dcrat | b8b5f7e2edc5114c9554dde3723b6f6221e4ec5ae0379c7feff8e2bc7398507d

Analysis

max time kernel
95s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
09/01/2025, 01:16

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
ba65161e6e83ddc896f9a5461f93d8f1.exe
Size 2.7MB
Sample250109-bmsststqhp
SHA256 b8b5f7e2edc5114c9554dde3723b6f6221e4ec5ae0379c7feff8e2bc7398507d
MD5 ba65161e6e83ddc896f9a5461f93d8f1
SHA1 51ecdadd3f065686e9fc6394685d968215cf4029
SHA512 264f88cce23bcaa16394f7d22e443bccb5a10ba080acee2d71daaddee24f9e9b3c14435a971d52c4fbf22d83e7fed7a9eea0d55179db88096724b6e32808dacd
SSDEEP 49152:XRx6mfxiUnp3jfmEXD9KxZU9IaK3clnUezzuuLjaO7e:h40VJ5XQxZUyrctHNyse
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

dcrat evasion infostealer rat trojan

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat
Dcrat family
dcrat

Process spawned unexpected child process 45 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3960	1116	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4232	1116	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2364	1116	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3988	1116	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2268	1116	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3724	1116	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4064	1116	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2536	1116	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4088	1116	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4976	1116	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4860	1116	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1604	1116	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3200	1116	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4812	1116	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4516	1116	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4596	1116	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3964	1116	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4364	1116	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1572	1116	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1664	1116	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4744	1116	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1176	1116	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3092	1116	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1292	1116	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4736	1116	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2320	1116	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1232	1116	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4936	1116	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2608	1116	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2152	1116	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3256	1116	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	388	1116	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3636	1116	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4492	1116	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4588	1116	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	732	1116	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1108	1116	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3524	1116	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3592	1116	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3668	1116	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1660	1116	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1796	1116	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4180	1116	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5112	1116	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3392	1116	schtasks.exe	83

UAC bypass 3 TTPs 6 IoCs

evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	ba65161e6e83ddc896f9a5461f93d8f1.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	ba65161e6e83ddc896f9a5461f93d8f1.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	ba65161e6e83ddc896f9a5461f93d8f1.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	sysmon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	sysmon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	sysmon.exe

DCRat payload 12 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral2/memory/1320-1-0x00000000003B0000-0x0000000000664000-memory.dmp	dcrat
behavioral2/files/0x0007000000023cac-30.dat	dcrat
behavioral2/files/0x000c000000023cd4-99.dat	dcrat
behavioral2/files/0x0009000000023ca9-112.dat	dcrat
behavioral2/files/0x0009000000023cac-123.dat	dcrat
behavioral2/files/0x0009000000023cb0-132.dat	dcrat
behavioral2/files/0x0009000000023cb3-145.dat	dcrat
behavioral2/files/0x0008000000023cbb-179.dat	dcrat
behavioral2/files/0x0009000000023cbe-190.dat	dcrat
behavioral2/files/0x000a000000023cc2-214.dat	dcrat
behavioral2/files/0x000a000000023cc5-225.dat	dcrat
behavioral2/memory/2716-288-0x0000000000DD0000-0x0000000001084000-memory.dmp	dcrat

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\International\Geo\Nation	ba65161e6e83ddc896f9a5461f93d8f1.exe

Executes dropped EXE 1 IoCs

pid	Process
2716	sysmon.exe

Checks whether UAC is enabled 1 TTPs 4 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	ba65161e6e83ddc896f9a5461f93d8f1.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	sysmon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	sysmon.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	ba65161e6e83ddc896f9a5461f93d8f1.exe

