dcrat | bbe24f9a2e5b7e135711572ff9b0d2bb7c4fd156a1d87ee819da8af441c7325e

Analysis

max time kernel
130s
max time network
149s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
31/05/2026, 14:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
xbbe24f9a2e5b7e135711572ff9b0d2bb7c4fd156a1d87ee819da8af441c7325e.exe
Size 2.0MB
Sample260531-rm4hbsct2n
SHA256 bbe24f9a2e5b7e135711572ff9b0d2bb7c4fd156a1d87ee819da8af441c7325e
MD5 a49aee60ad5bea06b10122dcb0b8613f
SHA1 259177c3de63882181692b50657b16b4967be43c
SHA512 cd4a3a2dae28981f4cd2103b75c6658b390d1b64dfbdcbc6102f9d80bdcbfe56c59bc601eb9e5f1a6d791f6edc1d7fe3dc6d433e7e4c86058d2fc617bac6bb45
SSDEEP 49152:ukQTA+YS/v6h3+1uhZcT2NnvOyLXXjFpNXCym/hXmL9W6EppQpQ:ua+5CbhZcT2lvnDFpFW/twU7+Q
TLSH
T1B2A5337470D1C1B2E5A6103584CACB32A636B062877EC1CB7A9D77F56F603F1623A6C6
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery execution dcrat infostealer persistence rat trojan

Malware Config

Signatures

Family: DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat

Modifies WinLogon for persistence 2 TTPs 4 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files\\Microsoft Office 15\\ClientX64\\StartMenuExperienceHost.exe\", \"C:\\Program Files (x86)\\Windows Sidebar\\Shared Gadgets\\explorer.exe\", \"C:\\Windows\\Sun\\Java\\sihost.exe\""	xbbe24f9a2e5b7e135711572ff9b0d2bb7c4fd156a1d87ee819da8af441c7325e.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files\\Microsoft Office 15\\ClientX64\\StartMenuExperienceHost.exe\", \"C:\\Program Files (x86)\\Windows Sidebar\\Shared Gadgets\\explorer.exe\", \"C:\\Windows\\Sun\\Java\\sihost.exe\", \"C:\\Recovery\\WindowsRE\\taskhostw.exe\""	xbbe24f9a2e5b7e135711572ff9b0d2bb7c4fd156a1d87ee819da8af441c7325e.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files\\Microsoft Office 15\\ClientX64\\StartMenuExperienceHost.exe\""	xbbe24f9a2e5b7e135711572ff9b0d2bb7c4fd156a1d87ee819da8af441c7325e.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files\\Microsoft Office 15\\ClientX64\\StartMenuExperienceHost.exe\", \"C:\\Program Files (x86)\\Windows Sidebar\\Shared Gadgets\\explorer.exe\""	xbbe24f9a2e5b7e135711572ff9b0d2bb7c4fd156a1d87ee819da8af441c7325e.exe

Process spawned unexpected child process 12 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4764	5452	schtasks.exe	80
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5852	5452	schtasks.exe	80
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2708	5452	schtasks.exe	80
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	6128	5452	schtasks.exe	80
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	6136	5452	schtasks.exe	80
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4396	5452	schtasks.exe	80
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2076	5452	schtasks.exe	80
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5692	5452	schtasks.exe	80
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4400	5452	schtasks.exe	80
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2624	5452	schtasks.exe	80
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	6012	5452	schtasks.exe	80
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3208	5452	schtasks.exe	80

UAC bypass 3 TTPs 3 IoCs

defense_evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	xbbe24f9a2e5b7e135711572ff9b0d2bb7c4fd156a1d87ee819da8af441c7325e.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	xbbe24f9a2e5b7e135711572ff9b0d2bb7c4fd156a1d87ee819da8af441c7325e.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	xbbe24f9a2e5b7e135711572ff9b0d2bb7c4fd156a1d87ee819da8af441c7325e.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 5 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
3592	powershell.exe
5292	powershell.exe
5116	powershell.exe
1656	powershell.exe
3016	powershell.exe

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\drivers\etc\hosts	xbbe24f9a2e5b7e135711572ff9b0d2bb7c4fd156a1d87ee819da8af441c7325e.exe

Executes dropped EXE 5 IoCs

pid	Process
2044	explorer.exe
5136	taskhostw.exe
5820	StartMenuExperienceHost.exe
2668	sihost.exe
6744	StartMenuExperienceHost.exe

