dcrat | f4111d30be32600233ad61440ff2f9a6484f3ba6c04fae4b522fc09ab0de3831

Analysis

max time kernel
150s
max time network
146s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
22/03/2025, 06:10

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

48dd84f7a2cbfb0a068fa1a74c35fa4983f355dd026648bde3c594d0afe696da.exe
Size

3.3MB
MD5

74da02657baeecb247413687ca835103
SHA1

44f3e5bdc60e9d41d624a1de2154d804a53aa8be
SHA256

48dd84f7a2cbfb0a068fa1a74c35fa4983f355dd026648bde3c594d0afe696da
SHA512

c679fa77c3b8a83e6c8607d77f2ff575ce9903fe8836e850cf12b5c8756f6123411c413e79bc131a1723d6803785c33f24612a4bcedbbb73035d6ec6aa53add1
SSDEEP

49152:Ts51kZEsvhP4KUYTMb5C1JyWdLQqFxLCobXK45p4aE:Ts5eaKhgKUFCo2LP15s

Score

10^/10

dcrat defense_evasion infostealer rat trojan

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat
Dcrat family
dcrat

Process spawned unexpected child process 27 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3028	2596	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2648	2596	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2660	2596	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2512	2596	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2536	2596	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2492	2596	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2564	2596	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2980	2596	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2948	2596	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1824	2596	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1564	2596	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	448	2596	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1760	2596	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1296	2596	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2000	2596	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1644	2596	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1908	2596	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2464	2596	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1328	2596	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1492	2596	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2556	2596	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1736	2596	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1632	2596	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1628	2596	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2016	2596	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2848	2596	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2120	2596	schtasks.exe	31

UAC bypass 3 TTPs 12 IoCs

defense_evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	48dd84f7a2cbfb0a068fa1a74c35fa4983f355dd026648bde3c594d0afe696da.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	wininit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	wininit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	wininit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	wininit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	wininit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	wininit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	48dd84f7a2cbfb0a068fa1a74c35fa4983f355dd026648bde3c594d0afe696da.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	wininit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	wininit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	wininit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	48dd84f7a2cbfb0a068fa1a74c35fa4983f355dd026648bde3c594d0afe696da.exe

DCRat payload 9 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral21/memory/1804-1-0x0000000000180000-0x00000000004CE000-memory.dmp	dcrat
behavioral21/files/0x000500000001a4c5-43.dat	dcrat
behavioral21/files/0x000600000001a4cd-90.dat	dcrat
behavioral21/files/0x000800000001a4bf-124.dat	dcrat
behavioral21/files/0x000700000001a4cf-133.dat	dcrat
behavioral21/files/0x000900000001a4d7-158.dat	dcrat
behavioral21/memory/2068-170-0x0000000000360000-0x00000000006AE000-memory.dmp	dcrat
behavioral21/memory/2840-182-0x0000000001140000-0x000000000148E000-memory.dmp	dcrat
behavioral21/memory/2764-194-0x00000000001C0000-0x000000000050E000-memory.dmp	dcrat

Executes dropped EXE 3 IoCs

pid	Process
2068	wininit.exe
2840	wininit.exe
2764	wininit.exe

Checks whether UAC is enabled 1 TTPs 8 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	wininit.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	48dd84f7a2cbfb0a068fa1a74c35fa4983f355dd026648bde3c594d0afe696da.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	48dd84f7a2cbfb0a068fa1a74c35fa4983f355dd026648bde3c594d0afe696da.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	wininit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	wininit.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	wininit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	wininit.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	wininit.exe