Drops file in Program Files directory 35 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Windows Photo Viewer\uk-UA\RCXCF1C.tmp	ba65161e6e83ddc896f9a5461f93d8f1.exe
File created	C:\Program Files\Windows Defender\it-IT\38384e6a620884	ba65161e6e83ddc896f9a5461f93d8f1.exe
File created	C:\Program Files (x86)\Windows Multimedia Platform\121e5b5079f7c0	ba65161e6e83ddc896f9a5461f93d8f1.exe
File opened for modification	C:\Program Files (x86)\Windows NT\Accessories\en-US\csrss.exe	ba65161e6e83ddc896f9a5461f93d8f1.exe
File opened for modification	C:\Program Files\Windows Photo Viewer\uk-UA\dwm.exe	ba65161e6e83ddc896f9a5461f93d8f1.exe
File opened for modification	C:\Program Files (x86)\Windows Multimedia Platform\RCXD440.tmp	ba65161e6e83ddc896f9a5461f93d8f1.exe
File created	C:\Program Files\Windows Defender\it-IT\SearchApp.exe	ba65161e6e83ddc896f9a5461f93d8f1.exe
File created	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\ee2ad38f3d4382	ba65161e6e83ddc896f9a5461f93d8f1.exe
File created	C:\Program Files (x86)\Windows Multimedia Platform\SearchApp.exe	ba65161e6e83ddc896f9a5461f93d8f1.exe
File opened for modification	C:\Program Files\Windows Defender\it-IT\RCXBB65.tmp	ba65161e6e83ddc896f9a5461f93d8f1.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\RCXC4C3.tmp	ba65161e6e83ddc896f9a5461f93d8f1.exe
File opened for modification	C:\Program Files (x86)\Windows NT\Accessories\en-US\RCXBD7A.tmp	ba65161e6e83ddc896f9a5461f93d8f1.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\Registry.exe	ba65161e6e83ddc896f9a5461f93d8f1.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ja-JP\RCXDBF8.tmp	ba65161e6e83ddc896f9a5461f93d8f1.exe
File opened for modification	C:\Program Files (x86)\Windows Multimedia Platform\sysmon.exe	ba65161e6e83ddc896f9a5461f93d8f1.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ja-JP\RCXDB7A.tmp	ba65161e6e83ddc896f9a5461f93d8f1.exe
File created	C:\Program Files (x86)\Windows NT\Accessories\en-US\886983d96e3d3e	ba65161e6e83ddc896f9a5461f93d8f1.exe
File opened for modification	C:\Program Files (x86)\Windows NT\Accessories\en-US\RCXBD7B.tmp	ba65161e6e83ddc896f9a5461f93d8f1.exe
File opened for modification	C:\Program Files (x86)\Windows Multimedia Platform\RCXC746.tmp	ba65161e6e83ddc896f9a5461f93d8f1.exe
File opened for modification	C:\Program Files\Windows Defender\it-IT\RCXBB66.tmp	ba65161e6e83ddc896f9a5461f93d8f1.exe
File opened for modification	C:\Program Files (x86)\Windows Multimedia Platform\RCXC7C4.tmp	ba65161e6e83ddc896f9a5461f93d8f1.exe
File opened for modification	C:\Program Files (x86)\Windows Multimedia Platform\RCXD4BE.tmp	ba65161e6e83ddc896f9a5461f93d8f1.exe
File created	C:\Program Files (x86)\Windows NT\Accessories\en-US\csrss.exe	ba65161e6e83ddc896f9a5461f93d8f1.exe
File created	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\Registry.exe	ba65161e6e83ddc896f9a5461f93d8f1.exe
File created	C:\Program Files\Windows Photo Viewer\uk-UA\6cb0b6c459d5d3	ba65161e6e83ddc896f9a5461f93d8f1.exe
File opened for modification	C:\Program Files (x86)\Windows Multimedia Platform\SearchApp.exe	ba65161e6e83ddc896f9a5461f93d8f1.exe
File opened for modification	C:\Program Files\Windows Photo Viewer\uk-UA\RCXCF1D.tmp	ba65161e6e83ddc896f9a5461f93d8f1.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ja-JP\sysmon.exe	ba65161e6e83ddc896f9a5461f93d8f1.exe
File created	C:\Program Files (x86)\Windows Multimedia Platform\38384e6a620884	ba65161e6e83ddc896f9a5461f93d8f1.exe
File created	C:\Program Files\Windows Photo Viewer\uk-UA\dwm.exe	ba65161e6e83ddc896f9a5461f93d8f1.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\RCXC541.tmp	ba65161e6e83ddc896f9a5461f93d8f1.exe
File opened for modification	C:\Program Files\Windows Defender\it-IT\SearchApp.exe	ba65161e6e83ddc896f9a5461f93d8f1.exe
File created	C:\Program Files (x86)\Windows Multimedia Platform\sysmon.exe	ba65161e6e83ddc896f9a5461f93d8f1.exe
File created	C:\Program Files (x86)\Internet Explorer\ja-JP\sysmon.exe	ba65161e6e83ddc896f9a5461f93d8f1.exe
File created	C:\Program Files (x86)\Internet Explorer\ja-JP\121e5b5079f7c0	ba65161e6e83ddc896f9a5461f93d8f1.exe

