of 1380	1160	RuntimeBroker.exe	130
PID 1160 wrote to memory of 1380	1160	RuntimeBroker.exe	130
PID 1160 wrote to memory of 3964	1160	RuntimeBroker.exe	132
PID 1160 wrote to memory of 3964	1160	RuntimeBroker.exe	132
PID 1380 wrote to memory of 3568	1380	cmd.exe	133
PID 1380 wrote to memory of 3568	1380	cmd.exe	133
PID 1184 wrote to memory of 3836	1184	WScript.exe	134
PID 1184 wrote to memory of 3836	1184	WScript.exe	134
PID 3836 wrote to memory of 3320	3836	RuntimeBroker.exe	136
PID 3836 wrote to memory of 3320	3836	RuntimeBroker.exe	136
PID 3836 wrote to memory of 3296	3836	RuntimeBroker.exe	137
PID 3836 wrote to memory of 3296	3836	RuntimeBroker.exe	137
PID 3836 wrote to memory of 5008	3836	RuntimeBroker.exe	139
PID 3836 wrote to memory of 5008	3836	RuntimeBroker.exe	139
PID 3296 wrote to memory of 4468	3296	cmd.exe	141
PID 3296 wrote to memory of 4468	3296	cmd.exe	141
PID 3320 wrote to memory of 3540	3320	WScript.exe	142
PID 3320 wrote to memory of 3540	3320	WScript.exe	142
PID 1380 wrote to memory of 744	1380	cmd.exe	143
PID 1380 wrote to memory of 744	1380	cmd.exe	143
PID 3540 wrote to memory of 216	3540	RuntimeBroker.exe	146
PID 3540 wrote to memory of 216	3540	RuntimeBroker.exe	146
PID 3540 wrote to memory of 2912	3540	RuntimeBroker.exe	145
PID 3540 wrote to memory of 2912	3540	RuntimeBroker.exe	145
PID 2912 wrote to memory of 4672	2912	cmd.exe	148
PID 2912 wrote to memory of 4672	2912	cmd.exe	148
PID 216 wrote to memory of 1500	216	WScript.exe	150
PID 216 wrote to memory of 1500	216	WScript.exe	150
PID 3296 wrote to memory of 680	3296	cmd.exe	152
PID 3296 wrote to memory of 680	3296	cmd.exe	152
PID 2912 wrote to memory of 3988	2912	cmd.exe	153
PID 2912 wrote to memory of 3988	2912	cmd.exe	153

System policy modification 1 TTPs 15 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	hyperblockDll.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	RuntimeBroker.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	RuntimeBroker.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	RuntimeBroker.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	RuntimeBroker.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	RuntimeBroker.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	hyperblockDll.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	hyperblockDll.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	hyperblockDll.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	RuntimeBroker.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	RuntimeBroker.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	hyperblockDll.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	hyperblockDll.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	RuntimeBroker.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	RuntimeBroker.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\голые фотографии акима.exe
"C:\Users\Admin\AppData\Local\Temp\голые фотографии акима.exe"
1⤵
- DcRat
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4784
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\BridgehyperchainportAgent\lcZ6MvLb.vbe"
  2⤵
  - Checks computer location settings
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2720
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\BridgehyperchainportAgent\akmRZ8KYIwqCrue04KkAUPxFzhoyZ.bat" "
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2512
  - - C:\BridgehyperchainportAgent\hyperblockDll.exe
      "C:\BridgehyperchainportAgent\hyperblockDll.exe"
      4⤵
      DcRat
      UAC bypass
      Checks computer location settings
      Executes dropped EXE
      Checks whether UAC is enabled
      Drops file in Program Files directory
      Modifies registry class
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      System policy modification
      PID:4800
    - - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\Rdf1ZkWNde.bat"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:1528
      - C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        6⤵
        
        PID:3284
      - C:\BridgehyperchainportAgent\hyperblockDll.exe
        
        "C:\BridgehyperchainportAgent\hyperblockDll.exe"
        6⤵
        UAC bypass
        Checks computer location settings
        Executes dropped EXE
        Checks whether UAC is enabled
        Drops file in Program Files directory
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        System policy modification
        
        PID:4000
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\HPJZN0gsBU.bat"
        7⤵
        Suspicious use of WriteProcessMemory
        
        PID:680
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        8⤵
        
        PID:1352
        
        C:\Program Files\WindowsPowerShell\RuntimeBroker.exe
        
        "C:\Program Files\WindowsPowerShell\RuntimeBroker.exe"
        8⤵
        UAC bypass
        Checks computer location settings
        Executes dropped EXE
        Checks whether UAC is enabled
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        System policy modification
        