Drops file in Program Files directory 20 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Windows Media Player\Skins\RCX627.tmp	48dd84f7a2cbfb0a068fa1a74c35fa4983f355dd026648bde3c594d0afe696da.exe
File opened for modification	C:\Program Files (x86)\Windows Media Player\Skins\RCX695.tmp	48dd84f7a2cbfb0a068fa1a74c35fa4983f355dd026648bde3c594d0afe696da.exe
File opened for modification	C:\Program Files\Windows Journal\es-ES\dwm.exe	48dd84f7a2cbfb0a068fa1a74c35fa4983f355dd026648bde3c594d0afe696da.exe
File created	C:\Program Files\Windows Journal\es-ES\6cb0b6c459d5d3	48dd84f7a2cbfb0a068fa1a74c35fa4983f355dd026648bde3c594d0afe696da.exe
File created	C:\Program Files (x86)\Windows NT\Accessories\it-IT\56085415360792	48dd84f7a2cbfb0a068fa1a74c35fa4983f355dd026648bde3c594d0afe696da.exe
File opened for modification	C:\Program Files (x86)\Adobe\RCXFF2F.tmp	48dd84f7a2cbfb0a068fa1a74c35fa4983f355dd026648bde3c594d0afe696da.exe
File opened for modification	C:\Program Files (x86)\Windows NT\Accessories\it-IT\RCX3B5.tmp	48dd84f7a2cbfb0a068fa1a74c35fa4983f355dd026648bde3c594d0afe696da.exe
File opened for modification	C:\Program Files (x86)\Windows NT\Accessories\it-IT\wininit.exe	48dd84f7a2cbfb0a068fa1a74c35fa4983f355dd026648bde3c594d0afe696da.exe
File opened for modification	C:\Program Files (x86)\Windows Media Player\Skins\dllhost.exe	48dd84f7a2cbfb0a068fa1a74c35fa4983f355dd026648bde3c594d0afe696da.exe
File created	C:\Program Files\Windows Journal\es-ES\dwm.exe	48dd84f7a2cbfb0a068fa1a74c35fa4983f355dd026648bde3c594d0afe696da.exe
File created	C:\Program Files (x86)\Adobe\Idle.exe	48dd84f7a2cbfb0a068fa1a74c35fa4983f355dd026648bde3c594d0afe696da.exe
File created	C:\Program Files (x86)\Adobe\6ccacd8608530f	48dd84f7a2cbfb0a068fa1a74c35fa4983f355dd026648bde3c594d0afe696da.exe
File created	C:\Program Files (x86)\Windows NT\Accessories\it-IT\wininit.exe	48dd84f7a2cbfb0a068fa1a74c35fa4983f355dd026648bde3c594d0afe696da.exe
File created	C:\Program Files (x86)\Windows Media Player\Skins\dllhost.exe	48dd84f7a2cbfb0a068fa1a74c35fa4983f355dd026648bde3c594d0afe696da.exe
File opened for modification	C:\Program Files (x86)\Adobe\Idle.exe	48dd84f7a2cbfb0a068fa1a74c35fa4983f355dd026648bde3c594d0afe696da.exe
File created	C:\Program Files (x86)\Windows Media Player\Skins\5940a34987c991	48dd84f7a2cbfb0a068fa1a74c35fa4983f355dd026648bde3c594d0afe696da.exe
File opened for modification	C:\Program Files (x86)\Adobe\RCXFF2E.tmp	48dd84f7a2cbfb0a068fa1a74c35fa4983f355dd026648bde3c594d0afe696da.exe
File opened for modification	C:\Program Files\Windows Journal\es-ES\RCX1B0.tmp	48dd84f7a2cbfb0a068fa1a74c35fa4983f355dd026648bde3c594d0afe696da.exe
File opened for modification	C:\Program Files\Windows Journal\es-ES\RCX1B1.tmp	48dd84f7a2cbfb0a068fa1a74c35fa4983f355dd026648bde3c594d0afe696da.exe
File opened for modification	C:\Program Files (x86)\Windows NT\Accessories\it-IT\RCX423.tmp	48dd84f7a2cbfb0a068fa1a74c35fa4983f355dd026648bde3c594d0afe696da.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Scheduled Task/Job: Scheduled Task 1 TTPs 27 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2536	schtasks.exe
2492	schtasks.exe
1824	schtasks.exe
1564	schtasks.exe
448	schtasks.exe
1492	schtasks.exe
2556	schtasks.exe
1736	schtasks.exe
2648	schtasks.exe
2564	schtasks.exe
2000	schtasks.exe
1644	schtasks.exe
2016	schtasks.exe
2848	schtasks.exe
2120	schtasks.exe
2512	schtasks.exe
2980	schtasks.exe
2948	schtasks.exe
1328	schtasks.exe
1632	schtasks.exe
3028	schtasks.exe
2660	schtasks.exe
1760	schtasks.exe
1296	schtasks.exe
1908	schtasks.exe
2464	schtasks.exe