Drops file in Windows directory 5 IoCs

description	ioc	Process
File created	C:\Windows\Offline Web Pages\5940a34987c991	ba65161e6e83ddc896f9a5461f93d8f1.exe
File opened for modification	C:\Windows\Offline Web Pages\RCXB94F.tmp	ba65161e6e83ddc896f9a5461f93d8f1.exe
File opened for modification	C:\Windows\Offline Web Pages\RCXB960.tmp	ba65161e6e83ddc896f9a5461f93d8f1.exe
File created	C:\Windows\Offline Web Pages\dllhost.exe	ba65161e6e83ddc896f9a5461f93d8f1.exe
File opened for modification	C:\Windows\Offline Web Pages\dllhost.exe	ba65161e6e83ddc896f9a5461f93d8f1.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	ba65161e6e83ddc896f9a5461f93d8f1.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 45 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2608	schtasks.exe
3524	schtasks.exe
5112	schtasks.exe
3392	schtasks.exe
4860	schtasks.exe
2320	schtasks.exe
1664	schtasks.exe
1292	schtasks.exe
4936	schtasks.exe
388	schtasks.exe
3636	schtasks.exe
3592	schtasks.exe
1604	schtasks.exe
1572	schtasks.exe
1796	schtasks.exe
4180	schtasks.exe
3092	schtasks.exe
3256	schtasks.exe
4232	schtasks.exe
1176	schtasks.exe
4516	schtasks.exe
2364	schtasks.exe
2268	schtasks.exe
4492	schtasks.exe
4088	schtasks.exe
4364	schtasks.exe
4596	schtasks.exe
4744	schtasks.exe
2152	schtasks.exe
732	schtasks.exe
1108	schtasks.exe
3668	schtasks.exe
3724	schtasks.exe
2536	schtasks.exe
3964	schtasks.exe
4736	schtasks.exe
1232	schtasks.exe
3960	schtasks.exe
4812	schtasks.exe
4976	schtasks.exe
3200	schtasks.exe
4588	schtasks.exe
1660	schtasks.exe
3988	schtasks.exe
4064	schtasks.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
1320	ba65161e6e83ddc896f9a5461f93d8f1.exe
1320	ba65161e6e83ddc896f9a5461f93d8f1.exe
1320	ba65161e6e83ddc896f9a5461f93d8f1.exe
1320	ba65161e6e83ddc896f9a5461f93d8f1.exe
1320	ba65161e6e83ddc896f9a5461f93d8f1.exe
1320	ba65161e6e83ddc896f9a5461f93d8f1.exe
1320	ba65161e6e83ddc896f9a5461f93d8f1.exe
1320	ba65161e6e83ddc896f9a5461f93d8f1.exe
1320	ba65161e6e83ddc896f9a5461f93d8f1.exe
1320	ba65161e6e83ddc896f9a5461f93d8f1.exe
1320	ba65161e6e83ddc896f9a5461f93d8f1.exe
1320	ba65161e6e83ddc896f9a5461f93d8f1.exe
1320	ba65161e6e83ddc896f9a5461f93d8f1.exe
2716	sysmon.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1320	ba65161e6e83ddc896f9a5461f93d8f1.exe
Token: SeDebugPrivilege	2716	sysmon.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 1320 wrote to memory of 2716	1320	ba65161e6e83ddc896f9a5461f93d8f1.exe	129
PID 1320 wrote to memory of 2716	1320	ba65161e6e83ddc896f9a5461f93d8f1.exe	129

