dcrat | 1054af5e9206aa0cb650a4e58900bcd369a554e64eaa89f56cb35cd105386eb5

Analysis

max time kernel
93s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
14-01-2025 02:07

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1054af5e9206aa0cb650a4e58900bcd369a554e64eaa89f56cb35cd105386eb5.exe
Size

829KB
MD5

c1f1bea182f1c3477c2f133c3ac26930
SHA1

2145c09d2c3279ac83e844c4d80e7aa219e99b8d
SHA256

1054af5e9206aa0cb650a4e58900bcd369a554e64eaa89f56cb35cd105386eb5
SHA512

6af6336782b29bdab906e4d289cb5c2c8500ba8a20dee53def21960e62afc28ec6756b746b4e4036a30726984a60b656b3d529b4abc119953267e91be4992a4d
SSDEEP

12288:P6TnOzi5kaag8hpT77JJMA+XSpW3Ari4VVyZC0+1cw2jINof7+vEnkdsOZ6:P6TnYa+T7dJMA+i3iE0nHfW6

Score

10^/10

dcrat discovery execution infostealer persistence rat spyware stealer

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat
Dcrat family
dcrat

Modifies WinLogon for persistence 2 TTPs 6 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Windows\\fr-FR\\winlogon.exe\", \"C:\\Program Files (x86)\\Windows Defender\\it-IT\\taskhostw.exe\", \"C:\\Windows\\ModemLogs\\winlogon.exe\""	1054af5e9206aa0cb650a4e58900bcd369a554e64eaa89f56cb35cd105386eb5.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Windows\\fr-FR\\winlogon.exe\", \"C:\\Program Files (x86)\\Windows Defender\\it-IT\\taskhostw.exe\", \"C:\\Windows\\ModemLogs\\winlogon.exe\", \"C:\\Users\\Admin\\PrintHood\\TextInputHost.exe\""	1054af5e9206aa0cb650a4e58900bcd369a554e64eaa89f56cb35cd105386eb5.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Windows\\fr-FR\\winlogon.exe\", \"C:\\Program Files (x86)\\Windows Defender\\it-IT\\taskhostw.exe\", \"C:\\Windows\\ModemLogs\\winlogon.exe\", \"C:\\Users\\Admin\\PrintHood\\TextInputHost.exe\", \"C:\\Program Files (x86)\\Windows Multimedia Platform\\sppsvc.exe\""	1054af5e9206aa0cb650a4e58900bcd369a554e64eaa89f56cb35cd105386eb5.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Windows\\fr-FR\\winlogon.exe\", \"C:\\Program Files (x86)\\Windows Defender\\it-IT\\taskhostw.exe\", \"C:\\Windows\\ModemLogs\\winlogon.exe\", \"C:\\Users\\Admin\\PrintHood\\TextInputHost.exe\", \"C:\\Program Files (x86)\\Windows Multimedia Platform\\sppsvc.exe\", \"C:\\Users\\Admin\\AppData\\Local\\Temp\\1054af5e9206aa0cb650a4e58900bcd369a554e64eaa89f56cb35cd105386eb5.exe\""	1054af5e9206aa0cb650a4e58900bcd369a554e64eaa89f56cb35cd105386eb5.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Windows\\fr-FR\\winlogon.exe\""	1054af5e9206aa0cb650a4e58900bcd369a554e64eaa89f56cb35cd105386eb5.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Windows\\fr-FR\\winlogon.exe\", \"C:\\Program Files (x86)\\Windows Defender\\it-IT\\taskhostw.exe\""	1054af5e9206aa0cb650a4e58900bcd369a554e64eaa89f56cb35cd105386eb5.exe

Process spawned unexpected child process 18 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	664	2624	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2608	2624	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2444	2624	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4392	2624	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1964	2624	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2948	2624	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3996	2624	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1256	2624	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	624	2624	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1960	2624	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2920	2624	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5004	2624	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1828	2624	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3192	2624	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3952	2624	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4544	2624	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4716	2624	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2188	2624	schtasks.exe	83

DCRat payload 2 IoCs

rat

resource	yara_rule
behavioral2/memory/3692-1-0x0000000000BD0000-0x0000000000CA6000-memory.dmp	family_dcrat_v2
behavioral2/files/0x0007000000023c7a-27.dat	family_dcrat_v2