1628	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1804	48dd84f7a2cbfb0a068fa1a74c35fa4983f355dd026648bde3c594d0afe696da.exe
1804	48dd84f7a2cbfb0a068fa1a74c35fa4983f355dd026648bde3c594d0afe696da.exe
1804	48dd84f7a2cbfb0a068fa1a74c35fa4983f355dd026648bde3c594d0afe696da.exe
1804	48dd84f7a2cbfb0a068fa1a74c35fa4983f355dd026648bde3c594d0afe696da.exe
1804	48dd84f7a2cbfb0a068fa1a74c35fa4983f355dd026648bde3c594d0afe696da.exe
1804	48dd84f7a2cbfb0a068fa1a74c35fa4983f355dd026648bde3c594d0afe696da.exe
1804	48dd84f7a2cbfb0a068fa1a74c35fa4983f355dd026648bde3c594d0afe696da.exe
1804	48dd84f7a2cbfb0a068fa1a74c35fa4983f355dd026648bde3c594d0afe696da.exe
1804	48dd84f7a2cbfb0a068fa1a74c35fa4983f355dd026648bde3c594d0afe696da.exe
1804	48dd84f7a2cbfb0a068fa1a74c35fa4983f355dd026648bde3c594d0afe696da.exe
1804	48dd84f7a2cbfb0a068fa1a74c35fa4983f355dd026648bde3c594d0afe696da.exe
1804	48dd84f7a2cbfb0a068fa1a74c35fa4983f355dd026648bde3c594d0afe696da.exe
1804	48dd84f7a2cbfb0a068fa1a74c35fa4983f355dd026648bde3c594d0afe696da.exe
1804	48dd84f7a2cbfb0a068fa1a74c35fa4983f355dd026648bde3c594d0afe696da.exe
1804	48dd84f7a2cbfb0a068fa1a74c35fa4983f355dd026648bde3c594d0afe696da.exe
1804	48dd84f7a2cbfb0a068fa1a74c35fa4983f355dd026648bde3c594d0afe696da.exe
1804	48dd84f7a2cbfb0a068fa1a74c35fa4983f355dd026648bde3c594d0afe696da.exe
1804	48dd84f7a2cbfb0a068fa1a74c35fa4983f355dd026648bde3c594d0afe696da.exe
1804	48dd84f7a2cbfb0a068fa1a74c35fa4983f355dd026648bde3c594d0afe696da.exe
1804	48dd84f7a2cbfb0a068fa1a74c35fa4983f355dd026648bde3c594d0afe696da.exe
1804	48dd84f7a2cbfb0a068fa1a74c35fa4983f355dd026648bde3c594d0afe696da.exe
1804	48dd84f7a2cbfb0a068fa1a74c35fa4983f355dd026648bde3c594d0afe696da.exe
1804	48dd84f7a2cbfb0a068fa1a74c35fa4983f355dd026648bde3c594d0afe696da.exe
1804	48dd84f7a2cbfb0a068fa1a74c35fa4983f355dd026648bde3c594d0afe696da.exe
1804	48dd84f7a2cbfb0a068fa1a74c35fa4983f355dd026648bde3c594d0afe696da.exe
1804	48dd84f7a2cbfb0a068fa1a74c35fa4983f355dd026648bde3c594d0afe696da.exe
1804	48dd84f7a2cbfb0a068fa1a74c35fa4983f355dd026648bde3c594d0afe696da.exe
1804	48dd84f7a2cbfb0a068fa1a74c35fa4983f355dd026648bde3c594d0afe696da.exe
1804	48dd84f7a2cbfb0a068fa1a74c35fa4983f355dd026648bde3c594d0afe696da.exe
1804	48dd84f7a2cbfb0a068fa1a74c35fa4983f355dd026648bde3c594d0afe696da.exe
1804	48dd84f7a2cbfb0a068fa1a74c35fa4983f355dd026648bde3c594d0afe696da.exe
1804	48dd84f7a2cbfb0a068fa1a74c35fa4983f355dd026648bde3c594d0afe696da.exe
1804	48dd84f7a2cbfb0a068fa1a74c35fa4983f355dd026648bde3c594d0afe696da.exe
1804	48dd84f7a2cbfb0a068fa1a74c35fa4983f355dd026648bde3c594d0afe696da.exe
1804	48dd84f7a2cbfb0a068fa1a74c35fa4983f355dd026648bde3c594d0afe696da.exe
1804	48dd84f7a2cbfb0a068fa1a74c35fa4983f355dd026648bde3c594d0afe696da.exe
1804	48dd84f7a2cbfb0a068fa1a74c35fa4983f355dd026648bde3c594d0afe696da.exe
1804	48dd84f7a2cbfb0a068fa1a74c35fa4983f355dd026648bde3c594d0afe696da.exe
1804	48dd84f7a2cbfb0a068fa1a74c35fa4983f355dd026648bde3c594d0afe696da.exe
2068	wininit.exe
2068	wininit.exe
2068	wininit.exe
2068	wininit.exe
2068	wininit.exe
2068	wininit.exe
2068	wininit.exe
2068	wininit.exe
2068	wininit.exe
2068	wininit.exe
2068	wininit.exe
2068	wininit.exe
2068	wininit.exe
2068	wininit.exe
2068	wininit.exe
2068	wininit.exe
2068	wininit.exe
2068	wininit.exe
2068	wininit.exe
2068	wininit.exe
2068	wininit.exe
2068	wininit.exe
2068	wininit.exe
2068	wininit.exe
2068	wininit.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	1804	48dd84f7a2cbfb0a068fa1a74c35fa4983f355dd026648bde3c594d0afe696da.exe
Token: SeDebugPrivilege	2068	wininit.exe
Token: SeDebugPrivilege	2840	wininit.exe
Token: SeDebugPrivilege	2764	wininit.exe