Adds Run key to start application 2 TTPs 8 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000\Software\Microsoft\Windows\CurrentVersion\Run\sihost = "\"C:\\Windows\\Sun\\Java\\sihost.exe\""	xbbe24f9a2e5b7e135711572ff9b0d2bb7c4fd156a1d87ee819da8af441c7325e.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\sihost = "\"C:\\Windows\\Sun\\Java\\sihost.exe\""	xbbe24f9a2e5b7e135711572ff9b0d2bb7c4fd156a1d87ee819da8af441c7325e.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000\Software\Microsoft\Windows\CurrentVersion\Run\taskhostw = "\"C:\\Recovery\\WindowsRE\\taskhostw.exe\""	xbbe24f9a2e5b7e135711572ff9b0d2bb7c4fd156a1d87ee819da8af441c7325e.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\taskhostw = "\"C:\\Recovery\\WindowsRE\\taskhostw.exe\""	xbbe24f9a2e5b7e135711572ff9b0d2bb7c4fd156a1d87ee819da8af441c7325e.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000\Software\Microsoft\Windows\CurrentVersion\Run\StartMenuExperienceHost = "\"C:\\Program Files\\Microsoft Office 15\\ClientX64\\StartMenuExperienceHost.exe\""	xbbe24f9a2e5b7e135711572ff9b0d2bb7c4fd156a1d87ee819da8af441c7325e.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\StartMenuExperienceHost = "\"C:\\Program Files\\Microsoft Office 15\\ClientX64\\StartMenuExperienceHost.exe\""	xbbe24f9a2e5b7e135711572ff9b0d2bb7c4fd156a1d87ee819da8af441c7325e.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000\Software\Microsoft\Windows\CurrentVersion\Run\explorer = "\"C:\\Program Files (x86)\\Windows Sidebar\\Shared Gadgets\\explorer.exe\""	xbbe24f9a2e5b7e135711572ff9b0d2bb7c4fd156a1d87ee819da8af441c7325e.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\explorer = "\"C:\\Program Files (x86)\\Windows Sidebar\\Shared Gadgets\\explorer.exe\""	xbbe24f9a2e5b7e135711572ff9b0d2bb7c4fd156a1d87ee819da8af441c7325e.exe

Checks whether UAC is enabled 1 TTPs 2 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	xbbe24f9a2e5b7e135711572ff9b0d2bb7c4fd156a1d87ee819da8af441c7325e.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	xbbe24f9a2e5b7e135711572ff9b0d2bb7c4fd156a1d87ee819da8af441c7325e.exe

SmartAssembly .NET packer 7 IoCs

Detects SmartAssembly .NET packer.

resource	yara_rule
behavioral2/memory/588-5232-0x0000000006270000-0x0000000006280000-memory.dmp	SmartAssembly
behavioral2/memory/588-5239-0x00000000069B0000-0x00000000069BA000-memory.dmp	SmartAssembly
behavioral2/memory/588-5246-0x00000000081A0000-0x00000000081AC000-memory.dmp	SmartAssembly
behavioral2/memory/588-5247-0x00000000081C0000-0x00000000081CC000-memory.dmp	SmartAssembly
behavioral2/memory/588-5249-0x00000000081F0000-0x00000000081FC000-memory.dmp	SmartAssembly
behavioral2/memory/588-5255-0x0000000008600000-0x000000000860A000-memory.dmp	SmartAssembly
behavioral2/memory/588-5251-0x00000000084C0000-0x00000000084CA000-memory.dmp	SmartAssembly

