1ef6c1a4dfdc39b63bfe650ca81ab89510de6c0d3d7c608ac5be80033e559326

Analysis

max time kernel
46s
max time network
46s
platform
windows10-ltsc 2021_x64
resource
win10ltsc2021-20241023-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20241023-enlocale:en-usos:windows10-ltsc 2021-x64system
submitted
24-12-2024 14:49

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

dControl.exe
Size

447KB
MD5

58008524a6473bdf86c1040a9a9e39c3
SHA1

cb704d2e8df80fd3500a5b817966dc262d80ddb8
SHA256

1ef6c1a4dfdc39b63bfe650ca81ab89510de6c0d3d7c608ac5be80033e559326
SHA512

8cf492584303523bf6cdfeb6b1b779ee44471c91e759ce32fd4849547b6245d4ed86af5b38d1c6979729a77f312ba91c48207a332ae1589a6e25de67ffb96c31
SSDEEP

6144:Vzv+kSn74iCmfianQGDM3OXTWRDy9GYQDUmJFXIXHrsUBnBTF8JJCYrYNsQJzfgu:Vzcn7EanlQiWtYhmJFSwUBLcQZfgiD

Score

10^/10

defense_evasion discovery evasion execution persistence trojan upx

Malware Config

Signatures

Modifies Windows Defender Real-time Protection settings 3 TTPs 1 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

description	ioc	Process
Key deleted	\REGISTRY\MACHINE\SOFTWARE\POLICIES\MICROSOFT\WINDOWS DEFENDER\REAL-TIME PROTECTION	dControl.exe

Modifies security service 2 TTPs 2 IoCs

evasion

Modify Registry

T1112

Windows Service

T1543.003

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\WinDefend\Start = "2"	dControl.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\WinDefend\Start = "4"	dControl.exe

Downloads MZ/PE file

Event Triggered Execution: Image File Execution Options Injection 1 TTPs 2 IoCs

persistence

Image File Execution Options Injection

T1546.012

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mpcmdrun.exe	dControl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mpcmdrun.exe\Debugger = "C:\\Windows\\System32\\systray.exe"	dControl.exe

Windows security modification 2 TTPs 4 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\DisableAntiVirus = "1"	dControl.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Real-Time Protection	dControl.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	dControl.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\DisableAntiSpyware = "1"	dControl.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WindowsDefender = "\"%ProgramFiles%\\Windows Defender\\MSASCuiL.exe\""	MsMpEng.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
5584	powershell.exe

Modifies Security services 2 TTPs 6 IoCs

Modifies the startup behavior of a security service.

defense_evasion

Modify Registry

T1112

Impair Defenses

T1562

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\WdNisSvc\Start = "3"	dControl.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\WdFilter\Start = "4"	dControl.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\WdNisDrv\Start = "4"	dControl.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\WdNisSvc\Start = "4"	dControl.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\WdFilter\Start = "0"	dControl.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\WdNisDrv\Start = "3"	dControl.exe

AutoIT Executable 5 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
behavioral1/memory/2488-22-0x0000000000400000-0x00000000004CD000-memory.dmp	autoit_exe
behavioral1/memory/3456-44-0x0000000000400000-0x00000000004CD000-memory.dmp	autoit_exe
behavioral1/memory/3780-107-0x0000000000400000-0x00000000004CD000-memory.dmp	autoit_exe
behavioral1/memory/3780-396-0x0000000000400000-0x00000000004CD000-memory.dmp	autoit_exe
behavioral1/memory/3292-398-0x0000000000400000-0x00000000004CD000-memory.dmp	autoit_exe

Drops file in System32 directory 5 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\GroupPolicy\gpt.ini	dControl.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log	powershell.exe
File opened for modification	C:\Windows\System32\GroupPolicy\Machine\Registry.pol	dControl.exe
File created	C:\Windows\System32\GroupPolicy\Machine\Registry.pol	dControl.exe

UPX packed file 6 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2488-0-0x0000000000400000-0x00000000004CD000-memory.dmp	upx
behavioral1/memory/2488-22-0x0000000000400000-0x00000000004CD000-memory.dmp	upx
behavioral1/memory/3456-44-0x0000000000400000-0x00000000004CD000-memory.dmp	upx
behavioral1/memory/3780-107-0x0000000000400000-0x00000000004CD000-memory.dmp	upx
behavioral1/memory/3780-396-0x0000000000400000-0x00000000004CD000-memory.dmp	upx
behavioral1/memory/3292-398-0x0000000000400000-0x00000000004CD000-memory.dmp	upx