Suspicious use of WriteProcessMemory 33 IoCs

description	pid	Process	procid_target
PID 1804 wrote to memory of 2356	1804	48dd84f7a2cbfb0a068fa1a74c35fa4983f355dd026648bde3c594d0afe696da.exe	59
PID 1804 wrote to memory of 2356	1804	48dd84f7a2cbfb0a068fa1a74c35fa4983f355dd026648bde3c594d0afe696da.exe	59
PID 1804 wrote to memory of 2356	1804	48dd84f7a2cbfb0a068fa1a74c35fa4983f355dd026648bde3c594d0afe696da.exe	59
PID 2356 wrote to memory of 1580	2356	cmd.exe	61
PID 2356 wrote to memory of 1580	2356	cmd.exe	61
PID 2356 wrote to memory of 1580	2356	cmd.exe	61
PID 2356 wrote to memory of 2068	2356	cmd.exe	62
PID 2356 wrote to memory of 2068	2356	cmd.exe	62
PID 2356 wrote to memory of 2068	2356	cmd.exe	62
PID 2068 wrote to memory of 2768	2068	wininit.exe	63
PID 2068 wrote to memory of 2768	2068	wininit.exe	63
PID 2068 wrote to memory of 2768	2068	wininit.exe	63
PID 2068 wrote to memory of 1252	2068	wininit.exe	64
PID 2068 wrote to memory of 1252	2068	wininit.exe	64
PID 2068 wrote to memory of 1252	2068	wininit.exe	64
PID 2768 wrote to memory of 2840	2768	WScript.exe	65
PID 2768 wrote to memory of 2840	2768	WScript.exe	65
PID 2768 wrote to memory of 2840	2768	WScript.exe	65
PID 2840 wrote to memory of 2324	2840	wininit.exe	66
PID 2840 wrote to memory of 2324	2840	wininit.exe	66
PID 2840 wrote to memory of 2324	2840	wininit.exe	66
PID 2840 wrote to memory of 1916	2840	wininit.exe	67
PID 2840 wrote to memory of 1916	2840	wininit.exe	67
PID 2840 wrote to memory of 1916	2840	wininit.exe	67
PID 2324 wrote to memory of 2764	2324	WScript.exe	69
PID 2324 wrote to memory of 2764	2324	WScript.exe	69
PID 2324 wrote to memory of 2764	2324	WScript.exe	69
PID 2764 wrote to memory of 776	2764	wininit.exe	70
PID 2764 wrote to memory of 776	2764	wininit.exe	70
PID 2764 wrote to memory of 776	2764	wininit.exe	70
PID 2764 wrote to memory of 2148	2764	wininit.exe	71
PID 2764 wrote to memory of 2148	2764	wininit.exe	71
PID 2764 wrote to memory of 2148	2764	wininit.exe	71