        PID:1160
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\19d2a0dd-69ed-47a2-9ada-e6ef0654034f.vbs"
        9⤵
        Suspicious use of WriteProcessMemory
        
        PID:1184
        
        C:\Program Files\WindowsPowerShell\RuntimeBroker.exe
        
        "C:\Program Files\WindowsPowerShell\RuntimeBroker.exe"
        10⤵
        UAC bypass
        Checks computer location settings
        Executes dropped EXE
        Checks whether UAC is enabled
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        System policy modification
        
        PID:3836
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\69293216-2b3b-482f-997c-71ad0e23dee9.vbs"
        11⤵
        Suspicious use of WriteProcessMemory
        
        PID:3320
        
        C:\Program Files\WindowsPowerShell\RuntimeBroker.exe
        
        "C:\Program Files\WindowsPowerShell\RuntimeBroker.exe"
        12⤵
        UAC bypass
        Checks computer location settings
        Executes dropped EXE
        Checks whether UAC is enabled
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        System policy modification
        
        PID:3540
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\w0sePnjeqs.bat"
        13⤵
        Suspicious use of WriteProcessMemory
        
        PID:2912
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        14⤵
        
        PID:4672
        
        C:\Program Files\WindowsPowerShell\RuntimeBroker.exe
        
        "C:\Program Files\WindowsPowerShell\RuntimeBroker.exe"
        14⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:3988
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\9978cadf-63ec-49e5-b8d4-3c45ffddfc0c.vbs"
        13⤵
        Suspicious use of WriteProcessMemory
        
        PID:216
        
        C:\Program Files\WindowsPowerShell\RuntimeBroker.exe
        
        "C:\Program Files\WindowsPowerShell\RuntimeBroker.exe"
        14⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:1500
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\5wDdqOa6yG.bat"
        11⤵
        Suspicious use of WriteProcessMemory
        
        PID:3296
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        12⤵
        
        PID:4468
        
        C:\Program Files\WindowsPowerShell\RuntimeBroker.exe
        
        "C:\Program Files\WindowsPowerShell\RuntimeBroker.exe"
        12⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:680
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\487fe2e2-b685-409a-9e95-92a37ff9f600.vbs"
        11⤵
        
        PID:5008
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\XulrEiBG5n.bat"
        9⤵
        Suspicious use of WriteProcessMemory
        
        PID:1380
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        10⤵
        
        PID:3568
        
        C:\Program Files\WindowsPowerShell\RuntimeBroker.exe
        
        "C:\Program Files\WindowsPowerShell\RuntimeBroker.exe"
        10⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:744
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\1e287bf0-476a-4ca9-b5bd-c460655fbf20.vbs"
        9⤵
        
        PID:3964
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\BridgehyperchainportAgent\file.vbs"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2072

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 5 /tr "'C:\Program Files\Microsoft Office\Office16\explorer.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1736

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorer" /sc ONLOGON /tr "'C:\Program Files\Microsoft Office\Office16\explorer.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2164

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 14 /tr "'C:\Program Files\Microsoft Office\Office16\explorer.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4676

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 10 /tr "'C:\BridgehyperchainportAgent\wininit.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1116

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininit" /sc ONLOGON /tr "'C:\BridgehyperchainportAgent\wininit.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5056

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 12 /tr "'C:\BridgehyperchainportAgent\wininit.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:756

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 14 /tr "'C:\Program Files\Common Files\winlogon.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4964

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogon" /sc ONLOGON /tr "'C:\Program Files\Common Files\winlogon.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:436

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 11 /tr "'C:\Program Files\Common Files\winlogon.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3468

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 13 /tr "'C:\BridgehyperchainportAgent\conhost.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3464

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhost" /sc ONLOGON /tr "'C:\BridgehyperchainportAgent\conhost.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:744

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 9 /tr "'C:\BridgehyperchainportAgent\conhost.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3832

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 11 /tr "'C:\Program Files (x86)\Common Files\Adobe\Reader\dwm.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1252

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwm" /sc ONLOGON /tr "'C:\Program Files (x86)\Common Files\Adobe\Reader\dwm.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1224

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 14 /tr "'C:\Program Files (x86)\Common Files\Adobe\Reader\dwm.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4628

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 11 /tr "'C:\Program Files\WindowsPowerShell\RuntimeBroker.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4344

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Program Files\WindowsPowerShell\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4348

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 8 /tr "'C:\Program Files\WindowsPowerShell\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:688