Drops file in Windows directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\logs\StorGroupPolicy.log	svchost.exe
File opened for modification	C:\Windows\SERVIC~1\NETWOR~1\AppData\Local\Temp\MpCmdRun.log	MpCmdRun.exe
File opened for modification	C:\Windows\SERVIC~1\NETWOR~1\AppData\Local\Temp\MpCmdRun.log	MpCmdRun.exe
File created	C:\Windows\SERVIC~1\NETWOR~1\AppData\Local\Temp\MpCmdRun-2C-53C9D589-6B66-4F30-9BAB-9A0193B0BAFC.lock	MpCmdRun.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dControl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dControl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dControl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dControl.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	MsMpEng.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	MsMpEng.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	MsMpEng.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	MsMpEng.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows Defender	MsMpEng.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	MsMpEng.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	MsMpEng.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	MsMpEng.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	MsMpEng.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	MsMpEng.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	MsMpEng.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	MsMpEng.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	MsMpEng.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	MsMpEng.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	MsMpEng.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	MsMpEng.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	MsMpEng.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	MsMpEng.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	MsMpEng.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	MsMpEng.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	MsMpEng.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	MsMpEng.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	MsMpEng.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	MsMpEng.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	MsMpEng.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	MsMpEng.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	MsMpEng.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	MsMpEng.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	MsMpEng.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	MsMpEng.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	MsMpEng.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	MsMpEng.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	powershell.exe

Modifies registry class 3 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Drive\shellex\ContextMenuHandlers\EPP\ = "{09A47860-11B0-4DA5-AFA5-26D86198A780}"	MsMpEng.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shellex\ContextMenuHandlers\EPP\ = "{09A47860-11B0-4DA5-AFA5-26D86198A780}"	MsMpEng.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\EPP\ = "{09A47860-11B0-4DA5-AFA5-26D86198A780}"	MsMpEng.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2488	dControl.exe
2488	dControl.exe
2488	dControl.exe
2488	dControl.exe
2488	dControl.exe
2488	dControl.exe
3456	dControl.exe
3456	dControl.exe
3456	dControl.exe
3456	dControl.exe
3456	dControl.exe
3456	dControl.exe
3292	dControl.exe
3292	dControl.exe
3292	dControl.exe
3292	dControl.exe
3292	dControl.exe
3292	dControl.exe
3292	dControl.exe
3292	dControl.exe
3292	dControl.exe
3292	dControl.exe
3292	dControl.exe
3292	dControl.exe
3780	dControl.exe
3780	dControl.exe
3780	dControl.exe
3780	dControl.exe
3780	dControl.exe
3780	dControl.exe
3292	dControl.exe
3292	dControl.exe
3292	dControl.exe
3292	dControl.exe
5584	powershell.exe
5584	powershell.exe
3292	dControl.exe
3292	dControl.exe
5584	powershell.exe
3292	dControl.exe
3292	dControl.exe
3292	dControl.exe
3292	dControl.exe
3292	dControl.exe
3292	dControl.exe
3292	dControl.exe
3292	dControl.exe
3292	dControl.exe
3292	dControl.exe
3292	dControl.exe
3292	dControl.exe
3292	dControl.exe
3292	dControl.exe
3292	dControl.exe
3292	dControl.exe
3292	dControl.exe
3292	dControl.exe
3292	dControl.exe
3292	dControl.exe
3292	dControl.exe
3292	dControl.exe
3292	dControl.exe
3292	dControl.exe
3292	dControl.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3292	dControl.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
688	Process not Found
3952	MsMpEng.exe