System policy modification 1 TTPs 12 IoCs

defense_evasion

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	48dd84f7a2cbfb0a068fa1a74c35fa4983f355dd026648bde3c594d0afe696da.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	48dd84f7a2cbfb0a068fa1a74c35fa4983f355dd026648bde3c594d0afe696da.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	wininit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	wininit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	wininit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	wininit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	wininit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	wininit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	48dd84f7a2cbfb0a068fa1a74c35fa4983f355dd026648bde3c594d0afe696da.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	wininit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	wininit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	wininit.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\48dd84f7a2cbfb0a068fa1a74c35fa4983f355dd026648bde3c594d0afe696da.exe
"C:\Users\Admin\AppData\Local\Temp\48dd84f7a2cbfb0a068fa1a74c35fa4983f355dd026648bde3c594d0afe696da.exe"
1⤵
- UAC bypass
- Checks whether UAC is enabled
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1804
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\7XDWEJg9xY.bat"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2356
- - C:\Windows\system32\w32tm.exe
    w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
    3⤵
    PID:1580
- - C:\Program Files (x86)\Windows NT\Accessories\it-IT\wininit.exe
    "C:\Program Files (x86)\Windows NT\Accessories\it-IT\wininit.exe"
    3⤵
    - UAC bypass
    - Executes dropped EXE
    - Checks whether UAC is enabled
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    - System policy modification
    PID:2068
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\c0cd765d-e8b1-4119-8b51-f5323ba161a2.vbs"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:2768
    - - C:\Program Files (x86)\Windows NT\Accessories\it-IT\wininit.exe
        
        "C:\Program Files (x86)\Windows NT\Accessories\it-IT\wininit.exe"
        5⤵
        UAC bypass
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        System policy modification
        
        PID:2840
      - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\d1e1e7ca-47b3-4c16-8570-3325bd56a7ea.vbs"
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:2324
        
        C:\Program Files (x86)\Windows NT\Accessories\it-IT\wininit.exe
        
        "C:\Program Files (x86)\Windows NT\Accessories\it-IT\wininit.exe"
        7⤵
        UAC bypass
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        System policy modification
        
        PID:2764
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\43b8a273-dd3e-497e-8bf5-bf5896c58f98.vbs"
        8⤵
        
        PID:776
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\76fa814f-605d-46d8-839b-ee3f9eb17219.vbs"
        8⤵
        
        PID:2148
      - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\8c754b4f-287e-4f6c-9215-c3dbe66c5f05.vbs"
        6⤵
        
        PID:1916
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\0c0d0d95-d1ae-475f-a7de-a37de5a86361.vbs"
      4⤵
      PID:1252

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 10 /tr "'C:\MSOCache\All Users\{90140000-0117-0409-0000-0000000FF1CE}-C\Access.en-us\dllhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3028

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-0117-0409-0000-0000000FF1CE}-C\Access.en-us\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2648

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 14 /tr "'C:\MSOCache\All Users\{90140000-0117-0409-0000-0000000FF1CE}-C\Access.en-us\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2660

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OSPPSVCO" /sc MINUTE /mo 7 /tr "'C:\MSOCache\All Users\{90140000-00BA-0409-0000-0000000FF1CE}-C\OSPPSVC.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2512

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OSPPSVC" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-00BA-0409-0000-0000000FF1CE}-C\OSPPSVC.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2536

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OSPPSVCO" /sc MINUTE /mo 6 /tr "'C:\MSOCache\All Users\{90140000-00BA-0409-0000-0000000FF1CE}-C\OSPPSVC.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2492

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 10 /tr "'C:\Users\Admin\WmiPrvSE.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2564

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSE" /sc ONLOGON /tr "'C:\Users\Admin\WmiPrvSE.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2980

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 12 /tr "'C:\Users\Admin\WmiPrvSE.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2948

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 11 /tr "'C:\Program Files (x86)\Adobe\Idle.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1824

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Idle" /sc ONLOGON /tr "'C:\Program Files (x86)\Adobe\Idle.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1564

