dcrat | 37393231ee6c2f1e4e81bb820867302f509abe5108d7e6eac891fe1ab4b66ca5

Analysis

max time kernel
102s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20250314-en
resource tags

arch:x64arch:x86image:win10v2004-20250314-enlocale:en-usos:windows10-2004-x64system
submitted
22/03/2025, 06:15

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b6baedc86ebdd4c9c3cc812f509f777b.exe
Size

999KB
MD5

b6baedc86ebdd4c9c3cc812f509f777b
SHA1

1dfd321978faba568b114ef07a663e799899b0c4
SHA256

7197f07c5612e994e7f66a40975e6ebc328847ab957ba0c84625e1c9f4543c69
SHA512

6b292e829209cfc6e2f7c7cd2c4afc4ce77cd36042e9af9494ad934f1ff840f7050511c09a54fcf9b4e2fafd27492ae7ba295bf8783e4158ed369b4c20440aa1
SSDEEP

12288:H9pLLk45WSSY1BX6f4bIS7rMNetPfC9Vs6IFGs0jxAqXj9xPSI0dzNgCoD7WX+Iu:H9pP5WS3lrMNyC9TJPCXBi

Score

10^/10

dcrat infostealer persistence rat

Malware Config

Signatures

DcRat 44 IoCs

DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

rat infostealer dcrat

pid	Process
4664	schtasks.exe
4764	schtasks.exe
2900	schtasks.exe
4188	schtasks.exe
2184	schtasks.exe
2156	schtasks.exe
1888	schtasks.exe
4860	schtasks.exe
4688	schtasks.exe
4728	schtasks.exe
380	schtasks.exe
620	schtasks.exe
4504	schtasks.exe
4348	schtasks.exe
4840	schtasks.exe
5988	schtasks.exe
4864	schtasks.exe
4408	schtasks.exe
4852	schtasks.exe
864	schtasks.exe
1220	schtasks.exe
4708	schtasks.exe
2932	schtasks.exe
4644	schtasks.exe
5740	schtasks.exe
5520	schtasks.exe
3260	schtasks.exe
4956	schtasks.exe
5980	schtasks.exe
2992	schtasks.exe
4756	schtasks.exe
5500	schtasks.exe
4784	schtasks.exe
4416	schtasks.exe
4684	schtasks.exe
6048	schtasks.exe
5720	schtasks.exe
4940	schtasks.exe
3556	schtasks.exe
4544	schtasks.exe
1044	schtasks.exe
2352	schtasks.exe
4996	schtasks.exe
4300	schtasks.exe