System policy modification 1 TTPs 6 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	ba65161e6e83ddc896f9a5461f93d8f1.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	ba65161e6e83ddc896f9a5461f93d8f1.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	ba65161e6e83ddc896f9a5461f93d8f1.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	sysmon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	sysmon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	sysmon.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\ba65161e6e83ddc896f9a5461f93d8f1.exe
"C:\Users\Admin\AppData\Local\Temp\ba65161e6e83ddc896f9a5461f93d8f1.exe"
1⤵
- UAC bypass
- Checks computer location settings
- Checks whether UAC is enabled
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1320
- C:\Program Files (x86)\Internet Explorer\ja-JP\sysmon.exe
  "C:\Program Files (x86)\Internet Explorer\ja-JP\sysmon.exe"
  2⤵
  - UAC bypass
  - Executes dropped EXE
  - Checks whether UAC is enabled
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - System policy modification
  PID:2716

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 12 /tr "'C:\Windows\Offline Web Pages\dllhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3960

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Windows\Offline Web Pages\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4232

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 5 /tr "'C:\Windows\Offline Web Pages\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2364

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SearchAppS" /sc MINUTE /mo 7 /tr "'C:\Program Files\Windows Defender\it-IT\SearchApp.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3988

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SearchApp" /sc ONLOGON /tr "'C:\Program Files\Windows Defender\it-IT\SearchApp.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2268

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SearchAppS" /sc MINUTE /mo 5 /tr "'C:\Program Files\Windows Defender\it-IT\SearchApp.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3724

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 9 /tr "'C:\Program Files (x86)\Windows NT\Accessories\en-US\csrss.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4064

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows NT\Accessories\en-US\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2536

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 11 /tr "'C:\Program Files (x86)\Windows NT\Accessories\en-US\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4088

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 12 /tr "'C:\Recovery\WindowsRE\Idle.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4976

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Idle" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\Idle.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4860

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 5 /tr "'C:\Recovery\WindowsRE\Idle.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1604

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 11 /tr "'C:\Recovery\WindowsRE\lsass.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3200

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsass" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4812

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 13 /tr "'C:\Recovery\WindowsRE\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4516

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RegistryR" /sc MINUTE /mo 14 /tr "'C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\Registry.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4596

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Registry" /sc ONLOGON /tr "'C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\Registry.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3964

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RegistryR" /sc MINUTE /mo 10 /tr "'C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\Registry.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4364

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SearchAppS" /sc MINUTE /mo 12 /tr "'C:\Program Files (x86)\Windows Multimedia Platform\SearchApp.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1572

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SearchApp" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Multimedia Platform\SearchApp.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1664

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SearchAppS" /sc MINUTE /mo 13 /tr "'C:\Program Files (x86)\Windows Multimedia Platform\SearchApp.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4744

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 13 /tr "'C:\Recovery\WindowsRE\RuntimeBroker.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1176

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3092

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 5 /tr "'C:\Recovery\WindowsRE\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1292

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "StartMenuExperienceHostS" /sc MINUTE /mo 13 /tr "'C:\Users\Admin\StartMenuExperienceHost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4736

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "StartMenuExperienceHost" /sc ONLOGON /tr "'C:\Users\Admin\StartMenuExperienceHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2320

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "StartMenuExperienceHostS" /sc MINUTE /mo 11 /tr "'C:\Users\Admin\StartMenuExperienceHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1232

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 6 /tr "'C:\Program Files\Windows Photo Viewer\uk-UA\dwm.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4936

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwm" /sc ONLOGON /tr "'C:\Program Files\Windows Photo Viewer\uk-UA\dwm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2608

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 5 /tr "'C:\Program Files\Windows Photo Viewer\uk-UA\dwm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2152

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RegistryR" /sc MINUTE /mo 10 /tr "'C:\Recovery\WindowsRE\Registry.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3256

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Registry" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\Registry.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:388