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 6 /tr "'C:\Program Files (x86)\Adobe\Idle.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:448

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 7 /tr "'C:\Program Files\Windows Journal\es-ES\dwm.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1760

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwm" /sc ONLOGON /tr "'C:\Program Files\Windows Journal\es-ES\dwm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1296

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 5 /tr "'C:\Program Files\Windows Journal\es-ES\dwm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2000

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 11 /tr "'C:\Program Files (x86)\Windows NT\Accessories\it-IT\wininit.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1644

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininit" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows NT\Accessories\it-IT\wininit.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1908

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 9 /tr "'C:\Program Files (x86)\Windows NT\Accessories\it-IT\wininit.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2464

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 13 /tr "'C:\Program Files (x86)\Windows Media Player\Skins\dllhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1328

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Media Player\Skins\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1492

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 13 /tr "'C:\Program Files (x86)\Windows Media Player\Skins\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2556

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "audiodga" /sc MINUTE /mo 13 /tr "'C:\MSOCache\All Users\audiodg.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1736

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "audiodg" /sc ONLOGON /tr "'C:\MSOCache\All Users\audiodg.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1632

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "audiodga" /sc MINUTE /mo 7 /tr "'C:\MSOCache\All Users\audiodg.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1628

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 6 /tr "'C:\Recovery\3a99bb82-4e15-11ef-8354-cae67966b5f6\sppsvc.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2016

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvc" /sc ONLOGON /tr "'C:\Recovery\3a99bb82-4e15-11ef-8354-cae67966b5f6\sppsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2848

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 12 /tr "'C:\Recovery\3a99bb82-4e15-11ef-8354-cae67966b5f6\sppsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2120

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Windows Media Player\Skins\dllhost.exe

Filesize
3.3MB

MD5
9f8945a37ff32fdefae9a2e3e255cf34

SHA1
04453ad812d632fba071365afc046f88777c13a1

SHA256
d15fafbfbeb6e259df24d0a79e534e854ce03995628ad1f90aecfd3532f58314

SHA512
5efc558cbe1b62c21b8809e2fdfc4ae746d8cf6c916ae7e112567bfb29a5657ddee1e3f5f3cf175930764bd876add8e1ad6a52200f46594abb4018d70e2f28a5

Download Submit
C:\Program Files (x86)\Windows NT\Accessories\it-IT\wininit.exe

Filesize
3.3MB

MD5
e94f122a1605ab8b88920a942874b2dd

SHA1
f0f2fcee818bf0722d766d99dabaef826e66bd65

SHA256
e40beb042cb25354ada765e23da2566266612429b8a0617e47820571e18f4b55

SHA512
1c8248e4b65a545b3135c80d2b5e6b149f9a075b6cdafb82346ec4b758a59049db7f92d3f8140a582158c32c60c5ef0c4c23006600b38bd4018cf8fd50052651

Download Submit
C:\Program Files\Windows Journal\es-ES\dwm.exe

Filesize
3.3MB

MD5
74da02657baeecb247413687ca835103

SHA1
44f3e5bdc60e9d41d624a1de2154d804a53aa8be

SHA256
48dd84f7a2cbfb0a068fa1a74c35fa4983f355dd026648bde3c594d0afe696da

SHA512
c679fa77c3b8a83e6c8607d77f2ff575ce9903fe8836e850cf12b5c8756f6123411c413e79bc131a1723d6803785c33f24612a4bcedbbb73035d6ec6aa53add1

Download Submit
C:\Recovery\3a99bb82-4e15-11ef-8354-cae67966b5f6\sppsvc.exe

Filesize
3.3MB

MD5
bece8dcfaf0a2c0ac2e9dda5ec1365b1

SHA1
41294d1929419fd460c3aa2cf4f90e9bdebdfd28

SHA256
1252094bebf6976c99c4f84ea702fb7f1da2616e98b61371d6afb37fd65ba6f5

SHA512
88a12beee973639e29bc23fa44b67f2a1f92635eb4530881e1684e2d4fb1df48c5ec3c4cbc243a3ae7dd26f2226856d5de902221f1aaf44e05c3aba194d4766d

Download Submit
C:\Users\Admin\AppData\Local\Temp\0c0d0d95-d1ae-475f-a7de-a37de5a86361.vbs