Dcrat family
dcrat

Modifies WinLogon for persistence 2 TTPs 11 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\ProgramData\\Microsoft\\StartMenuExperienceHost.exe\", \"C:\\Program Files\\Crashpad\\attachments\\TextInputHost.exe\", \"C:\\Recovery\\WindowsRE\\taskhostw.exe\", \"C:\\Windows\\Help\\en-US\\lsass.exe\", \"C:\\7e20f84d5244aba7145631d4073af8\\sysmon.exe\""	b6baedc86ebdd4c9c3cc812f509f777b.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\ProgramData\\Microsoft\\StartMenuExperienceHost.exe\", \"C:\\Program Files\\Crashpad\\attachments\\TextInputHost.exe\", \"C:\\Recovery\\WindowsRE\\taskhostw.exe\", \"C:\\Windows\\Help\\en-US\\lsass.exe\", \"C:\\7e20f84d5244aba7145631d4073af8\\sysmon.exe\", \"C:\\Program Files (x86)\\Windows NT\\Accessories\\en-US\\winlogon.exe\", \"C:\\Program Files (x86)\\Windows Mail\\RuntimeBroker.exe\""	b6baedc86ebdd4c9c3cc812f509f777b.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\ProgramData\\Microsoft\\StartMenuExperienceHost.exe\", \"C:\\Program Files\\Crashpad\\attachments\\TextInputHost.exe\", \"C:\\Recovery\\WindowsRE\\taskhostw.exe\", \"C:\\Windows\\Help\\en-US\\lsass.exe\", \"C:\\7e20f84d5244aba7145631d4073af8\\sysmon.exe\", \"C:\\Program Files (x86)\\Windows NT\\Accessories\\en-US\\winlogon.exe\", \"C:\\Program Files (x86)\\Windows Mail\\RuntimeBroker.exe\", \"C:\\Program Files\\Crashpad\\winlogon.exe\", \"C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\spoolsv.exe\", \"C:\\Windows\\DigitalLocker\\en-US\\spoolsv.exe\""	b6baedc86ebdd4c9c3cc812f509f777b.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\ProgramData\\Microsoft\\StartMenuExperienceHost.exe\", \"C:\\Program Files\\Crashpad\\attachments\\TextInputHost.exe\", \"C:\\Recovery\\WindowsRE\\taskhostw.exe\", \"C:\\Windows\\Help\\en-US\\lsass.exe\", \"C:\\7e20f84d5244aba7145631d4073af8\\sysmon.exe\", \"C:\\Program Files (x86)\\Windows NT\\Accessories\\en-US\\winlogon.exe\", \"C:\\Program Files (x86)\\Windows Mail\\RuntimeBroker.exe\", \"C:\\Program Files\\Crashpad\\winlogon.exe\", \"C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\spoolsv.exe\", \"C:\\Windows\\DigitalLocker\\en-US\\spoolsv.exe\", \"C:\\Windows\\SystemApps\\Microsoft.Windows.XGpuEjectDialog_cw5n1h2txyewy\\microsoft.system.package.metadata\\Autogen\\wininit.exe\""	b6baedc86ebdd4c9c3cc812f509f777b.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\ProgramData\\Microsoft\\StartMenuExperienceHost.exe\""	b6baedc86ebdd4c9c3cc812f509f777b.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\ProgramData\\Microsoft\\StartMenuExperienceHost.exe\", \"C:\\Program Files\\Crashpad\\attachments\\TextInputHost.exe\", \"C:\\Recovery\\WindowsRE\\taskhostw.exe\""	b6baedc86ebdd4c9c3cc812f509f777b.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\ProgramData\\Microsoft\\StartMenuExperienceHost.exe\", \"C:\\Program Files\\Crashpad\\attachments\\TextInputHost.exe\", \"C:\\Recovery\\WindowsRE\\taskhostw.exe\", \"C:\\Windows\\Help\\en-US\\lsass.exe\""	b6baedc86ebdd4c9c3cc812f509f777b.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\ProgramData\\Microsoft\\StartMenuExperienceHost.exe\", \"C:\\Program Files\\Crashpad\\attachments\\TextInputHost.exe\", \"C:\\Recovery\\WindowsRE\\taskhostw.exe\", \"C:\\Windows\\Help\\en-US\\lsass.exe\", \"C:\\7e20f84d5244aba7145631d4073af8\\sysmon.exe\", \"C:\\Program Files (x86)\\Windows NT\\Accessories\\en-US\\winlogon.exe\""	b6baedc86ebdd4c9c3cc812f509f777b.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\ProgramData\\Microsoft\\StartMenuExperienceHost.exe\", \"C:\\Program Files\\Crashpad\\attachments\\TextInputHost.exe\", \"C:\\Recovery\\WindowsRE\\taskhostw.exe\", \"C:\\Windows\\Help\\en-US\\lsass.exe\", \"C:\\7e20f84d5244aba7145631d4073af8\\sysmon.exe\", \"C:\\Program Files (x86)\\Windows NT\\Accessories\\en-US\\winlogon.exe\", \"C:\\Program Files (x86)\\Windows Mail\\RuntimeBroker.exe\", \"C:\\Program Files\\Crashpad\\winlogon.exe\""	b6baedc86ebdd4c9c3cc812f509f777b.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\ProgramData\\Microsoft\\StartMenuExperienceHost.exe\", \"C:\\Program Files\\Crashpad\\attachments\\TextInputHost.exe\", \"C:\\Recovery\\WindowsRE\\taskhostw.exe\", \"C:\\Windows\\Help\\en-US\\lsass.exe\", \"C:\\7e20f84d5244aba7145631d4073af8\\sysmon.exe\", \"C:\\Program Files (x86)\\Windows NT\\Accessories\\en-US\\winlogon.exe\", \"C:\\Program Files (x86)\\Windows Mail\\RuntimeBroker.exe\", \"C:\\Program Files\\Crashpad\\winlogon.exe\", \"C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\spoolsv.exe\""	b6baedc86ebdd4c9c3cc812f509f777b.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\ProgramData\\Microsoft\\StartMenuExperienceHost.exe\", \"C:\\Program Files\\Crashpad\\attachments\\TextInputHost.exe\""	b6baedc86ebdd4c9c3cc812f509f777b.exe