Drops file in Program Files directory 10 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Microsoft Office 15\ClientX64\StartMenuExperienceHost.exe	xbbe24f9a2e5b7e135711572ff9b0d2bb7c4fd156a1d87ee819da8af441c7325e.exe
File created	C:\Program Files\Microsoft Office 15\ClientX64\55b276f4edf653	xbbe24f9a2e5b7e135711572ff9b0d2bb7c4fd156a1d87ee819da8af441c7325e.exe
File created	C:\Program Files (x86)\Windows Sidebar\Shared Gadgets\explorer.exe	xbbe24f9a2e5b7e135711572ff9b0d2bb7c4fd156a1d87ee819da8af441c7325e.exe
File opened for modification	C:\Program Files\Microsoft Office 15\ClientX64\RCX7E45.tmp	xbbe24f9a2e5b7e135711572ff9b0d2bb7c4fd156a1d87ee819da8af441c7325e.exe
File opened for modification	C:\Program Files\Microsoft Office 15\ClientX64\RCX7E46.tmp	xbbe24f9a2e5b7e135711572ff9b0d2bb7c4fd156a1d87ee819da8af441c7325e.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Shared Gadgets\RCX8099.tmp	xbbe24f9a2e5b7e135711572ff9b0d2bb7c4fd156a1d87ee819da8af441c7325e.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Shared Gadgets\RCX80AA.tmp	xbbe24f9a2e5b7e135711572ff9b0d2bb7c4fd156a1d87ee819da8af441c7325e.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Shared Gadgets\explorer.exe	xbbe24f9a2e5b7e135711572ff9b0d2bb7c4fd156a1d87ee819da8af441c7325e.exe
File created	C:\Program Files\Microsoft Office 15\ClientX64\StartMenuExperienceHost.exe	xbbe24f9a2e5b7e135711572ff9b0d2bb7c4fd156a1d87ee819da8af441c7325e.exe
File created	C:\Program Files (x86)\Windows Sidebar\Shared Gadgets\7a0fd90576e088	xbbe24f9a2e5b7e135711572ff9b0d2bb7c4fd156a1d87ee819da8af441c7325e.exe