Suspicious use of AdjustPrivilegeToken 41 IoCs

description	pid	Process
Token: SeDebugPrivilege	2488	dControl.exe
Token: SeAssignPrimaryTokenPrivilege	2488	dControl.exe
Token: SeIncreaseQuotaPrivilege	2488	dControl.exe
Token: 0	2488	dControl.exe
Token: SeDebugPrivilege	3456	dControl.exe
Token: SeAssignPrimaryTokenPrivilege	3456	dControl.exe
Token: SeIncreaseQuotaPrivilege	3456	dControl.exe
Token: SeAssignPrimaryTokenPrivilege	3952	MsMpEng.exe
Token: SeIncreaseQuotaPrivilege	3952	MsMpEng.exe
Token: SeTcbPrivilege	3952	MsMpEng.exe
Token: SeSecurityPrivilege	3952	MsMpEng.exe
Token: SeTakeOwnershipPrivilege	3952	MsMpEng.exe
Token: SeLoadDriverPrivilege	3952	MsMpEng.exe
Token: SeIncBasePriorityPrivilege	3952	MsMpEng.exe
Token: SeBackupPrivilege	3952	MsMpEng.exe
Token: SeRestorePrivilege	3952	MsMpEng.exe
Token: SeShutdownPrivilege	3952	MsMpEng.exe
Token: SeDebugPrivilege	3952	MsMpEng.exe
Token: SeSystemEnvironmentPrivilege	3952	MsMpEng.exe
Token: SeChangeNotifyPrivilege	3952	MsMpEng.exe
Token: SeImpersonatePrivilege	3952	MsMpEng.exe
Token: SeDebugPrivilege	3292	dControl.exe
Token: SeAssignPrimaryTokenPrivilege	3292	dControl.exe
Token: SeIncreaseQuotaPrivilege	3292	dControl.exe
Token: 0	3292	dControl.exe
Token: SeDebugPrivilege	3952	MsMpEng.exe
Token: SeBackupPrivilege	3952	MsMpEng.exe
Token: SeRestorePrivilege	3952	MsMpEng.exe
Token: SeDebugPrivilege	5584	powershell.exe
Token: SeAssignPrimaryTokenPrivilege	5584	powershell.exe
Token: SeIncreaseQuotaPrivilege	5584	powershell.exe
Token: SeSecurityPrivilege	5584	powershell.exe
Token: SeTakeOwnershipPrivilege	5584	powershell.exe
Token: SeLoadDriverPrivilege	5584	powershell.exe
Token: SeSystemtimePrivilege	5584	powershell.exe
Token: SeBackupPrivilege	5584	powershell.exe
Token: SeRestorePrivilege	5584	powershell.exe
Token: SeShutdownPrivilege	5584	powershell.exe
Token: SeSystemEnvironmentPrivilege	5584	powershell.exe
Token: SeUndockPrivilege	5584	powershell.exe
Token: SeManageVolumePrivilege	5584	powershell.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
3292	dControl.exe
3292	dControl.exe
3292	dControl.exe
3292	dControl.exe
3292	dControl.exe
3292	dControl.exe
3292	dControl.exe
3292	dControl.exe
3292	dControl.exe
3292	dControl.exe
3292	dControl.exe
3292	dControl.exe
3292	dControl.exe
3292	dControl.exe
3292	dControl.exe
396	SecurityHealthSystray.exe
396	SecurityHealthSystray.exe
396	SecurityHealthSystray.exe
396	SecurityHealthSystray.exe
3292	dControl.exe
3292	dControl.exe
3292	dControl.exe
3292	dControl.exe
3292	dControl.exe
3292	dControl.exe
3292	dControl.exe
3292	dControl.exe
3292	dControl.exe
3292	dControl.exe
3292	dControl.exe
3292	dControl.exe
3292	dControl.exe
3292	dControl.exe
3292	dControl.exe
3292	dControl.exe
3292	dControl.exe
3292	dControl.exe
3292	dControl.exe
3292	dControl.exe
3292	dControl.exe
3292	dControl.exe
3292	dControl.exe
3292	dControl.exe
3292	dControl.exe
3292	dControl.exe
3292	dControl.exe
3292	dControl.exe
3292	dControl.exe
3292	dControl.exe
3292	dControl.exe
3292	dControl.exe
3292	dControl.exe
3292	dControl.exe
3292	dControl.exe
3292	dControl.exe
3292	dControl.exe
3292	dControl.exe
3292	dControl.exe
3292	dControl.exe
3292	dControl.exe
3292	dControl.exe
3292	dControl.exe
3292	dControl.exe
3292	dControl.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
3292	dControl.exe
3292	dControl.exe
3292	dControl.exe
3292	dControl.exe
3292	dControl.exe
3292	dControl.exe
3292	dControl.exe
3292	dControl.exe
3292	dControl.exe
3292	dControl.exe
3292	dControl.exe
3292	dControl.exe
3292	dControl.exe
3292	dControl.exe
3292	dControl.exe
396	SecurityHealthSystray.exe
396	SecurityHealthSystray.exe
396	SecurityHealthSystray.exe
3292	dControl.exe
3292	dControl.exe
3292	dControl.exe
3292	dControl.exe
3292	dControl.exe
3292	dControl.exe
3292	dControl.exe
3292	dControl.exe
3292	dControl.exe
3292	dControl.exe
3292	dControl.exe
3292	dControl.exe
3292	dControl.exe
3292	dControl.exe
3292	dControl.exe
3292	dControl.exe
3292	dControl.exe
3292	dControl.exe
3292	dControl.exe
3292	dControl.exe
3292	dControl.exe
3292	dControl.exe
3292	dControl.exe
3292	dControl.exe
3292	dControl.exe
3292	dControl.exe
3292	dControl.exe
3292	dControl.exe
3292	dControl.exe
3292	dControl.exe
3292	dControl.exe
3292	dControl.exe
3292	dControl.exe
3292	dControl.exe
3292	dControl.exe
3292	dControl.exe
3292	dControl.exe
3292	dControl.exe
3292	dControl.exe
3292	dControl.exe
3292	dControl.exe
3292	dControl.exe
3292	dControl.exe
3292	dControl.exe
3292	dControl.exe
3292	dControl.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4020	SecHealthUI.exe
5176	SecHealthUI.exe