Process spawned unexpected child process 44 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5988	2124	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2900	2124	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1044	2124	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1888	2124	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	864	2124	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4300	2124	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1220	2124	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4784	2124	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4416	2124	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4408	2124	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4544	2124	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4644	2124	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4664	2124	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4684	2124	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4688	2124	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4708	2124	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4852	2124	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4504	2124	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	6048	2124	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4348	2124	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3556	2124	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	620	2124	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2352	2124	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4188	2124	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2156	2124	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5500	2124	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3260	2124	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	380	2124	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4728	2124	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4756	2124	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4840	2124	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4860	2124	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4764	2124	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4996	2124	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4864	2124	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4940	2124	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4956	2124	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5740	2124	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5520	2124	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5980	2124	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5720	2124	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2992	2124	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2184	2124	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2932	2124	schtasks.exe	86

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-308834014-1004923324-1191300197-1000\Control Panel\International\Geo\Nation	b6baedc86ebdd4c9c3cc812f509f777b.exe

Executes dropped EXE 1 IoCs

pid	Process
5068	RuntimeBroker.exe

Adds Run key to start application 2 TTPs 11 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\StartMenuExperienceHost = "\"C:\\ProgramData\\Microsoft\\StartMenuExperienceHost.exe\""	b6baedc86ebdd4c9c3cc812f509f777b.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\TextInputHost = "\"C:\\Program Files\\Crashpad\\attachments\\TextInputHost.exe\""	b6baedc86ebdd4c9c3cc812f509f777b.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\taskhostw = "\"C:\\Recovery\\WindowsRE\\taskhostw.exe\""	b6baedc86ebdd4c9c3cc812f509f777b.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sysmon = "\"C:\\7e20f84d5244aba7145631d4073af8\\sysmon.exe\""	b6baedc86ebdd4c9c3cc812f509f777b.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RuntimeBroker = "\"C:\\Program Files (x86)\\Windows Mail\\RuntimeBroker.exe\""	b6baedc86ebdd4c9c3cc812f509f777b.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\winlogon = "\"C:\\Program Files\\Crashpad\\winlogon.exe\""	b6baedc86ebdd4c9c3cc812f509f777b.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\spoolsv = "\"C:\\Windows\\DigitalLocker\\en-US\\spoolsv.exe\""	b6baedc86ebdd4c9c3cc812f509f777b.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\wininit = "\"C:\\Windows\\SystemApps\\Microsoft.Windows.XGpuEjectDialog_cw5n1h2txyewy\\microsoft.system.package.metadata\\Autogen\\wininit.exe\""	b6baedc86ebdd4c9c3cc812f509f777b.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\lsass = "\"C:\\Windows\\Help\\en-US\\lsass.exe\""	b6baedc86ebdd4c9c3cc812f509f777b.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\winlogon = "\"C:\\Program Files (x86)\\Windows NT\\Accessories\\en-US\\winlogon.exe\""	b6baedc86ebdd4c9c3cc812f509f777b.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\spoolsv = "\"C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\spoolsv.exe\""	b6baedc86ebdd4c9c3cc812f509f777b.exe