Command and Scripting Interpreter: PowerShell 1 TTPs 6 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
2972	powershell.exe
992	powershell.exe
4800	powershell.exe
1172	powershell.exe
1940	powershell.exe
1476	powershell.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation	1054af5e9206aa0cb650a4e58900bcd369a554e64eaa89f56cb35cd105386eb5.exe

Executes dropped EXE 1 IoCs

pid	Process
1680	sppsvc.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 12 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\winlogon = "\"C:\\Windows\\ModemLogs\\winlogon.exe\""	1054af5e9206aa0cb650a4e58900bcd369a554e64eaa89f56cb35cd105386eb5.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\TextInputHost = "\"C:\\Users\\Admin\\PrintHood\\TextInputHost.exe\""	1054af5e9206aa0cb650a4e58900bcd369a554e64eaa89f56cb35cd105386eb5.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\TextInputHost = "\"C:\\Users\\Admin\\PrintHood\\TextInputHost.exe\""	1054af5e9206aa0cb650a4e58900bcd369a554e64eaa89f56cb35cd105386eb5.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sppsvc = "\"C:\\Program Files (x86)\\Windows Multimedia Platform\\sppsvc.exe\""	1054af5e9206aa0cb650a4e58900bcd369a554e64eaa89f56cb35cd105386eb5.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\1054af5e9206aa0cb650a4e58900bcd369a554e64eaa89f56cb35cd105386eb5 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\1054af5e9206aa0cb650a4e58900bcd369a554e64eaa89f56cb35cd105386eb5.exe\""	1054af5e9206aa0cb650a4e58900bcd369a554e64eaa89f56cb35cd105386eb5.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\winlogon = "\"C:\\Windows\\fr-FR\\winlogon.exe\""	1054af5e9206aa0cb650a4e58900bcd369a554e64eaa89f56cb35cd105386eb5.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\taskhostw = "\"C:\\Program Files (x86)\\Windows Defender\\it-IT\\taskhostw.exe\""	1054af5e9206aa0cb650a4e58900bcd369a554e64eaa89f56cb35cd105386eb5.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\winlogon = "\"C:\\Windows\\ModemLogs\\winlogon.exe\""	1054af5e9206aa0cb650a4e58900bcd369a554e64eaa89f56cb35cd105386eb5.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\1054af5e9206aa0cb650a4e58900bcd369a554e64eaa89f56cb35cd105386eb5 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\1054af5e9206aa0cb650a4e58900bcd369a554e64eaa89f56cb35cd105386eb5.exe\""	1054af5e9206aa0cb650a4e58900bcd369a554e64eaa89f56cb35cd105386eb5.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\winlogon = "\"C:\\Windows\\fr-FR\\winlogon.exe\""	1054af5e9206aa0cb650a4e58900bcd369a554e64eaa89f56cb35cd105386eb5.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\taskhostw = "\"C:\\Program Files (x86)\\Windows Defender\\it-IT\\taskhostw.exe\""	1054af5e9206aa0cb650a4e58900bcd369a554e64eaa89f56cb35cd105386eb5.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sppsvc = "\"C:\\Program Files (x86)\\Windows Multimedia Platform\\sppsvc.exe\""	1054af5e9206aa0cb650a4e58900bcd369a554e64eaa89f56cb35cd105386eb5.exe

Looks up external IP address via web service 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
20	ipinfo.io
19	ipinfo.io

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	\??\c:\Windows\System32\CSCC8A0CD127904458C969B3432AF9A8A4.TMP	csc.exe
File created	\??\c:\Windows\System32\ovufcs.exe	csc.exe