Drops file in Windows directory 5 IoCs

description	ioc	Process
File created	C:\Windows\Sun\Java\sihost.exe	xbbe24f9a2e5b7e135711572ff9b0d2bb7c4fd156a1d87ee819da8af441c7325e.exe
File created	C:\Windows\Sun\Java\66fc9ff0ee96c2	xbbe24f9a2e5b7e135711572ff9b0d2bb7c4fd156a1d87ee819da8af441c7325e.exe
File opened for modification	C:\Windows\Sun\Java\RCX83B8.tmp	xbbe24f9a2e5b7e135711572ff9b0d2bb7c4fd156a1d87ee819da8af441c7325e.exe
File opened for modification	C:\Windows\Sun\Java\RCX83C8.tmp	xbbe24f9a2e5b7e135711572ff9b0d2bb7c4fd156a1d87ee819da8af441c7325e.exe
File opened for modification	C:\Windows\Sun\Java\sihost.exe	xbbe24f9a2e5b7e135711572ff9b0d2bb7c4fd156a1d87ee819da8af441c7325e.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	StartMenuExperienceHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskhostw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sihost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xbbe24f9a2e5b7e135711572ff9b0d2bb7c4fd156a1d87ee819da8af441c7325e.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	StartMenuExperienceHost.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	xbbe24f9a2e5b7e135711572ff9b0d2bb7c4fd156a1d87ee819da8af441c7325e.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 12 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
5852	schtasks.exe
2708	schtasks.exe
6136	schtasks.exe
4396	schtasks.exe
2076	schtasks.exe
5692	schtasks.exe
4400	schtasks.exe
6128	schtasks.exe
2624	schtasks.exe
6012	schtasks.exe
3208	schtasks.exe
4764	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
588	xbbe24f9a2e5b7e135711572ff9b0d2bb7c4fd156a1d87ee819da8af441c7325e.exe
588	xbbe24f9a2e5b7e135711572ff9b0d2bb7c4fd156a1d87ee819da8af441c7325e.exe
588	xbbe24f9a2e5b7e135711572ff9b0d2bb7c4fd156a1d87ee819da8af441c7325e.exe
588	xbbe24f9a2e5b7e135711572ff9b0d2bb7c4fd156a1d87ee819da8af441c7325e.exe
588	xbbe24f9a2e5b7e135711572ff9b0d2bb7c4fd156a1d87ee819da8af441c7325e.exe
588	xbbe24f9a2e5b7e135711572ff9b0d2bb7c4fd156a1d87ee819da8af441c7325e.exe
588	xbbe24f9a2e5b7e135711572ff9b0d2bb7c4fd156a1d87ee819da8af441c7325e.exe
588	xbbe24f9a2e5b7e135711572ff9b0d2bb7c4fd156a1d87ee819da8af441c7325e.exe
588	xbbe24f9a2e5b7e135711572ff9b0d2bb7c4fd156a1d87ee819da8af441c7325e.exe
588	xbbe24f9a2e5b7e135711572ff9b0d2bb7c4fd156a1d87ee819da8af441c7325e.exe
588	xbbe24f9a2e5b7e135711572ff9b0d2bb7c4fd156a1d87ee819da8af441c7325e.exe
588	xbbe24f9a2e5b7e135711572ff9b0d2bb7c4fd156a1d87ee819da8af441c7325e.exe
588	xbbe24f9a2e5b7e135711572ff9b0d2bb7c4fd156a1d87ee819da8af441c7325e.exe
588	xbbe24f9a2e5b7e135711572ff9b0d2bb7c4fd156a1d87ee819da8af441c7325e.exe
588	xbbe24f9a2e5b7e135711572ff9b0d2bb7c4fd156a1d87ee819da8af441c7325e.exe
588	xbbe24f9a2e5b7e135711572ff9b0d2bb7c4fd156a1d87ee819da8af441c7325e.exe
588	xbbe24f9a2e5b7e135711572ff9b0d2bb7c4fd156a1d87ee819da8af441c7325e.exe
588	xbbe24f9a2e5b7e135711572ff9b0d2bb7c4fd156a1d87ee819da8af441c7325e.exe
588	xbbe24f9a2e5b7e135711572ff9b0d2bb7c4fd156a1d87ee819da8af441c7325e.exe
588	xbbe24f9a2e5b7e135711572ff9b0d2bb7c4fd156a1d87ee819da8af441c7325e.exe
588	xbbe24f9a2e5b7e135711572ff9b0d2bb7c4fd156a1d87ee819da8af441c7325e.exe
588	xbbe24f9a2e5b7e135711572ff9b0d2bb7c4fd156a1d87ee819da8af441c7325e.exe
588	xbbe24f9a2e5b7e135711572ff9b0d2bb7c4fd156a1d87ee819da8af441c7325e.exe
588	xbbe24f9a2e5b7e135711572ff9b0d2bb7c4fd156a1d87ee819da8af441c7325e.exe
588	xbbe24f9a2e5b7e135711572ff9b0d2bb7c4fd156a1d87ee819da8af441c7325e.exe
588	xbbe24f9a2e5b7e135711572ff9b0d2bb7c4fd156a1d87ee819da8af441c7325e.exe
588	xbbe24f9a2e5b7e135711572ff9b0d2bb7c4fd156a1d87ee819da8af441c7325e.exe
588	xbbe24f9a2e5b7e135711572ff9b0d2bb7c4fd156a1d87ee819da8af441c7325e.exe
588	xbbe24f9a2e5b7e135711572ff9b0d2bb7c4fd156a1d87ee819da8af441c7325e.exe
588	xbbe24f9a2e5b7e135711572ff9b0d2bb7c4fd156a1d87ee819da8af441c7325e.exe
588	xbbe24f9a2e5b7e135711572ff9b0d2bb7c4fd156a1d87ee819da8af441c7325e.exe
588	xbbe24f9a2e5b7e135711572ff9b0d2bb7c4fd156a1d87ee819da8af441c7325e.exe
588	xbbe24f9a2e5b7e135711572ff9b0d2bb7c4fd156a1d87ee819da8af441c7325e.exe
588	xbbe24f9a2e5b7e135711572ff9b0d2bb7c4fd156a1d87ee819da8af441c7325e.exe
588	xbbe24f9a2e5b7e135711572ff9b0d2bb7c4fd156a1d87ee819da8af441c7325e.exe
588	xbbe24f9a2e5b7e135711572ff9b0d2bb7c4fd156a1d87ee819da8af441c7325e.exe
588	xbbe24f9a2e5b7e135711572ff9b0d2bb7c4fd156a1d87ee819da8af441c7325e.exe
588	xbbe24f9a2e5b7e135711572ff9b0d2bb7c4fd156a1d87ee819da8af441c7325e.exe
5116	powershell.exe
5116	powershell.exe
588	xbbe24f9a2e5b7e135711572ff9b0d2bb7c4fd156a1d87ee819da8af441c7325e.exe
1656	powershell.exe
1656	powershell.exe
588	xbbe24f9a2e5b7e135711572ff9b0d2bb7c4fd156a1d87ee819da8af441c7325e.exe
588	xbbe24f9a2e5b7e135711572ff9b0d2bb7c4fd156a1d87ee819da8af441c7325e.exe
588	xbbe24f9a2e5b7e135711572ff9b0d2bb7c4fd156a1d87ee819da8af441c7325e.exe
5292	powershell.exe
5292	powershell.exe
3592	powershell.exe
3592	powershell.exe
588	xbbe24f9a2e5b7e135711572ff9b0d2bb7c4fd156a1d87ee819da8af441c7325e.exe
588	xbbe24f9a2e5b7e135711572ff9b0d2bb7c4fd156a1d87ee819da8af441c7325e.exe
588	xbbe24f9a2e5b7e135711572ff9b0d2bb7c4fd156a1d87ee819da8af441c7325e.exe
588	xbbe24f9a2e5b7e135711572ff9b0d2bb7c4fd156a1d87ee819da8af441c7325e.exe
588	xbbe24f9a2e5b7e135711572ff9b0d2bb7c4fd156a1d87ee819da8af441c7325e.exe
3016	powershell.exe
3016	powershell.exe
588	xbbe24f9a2e5b7e135711572ff9b0d2bb7c4fd156a1d87ee819da8af441c7325e.exe
588	xbbe24f9a2e5b7e135711572ff9b0d2bb7c4fd156a1d87ee819da8af441c7325e.exe
5116	powershell.exe
5116	powershell.exe
3592	powershell.exe
3592	powershell.exe
1656	powershell.exe