Drops file in Program Files directory 25 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Windows Mail\RuntimeBroker.exe	b6baedc86ebdd4c9c3cc812f509f777b.exe
File created	C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\f3b6ecef712a24	b6baedc86ebdd4c9c3cc812f509f777b.exe
File opened for modification	C:\Program Files\Crashpad\attachments\RCX8B5D.tmp	b6baedc86ebdd4c9c3cc812f509f777b.exe
File opened for modification	C:\Program Files (x86)\Windows NT\Accessories\en-US\RCX93B1.tmp	b6baedc86ebdd4c9c3cc812f509f777b.exe
File opened for modification	C:\Program Files (x86)\Windows NT\Accessories\en-US\winlogon.exe	b6baedc86ebdd4c9c3cc812f509f777b.exe
File created	C:\Program Files\Crashpad\attachments\TextInputHost.exe	b6baedc86ebdd4c9c3cc812f509f777b.exe
File created	C:\Program Files\Crashpad\attachments\22eafd247d37c3	b6baedc86ebdd4c9c3cc812f509f777b.exe
File created	C:\Program Files (x86)\Windows NT\Accessories\en-US\winlogon.exe	b6baedc86ebdd4c9c3cc812f509f777b.exe
File created	C:\Program Files\Crashpad\cc11b995f2a76d	b6baedc86ebdd4c9c3cc812f509f777b.exe
File opened for modification	C:\Program Files (x86)\Windows Mail\RuntimeBroker.exe	b6baedc86ebdd4c9c3cc812f509f777b.exe
File opened for modification	C:\Program Files\Crashpad\RCX9839.tmp	b6baedc86ebdd4c9c3cc812f509f777b.exe
File opened for modification	C:\Program Files\Crashpad\RCX983A.tmp	b6baedc86ebdd4c9c3cc812f509f777b.exe
File opened for modification	C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\RCX9A40.tmp	b6baedc86ebdd4c9c3cc812f509f777b.exe
File created	C:\Program Files (x86)\Windows Mail\9e8d7a4ca61bd9	b6baedc86ebdd4c9c3cc812f509f777b.exe
File opened for modification	C:\Program Files\Crashpad\attachments\RCX8B5C.tmp	b6baedc86ebdd4c9c3cc812f509f777b.exe
File opened for modification	C:\Program Files\Crashpad\attachments\TextInputHost.exe	b6baedc86ebdd4c9c3cc812f509f777b.exe
File opened for modification	C:\Program Files (x86)\Windows NT\Accessories\en-US\RCX93B2.tmp	b6baedc86ebdd4c9c3cc812f509f777b.exe
File opened for modification	C:\Program Files (x86)\Windows Mail\RCX95B6.tmp	b6baedc86ebdd4c9c3cc812f509f777b.exe
File opened for modification	C:\Program Files\Crashpad\winlogon.exe	b6baedc86ebdd4c9c3cc812f509f777b.exe
File opened for modification	C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\spoolsv.exe	b6baedc86ebdd4c9c3cc812f509f777b.exe
File created	C:\Program Files (x86)\Windows NT\Accessories\en-US\cc11b995f2a76d	b6baedc86ebdd4c9c3cc812f509f777b.exe
File created	C:\Program Files\Crashpad\winlogon.exe	b6baedc86ebdd4c9c3cc812f509f777b.exe
File created	C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\spoolsv.exe	b6baedc86ebdd4c9c3cc812f509f777b.exe
File opened for modification	C:\Program Files (x86)\Windows Mail\RCX95B7.tmp	b6baedc86ebdd4c9c3cc812f509f777b.exe
File opened for modification	C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\RCX9A3F.tmp	b6baedc86ebdd4c9c3cc812f509f777b.exe