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RegistryR" /sc MINUTE /mo 13 /tr "'C:\Recovery\WindowsRE\Registry.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3636

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sysmons" /sc MINUTE /mo 14 /tr "'C:\Program Files (x86)\Windows Multimedia Platform\sysmon.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4492

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sysmon" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Multimedia Platform\sysmon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4588

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sysmons" /sc MINUTE /mo 10 /tr "'C:\Program Files (x86)\Windows Multimedia Platform\sysmon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:732

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 6 /tr "'C:\Recovery\WindowsRE\wininit.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1108

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininit" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\wininit.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3524

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 5 /tr "'C:\Recovery\WindowsRE\wininit.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3592

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 9 /tr "'C:\Users\Default\spoolsv.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3668

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsv" /sc ONLOGON /tr "'C:\Users\Default\spoolsv.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1660

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 14 /tr "'C:\Users\Default\spoolsv.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1796

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sysmons" /sc MINUTE /mo 6 /tr "'C:\Program Files (x86)\Internet Explorer\ja-JP\sysmon.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4180

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sysmon" /sc ONLOGON /tr "'C:\Program Files (x86)\Internet Explorer\ja-JP\sysmon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5112

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sysmons" /sc MINUTE /mo 5 /tr "'C:\Program Files (x86)\Internet Explorer\ja-JP\sysmon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3392

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

sysmon.exe

Path C:\Program Files (x86)\Internet Explorer\ja-JP\sysmon.exe
Size 2.7MB
SHA256 3a9ff5815fd69a53678a5fcafbe969d127ec1ebdeb05b4b9339e05c5e288cb3f
MD5 608bbcc43a41a1fb4d04007064171232
SHA1 1774571c064b31d6f561d4584d37d6ade46dd4b7
SHA512 f522887148e04c9af91c9ad997c127744be506d52e0d6d00524300b345fbe7470b5005ace409742eb967b30d213b891d46cebf5a09b7c00b4fc9b5e8d36122b9
SSDEEP 49152:VRx6mfxiUnp3jfmEXD9KxZU9IaK3clnUezzuuLjaO7e:b40VJ5XQxZUyrctHNyse
MD5 SHA1 SHA512 SSDEEP

Submit Download

Registry.exe

Path C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\Registry.exe
Size 2.7MB
SHA256 6265c5bae24ac36308f9f8f8b24fd2ec7d3d697a06c5a893ccdc16a2b3ea157c
MD5 a7a76e1778919840b8cef2b376807d44
SHA1 9567a0eaddefce5bf56f3fba85ad5a79113f6b39
SHA512 ac0b336b40b8c540f7c03222a667232fde624c7a4912384fd8357f4d091d8446c900c9a3703c5cb740fef7a2e34f135a8c8d0f218c161df37fb5288c8f1ec23f
SSDEEP 49152:VRx6mfxiUnp3jfmEXD9KxZU9IaK3clnUezzuuLjaO7e:b40VJ5XQxZUyrctHNyse
MD5 SHA1 SHA512 SSDEEP

Submit Download

SearchApp.exe

Path C:\Program Files (x86)\Windows Multimedia Platform\SearchApp.exe
Size 2.7MB
SHA256 73b226d857d07c4797fdc471dd64d2185f8a10f756833b7d0334997974a10465
MD5 8d1a60f35fc35bdf6b4777480ecad185
SHA1 c5883b4f7af3c15e3d8193b295c98b490793c37b
SHA512 a522f675b6218932b4e35fe57b0498af83d40a1fcd0ce8ce0dcc1a0babdcec901d713f750b59d596f7df45e9e475d1cdd905df35912687f0c640bdc1a46d1e3c
SSDEEP 49152:VRx6mfxiUnp3jfmEXD9KxZU9IaK3clnUezzuuLjaO7e:b40VJ5XQxZUyrctHNyse
MD5 SHA1 SHA512 SSDEEP