Suspicious use of WriteProcessMemory 17 IoCs

description	pid	Process	procid_target
PID 3292 wrote to memory of 3780	3292	dControl.exe	92
PID 3292 wrote to memory of 3780	3292	dControl.exe	92
PID 3292 wrote to memory of 3780	3292	dControl.exe	92
PID 3292 wrote to memory of 2264	3292	dControl.exe	93
PID 3292 wrote to memory of 2264	3292	dControl.exe	93
PID 3816 wrote to memory of 396	3816	explorer.exe	97
PID 3816 wrote to memory of 396	3816	explorer.exe	97
PID 3952 wrote to memory of 1808	3952	MsMpEng.exe	98
PID 3952 wrote to memory of 1808	3952	MsMpEng.exe	98
PID 3952 wrote to memory of 2384	3952	MsMpEng.exe	100
PID 3952 wrote to memory of 2384	3952	MsMpEng.exe	100
PID 1808 wrote to memory of 3124	1808	MpCmdRun.exe	101
PID 1808 wrote to memory of 3124	1808	MpCmdRun.exe	101
PID 3952 wrote to memory of 2348	3952	MsMpEng.exe	102
PID 3952 wrote to memory of 2348	3952	MsMpEng.exe	102
PID 3292 wrote to memory of 5584	3292	dControl.exe	123
PID 3292 wrote to memory of 5584	3292	dControl.exe	123

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\dControl.exe
"C:\Users\Admin\AppData\Local\Temp\dControl.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2488
- C:\Users\Admin\AppData\Local\Temp\dControl.exe
  C:\Users\Admin\AppData\Local\Temp\dControl.exe
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3456
- - C:\Users\Admin\AppData\Local\Temp\dControl.exe
    "C:\Users\Admin\AppData\Local\Temp\dControl.exe" /TI
    3⤵
    - Modifies Windows Defender Real-time Protection settings
    - Modifies security service
    - Event Triggered Execution: Image File Execution Options Injection
    - Windows security modification
    - Modifies Security services
    - Drops file in System32 directory
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    - Suspicious use of WriteProcessMemory
    PID:3292
  - - C:\Windows\Explorer.exe
      "C:\Windows\Explorer.exe" C:\Windows\System32\SecurityHealthSystray.exe
      4⤵
      PID:4576
  - - C:\Users\Admin\AppData\Local\Temp\dControl.exe
      "C:\Users\Admin\AppData\Local\Temp\dControl.exe" /EXP |3656|
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      PID:3780
  - - C:\Program Files\Windows Defender\mpcmdrun.exe
      "C:\Program Files\Windows Defender\mpcmdrun.exe" -wdenable
      4⤵
      PID:2264
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -NoLogo -NoProfile -NonInteractive -Command Set-MpPreference -DisableRealtimeMonitoring 1
      4⤵
      Command and Scripting Interpreter: PowerShell
      Drops file in System32 directory
      Modifies data under HKEY_USERS
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:5584

C:\Program Files\Windows Defender\MsMpEng.exe
"C:\Program Files\Windows Defender\MsMpEng.exe"
1⤵
- Adds Run key to start application
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: LoadsDriver
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3952
- C:\Program Files\Windows Defender\MpCmdRun.exe
  "C:\Program Files\Windows Defender\MpCmdRun.exe" SignatureUpdate -ScheduleJob -RestrictPrivileges
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1808
- - C:\Program Files\Windows Defender\MpCmdRun.exe
    "C:\Program Files\Windows Defender\MpCmdRun.exe" SignatureUpdate -ScheduleJob -RestrictPrivileges -Reinvoke
    3⤵
    - Drops file in Windows directory
    PID:3124
- C:\Program Files\Windows Defender\MpCmdRun.exe
  "C:\Program Files\Windows Defender\MpCmdRun.exe" GetDeviceTicket -AccessKey E884C1A6-B83C-C90B-0C05-DB8FD873A104
  2⤵
  - Drops file in Windows directory
  PID:2384
- C:\Program Files\Windows Defender\MpCmdRun.exe
  "C:\Program Files\Windows Defender\MpCmdRun.exe" SignaturesUpdateService -ScheduleJob -UnmanagedUpdate
  2⤵
  PID:2348