Drops file in Program Files directory 5 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Windows Defender\it-IT\taskhostw.exe	1054af5e9206aa0cb650a4e58900bcd369a554e64eaa89f56cb35cd105386eb5.exe
File created	C:\Program Files (x86)\Windows Defender\it-IT\ea9f0e6c9e2dcd	1054af5e9206aa0cb650a4e58900bcd369a554e64eaa89f56cb35cd105386eb5.exe
File created	C:\Program Files (x86)\Windows Multimedia Platform\sppsvc.exe	1054af5e9206aa0cb650a4e58900bcd369a554e64eaa89f56cb35cd105386eb5.exe
File opened for modification	C:\Program Files (x86)\Windows Multimedia Platform\sppsvc.exe	1054af5e9206aa0cb650a4e58900bcd369a554e64eaa89f56cb35cd105386eb5.exe
File created	C:\Program Files (x86)\Windows Multimedia Platform\0a1fd5f707cd16	1054af5e9206aa0cb650a4e58900bcd369a554e64eaa89f56cb35cd105386eb5.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File created	C:\Windows\fr-FR\cc11b995f2a76d	1054af5e9206aa0cb650a4e58900bcd369a554e64eaa89f56cb35cd105386eb5.exe
File created	C:\Windows\ModemLogs\winlogon.exe	1054af5e9206aa0cb650a4e58900bcd369a554e64eaa89f56cb35cd105386eb5.exe
File created	C:\Windows\ModemLogs\cc11b995f2a76d	1054af5e9206aa0cb650a4e58900bcd369a554e64eaa89f56cb35cd105386eb5.exe
File created	C:\Windows\fr-FR\winlogon.exe	1054af5e9206aa0cb650a4e58900bcd369a554e64eaa89f56cb35cd105386eb5.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
4376	PING.EXE

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings	1054af5e9206aa0cb650a4e58900bcd369a554e64eaa89f56cb35cd105386eb5.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
4376	PING.EXE