Submit Download

sysmon.exe

Path C:\Program Files (x86)\Windows Multimedia Platform\sysmon.exe
Size 2.7MB
SHA256 2eed74ab5a730f68b4620bd85ff88725b8242596a5407937e202fcfa56aa16ba
MD5 6c57965db4b6544c67efce9d0ec55571
SHA1 aae9621d22c4db557a61af584c11bff7ab18205c
SHA512 67dd4e79378a87b28f84a2ea9cbcdd348908c058620f6bf003e2f403f0e4c6324dc8d9ee22ce655f2f25e4f05ea933d1994de4321dde3e95255c1da379c83d11
SSDEEP 49152:FRx6mfxiUnp3jfmEXD9KxZU9IaK3clnUezzuuLjaO7e:r40VJ5XQxZUyrctHNyse
MD5 SHA1 SHA512 SSDEEP

Submit Download

Idle.exe

Path C:\Recovery\WindowsRE\Idle.exe
Size 2.7MB
SHA256 0198b35209cfe1aa52304800e8085b1898f93701b00bf4a0f2c5433579e3cf59
MD5 e6eabfafb9a3614ea1ea79033df8b56e
SHA1 7f18908cd51c7ec071e592d23a6e346c8d2e349f
SHA512 3fc845afa608e8d415e84d46e5e087623f79123b24da4fe4ed252969ecbee3c7d7b4ec0cdeeab089e79b531aee15ca62c213ded91037f318e293532bfcfe9e7b
SSDEEP 49152:VRx6mfxiUnp3jfmEXD9KxZU9IaK3clnUezzuuLjaO7e:b40VJ5XQxZUyrctHNyse
MD5 SHA1 SHA512 SSDEEP

Submit Download

Registry.exe

Path C:\Recovery\WindowsRE\Registry.exe
Size 2.7MB
SHA256 c632d9b95a9c860950db205e72065663fade272723a725a1be07ff2bdff2eef7
MD5 7acbc8b1999f8b38b0adf5c377074c5f
SHA1 d3a3e620421b096a5880fc04ba63c298df4b2917
SHA512 77272674ca914495493352e1fcd60c541a4d6b06c4222f6294ce0f5bf96cb5e81b36f71e560f1ff199455168bb9177824073922054f754d19add63fa239281d4
SSDEEP 49152:VRx6mfxiUnp3jfmEXD9KxZU9IaK3clnUezzuuLjaO7e:b40VJ5XQxZUyrctHNyse
MD5 SHA1 SHA512 SSDEEP

Submit Download

RuntimeBroker.exe

Path C:\Recovery\WindowsRE\RuntimeBroker.exe
Size 2.7MB
SHA256 273b4f7204452ec7a6fd87327db15ae4d1b9e525998cd24125521e3979366724
MD5 d3fa1b7c16a89cf63fd5cd1f86ed2361
SHA1 0a3e550a29612aa8b9c6c0f0c46d12af9378dfd4
SHA512 5bef18e1215ce6a49c5be4c0820d1c37415085576a1f933d5fcd672bff7a977aa513124dc2416ee6233175a89c6d394521efadb14449c755626b2ac7eb422b7f
SSDEEP 49152:FRx6mfxiUnp3jfmEXD9KxZU9IaK3clnUezzuuLjaO7e:r40VJ5XQxZUyrctHNyse
MD5 SHA1 SHA512 SSDEEP

Submit Download

lsass.exe

Path C:\Recovery\WindowsRE\lsass.exe
Size 2.7MB
SHA256 b8b5f7e2edc5114c9554dde3723b6f6221e4ec5ae0379c7feff8e2bc7398507d
MD5 ba65161e6e83ddc896f9a5461f93d8f1
SHA1 51ecdadd3f065686e9fc6394685d968215cf4029
SHA512 264f88cce23bcaa16394f7d22e443bccb5a10ba080acee2d71daaddee24f9e9b3c14435a971d52c4fbf22d83e7fed7a9eea0d55179db88096724b6e32808dacd
SSDEEP 49152:XRx6mfxiUnp3jfmEXD9KxZU9IaK3clnUezzuuLjaO7e:h40VJ5XQxZUyrctHNyse
MD5 SHA1 SHA512 SSDEEP