C:\Windows\system32\gpscript.exe
gpscript.exe /RefreshSystemParam
1⤵
PID:4124

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc
1⤵
PID:4964

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -s WPDBusEnum
1⤵
- Drops file in Windows directory
PID:4700

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Suspicious use of WriteProcessMemory
PID:3816
- C:\Windows\System32\SecurityHealthSystray.exe
  "C:\Windows\System32\SecurityHealthSystray.exe"
  2⤵
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  PID:396

C:\Windows\SystemApps\Microsoft.Windows.SecHealthUI_cw5n1h2txyewy\SecHealthUI.exe
"C:\Windows\SystemApps\Microsoft.Windows.SecHealthUI_cw5n1h2txyewy\SecHealthUI.exe" -ServerName:SecHealthUI.AppXep4x2tbtjws1v9qqs0rmb3hxykvkpqtn.mca
1⤵
- Suspicious use of SetWindowsHookEx
PID:4020

C:\Windows\System32\SecurityHealthHost.exe
C:\Windows\System32\SecurityHealthHost.exe {E041C90B-68BA-42C9-991E-477B73A75C90} -Embedding
1⤵
PID:236

C:\Windows\System32\SecurityHealthHost.exe
C:\Windows\System32\SecurityHealthHost.exe {E041C90B-68BA-42C9-991E-477B73A75C90} -Embedding
1⤵
PID:1524

C:\Windows\System32\SecurityHealthHost.exe
C:\Windows\System32\SecurityHealthHost.exe {E041C90B-68BA-42C9-991E-477B73A75C90} -Embedding
1⤵
PID:4392

C:\Windows\system32\gpscript.exe
gpscript.exe /RefreshSystemParam
1⤵
PID:5912

C:\Windows\SystemApps\Microsoft.Windows.SecHealthUI_cw5n1h2txyewy\SecHealthUI.exe
"C:\Windows\SystemApps\Microsoft.Windows.SecHealthUI_cw5n1h2txyewy\SecHealthUI.exe" -ServerName:SecHealthUI.AppXep4x2tbtjws1v9qqs0rmb3hxykvkpqtn.mca
1⤵
- Suspicious use of SetWindowsHookEx
PID:5176

C:\Windows\System32\SecurityHealthHost.exe
C:\Windows\System32\SecurityHealthHost.exe {E041C90B-68BA-42C9-991E-477B73A75C90} -Embedding
1⤵
PID:5012

C:\Windows\System32\SecurityHealthHost.exe
C:\Windows\System32\SecurityHealthHost.exe {E041C90B-68BA-42C9-991E-477B73A75C90} -Embedding
1⤵
PID:1240

C:\Windows\System32\SecurityHealthHost.exe
C:\Windows\System32\SecurityHealthHost.exe {E041C90B-68BA-42C9-991E-477B73A75C90} -Embedding
1⤵
PID:5492

C:\Windows\system32\gpscript.exe
gpscript.exe /RefreshSystemParam
1⤵
PID:416

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc
1⤵
PID:3200

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Image File Execution Options Injection

T1546.012

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Image File Execution Options Injection

T1546.012

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\dControl.ini

Filesize
2KB

MD5
9e5af2ec82c24bcaa37d3c1d68513a4a

SHA1
1df08674726a93588e5029bb911d8a3563f7df42

SHA256
e633da0c232169ee6dc5595cf9a004fc2779da90b3d9a665db74e14d639266c4

SHA512
def42a3ea106cbb7661077b86c2fdeec598d453b27b2e30e1a0053af03eb69b1b6f7877ae7b902349d5d733864a48dc781d563e0bf6460a4e7dcb20fd206767a

Download Submit
C:\Windows\SERVIC~1\NETWOR~1\AppData\Local\Temp\MpCmdRun.log

Filesize
3KB

MD5
ddeb01880a6e5b286cfb73d4b1b4e91d

SHA1
1f3baa3741d028ea4cac89d27b3c23897cb136f8

SHA256
bf184df2875979f25d1df737b4897379d00e44add7a2dc0ba9701e2d1c75f907

SHA512
b8b4c5fc1903a58aa2882b48a35dea5bf595a263672840e433f25da50f524aaf624ab3b7a74c900c0327c7ead27adc61949405b7fcb464a5af5e4c902b21398f