Suspicious use of AdjustPrivilegeToken 11 IoCs

description	pid	Process
Token: SeDebugPrivilege	588	xbbe24f9a2e5b7e135711572ff9b0d2bb7c4fd156a1d87ee819da8af441c7325e.exe
Token: SeDebugPrivilege	2044	explorer.exe
Token: SeDebugPrivilege	5136	taskhostw.exe
Token: SeDebugPrivilege	5820	StartMenuExperienceHost.exe
Token: SeDebugPrivilege	2668	sihost.exe
Token: SeDebugPrivilege	5116	powershell.exe
Token: SeDebugPrivilege	1656	powershell.exe
Token: SeDebugPrivilege	3016	powershell.exe
Token: SeDebugPrivilege	5292	powershell.exe
Token: SeDebugPrivilege	3592	powershell.exe
Token: SeDebugPrivilege	6744	StartMenuExperienceHost.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 588 wrote to memory of 3016	588	xbbe24f9a2e5b7e135711572ff9b0d2bb7c4fd156a1d87ee819da8af441c7325e.exe	105
PID 588 wrote to memory of 1656	588	xbbe24f9a2e5b7e135711572ff9b0d2bb7c4fd156a1d87ee819da8af441c7325e.exe	106
PID 588 wrote to memory of 5116	588	xbbe24f9a2e5b7e135711572ff9b0d2bb7c4fd156a1d87ee819da8af441c7325e.exe	107
PID 588 wrote to memory of 5292	588	xbbe24f9a2e5b7e135711572ff9b0d2bb7c4fd156a1d87ee819da8af441c7325e.exe	108
PID 588 wrote to memory of 3592	588	xbbe24f9a2e5b7e135711572ff9b0d2bb7c4fd156a1d87ee819da8af441c7325e.exe	109
PID 588 wrote to memory of 6744	588	xbbe24f9a2e5b7e135711572ff9b0d2bb7c4fd156a1d87ee819da8af441c7325e.exe	115

System policy modification 1 TTPs 3 IoCs

defense_evasion

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	xbbe24f9a2e5b7e135711572ff9b0d2bb7c4fd156a1d87ee819da8af441c7325e.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	xbbe24f9a2e5b7e135711572ff9b0d2bb7c4fd156a1d87ee819da8af441c7325e.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	xbbe24f9a2e5b7e135711572ff9b0d2bb7c4fd156a1d87ee819da8af441c7325e.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\xbbe24f9a2e5b7e135711572ff9b0d2bb7c4fd156a1d87ee819da8af441c7325e.exe
"C:\Users\Admin\AppData\Local\Temp\xbbe24f9a2e5b7e135711572ff9b0d2bb7c4fd156a1d87ee819da8af441c7325e.exe"
1⤵
- Modifies WinLogon for persistence
- UAC bypass
- Drops file in Drivers directory
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:588
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\xbbe24f9a2e5b7e135711572ff9b0d2bb7c4fd156a1d87ee819da8af441c7325e.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3016
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Microsoft Office 15\ClientX64\StartMenuExperienceHost.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1656
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Windows Sidebar\Shared Gadgets\explorer.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5116
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\Sun\Java\sihost.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5292
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\WindowsRE\taskhostw.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3592
- C:\Program Files\Microsoft Office 15\ClientX64\StartMenuExperienceHost.exe
  "C:\Program Files\Microsoft Office 15\ClientX64\StartMenuExperienceHost.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  PID:6744