Drops file in Windows directory 15 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Help\en-US\RCX8FA5.tmp	b6baedc86ebdd4c9c3cc812f509f777b.exe
File opened for modification	C:\Windows\Help\en-US\RCX8FA6.tmp	b6baedc86ebdd4c9c3cc812f509f777b.exe
File opened for modification	C:\Windows\DigitalLocker\en-US\RCX9C44.tmp	b6baedc86ebdd4c9c3cc812f509f777b.exe
File created	C:\Windows\Help\en-US\lsass.exe	b6baedc86ebdd4c9c3cc812f509f777b.exe
File opened for modification	C:\Windows\Help\en-US\lsass.exe	b6baedc86ebdd4c9c3cc812f509f777b.exe
File opened for modification	C:\Windows\DigitalLocker\en-US\spoolsv.exe	b6baedc86ebdd4c9c3cc812f509f777b.exe
File opened for modification	C:\Windows\SystemApps\Microsoft.Windows.XGpuEjectDialog_cw5n1h2txyewy\microsoft.system.package.metadata\Autogen\wininit.exe	b6baedc86ebdd4c9c3cc812f509f777b.exe
File created	C:\Windows\Help\en-US\6203df4a6bafc7	b6baedc86ebdd4c9c3cc812f509f777b.exe
File created	C:\Windows\DigitalLocker\en-US\spoolsv.exe	b6baedc86ebdd4c9c3cc812f509f777b.exe
File created	C:\Windows\DigitalLocker\en-US\f3b6ecef712a24	b6baedc86ebdd4c9c3cc812f509f777b.exe
File opened for modification	C:\Windows\SystemApps\Microsoft.Windows.XGpuEjectDialog_cw5n1h2txyewy\microsoft.system.package.metadata\Autogen\RCX9EC7.tmp	b6baedc86ebdd4c9c3cc812f509f777b.exe
File opened for modification	C:\Windows\SystemApps\Microsoft.Windows.XGpuEjectDialog_cw5n1h2txyewy\microsoft.system.package.metadata\Autogen\RCX9F35.tmp	b6baedc86ebdd4c9c3cc812f509f777b.exe
File created	C:\Windows\SystemApps\Microsoft.Windows.XGpuEjectDialog_cw5n1h2txyewy\microsoft.system.package.metadata\Autogen\wininit.exe	b6baedc86ebdd4c9c3cc812f509f777b.exe
File opened for modification	C:\Windows\DigitalLocker\en-US\RCX9C45.tmp	b6baedc86ebdd4c9c3cc812f509f777b.exe
File created	C:\Windows\SystemApps\Microsoft.Windows.XGpuEjectDialog_cw5n1h2txyewy\microsoft.system.package.metadata\Autogen\56085415360792	b6baedc86ebdd4c9c3cc812f509f777b.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Scheduled Task/Job: Scheduled Task 1 TTPs 44 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
620	schtasks.exe
4188	schtasks.exe
4728	schtasks.exe
4756	schtasks.exe
4688	schtasks.exe
2352	schtasks.exe
4840	schtasks.exe
4864	schtasks.exe
4940	schtasks.exe
5520	schtasks.exe
2992	schtasks.exe
1220	schtasks.exe
4408	schtasks.exe
4708	schtasks.exe
4504	schtasks.exe
5500	schtasks.exe
4764	schtasks.exe
4956	schtasks.exe
5740	schtasks.exe
5988	schtasks.exe
4300	schtasks.exe
4784	schtasks.exe
4644	schtasks.exe
1888	schtasks.exe
4664	schtasks.exe
4860	schtasks.exe
5980	schtasks.exe
2184	schtasks.exe
864	schtasks.exe
3556	schtasks.exe
5720	schtasks.exe
2932	schtasks.exe
2156	schtasks.exe
3260	schtasks.exe
380	schtasks.exe
2900	schtasks.exe
4544	schtasks.exe
4684	schtasks.exe
4852	schtasks.exe
4996	schtasks.exe
1044	schtasks.exe
4416	schtasks.exe
6048	schtasks.exe
4348	schtasks.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
360	b6baedc86ebdd4c9c3cc812f509f777b.exe
360	b6baedc86ebdd4c9c3cc812f509f777b.exe
360	b6baedc86ebdd4c9c3cc812f509f777b.exe
360	b6baedc86ebdd4c9c3cc812f509f777b.exe
360	b6baedc86ebdd4c9c3cc812f509f777b.exe
360	b6baedc86ebdd4c9c3cc812f509f777b.exe
360	b6baedc86ebdd4c9c3cc812f509f777b.exe
360	b6baedc86ebdd4c9c3cc812f509f777b.exe
360	b6baedc86ebdd4c9c3cc812f509f777b.exe
360	b6baedc86ebdd4c9c3cc812f509f777b.exe
360	b6baedc86ebdd4c9c3cc812f509f777b.exe
360	b6baedc86ebdd4c9c3cc812f509f777b.exe
360	b6baedc86ebdd4c9c3cc812f509f777b.exe
360	b6baedc86ebdd4c9c3cc812f509f777b.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	360	b6baedc86ebdd4c9c3cc812f509f777b.exe
Token: SeDebugPrivilege	5068	RuntimeBroker.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 360 wrote to memory of 5068	360	b6baedc86ebdd4c9c3cc812f509f777b.exe	135
PID 360 wrote to memory of 5068	360	b6baedc86ebdd4c9c3cc812f509f777b.exe	135