Scheduled Task/Job: Scheduled Task 1 TTPs 18 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2948	schtasks.exe
3952	schtasks.exe
2608	schtasks.exe
2444	schtasks.exe
3996	schtasks.exe
1256	schtasks.exe
2188	schtasks.exe
5004	schtasks.exe
1828	schtasks.exe
4544	schtasks.exe
3192	schtasks.exe
4716	schtasks.exe
664	schtasks.exe
4392	schtasks.exe
1964	schtasks.exe
624	schtasks.exe
1960	schtasks.exe
2920	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3692	1054af5e9206aa0cb650a4e58900bcd369a554e64eaa89f56cb35cd105386eb5.exe
3692	1054af5e9206aa0cb650a4e58900bcd369a554e64eaa89f56cb35cd105386eb5.exe
3692	1054af5e9206aa0cb650a4e58900bcd369a554e64eaa89f56cb35cd105386eb5.exe
3692	1054af5e9206aa0cb650a4e58900bcd369a554e64eaa89f56cb35cd105386eb5.exe
3692	1054af5e9206aa0cb650a4e58900bcd369a554e64eaa89f56cb35cd105386eb5.exe
3692	1054af5e9206aa0cb650a4e58900bcd369a554e64eaa89f56cb35cd105386eb5.exe
3692	1054af5e9206aa0cb650a4e58900bcd369a554e64eaa89f56cb35cd105386eb5.exe
3692	1054af5e9206aa0cb650a4e58900bcd369a554e64eaa89f56cb35cd105386eb5.exe
3692	1054af5e9206aa0cb650a4e58900bcd369a554e64eaa89f56cb35cd105386eb5.exe
3692	1054af5e9206aa0cb650a4e58900bcd369a554e64eaa89f56cb35cd105386eb5.exe
3692	1054af5e9206aa0cb650a4e58900bcd369a554e64eaa89f56cb35cd105386eb5.exe
3692	1054af5e9206aa0cb650a4e58900bcd369a554e64eaa89f56cb35cd105386eb5.exe
3692	1054af5e9206aa0cb650a4e58900bcd369a554e64eaa89f56cb35cd105386eb5.exe
3692	1054af5e9206aa0cb650a4e58900bcd369a554e64eaa89f56cb35cd105386eb5.exe
3692	1054af5e9206aa0cb650a4e58900bcd369a554e64eaa89f56cb35cd105386eb5.exe
3692	1054af5e9206aa0cb650a4e58900bcd369a554e64eaa89f56cb35cd105386eb5.exe
3692	1054af5e9206aa0cb650a4e58900bcd369a554e64eaa89f56cb35cd105386eb5.exe
3692	1054af5e9206aa0cb650a4e58900bcd369a554e64eaa89f56cb35cd105386eb5.exe
3692	1054af5e9206aa0cb650a4e58900bcd369a554e64eaa89f56cb35cd105386eb5.exe
3692	1054af5e9206aa0cb650a4e58900bcd369a554e64eaa89f56cb35cd105386eb5.exe
3692	1054af5e9206aa0cb650a4e58900bcd369a554e64eaa89f56cb35cd105386eb5.exe
3692	1054af5e9206aa0cb650a4e58900bcd369a554e64eaa89f56cb35cd105386eb5.exe
3692	1054af5e9206aa0cb650a4e58900bcd369a554e64eaa89f56cb35cd105386eb5.exe
3692	1054af5e9206aa0cb650a4e58900bcd369a554e64eaa89f56cb35cd105386eb5.exe
3692	1054af5e9206aa0cb650a4e58900bcd369a554e64eaa89f56cb35cd105386eb5.exe
3692	1054af5e9206aa0cb650a4e58900bcd369a554e64eaa89f56cb35cd105386eb5.exe
3692	1054af5e9206aa0cb650a4e58900bcd369a554e64eaa89f56cb35cd105386eb5.exe
3692	1054af5e9206aa0cb650a4e58900bcd369a554e64eaa89f56cb35cd105386eb5.exe
3692	1054af5e9206aa0cb650a4e58900bcd369a554e64eaa89f56cb35cd105386eb5.exe
3692	1054af5e9206aa0cb650a4e58900bcd369a554e64eaa89f56cb35cd105386eb5.exe
3692	1054af5e9206aa0cb650a4e58900bcd369a554e64eaa89f56cb35cd105386eb5.exe
3692	1054af5e9206aa0cb650a4e58900bcd369a554e64eaa89f56cb35cd105386eb5.exe
3692	1054af5e9206aa0cb650a4e58900bcd369a554e64eaa89f56cb35cd105386eb5.exe
3692	1054af5e9206aa0cb650a4e58900bcd369a554e64eaa89f56cb35cd105386eb5.exe
3692	1054af5e9206aa0cb650a4e58900bcd369a554e64eaa89f56cb35cd105386eb5.exe
3692	1054af5e9206aa0cb650a4e58900bcd369a554e64eaa89f56cb35cd105386eb5.exe
3692	1054af5e9206aa0cb650a4e58900bcd369a554e64eaa89f56cb35cd105386eb5.exe
3692	1054af5e9206aa0cb650a4e58900bcd369a554e64eaa89f56cb35cd105386eb5.exe
3692	1054af5e9206aa0cb650a4e58900bcd369a554e64eaa89f56cb35cd105386eb5.exe
3692	1054af5e9206aa0cb650a4e58900bcd369a554e64eaa89f56cb35cd105386eb5.exe
3692	1054af5e9206aa0cb650a4e58900bcd369a554e64eaa89f56cb35cd105386eb5.exe
3692	1054af5e9206aa0cb650a4e58900bcd369a554e64eaa89f56cb35cd105386eb5.exe
3692	1054af5e9206aa0cb650a4e58900bcd369a554e64eaa89f56cb35cd105386eb5.exe
3692	1054af5e9206aa0cb650a4e58900bcd369a554e64eaa89f56cb35cd105386eb5.exe
3692	1054af5e9206aa0cb650a4e58900bcd369a554e64eaa89f56cb35cd105386eb5.exe
3692	1054af5e9206aa0cb650a4e58900bcd369a554e64eaa89f56cb35cd105386eb5.exe
3692	1054af5e9206aa0cb650a4e58900bcd369a554e64eaa89f56cb35cd105386eb5.exe
3692	1054af5e9206aa0cb650a4e58900bcd369a554e64eaa89f56cb35cd105386eb5.exe
3692	1054af5e9206aa0cb650a4e58900bcd369a554e64eaa89f56cb35cd105386eb5.exe
3692	1054af5e9206aa0cb650a4e58900bcd369a554e64eaa89f56cb35cd105386eb5.exe
3692	1054af5e9206aa0cb650a4e58900bcd369a554e64eaa89f56cb35cd105386eb5.exe
3692	1054af5e9206aa0cb650a4e58900bcd369a554e64eaa89f56cb35cd105386eb5.exe
3692	1054af5e9206aa0cb650a4e58900bcd369a554e64eaa89f56cb35cd105386eb5.exe
3692	1054af5e9206aa0cb650a4e58900bcd369a554e64eaa89f56cb35cd105386eb5.exe
3692	1054af5e9206aa0cb650a4e58900bcd369a554e64eaa89f56cb35cd105386eb5.exe
3692	1054af5e9206aa0cb650a4e58900bcd369a554e64eaa89f56cb35cd105386eb5.exe
3692	1054af5e9206aa0cb650a4e58900bcd369a554e64eaa89f56cb35cd105386eb5.exe
3692	1054af5e9206aa0cb650a4e58900bcd369a554e64eaa89f56cb35cd105386eb5.exe
3692	1054af5e9206aa0cb650a4e58900bcd369a554e64eaa89f56cb35cd105386eb5.exe
3692	1054af5e9206aa0cb650a4e58900bcd369a554e64eaa89f56cb35cd105386eb5.exe
3692	1054af5e9206aa0cb650a4e58900bcd369a554e64eaa89f56cb35cd105386eb5.exe
3692	1054af5e9206aa0cb650a4e58900bcd369a554e64eaa89f56cb35cd105386eb5.exe
3692	1054af5e9206aa0cb650a4e58900bcd369a554e64eaa89f56cb35cd105386eb5.exe
3692	1054af5e9206aa0cb650a4e58900bcd369a554e64eaa89f56cb35cd105386eb5.exe