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "StartMenuExperienceHostS" /sc MINUTE /mo 8 /tr "'C:\Program Files\Microsoft Office 15\ClientX64\StartMenuExperienceHost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4764

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "StartMenuExperienceHost" /sc ONLOGON /tr "'C:\Program Files\Microsoft Office 15\ClientX64\StartMenuExperienceHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2708

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "StartMenuExperienceHostS" /sc MINUTE /mo 7 /tr "'C:\Program Files\Microsoft Office 15\ClientX64\StartMenuExperienceHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5852

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 11 /tr "'C:\Program Files (x86)\Windows Sidebar\Shared Gadgets\explorer.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:6128

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorer" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Sidebar\Shared Gadgets\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:6136

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 12 /tr "'C:\Program Files (x86)\Windows Sidebar\Shared Gadgets\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4396

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sihosts" /sc MINUTE /mo 5 /tr "'C:\Windows\Sun\Java\sihost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2076

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sihost" /sc ONLOGON /tr "'C:\Windows\Sun\Java\sihost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5692

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sihosts" /sc MINUTE /mo 6 /tr "'C:\Windows\Sun\Java\sihost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4400

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostwt" /sc MINUTE /mo 9 /tr "'C:\Recovery\WindowsRE\taskhostw.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2624

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostw" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\taskhostw.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:6012

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostwt" /sc MINUTE /mo 9 /tr "'C:\Recovery\WindowsRE\taskhostw.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3208

C:\Program Files (x86)\Windows Sidebar\Shared Gadgets\explorer.exe
"C:\Program Files (x86)\Windows Sidebar\Shared Gadgets\explorer.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:2044
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\bbf2a6dc-075c-48c4-bc43-48c1bc527276.vbs"
  2⤵
  PID:1972
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\58ebd6d0-efcb-45ad-a1b3-7ad42229dbc4.vbs"
  2⤵
  PID:7036

C:\Recovery\WindowsRE\taskhostw.exe
"C:\Recovery\WindowsRE\taskhostw.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:5136

C:\Program Files\Microsoft Office 15\ClientX64\StartMenuExperienceHost.exe
"C:\Program Files\Microsoft Office 15\ClientX64\StartMenuExperienceHost.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:5820

C:\Windows\Sun\Java\sihost.exe
"C:\Windows\Sun\Java\sihost.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:2668