Download Submit
C:\Windows\System32\GroupPolicy\gpt.ini

Filesize
233B

MD5
cd4326a6fd01cd3ca77cfd8d0f53821b

SHA1
a1030414d1f8e5d5a6e89d5a309921b8920856f9

SHA256
1c59482111e657ef5190e22de6c047609a67e46e28d67fd70829882fd8087a9c

SHA512
29ce5532fb3adf55caa011e53736507fbf241afee9d3ca516a1d9bffec6e5cb2f87c4cd73e4da8c33b8706f96ba3b31f13ce229746110d5bd248839f67ec6d67

Download Submit
C:\Windows\TEMP\MpCmdRun.log

Filesize
5KB

MD5
58981b8e8f721ce8ccf7bb1bfdddab2d

SHA1
aeac135b6cb34af917793f2d8b467a5b0fbdb0aa

SHA256
1604286b458762a8cc2402787760e53b4135d020fc4c10b5ba1b9bafdc71ae1a

SHA512
b1acbf6f44356d969497607da32b3f6c320912764619fab5a6dcb289a0c4a79935d74cc575f0a356fb91f6d442c0af638eb314042fa866fefff982b8854ad3ce

Download Submit
C:\Windows\TEMP\MpCmdRun.log

Filesize
5KB

MD5
3193b3f5403283df8e157eb90e3b35dd

SHA1
86a602e8e16c42972ccfd5deaf5c372c12725f68

SHA256
2241d9d0c9691f1999b825a20d48c82a7bd54e0cb54a0b4622e7f2c63591beaa

SHA512
2b1b1ee5560352df4b017175c9c32ffff16051bf1ef4a1c387f47a070b4bf3ca882547c26af11a11608924d58a8b28e054f372aaa28e101c63ce9e8ddfdf2ea0

Download Submit
C:\Windows\Temp\3u4l5t6m.tmp

Filesize
37KB

MD5
1f8c95b97229e09286b8a531f690c661

SHA1
b15b21c4912267b41861fb351f192849cca68a12

SHA256
557a903f0f2177e3e62b1a534dee554cf2eff3dd3991bc2310f064bf9c7d2152

SHA512
0f0e5b85b6ef73ecebcd70ca90ce54c019eec1ea99966c469f357dd3393d0067f591b3690fe0b7922d7ba4aa25ebefd76a092d28c3377e6035720f8630a1a186

Download Submit
C:\Windows\Temp\3u4l5t6m.tmp

Filesize
37KB

MD5
3bc9acd9c4b8384fb7ce6c08db87df6d

SHA1
936c93e3a01d5ae30d05711a97bbf3dfa5e0921f

SHA256
a3d7de3d70c7673e8af7275eede44c1596156b6503a9614c47bad2c8e5fa3f79

SHA512
f8508376d9fb001bce10a8cc56da5c67b31ff220afd01fb57e736e961f3a563731e84d6a6c046123e1a5c16d31f39d9b07528b64a8f432eac7baa433e1d23375

Download Submit
C:\Windows\Temp\__PSScriptPolicyTest_ur3ji31y.v2g.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Windows\Temp\autA50A.tmp

Filesize
14KB

MD5
9d5a0ef18cc4bb492930582064c5330f

SHA1
2ec4168fd3c5ea9f2b0ab6acd676a5b4a95848c8

SHA256
8f5bbcc572bc62feb13a669f856d21886a61888fd6288afd066272a27ea79bb3

SHA512
1dc3387790b051c3291692607312819f0967848961bc075799b5a2353efadd65f54db54ddf47c296bb6a9f48e94ec83086a4f8bf7200c64329a73fc7ec4340a4

Download Submit
C:\Windows\Temp\autA50B.tmp

Filesize
12KB

MD5
efe44d9f6e4426a05e39f99ad407d3e7

SHA1
637c531222ee6a56780a7fdcd2b5078467b6e036

SHA256
5ea3b26c6b1b71edaef17ce365d50be963ae9f4cb79b39ec723fe6e9e4054366

SHA512
8014b60cef62ff5c94bf6338ee3385962cfc62aaa6c101a607c592ba00aea2d860f52e5f52be2a2a3b35310f135548e8d0b00211bfcf32d6b71198f5d3046b63