Suspicious use of AdjustPrivilegeToken 8 IoCs

description	pid	Process
Token: SeDebugPrivilege	3692	1054af5e9206aa0cb650a4e58900bcd369a554e64eaa89f56cb35cd105386eb5.exe
Token: SeDebugPrivilege	1172	powershell.exe
Token: SeDebugPrivilege	4800	powershell.exe
Token: SeDebugPrivilege	992	powershell.exe
Token: SeDebugPrivilege	2972	powershell.exe
Token: SeDebugPrivilege	1940	powershell.exe
Token: SeDebugPrivilege	1476	powershell.exe
Token: SeDebugPrivilege	1680	sppsvc.exe

Suspicious use of WriteProcessMemory 24 IoCs

description	pid	Process	procid_target
PID 3692 wrote to memory of 4288	3692	1054af5e9206aa0cb650a4e58900bcd369a554e64eaa89f56cb35cd105386eb5.exe	87
PID 3692 wrote to memory of 4288	3692	1054af5e9206aa0cb650a4e58900bcd369a554e64eaa89f56cb35cd105386eb5.exe	87
PID 4288 wrote to memory of 628	4288	csc.exe	89
PID 4288 wrote to memory of 628	4288	csc.exe	89
PID 3692 wrote to memory of 1476	3692	1054af5e9206aa0cb650a4e58900bcd369a554e64eaa89f56cb35cd105386eb5.exe	105
PID 3692 wrote to memory of 1476	3692	1054af5e9206aa0cb650a4e58900bcd369a554e64eaa89f56cb35cd105386eb5.exe	105
PID 3692 wrote to memory of 1940	3692	1054af5e9206aa0cb650a4e58900bcd369a554e64eaa89f56cb35cd105386eb5.exe	106
PID 3692 wrote to memory of 1940	3692	1054af5e9206aa0cb650a4e58900bcd369a554e64eaa89f56cb35cd105386eb5.exe	106
PID 3692 wrote to memory of 1172	3692	1054af5e9206aa0cb650a4e58900bcd369a554e64eaa89f56cb35cd105386eb5.exe	107
PID 3692 wrote to memory of 1172	3692	1054af5e9206aa0cb650a4e58900bcd369a554e64eaa89f56cb35cd105386eb5.exe	107
PID 3692 wrote to memory of 4800	3692	1054af5e9206aa0cb650a4e58900bcd369a554e64eaa89f56cb35cd105386eb5.exe	108
PID 3692 wrote to memory of 4800	3692	1054af5e9206aa0cb650a4e58900bcd369a554e64eaa89f56cb35cd105386eb5.exe	108
PID 3692 wrote to memory of 992	3692	1054af5e9206aa0cb650a4e58900bcd369a554e64eaa89f56cb35cd105386eb5.exe	109
PID 3692 wrote to memory of 992	3692	1054af5e9206aa0cb650a4e58900bcd369a554e64eaa89f56cb35cd105386eb5.exe	109
PID 3692 wrote to memory of 2972	3692	1054af5e9206aa0cb650a4e58900bcd369a554e64eaa89f56cb35cd105386eb5.exe	110
PID 3692 wrote to memory of 2972	3692	1054af5e9206aa0cb650a4e58900bcd369a554e64eaa89f56cb35cd105386eb5.exe	110
PID 3692 wrote to memory of 1064	3692	1054af5e9206aa0cb650a4e58900bcd369a554e64eaa89f56cb35cd105386eb5.exe	117
PID 3692 wrote to memory of 1064	3692	1054af5e9206aa0cb650a4e58900bcd369a554e64eaa89f56cb35cd105386eb5.exe	117
PID 1064 wrote to memory of 4680	1064	cmd.exe	119
PID 1064 wrote to memory of 4680	1064	cmd.exe	119
PID 1064 wrote to memory of 4376	1064	cmd.exe	120
PID 1064 wrote to memory of 4376	1064	cmd.exe	120
PID 1064 wrote to memory of 1680	1064	cmd.exe	127
PID 1064 wrote to memory of 1680	1064	cmd.exe	127