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\BridgehyperchainportAgent\akmRZ8KYIwqCrue04KkAUPxFzhoyZ.bat

Filesize
48B

MD5
efb9b32455839f2f1e46065e13aeb93f

SHA1
cae49ccdd500a9808ac144387b15ad6ced46c036

SHA256
611d9c30bfabaaa6e9aee5c75025b71dca9116c45300ac325febeefe2d5b0e24

SHA512
351d053f36e497238add089f19e30f164c1110be7826d58e7fb71705b06a7d6d51789add692ac08af4c1e613e3f9c54789a5c8f707ad302a70bcd379645cff1c

Download Submit
C:\BridgehyperchainportAgent\file.vbs

Filesize
34B

MD5
677cc4360477c72cb0ce00406a949c61

SHA1
b679e8c3427f6c5fc47c8ac46cd0e56c9424de05

SHA256
f1cccb5ae4aa51d293bd3c7d2a1a04cb7847d22c5db8e05ac64e9a6d7455aa0b

SHA512
7cfe2cc92f9e659f0a15a295624d611b3363bd01eb5bcf9bc7681ea9b70b0564d192d570d294657c8dc2c93497fa3b4526c975a9bf35d69617c31d9936573c6a

Download Submit
C:\BridgehyperchainportAgent\hyperblockDll.exe

Filesize
3.4MB

MD5
df6d3aff42df48d0830227cae92e6bd6

SHA1
bf7f75fd82694b2a44098df2b28c2db35e7ea142

SHA256
05b5df5bc84e193fba3aa26d1b20cb81faa7b176a24a8df2238c8ed61e6e583a

SHA512
07163831729582397fdbdcef5d921750b2968b9d555fd0b881913ae1b283573e4efc827d0eb51552882743b541e44ff2a8dbf0d99a4e5c3f47228a4536bab64a

Download Submit
C:\BridgehyperchainportAgent\lcZ6MvLb.vbe

Filesize
231B

MD5
05a47a3e17c29bf5b8bc6949a26ccb44

SHA1
87e896625a30943a252a839ba3e22507422bbb04

SHA256
85f873ac1def74dea8180c0cce0084490505d2bc213abf34d3a95fda4b92c63f

SHA512
72ef9bb092cfbc824341aa0075ee594b410e9afea3a8ae40c0f1743a4cb2528005701099ef156dc0f2a2da4474809f1d5995e01d12c6ac36f0cc7ae6baf8f64b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\hyperblockDll.exe.log

Filesize
1KB

MD5
655010c15ea0ca05a6e5ddcd84986b98

SHA1
120bf7e516aeed462c07625fbfcdab5124ad05d3

SHA256
2b1ffeab025cc7c61c50e3e2e4c9253046d9174cf00181a8c1de733a4c0daa14

SHA512
e52c26718d7d1e979837b5ac626dde26920fe7413b8aa7be6f1be566a1b0f035582f4d313400e3ad6b92552abb1dfaf186b60b875fb955a2a94fd839fe841437

Download Submit
C:\Users\Admin\AppData\Local\Temp\19d2a0dd-69ed-47a2-9ada-e6ef0654034f.vbs

Filesize
728B

MD5
564bc242dc4560a85b778cf6caa40dba

SHA1
cd0e622b960850ba3f01e61ba66f812d3c2e55c3

SHA256
081b703bc90ec420a2cd052e11fbccf60686c7b6167e7c84b15cdd8c154f697c

SHA512
ffae429192aa577f2c3b8725ad10f1d8e1559055c438b3aaf44f555ab5d656503d941988c99d62cd4ccf67b8c7d3b7995b1d2b9849930384fa7172e71b844b12

Download Submit
C:\Users\Admin\AppData\Local\Temp\1e287bf0-476a-4ca9-b5bd-c460655fbf20.vbs

Filesize
504B

MD5
240f46f466fc4eef99b78818de7ac25d

SHA1
20fd6f26bf284ba4b311d5b0530bfe6a30cc46ef

SHA256
219407dd1d745a992ce0b18a6806a0749679ce8058c928e5964fd021b58ee787

SHA512
03ae9204dda023be227e475d042652764dcc172003d304cd1c0ca1fcbb2a4a950de82d5260bd56ee5f574cb223c44590209e6eb802944c94a240b2737f4f0f32