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\b6baedc86ebdd4c9c3cc812f509f777b.exe
"C:\Users\Admin\AppData\Local\Temp\b6baedc86ebdd4c9c3cc812f509f777b.exe"
1⤵
- Modifies WinLogon for persistence
- Checks computer location settings
- Adds Run key to start application
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:360
- C:\Program Files (x86)\Windows Mail\RuntimeBroker.exe
  "C:\Program Files (x86)\Windows Mail\RuntimeBroker.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:5068

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "StartMenuExperienceHost" /sc MINUTE /mo 8 /tr "'C:\ProgramData\Microsoft\StartMenuExperienceHost.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2900

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "StartMenuExperienceHost" /sc ONLOGON /tr "'C:\ProgramData\Microsoft\StartMenuExperienceHost.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5988

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "StartMenuExperienceHost" /sc ONSTART /tr "'C:\ProgramData\Microsoft\StartMenuExperienceHost.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1044

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "StartMenuExperienceHostS" /sc MINUTE /mo 11 /tr "'C:\ProgramData\Microsoft\StartMenuExperienceHost.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1888

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "TextInputHost" /sc MINUTE /mo 7 /tr "'C:\Program Files\Crashpad\attachments\TextInputHost.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:864

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "TextInputHost" /sc ONLOGON /tr "'C:\Program Files\Crashpad\attachments\TextInputHost.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4300

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "TextInputHost" /sc ONSTART /tr "'C:\Program Files\Crashpad\attachments\TextInputHost.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1220

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "TextInputHostT" /sc MINUTE /mo 12 /tr "'C:\Program Files\Crashpad\attachments\TextInputHost.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4784

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostw" /sc MINUTE /mo 9 /tr "'C:\Recovery\WindowsRE\taskhostw.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4416

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostw" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\taskhostw.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4408

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostw" /sc ONSTART /tr "'C:\Recovery\WindowsRE\taskhostw.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4544

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostwt" /sc MINUTE /mo 5 /tr "'C:\Recovery\WindowsRE\taskhostw.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4644

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsass" /sc MINUTE /mo 5 /tr "'C:\Windows\Help\en-US\lsass.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4664

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsass" /sc ONLOGON /tr "'C:\Windows\Help\en-US\lsass.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4684

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsass" /sc ONSTART /tr "'C:\Windows\Help\en-US\lsass.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4688

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 12 /tr "'C:\Windows\Help\en-US\lsass.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4708

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sysmon" /sc MINUTE /mo 5 /tr "'C:\7e20f84d5244aba7145631d4073af8\sysmon.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4852

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sysmon" /sc ONLOGON /tr "'C:\7e20f84d5244aba7145631d4073af8\sysmon.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4504

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sysmon" /sc ONSTART /tr "'C:\7e20f84d5244aba7145631d4073af8\sysmon.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:6048

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sysmons" /sc MINUTE /mo 11 /tr "'C:\7e20f84d5244aba7145631d4073af8\sysmon.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4348

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogon" /sc MINUTE /mo 13 /tr "'C:\Program Files (x86)\Windows NT\Accessories\en-US\winlogon.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3556

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogon" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows NT\Accessories\en-US\winlogon.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:620

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogon" /sc ONSTART /tr "'C:\Program Files (x86)\Windows NT\Accessories\en-US\winlogon.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2352

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 13 /tr "'C:\Program Files (x86)\Windows NT\Accessories\en-US\winlogon.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4188

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc MINUTE /mo 14 /tr "'C:\Program Files (x86)\Windows Mail\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2156

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Mail\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5500

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONSTART /tr "'C:\Program Files (x86)\Windows Mail\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3260

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 6 /tr "'C:\Program Files (x86)\Windows Mail\RuntimeBroker.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:380

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogon" /sc MINUTE /mo 5 /tr "'C:\Program Files\Crashpad\winlogon.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4728

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogon" /sc ONLOGON /tr "'C:\Program Files\Crashpad\winlogon.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4756

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogon" /sc ONSTART /tr "'C:\Program Files\Crashpad\winlogon.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4840

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 7 /tr "'C:\Program Files\Crashpad\winlogon.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4860

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsv" /sc MINUTE /mo 5 /tr "'C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\spoolsv.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4764

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsv" /sc ONLOGON /tr "'C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\spoolsv.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4996

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsv" /sc ONSTART /tr "'C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\spoolsv.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4864

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 8 /tr "'C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\spoolsv.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4940