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\1054af5e9206aa0cb650a4e58900bcd369a554e64eaa89f56cb35cd105386eb5.exe
"C:\Users\Admin\AppData\Local\Temp\1054af5e9206aa0cb650a4e58900bcd369a554e64eaa89f56cb35cd105386eb5.exe"
1⤵
- Modifies WinLogon for persistence
- Checks computer location settings
- Adds Run key to start application
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3692
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\iux5hkbw\iux5hkbw.cmdline"
  2⤵
  - Drops file in System32 directory
  - Suspicious use of WriteProcessMemory
  PID:4288
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESFCBF.tmp" "c:\Windows\System32\CSCC8A0CD127904458C969B3432AF9A8A4.TMP"
    3⤵
    PID:628
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\fr-FR\winlogon.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of AdjustPrivilegeToken
  PID:1476
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Windows Defender\it-IT\taskhostw.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of AdjustPrivilegeToken
  PID:1940
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\ModemLogs\winlogon.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of AdjustPrivilegeToken
  PID:1172
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\PrintHood\TextInputHost.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of AdjustPrivilegeToken
  PID:4800
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Windows Multimedia Platform\sppsvc.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of AdjustPrivilegeToken
  PID:992
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\1054af5e9206aa0cb650a4e58900bcd369a554e64eaa89f56cb35cd105386eb5.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of AdjustPrivilegeToken
  PID:2972
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\Q1irsTjqFp.bat"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1064
- - C:\Windows\system32\chcp.com
    chcp 65001
    3⤵
    PID:4680
- - C:\Windows\system32\PING.EXE
    ping -n 10 localhost
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:4376
- - C:\Program Files (x86)\Windows Multimedia Platform\sppsvc.exe
    "C:\Program Files (x86)\Windows Multimedia Platform\sppsvc.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of AdjustPrivilegeToken
    PID:1680

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 14 /tr "'C:\Windows\fr-FR\winlogon.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:664

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogon" /sc ONLOGON /tr "'C:\Windows\fr-FR\winlogon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2608

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 10 /tr "'C:\Windows\fr-FR\winlogon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2444

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostwt" /sc MINUTE /mo 5 /tr "'C:\Program Files (x86)\Windows Defender\it-IT\taskhostw.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4392

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostw" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Defender\it-IT\taskhostw.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1964

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostwt" /sc MINUTE /mo 8 /tr "'C:\Program Files (x86)\Windows Defender\it-IT\taskhostw.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2948

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 6 /tr "'C:\Windows\ModemLogs\winlogon.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2188

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogon" /sc ONLOGON /tr "'C:\Windows\ModemLogs\winlogon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3996

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 13 /tr "'C:\Windows\ModemLogs\winlogon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4716

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "TextInputHostT" /sc MINUTE /mo 6 /tr "'C:\Users\Admin\PrintHood\TextInputHost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1256

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "TextInputHost" /sc ONLOGON /tr "'C:\Users\Admin\PrintHood\TextInputHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:624