Filesize
515B

MD5
177043ba2cfb1dbe8e46b967223cf4cd

SHA1
3e435c253bc93010812afa82e4ed6e76be476cfc

SHA256
b62d0ff6f0756ba4f632863aaa46b431907f2e06f26a8e87407abc131a669b6c

SHA512
d77ac26c88dbe693bd10e269cc74e2efaef201b0dda9c526386dbdde5841a85df106c7339860647bf1600b79bafe1adf361c813423aa90c246eb910a2185bf32

Download Submit
C:\Users\Admin\AppData\Local\Temp\43b8a273-dd3e-497e-8bf5-bf5896c58f98.vbs

Filesize
739B

MD5
fe32b33243aca89323d05a9a9fea9df5

SHA1
7984eb7a0af3063fc0c236867543cfd41a5805cf

SHA256
8fc2532dccbcc6530fb7cb6ad18d8dd2e7abd7fb49a9e56522e17fe99b5f935c

SHA512
7f73164c7e01f4b48dfe0f2a746684ebe0624c08af983fe2b0b06be3e248421b3d2f23b0a089fa9e8c556ea5f0b4b0032c0d44a0ad2c541fc067e4aebb4c9cf8

Download Submit
C:\Users\Admin\AppData\Local\Temp\7XDWEJg9xY.bat

Filesize
228B

MD5
85453f76d223b2aa3e803f6f6e63df6c

SHA1
d5856ae4d97f1c4e206f6fe79475c425316eaa2c

SHA256
24e9b41fded8d5692341774fe35bfb34d9c37dcfa513447b894f605d1375c09c

SHA512
33c0c51b80d6c9782dd5ce4b1366a683eff932b054d29464ea752b9cb40ba48f65b21fcea0af4cd09d064c86437f09a905fd8cfc1f2e11f9932cb24d8156069b

Download Submit
C:\Users\Admin\AppData\Local\Temp\c0cd765d-e8b1-4119-8b51-f5323ba161a2.vbs

Filesize
739B

MD5
a13e20c58c0f7e4129ea609d43211eba

SHA1
f9788b447b9da00881aa07832a00b148a466db46

SHA256
0ee94e0139022683f37121d14947d3fc7d6acca19e86dd8a94c45fa26c9477ec

SHA512
fc432d48e81660ff39a38cc85de0e3394296b5c494a32ac97523dc781c73157032cdacde1c218342e638f67feb37d71d161028f655e31fad5a5e21ee0f6627f3

Download Submit
C:\Users\Admin\AppData\Local\Temp\d1e1e7ca-47b3-4c16-8570-3325bd56a7ea.vbs

Filesize
739B

MD5
fff8ae9e6a04d8e7181976a06ad57c29

SHA1
1a5c39656d45d6eec0299c5f200dc3bd619d59a9

SHA256
32280e0407d5beabe8974d41ea37d4dac4370babdd798c29fd51c3a37466830a

SHA512
5a86072866750c45c0a101c455e8b1f8860d48eac8c6ec0455f765eef5c190653b3f405732c3b7fe8cd76469037c46784b6e88c69a055ebac186122a2e9a9290

Download Submit
C:\Users\Admin\WmiPrvSE.exe

Filesize
3.3MB

MD5
0372def79b2201667988e54f0a052ad1

SHA1
5a406511f2fd0f2a59540bacbd5bfecc2bbf8201

SHA256
3d1bd74e571694521db12f2e929a138d372a9c7ed561f64c4d2eae751fcbf03e

SHA512
2f417398fd6af7235b9569ac7290ba5c3723e2bbc3fa65d9500d615bda51a569b4555df918a70df06c30163d56da4fc887460e4915402df234f49c4fc03d1411