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsv" /sc MINUTE /mo 12 /tr "'C:\Windows\DigitalLocker\en-US\spoolsv.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4956

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsv" /sc ONLOGON /tr "'C:\Windows\DigitalLocker\en-US\spoolsv.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5740

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsv" /sc ONSTART /tr "'C:\Windows\DigitalLocker\en-US\spoolsv.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5520

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 5 /tr "'C:\Windows\DigitalLocker\en-US\spoolsv.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5980

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininit" /sc MINUTE /mo 9 /tr "'C:\Windows\SystemApps\Microsoft.Windows.XGpuEjectDialog_cw5n1h2txyewy\microsoft.system.package.metadata\Autogen\wininit.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5720

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininit" /sc ONLOGON /tr "'C:\Windows\SystemApps\Microsoft.Windows.XGpuEjectDialog_cw5n1h2txyewy\microsoft.system.package.metadata\Autogen\wininit.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2992

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininit" /sc ONSTART /tr "'C:\Windows\SystemApps\Microsoft.Windows.XGpuEjectDialog_cw5n1h2txyewy\microsoft.system.package.metadata\Autogen\wininit.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2184

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 8 /tr "'C:\Windows\SystemApps\Microsoft.Windows.XGpuEjectDialog_cw5n1h2txyewy\microsoft.system.package.metadata\Autogen\wininit.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2932

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\7e20f84d5244aba7145631d4073af8\sysmon.exe

Filesize
999KB

MD5
b6baedc86ebdd4c9c3cc812f509f777b

SHA1
1dfd321978faba568b114ef07a663e799899b0c4

SHA256
7197f07c5612e994e7f66a40975e6ebc328847ab957ba0c84625e1c9f4543c69

SHA512
6b292e829209cfc6e2f7c7cd2c4afc4ce77cd36042e9af9494ad934f1ff840f7050511c09a54fcf9b4e2fafd27492ae7ba295bf8783e4158ed369b4c20440aa1

Download Submit
C:\Program Files\Crashpad\RCX9839.tmp

Filesize
999KB

MD5
e8c70df554df1ca89c60e83ca685482d

SHA1
c6de6f8478745600130361e2eea016087ef299a6

SHA256
baa0625e4443a768a2633de2c9569202d8d3415c548ee32275bdc337be3ecf0f

SHA512
7b7e19770a5cfc8d8fa3c2763d9762884bc24b271f25df905adebeeaf7b353accbfbbabf5ed6d5f201eb92d35f266f6d59c8ae6b792c8721a5f6b0169ed1341c

Download Submit
memory/360-7-0x0000000002F60000-0x0000000002F70000-memory.dmp

Filesize
64KB

Download
memory/360-9-0x0000000002F80000-0x0000000002F8E000-memory.dmp

Filesize
56KB

Download
memory/360-0-0x00007FFAE86E3000-0x00007FFAE86E5000-memory.dmp

Filesize
8KB

Download
memory/360-5-0x0000000002F40000-0x0000000002F50000-memory.dmp

Filesize
64KB

Download
memory/360-4-0x0000000002FB0000-0x0000000003000000-memory.dmp

Filesize
320KB

Download
memory/360-3-0x0000000001730000-0x000000000174C000-memory.dmp

Filesize
112KB

Download
memory/360-8-0x0000000002F70000-0x0000000002F7C000-memory.dmp

Filesize
48KB

Download
memory/360-6-0x0000000002F50000-0x0000000002F60000-memory.dmp

Filesize
64KB

Download
memory/360-10-0x0000000002F90000-0x0000000002F9C000-memory.dmp

Filesize
48KB

Download
memory/360-11-0x0000000003000000-0x000000000300C000-memory.dmp

Filesize
48KB

Download
memory/360-2-0x00007FFAE86E0000-0x00007FFAE91A1000-memory.dmp

Filesize
10.8MB

Download
memory/360-1-0x0000000000D30000-0x0000000000E30000-memory.dmp

Filesize
1024KB

Download
memory/360-179-0x00007FFAE86E0000-0x00007FFAE91A1000-memory.dmp

Filesize
10.8MB

Download
memory/5068-181-0x000000001CAC0000-0x000000001CBC2000-memory.dmp

Filesize
1.0MB

Download