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "TextInputHostT" /sc MINUTE /mo 13 /tr "'C:\Users\Admin\PrintHood\TextInputHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1960

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 7 /tr "'C:\Program Files (x86)\Windows Multimedia Platform\sppsvc.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2920

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvc" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Multimedia Platform\sppsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5004

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 9 /tr "'C:\Program Files (x86)\Windows Multimedia Platform\sppsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1828

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "1054af5e9206aa0cb650a4e58900bcd369a554e64eaa89f56cb35cd105386eb51" /sc MINUTE /mo 8 /tr "'C:\Users\Admin\AppData\Local\Temp\1054af5e9206aa0cb650a4e58900bcd369a554e64eaa89f56cb35cd105386eb5.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4544

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "1054af5e9206aa0cb650a4e58900bcd369a554e64eaa89f56cb35cd105386eb5" /sc ONLOGON /tr "'C:\Users\Admin\AppData\Local\Temp\1054af5e9206aa0cb650a4e58900bcd369a554e64eaa89f56cb35cd105386eb5.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3192

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "1054af5e9206aa0cb650a4e58900bcd369a554e64eaa89f56cb35cd105386eb51" /sc MINUTE /mo 5 /tr "'C:\Users\Admin\AppData\Local\Temp\1054af5e9206aa0cb650a4e58900bcd369a554e64eaa89f56cb35cd105386eb5.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3952

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
d85ba6ff808d9e5444a4b369f5bc2730

SHA1
31aa9d96590fff6981b315e0b391b575e4c0804a

SHA256
84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

SHA512
8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
6d3e9c29fe44e90aae6ed30ccf799ca8

SHA1
c7974ef72264bbdf13a2793ccf1aed11bc565dce

SHA256
2360634e63e8f0b5748e2c56ebb8f4aa78e71008ea7b5c9ca1c49be03b49557d

SHA512
60c38c4367352537545d859f64b9c5cbada94240478d1d039fd27b5ecba4dc1c90051557c16d802269703b873546ead416279c0a80c6fd5e49ad361cef22596a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
d28a889fd956d5cb3accfbaf1143eb6f

SHA1
157ba54b365341f8ff06707d996b3635da8446f7

SHA256
21e5d7ccf80a293e6ba30ed728846ca19c929c52b96e2c8d34e27cd2234f1d45

SHA512
0b6d88deb9be85722e6a78d5886d49f2caf407a59e128d2b4ed74c1356f9928c40048a62731959f2460e9ff9d9feee311043d2a37abe3bb92c2b76a44281478c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Q1irsTjqFp.bat

Filesize
189B

MD5
f1d1a99362af9a0e3dab17236083d15f

SHA1
45982bbd07c5ac711e1390c9f42af5c0c99e7674

SHA256
ac7c7cf4e6a7e4029fd658651c0ab1ad82350629993f3505d97ef84405336085

SHA512
4f6d6be1942675348fa2c3b69631a72b7c2500823c41d335352f95f3afd93ec4e38f664ea526d871403143e14a891a7d7eb9918baf2105cf41c33851f1a88e35

Download Submit
C:\Users\Admin\AppData\Local\Temp\RESFCBF.tmp

Filesize
1KB

MD5
6e3f436b348e7a72badb3e7b2f53c5c2

SHA1
71d8be2808d8cb136ca9a847eeaad498d4495225

SHA256
e640520209dab904f0ad258065488b83a44d3d7eb9426d3848f88cf8759dee5a

SHA512
cfa11865499f911c50cb1e64af0dcae2f71c1e99db82851512635b37acbe9334325b2d115cf47a392294a4bd89da6d409e33ec4ecc100a65bb79afa7ea34721c

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_vbbn0z4q.eob.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Windows\fr-FR\winlogon.exe

Filesize
829KB

MD5
c1f1bea182f1c3477c2f133c3ac26930

SHA1
2145c09d2c3279ac83e844c4d80e7aa219e99b8d

SHA256
1054af5e9206aa0cb650a4e58900bcd369a554e64eaa89f56cb35cd105386eb5

SHA512
6af6336782b29bdab906e4d289cb5c2c8500ba8a20dee53def21960e62afc28ec6756b746b4e4036a30726984a60b656b3d529b4abc119953267e91be4992a4d