Download Submit
C:\Users\Admin\AppData\Local\Temp\5wDdqOa6yG.bat

Filesize
217B

MD5
4402387d8634dde4c70b2e226f0b9865

SHA1
a0000317bc12f9bc7da969b7f00e5eb1c46031fb

SHA256
5a8c72ba25e19ac8d71abad06b9a485effbf884b854d38a8ee52d3cabedfde14

SHA512
765cf87ad5bf0e0d3e0284665f145f27ac29b788cc301e076534ea65b5e765c0f79bd2adcb1ffea0ad946a7d003575de2921dd06a36786a364ccd49298420170

Download Submit
C:\Users\Admin\AppData\Local\Temp\69293216-2b3b-482f-997c-71ad0e23dee9.vbs

Filesize
728B

MD5
41827c3ed848ca5123317bf9c40bb64d

SHA1
9cf5a8560ad9639b8548c547d270c2ac0e1ee14c

SHA256
0864d509d20d6d403fe3a32fffc9a1514908063c42675aaf0da3a44e16ec5bbb

SHA512
beb382c3e23bcfcec17bd632130a91987e4db5b7344cfdbead1f96d2d4d3d7dcab6f734324ba77bb6e31be0469989301962ea993d78259f2dc6aa25a023ac42a

Download Submit
C:\Users\Admin\AppData\Local\Temp\9978cadf-63ec-49e5-b8d4-3c45ffddfc0c.vbs

Filesize
728B

MD5
924e093b33920b3223525fec391544da

SHA1
2ec59432920db9b8765f047136b5bb0d39d64a96

SHA256
47598b90ed308fce46183ab3d267e002ad900265fa2571b30d3b4b6b88e350ab

SHA512
a9386d88d2819bb91ca5f21842174213be1840afabbc2ae63d420fde16193b3dc482f7aaf6118a8610bb2d3e2c97be9d4ee61880c4dfca2d86110bc4ec9b1797

Download Submit
C:\Users\Admin\AppData\Local\Temp\HPJZN0gsBU.bat

Filesize
217B

MD5
81d819e1992921d10e7c2a66890a42d3

SHA1
1e59984e8c30fffd2fe78f09f07fc07c2beb1008

SHA256
983e7a452145b18a575a7fcec5cd04d1a385582115e42bcdc6a23966ca4b22d9

SHA512
fb10904f45c802f0ab0cad95d2dfd82689caaac86735fae3a3133c77b537b750d84b40f48e2b5776a75dca381a47948ec51e970f02cb8ba2c7591e696ec32551

Download Submit
C:\Users\Admin\AppData\Local\Temp\Rdf1ZkWNde.bat

Filesize
211B

MD5
04abcc64b7b6b7a3f813dbc114e8f947

SHA1
5224963e85c685e45ba72802460992a28ec71b82

SHA256
33de333f4ea8f01e6a06e9b5a003c81e6b163139be50ea28fe010dd6ff75714f

SHA512
e59d42cae2ff56ea6c4cc0d0b71b52a340fd879643636c8fa705b92baf508584058a8ae4d58e0665fa7abcd2dcf1f00f8143c984101f4016f329982c430aef69

Download Submit
C:\Users\Admin\AppData\Local\Temp\XulrEiBG5n.bat

Filesize
217B

MD5
2dbb4dfd25287da3618f4343fdb25ac1

SHA1
cc2cdab04bc3595259dc9b9736f24cca5132a95b

SHA256
a029468f91b67523ab7a5f7e6cd30fb73481112bbdaf967140ac7fd7b1125b6b

SHA512
260f15f8abd51db388110cb6d3a8a70ab687385e46e2349c43f03c3f24b1ee33cc39eb15e23e76fab1b848177e1c4b368927d5cf74f81ccb14cabd37609a57fb

Download Submit
C:\Users\Admin\AppData\Local\Temp\w0sePnjeqs.bat

Filesize
217B

MD5
a9dd00df6beac0bdf04f8b9c67b33e01

SHA1
4fa6af991a66867d98d21beb74ca1158696b7126

SHA256
eece7b93ef2118f7d6caea571dad23889aa24d1dc49f560b875a0fc52ba0bb41

SHA512
675f5d70bc5d6f7724703a71ee02831c0431dec3738b69132c5edf76469e4336992d634e60e583a2e1fbbc0717bb00ac72fc7fbee23cea18d8080eaf8dc46b74