Download Submit
C:\Windows\Temp\autA50C.tmp

Filesize
7KB

MD5
ecffd3e81c5f2e3c62bcdc122442b5f2

SHA1
d41567acbbb0107361c6ee1715fe41b416663f40

SHA256
9874ab363b07dcc7e9cd6022a380a64102c1814343642295239a9f120cb941c5

SHA512
7f84899b77e3e2c0a35fb4973f4cd57f170f7a22f862b08f01938cf7537c8af7c442ef2ae6e561739023f6c9928f93a59b50d463af6373ed344f68260bc47c76

Download Submit
memory/2488-22-0x0000000000400000-0x00000000004CD000-memory.dmp

Filesize
820KB

Download
memory/2488-0-0x0000000000400000-0x00000000004CD000-memory.dmp

Filesize
820KB

Download
memory/3292-398-0x0000000000400000-0x00000000004CD000-memory.dmp

Filesize
820KB

Download
memory/3456-44-0x0000000000400000-0x00000000004CD000-memory.dmp

Filesize
820KB

Download
memory/3780-107-0x0000000000400000-0x00000000004CD000-memory.dmp

Filesize
820KB

Download
memory/3780-396-0x0000000000400000-0x00000000004CD000-memory.dmp

Filesize
820KB

Download
memory/3952-160-0x00000156FD580000-0x00000156FD581000-memory.dmp

Filesize
4KB

Download
memory/3952-151-0x0000015682A20000-0x0000015682A24000-memory.dmp

Filesize
16KB

Download
memory/3952-182-0x00000156FF650000-0x00000156FF651000-memory.dmp

Filesize
4KB

Download
memory/3952-181-0x00000156FF640000-0x00000156FF641000-memory.dmp

Filesize
4KB

Download
memory/3952-180-0x00000156FF630000-0x00000156FF631000-memory.dmp

Filesize
4KB

Download
memory/3952-179-0x00000156FF620000-0x00000156FF621000-memory.dmp

Filesize
4KB

Download
memory/3952-178-0x00000156FE300000-0x00000156FE301000-memory.dmp

Filesize
4KB

Download
memory/3952-177-0x00000156FE2F0000-0x00000156FE2F1000-memory.dmp

Filesize
4KB

Download
memory/3952-176-0x00000156FE2E0000-0x00000156FE2E1000-memory.dmp

Filesize
4KB

Download
memory/3952-175-0x00000156FE2C0000-0x00000156FE2C1000-memory.dmp

Filesize
4KB

Download
memory/3952-174-0x00000156FE2B0000-0x00000156FE2B1000-memory.dmp

Filesize
4KB

Download
memory/3952-173-0x00000156FE2A0000-0x00000156FE2A1000-memory.dmp

Filesize
4KB

Download
memory/3952-172-0x00000156FE290000-0x00000156FE291000-memory.dmp

Filesize
4KB

Download
memory/3952-171-0x00000156FDD70000-0x00000156FDD71000-memory.dmp

Filesize
4KB

Download
memory/3952-170-0x00000156FDD60000-0x00000156FDD61000-memory.dmp

Filesize
4KB

Download
memory/3952-169-0x00000156FDD50000-0x00000156FDD51000-memory.dmp

Filesize
4KB

Download
memory/3952-168-0x00000156FD970000-0x00000156FD971000-memory.dmp

Filesize
4KB

Download
memory/3952-167-0x00000156FD790000-0x00000156FD791000-memory.dmp

Filesize
4KB

Download
memory/3952-166-0x00000156FD780000-0x00000156FD781000-memory.dmp

Filesize
4KB

Download
memory/3952-165-0x00000156FD770000-0x00000156FD771000-memory.dmp

Filesize
4KB

Download
memory/3952-164-0x00000156FD6E0000-0x00000156FD6E1000-memory.dmp

Filesize
4KB

Download
memory/3952-163-0x00000156FDA00000-0x00000156FDA01000-memory.dmp

Filesize
4KB

Download
memory/3952-162-0x00000156FD7E0000-0x00000156FD7E1000-memory.dmp

Filesize
4KB

Download
memory/3952-161-0x00000156FD610000-0x00000156FD611000-memory.dmp

Filesize
4KB

Download
memory/3952-184-0x00000156FF670000-0x00000156FF671000-memory.dmp

Filesize
4KB

Download
memory/3952-159-0x00000156FD470000-0x00000156FD471000-memory.dmp

Filesize
4KB

Download
memory/3952-158-0x0000015682A90000-0x0000015682AF8000-memory.dmp

Filesize
416KB

Download
memory/3952-157-0x0000015682A80000-0x0000015682A81000-memory.dmp

Filesize
4KB

Download