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\iux5hkbw\iux5hkbw.0.cs

Filesize
361B

MD5
10d2c2d6cc5bfae73affc9ecba0c69d0

SHA1
9c60bdfbb19d2fb0f26bc6352ef23e0b5a22e017

SHA256
3650c3522b3a54fa3d7cf1004a394b8b37ab4c62ff19200603e309b3bc818643

SHA512
c1422cc4933cd940607b769a229ed6348a03e15322092a9439610e58e95a044b7bb950b6422307d0cfd1b4210b0c0a758451c3d8d3eeb0ba87e8179b6e49e196

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\iux5hkbw\iux5hkbw.cmdline

Filesize
235B

MD5
fe975ef728a7e43e6f4888f8b5efbf6e

SHA1
ffa6f12f67b024dee205839a4d153fc04cf64277

SHA256
0cececbd8faa3ea14a20b0f3464034af3fffbfd2cf5180bebc768c00bde0c5bf

SHA512
86205bccbf8e5338feb76dbf84a67049a45da9d53718605ef16f7b4361fcf3b42200c8a11c9600c329abfee18d07e8e298be8685689c4d498e3dbfa026cf0cca

Download Submit
\??\c:\Windows\System32\CSCC8A0CD127904458C969B3432AF9A8A4.TMP

Filesize
1KB

MD5
1c519e4618f2b468d0f490d4a716da11

SHA1
1a693d0046e48fa813e4fa3bb94ccd20d43e3106

SHA256
4dbf16e3b3bb06c98eeaf27d0a25d9f34ee0ceac51e6365218ef7cd09edb3438

SHA512
99f293878a08b56db6ff2297f243f5f5b85864e6925a1d6af61a65369f7eb323ae1b75fe5f1465fac0b982ac9f49b9e0a295b5dac947da40f61991c4411233fd

Download Submit
memory/1172-69-0x000001F8F8C40000-0x000001F8F8C62000-memory.dmp

Filesize
136KB

Download
memory/3692-30-0x00007FF8AC370000-0x00007FF8ACE31000-memory.dmp

Filesize
10.8MB

Download
memory/3692-11-0x0000000001580000-0x000000000158E000-memory.dmp

Filesize
56KB

Download
memory/3692-29-0x00007FF8AC370000-0x00007FF8ACE31000-memory.dmp

Filesize
10.8MB

Download
memory/3692-0-0x00007FF8AC373000-0x00007FF8AC375000-memory.dmp

Filesize
8KB

Download
memory/3692-34-0x00007FF8AC370000-0x00007FF8ACE31000-memory.dmp

Filesize
10.8MB

Download
memory/3692-35-0x00007FF8AC370000-0x00007FF8ACE31000-memory.dmp

Filesize
10.8MB

Download
memory/3692-16-0x0000000002D90000-0x0000000002D9C000-memory.dmp

Filesize
48KB

Download
memory/3692-14-0x00007FF8AC370000-0x00007FF8ACE31000-memory.dmp

Filesize
10.8MB

Download
memory/3692-13-0x0000000001590000-0x0000000001598000-memory.dmp

Filesize
32KB

Download
memory/3692-17-0x00007FF8AC370000-0x00007FF8ACE31000-memory.dmp

Filesize
10.8MB

Download
memory/3692-50-0x00007FF8AC370000-0x00007FF8ACE31000-memory.dmp

Filesize
10.8MB

Download
memory/3692-9-0x0000000002D70000-0x0000000002D88000-memory.dmp

Filesize
96KB

Download
memory/3692-7-0x000000001B7C0000-0x000000001B810000-memory.dmp

Filesize
320KB

Download
memory/3692-6-0x0000000002D50000-0x0000000002D6C000-memory.dmp

Filesize
112KB

Download
memory/3692-4-0x0000000001570000-0x000000000157E000-memory.dmp

Filesize
56KB

Download
memory/3692-2-0x00007FF8AC370000-0x00007FF8ACE31000-memory.dmp

Filesize
10.8MB

Download
memory/3692-1-0x0000000000BD0000-0x0000000000CA6000-memory.dmp

Filesize
856KB

Download