Download Submit
memory/1160-84-0x000000001D3F0000-0x000000001D402000-memory.dmp

Filesize
72KB

Download
memory/3540-129-0x000000001E8A0000-0x000000001E941000-memory.dmp

Filesize
644KB

Download
memory/4000-69-0x000000001C4E0000-0x000000001C4F2000-memory.dmp

Filesize
72KB

Download
memory/4800-36-0x000000001C780000-0x000000001C788000-memory.dmp

Filesize
32KB

Download
memory/4800-46-0x000000001C920000-0x000000001C92A000-memory.dmp

Filesize
40KB

Download
memory/4800-29-0x000000001C560000-0x000000001C568000-memory.dmp

Filesize
32KB

Download
memory/4800-30-0x000000001C590000-0x000000001C5A0000-memory.dmp

Filesize
64KB

Download
memory/4800-31-0x000000001C6F0000-0x000000001C6FA000-memory.dmp

Filesize
40KB

Download
memory/4800-32-0x000000001C700000-0x000000001C756000-memory.dmp

Filesize
344KB

Download
memory/4800-33-0x000000001C750000-0x000000001C75C000-memory.dmp

Filesize
48KB

Download
memory/4800-34-0x000000001C760000-0x000000001C768000-memory.dmp

Filesize
32KB

Download
memory/4800-35-0x000000001C770000-0x000000001C77C000-memory.dmp

Filesize
48KB

Download
memory/4800-24-0x000000001BF10000-0x000000001BF20000-memory.dmp

Filesize
64KB

Download
memory/4800-37-0x000000001C790000-0x000000001C7A2000-memory.dmp

Filesize
72KB

Download
memory/4800-38-0x000000001CCF0000-0x000000001D218000-memory.dmp

Filesize
5.2MB

Download
memory/4800-39-0x000000001C7C0000-0x000000001C7CC000-memory.dmp

Filesize
48KB

Download
memory/4800-40-0x000000001C7D0000-0x000000001C7DC000-memory.dmp

Filesize
48KB

Download
memory/4800-42-0x000000001C7F0000-0x000000001C7FC000-memory.dmp

Filesize
48KB

Download
memory/4800-41-0x000000001C7E0000-0x000000001C7E8000-memory.dmp

Filesize
32KB

Download
memory/4800-43-0x000000001C800000-0x000000001C80C000-memory.dmp

Filesize
48KB

Download
memory/4800-44-0x000000001CA80000-0x000000001CA88000-memory.dmp

Filesize
32KB

Download
memory/4800-45-0x000000001C910000-0x000000001C91C000-memory.dmp

Filesize
48KB

Download
memory/4800-28-0x000000001C580000-0x000000001C58C000-memory.dmp

Filesize
48KB

Download
memory/4800-48-0x000000001CA40000-0x000000001CA48000-memory.dmp

Filesize
32KB

Download
memory/4800-47-0x000000001C930000-0x000000001C93E000-memory.dmp

Filesize
56KB

Download
memory/4800-49-0x000000001CA50000-0x000000001CA5E000-memory.dmp

Filesize
56KB

Download
memory/4800-51-0x000000001CA70000-0x000000001CA7C000-memory.dmp

Filesize
48KB

Download
memory/4800-50-0x000000001CA60000-0x000000001CA68000-memory.dmp

Filesize
32KB

Download
memory/4800-27-0x000000001C570000-0x000000001C582000-memory.dmp

Filesize
72KB

Download
memory/4800-26-0x000000001C550000-0x000000001C558000-memory.dmp

Filesize
32KB

Download
memory/4800-25-0x000000001BF20000-0x000000001BF36000-memory.dmp

Filesize
88KB

Download
memory/4800-23-0x000000001BF00000-0x000000001BF08000-memory.dmp

Filesize
32KB

Download
memory/4800-22-0x000000001C5A0000-0x000000001C5F0000-memory.dmp

Filesize
320KB

Download
memory/4800-21-0x000000001BEE0000-0x000000001BEFC000-memory.dmp

Filesize
112KB

Download
memory/4800-20-0x000000001BED0000-0x000000001BED8000-memory.dmp

Filesize
32KB

Download
memory/4800-19-0x00000000035A0000-0x00000000035AE000-memory.dmp

Filesize
56KB

Download
memory/4800-18-0x0000000003590000-0x000000000359E000-memory.dmp

Filesize
56KB

Download
memory/4800-17-0x0000000000F40000-0x00000000012AA000-memory.dmp

Filesize
3.4MB

Download
memory/4800-52-0x000000001CA90000-0x000000001CA98000-memory.dmp

Filesize
32KB

Download
memory/4800-54-0x000000001CAB0000-0x000000001CABC000-memory.dmp

Filesize
48KB

Download
memory/4800-53-0x000000001CAA0000-0x000000001CAAA000-memory.dmp

Filesize
40KB

Download