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

explorer.exe

Path C:\Program Files (x86)\Windows Sidebar\Shared Gadgets\explorer.exe
Size 2.0MB
SHA256 bbe24f9a2e5b7e135711572ff9b0d2bb7c4fd156a1d87ee819da8af441c7325e
MD5 a49aee60ad5bea06b10122dcb0b8613f
SHA1 259177c3de63882181692b50657b16b4967be43c
SHA512 cd4a3a2dae28981f4cd2103b75c6658b390d1b64dfbdcbc6102f9d80bdcbfe56c59bc601eb9e5f1a6d791f6edc1d7fe3dc6d433e7e4c86058d2fc617bac6bb45
SSDEEP 49152:ukQTA+YS/v6h3+1uhZcT2NnvOyLXXjFpNXCym/hXmL9W6EppQpQ:ua+5CbhZcT2lvnDFpFW/twU7+Q
TLSH
T1B2A5337470D1C1B2E5A6103584CACB32A636B062877EC1CB7A9D77F56F603F1623A6C6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log
Size 2KB
SHA256 e39062a62c3c7617feeeff95ea8a0be51104a0d36f46e44eea22556fda74d8d9
MD5 ac4917a885cf6050b1a483e4bc4d2ea5
SHA1 b1c0a9f27bd21c6bbb8e9be70db8777b4a2a640f
SHA512 092c67a3ecae1d187cad72a8ea1ea37cb78a0cf79c2cd7fb88953e5990669a2e871267015762fd46d274badb88ac0c1d73b00f1df7394d89bed48a3a45c2ba3d
TLSH
T10B415C303161A5D84D435B1205286ED5E3EF478AAFAC8F5CB569231DCD2A44BD7121F3
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 18KB
SHA256 5c8209ee516c45597b7e5ebb1ce48d282ad11ed7bf2bcd881147b2eb9e3a01b3
MD5 b1b694ee0c193c3b2ee88f07442aa549
SHA1 39a6088c1493f37c9d465a251c4b82a5966c0dae
SHA512 bfd8335379c20004768e0cbbc914dd44805ee686ab3da2ee2f7f0dc48f168cfb3df1068a0c8beb78f6fc23a5ea37779870b728470c735c161399cbf290088157
SSDEEP 384:STHhY1SS1gZKFlewPFRHEqHnnNzjs2xtgmNrm253M9Joj0iFpX:hSSqClew9RVNzj7xtgurm2M9Joj0M
TLSH
T1D292C4AE711F22C3C89553B8E107050FE8F2DE8D431953D8B72E9E7B89AC95E813D558
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 18KB
SHA256 e70be802e5cb54efe082fa0a77e7ed6c5c271e13291c77d329b845bf44e7c485
MD5 9d63e893dfc052f0480d95db0e2eef43
SHA1 46d1dd445eea625403974215ba69762c7544ad3d
SHA512 7615465dd74f337d976b1e55be3124dadae46049a999f000c3626a38f2fa1e0b3902456c05f05724709ded96132aa0a91c938e22201e0e043997ca305328359f
SSDEEP 384:EL3HhsSS1U72vK60gFRHEMETcHnnNjjs2xtguNrC25PB9Jsu0iFpX:qySSCkK6TRPE0Njj7xtg2rCeB9Jsu0M
TLSH
T10592C5AE611F22C3C89553B8E107050FE8F2DE8D431913D9BB2E9E7B8AAC54E517D548
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 18KB
SHA256 0857278c72bc71cff5bc924063b68060293255645b91d69a63ddc669888850cc
MD5 49f5a18a953ef0df6e4cba1e2e8bb6f3
SHA1 cdee2e47fef43718e7092a395ea1cbe5c108cf91
SHA512 eb05e3c0efaeae89759ae96147806821649d076d23b0b99c2e9e766a9c646b13aae66f4979884d6fa49e4c6ee08da2d08cd49541e963a8f58f27282e2f5addec
SSDEEP 384:HL3HhY1SS1UetSH6QGSEk77HnnNejs2xtgyNry2L9d9JAu0iFFX:rWSSCO36nNej7xtgCryed9JAu0Y
TLSH
T18D92C4AE711F22C3C89553B8E106050FE8F2DE8D431A13D8BB2A9F7B89AC55E913D558
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 18KB
SHA256 19151f83188f7af231b5b63ed9e0f3b4735154c25432a852ee7702bbf11803b0
MD5 dded0fa5e6ea7c113f6c84e184907c27
SHA1 e412ea6140ebfc87561b60fea10cffb5d18ce558
SHA512 8594bdbbd4b56211da14a0eea6fb43aaa78f23aed11bd14137d2ecc0ce101b78c52aff58380b823d224686400a15d577a9cd57c087d265a538d37910a14322d6
SSDEEP 384:EL3HhY1SS1Ss70522d6vMEKH6LiEnNRjs2xtguNrC2L9B9Jsu0iFpX:qWSSr08W5EawRj7xtg2rCeB9Jsu0M
TLSH
T1FA92C5AE711F22C3C89563B8E107010FE8F2DE8D431A12D9B72A9F7B89AC55E513D658
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

58ebd6d0-efcb-45ad-a1b3-7ad42229dbc4.vbs

Path C:\Users\Admin\AppData\Local\Temp\58ebd6d0-efcb-45ad-a1b3-7ad42229dbc4.vbs
Size 518B
SHA256 5900ec4b0f35c3df276d44db960679a126edfda624796ed4f6e5d2945ca6e614
MD5 06387725f4b663eb7a67bb00d02e2d46
SHA1 4a9efb4f14c77eaa9485751287af03a288c89328
SHA512 68141a2496f84e40774d68ccf7e0224867709f44075667f5f4c4378cdbb2eec7ecf6aa39e17a92a512c402d250c57f7354a9c5f9dbf9c496b1ab65551e000a6a
TLSH
T184F0591DAF06C774D802034323F658CF8AAC984D3275D1596A49DC9E719063049EE1CE
MD5 SHA1 SHA512 TLSH