Submit Download

lsass.exe

Path C:\Recovery\WindowsRE\lsass.exe
Size 2.7MB
SHA256 51db3c5996fa9ee9603aa4dcd1ea805d43d16c0fa9d46366b6ac9ef6d445d8f0
MD5 16706fb1b8da9f07a76e651178f6a43f
SHA1 e75d1c2756b8392079defb06c202ae10af15eccd
SHA512 4415956a6277a96f96ba497b01bfe93e2e4ee4f89ec1c28820428fb52573aa80218d05d073ffbe65f09728955f86603a4fb2bcaa3c4b73d1a511148a552a8a7f
SSDEEP 49152:lRx6mfxiUnp3jfmEXD9KxZU9IaK3clnUezzuuLjaO7e:L40VJ5XQxZUyrctHNyse
MD5 SHA1 SHA512 SSDEEP

Submit Download

spoolsv.exe

Path C:\Users\Default\spoolsv.exe
Size 2.7MB
SHA256 75ef4fd435eca99af76159ca6324869703ea6b226e4f7a2cb8118dc35bb7cd76
MD5 080955593f89b1a59b7baf6dfa62463a
SHA1 edb147fb395b0d9345d203389bbc241073e044c0
SHA512 3f8d9adf16f9e21ab2e5622db0768abede4f04b3fae5a7f0335068189756769f1e4440fd654571cbcb6b5b4257fcad1e8277d645c78a0fd27b04d038fcb06f47
SSDEEP 49152:VRx6mfxiUnp3jfmEXD9KxZU9IaK3clnUezzuuLjaO7e:b40VJ5XQxZUyrctHNyse
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1320-9-0x000000001B8F0000-0x000000001B8F8000-memory.dmp

Download

memory/1320-0-0x00007FFFC1E73000-0x00007FFFC1E75000-memory.dmp

Download

memory/1320-12-0x000000001B910000-0x000000001B918000-memory.dmp

Download

memory/1320-13-0x000000001B920000-0x000000001B932000-memory.dmp

Download

memory/1320-14-0x000000001BF30000-0x000000001C458000-memory.dmp

Download

memory/1320-16-0x000000001BA00000-0x000000001BA08000-memory.dmp

Download

memory/1320-19-0x000000001BA20000-0x000000001BA2C000-memory.dmp

Download

memory/1320-18-0x000000001BA10000-0x000000001BA1E000-memory.dmp

Download

memory/1320-20-0x000000001BA30000-0x000000001BA3A000-memory.dmp

Download

memory/1320-17-0x000000001BB10000-0x000000001BB1C000-memory.dmp

Download

memory/1320-15-0x000000001B930000-0x000000001B938000-memory.dmp

Download

memory/1320-21-0x000000001BA40000-0x000000001BA4C000-memory.dmp

Download

memory/1320-10-0x000000001B900000-0x000000001B90A000-memory.dmp

Download

memory/1320-11-0x000000001B990000-0x000000001B9E6000-memory.dmp

Download

memory/1320-7-0x000000001B1B0000-0x000000001B1C0000-memory.dmp

Download

memory/1320-8-0x000000001B1C0000-0x000000001B1D6000-memory.dmp

Download

memory/1320-6-0x0000000002800000-0x0000000002808000-memory.dmp

Download

memory/1320-5-0x000000001B940000-0x000000001B990000-memory.dmp

Download

memory/1320-170-0x00007FFFC1E73000-0x00007FFFC1E75000-memory.dmp

Download

memory/1320-4-0x0000000002820000-0x000000000283C000-memory.dmp

Download

memory/1320-3-0x00000000027F0000-0x00000000027FE000-memory.dmp

Download

memory/1320-193-0x00007FFFC1E70000-0x00007FFFC2931000-memory.dmp

Download

memory/1320-2-0x00007FFFC1E70000-0x00007FFFC2931000-memory.dmp

Download

memory/1320-1-0x00000000003B0000-0x0000000000664000-memory.dmp

Download

memory/1320-289-0x00007FFFC1E70000-0x00007FFFC2931000-memory.dmp

Download

memory/2716-288-0x0000000000DD0000-0x0000000001084000-memory.dmp

Download