memory/3952-156-0x0000015682A70000-0x0000015682A76000-memory.dmp

Filesize
24KB

Download
memory/3952-155-0x0000015682A60000-0x0000015682A66000-memory.dmp

Filesize
24KB

Download
memory/3952-154-0x0000015682A50000-0x0000015682A54000-memory.dmp

Filesize
16KB

Download
memory/3952-153-0x0000015682A40000-0x0000015682A44000-memory.dmp

Filesize
16KB

Download
memory/3952-152-0x0000015682A30000-0x0000015682A34000-memory.dmp

Filesize
16KB

Download
memory/3952-183-0x00000156FF660000-0x00000156FF661000-memory.dmp

Filesize
4KB

Download
memory/3952-150-0x0000015682A10000-0x0000015682A14000-memory.dmp

Filesize
16KB

Download
memory/3952-149-0x0000015682A00000-0x0000015682A04000-memory.dmp

Filesize
16KB

Download
memory/3952-148-0x00000156829F0000-0x00000156829F4000-memory.dmp

Filesize
16KB

Download
memory/3952-147-0x00000156829E0000-0x00000156829E4000-memory.dmp

Filesize
16KB

Download
memory/3952-146-0x00000156829D0000-0x00000156829D4000-memory.dmp

Filesize
16KB

Download
memory/3952-145-0x00000156829C0000-0x00000156829C4000-memory.dmp

Filesize
16KB

Download
memory/3952-144-0x0000015682680000-0x0000015682684000-memory.dmp

Filesize
16KB

Download
memory/3952-143-0x0000015682670000-0x0000015682674000-memory.dmp

Filesize
16KB

Download
memory/3952-142-0x0000015682660000-0x0000015682664000-memory.dmp

Filesize
16KB

Download
memory/3952-141-0x0000015682650000-0x0000015682654000-memory.dmp

Filesize
16KB

Download
memory/3952-140-0x0000015682640000-0x0000015682644000-memory.dmp

Filesize
16KB

Download
memory/3952-139-0x0000015682620000-0x0000015682624000-memory.dmp

Filesize
16KB

Download
memory/3952-138-0x0000015682610000-0x0000015682614000-memory.dmp

Filesize
16KB

Download
memory/3952-137-0x00000156FF7E0000-0x00000156FF7E4000-memory.dmp

Filesize
16KB

Download
memory/3952-136-0x00000156FE180000-0x00000156FE184000-memory.dmp

Filesize
16KB

Download
memory/3952-135-0x00000156FE170000-0x00000156FE174000-memory.dmp

Filesize
16KB

Download
memory/3952-134-0x00000156FF740000-0x00000156FF744000-memory.dmp

Filesize
16KB

Download
memory/3952-133-0x00000156FF6D0000-0x00000156FF6D4000-memory.dmp

Filesize
16KB

Download
memory/3952-132-0x00000156FE2D0000-0x00000156FE2D4000-memory.dmp

Filesize
16KB

Download
memory/3952-131-0x00000156FD420000-0x00000156FD424000-memory.dmp

Filesize
16KB

Download
memory/3952-130-0x0000015682630000-0x0000015682631000-memory.dmp

Filesize
4KB

Download
memory/3952-185-0x00000156FF6C0000-0x00000156FF6C1000-memory.dmp

Filesize
4KB

Download
memory/3952-186-0x00000156FF720000-0x00000156FF721000-memory.dmp

Filesize
4KB

Download
memory/3952-187-0x00000156FF730000-0x00000156FF731000-memory.dmp

Filesize
4KB

Download
memory/3952-188-0x00000156FF750000-0x00000156FF751000-memory.dmp

Filesize
4KB

Download
memory/3952-189-0x00000156FFFD0000-0x00000156FFFD1000-memory.dmp

Filesize
4KB

Download
memory/3952-129-0x00000156822F0000-0x000001568260D000-memory.dmp

Filesize
3.1MB

Download
memory/3952-128-0x0000015681EB0000-0x0000015681F21000-memory.dmp

Filesize
452KB

Download
memory/5584-421-0x0000027D1AFE0000-0x0000027D1AFFC000-memory.dmp

Filesize
112KB

Download
memory/5584-422-0x0000027D1B000000-0x0000027D1B0B5000-memory.dmp

Filesize
724KB

Download
memory/5584-423-0x0000027D1B0C0000-0x0000027D1B0CA000-memory.dmp

Filesize
40KB

Download
memory/5584-411-0x0000027D1AD70000-0x0000027D1AD92000-memory.dmp

Filesize
136KB

Download