Download Submit
memory/1804-12-0x0000000000AB0000-0x0000000000ABA000-memory.dmp

Filesize
40KB

Download
memory/1804-29-0x000000001B060000-0x000000001B06E000-memory.dmp

Filesize
56KB

Download
memory/1804-0-0x000007FEF6183000-0x000007FEF6184000-memory.dmp

Filesize
4KB

Download
memory/1804-13-0x000000001AF10000-0x000000001AF66000-memory.dmp

Filesize
344KB

Download
memory/1804-14-0x0000000002270000-0x000000000227C000-memory.dmp

Filesize
48KB

Download
memory/1804-15-0x0000000002290000-0x0000000002298000-memory.dmp

Filesize
32KB

Download
memory/1804-16-0x00000000022A0000-0x00000000022AC000-memory.dmp

Filesize
48KB

Download
memory/1804-17-0x00000000022B0000-0x00000000022B8000-memory.dmp

Filesize
32KB

Download
memory/1804-18-0x0000000002450000-0x0000000002462000-memory.dmp

Filesize
72KB

Download
memory/1804-19-0x000000001A900000-0x000000001A90C000-memory.dmp

Filesize
48KB

Download
memory/1804-20-0x000000001A910000-0x000000001A91C000-memory.dmp

Filesize
48KB

Download
memory/1804-21-0x000000001AF60000-0x000000001AF68000-memory.dmp

Filesize
32KB

Download
memory/1804-22-0x000000001AF70000-0x000000001AF7C000-memory.dmp

Filesize
48KB

Download
memory/1804-23-0x000000001AF80000-0x000000001AF8C000-memory.dmp

Filesize
48KB

Download
memory/1804-24-0x000000001AFA0000-0x000000001AFA8000-memory.dmp

Filesize
32KB

Download
memory/1804-25-0x000000001AF90000-0x000000001AF9C000-memory.dmp

Filesize
48KB

Download
memory/1804-26-0x000000001AFB0000-0x000000001AFBA000-memory.dmp

Filesize
40KB

Download
memory/1804-27-0x000000001AFC0000-0x000000001AFCE000-memory.dmp

Filesize
56KB

Download
memory/1804-28-0x000000001B050000-0x000000001B058000-memory.dmp

Filesize
32KB

Download
memory/1804-11-0x0000000002280000-0x0000000002290000-memory.dmp

Filesize
64KB

Download
memory/1804-30-0x000000001B070000-0x000000001B078000-memory.dmp

Filesize
32KB

Download
memory/1804-31-0x000000001B080000-0x000000001B08C000-memory.dmp

Filesize
48KB

Download
memory/1804-32-0x000000001B090000-0x000000001B098000-memory.dmp

Filesize
32KB

Download
memory/1804-33-0x000000001B0A0000-0x000000001B0AA000-memory.dmp

Filesize
40KB

Download
memory/1804-34-0x000000001B1B0000-0x000000001B1BC000-memory.dmp

Filesize
48KB

Download
memory/1804-10-0x0000000002260000-0x0000000002272000-memory.dmp

Filesize
72KB

Download
memory/1804-9-0x0000000000AA0000-0x0000000000AA8000-memory.dmp

Filesize
32KB

Download
memory/1804-8-0x0000000000900000-0x0000000000916000-memory.dmp

Filesize
88KB

Download
memory/1804-7-0x0000000000670000-0x0000000000680000-memory.dmp

Filesize
64KB

Download
memory/1804-6-0x0000000000660000-0x0000000000668000-memory.dmp

Filesize
32KB

Download
memory/1804-5-0x0000000000640000-0x000000000065C000-memory.dmp

Filesize
112KB

Download
memory/1804-167-0x000007FEF6180000-0x000007FEF6B6C000-memory.dmp

Filesize
9.9MB

Download
memory/1804-1-0x0000000000180000-0x00000000004CE000-memory.dmp

Filesize
3.3MB

Download
memory/1804-2-0x000007FEF6180000-0x000007FEF6B6C000-memory.dmp

Filesize
9.9MB

Download
memory/1804-4-0x0000000000630000-0x0000000000638000-memory.dmp

Filesize
32KB

Download
memory/1804-3-0x0000000000610000-0x000000000061E000-memory.dmp

Filesize
56KB

Download
memory/2068-171-0x0000000000890000-0x00000000008A2000-memory.dmp

Filesize
72KB

Download
memory/2068-170-0x0000000000360000-0x00000000006AE000-memory.dmp

Filesize
3.3MB

Download
memory/2764-194-0x00000000001C0000-0x000000000050E000-memory.dmp

Filesize
3.3MB

Download
memory/2840-182-0x0000000001140000-0x000000000148E000-memory.dmp

Filesize
3.3MB

Download