Submit Download

RCX7C41.tmp

Path C:\Users\Admin\AppData\Local\Temp\RCX7C41.tmp
Size 2.0MB
SHA256 32583cdfa30ba88e95dd1869a068382734e246442ff1fd204e1081b256430bad
MD5 0e15124a9347dffa9b807dace0e61121
SHA1 b924e70032030ce4bc76b87b9004cad479d6e5f6
SHA512 b3411d43dbbfb35855c5a92a4ebfc58fa7d3619df309b7411b31cf398d78736cefe1cbee50bc821043414fade4e503fdd5c6c4dea54ba48ae0fc03b77b0fda28
SSDEEP 1536:MxxKY+T6KW5CvEyXWvE344wAL5LO8XvdPTwZI3sq5gnToIfnIOlIOjcTp5XfCg:MnDKW1LgppLRHMY0TBfJvjcTp5XfCg
TLSH
T154A56B2175C1C1B3C4B7113044E6CA799A7A3071077A96D7B7DD2BBA6E213E1A3362CE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_vvchpfzx.brj.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_vvchpfzx.brj.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

bbf2a6dc-075c-48c4-bc43-48c1bc527276.vbs

Path C:\Users\Admin\AppData\Local\Temp\bbf2a6dc-075c-48c4-bc43-48c1bc527276.vbs
Size 742B
SHA256 75cdd0d08310429f1da43359f854dfff07cfad4966b1ff8e14e89321f20c2284
MD5 bf4c65de328d1f740997fd46b445aca5
SHA1 89a00f9b02c1a6d9236e52427644beb2d5cd66a5
SHA512 ef813876be4b154d0a2e31e1be54a6a85e5de08b989c5abfe4e4eba16ac9dadf84228b9d89c8c681506aea3668faf8ece50b9f47e6a46191fb8149348d01e7ee
TLSH
T131011006BE0BE67060A13340E1F645BB6ED8845C3136BC57BD60E46C2745E3004EC4EE
MD5 SHA1 SHA512 TLSH

Submit Download

memory/588-120-0x0000000005330000-0x00000000055E1000-memory.dmp

Download

memory/588-56-0x0000000005330000-0x00000000055E1000-memory.dmp

Download

memory/588-52-0x0000000005330000-0x00000000055E1000-memory.dmp

Download

memory/588-50-0x0000000005330000-0x00000000055E1000-memory.dmp

Download

memory/588-46-0x0000000005330000-0x00000000055E1000-memory.dmp

Download

memory/588-44-0x0000000005330000-0x00000000055E1000-memory.dmp

Download

memory/588-42-0x0000000005330000-0x00000000055E1000-memory.dmp

Download

memory/588-40-0x0000000005330000-0x00000000055E1000-memory.dmp

Download

memory/588-38-0x0000000005330000-0x00000000055E1000-memory.dmp

Download

memory/588-48-0x0000000005330000-0x00000000055E1000-memory.dmp

Download

memory/588-36-0x0000000005330000-0x00000000055E1000-memory.dmp

Download

memory/588-34-0x0000000005330000-0x00000000055E1000-memory.dmp

Download

memory/588-30-0x0000000005330000-0x00000000055E1000-memory.dmp

Download

memory/588-28-0x0000000005330000-0x00000000055E1000-memory.dmp

Download

memory/588-26-0x0000000005330000-0x00000000055E1000-memory.dmp

Download

memory/588-24-0x0000000005330000-0x00000000055E1000-memory.dmp

Download

memory/588-22-0x0000000005330000-0x00000000055E1000-memory.dmp

Download

memory/588-21-0x0000000005330000-0x00000000055E1000-memory.dmp

Download

memory/588-18-0x0000000005330000-0x00000000055E1000-memory.dmp

Download

memory/588-16-0x0000000005330000-0x00000000055E1000-memory.dmp

Download

memory/588-14-0x0000000005330000-0x00000000055E1000-memory.dmp

Download

memory/588-64-0x0000000005330000-0x00000000055E1000-memory.dmp

Download

memory/588-68-0x0000000005330000-0x00000000055E1000-memory.dmp

Download

memory/588-109-0x0000000005330000-0x00000000055E1000-memory.dmp

Download

memory/588-0-0x0000000005320000-0x0000000005330000-memory.dmp

Download

memory/588-130-0x0000000005330000-0x00000000055E1000-memory.dmp

Download

memory/588-128-0x0000000005330000-0x00000000055E1000-memory.dmp

Download

memory/588-126-0x0000000005330000-0x00000000055E1000-memory.dmp

Download

memory/588-124-0x0000000005330000-0x00000000055E1000-memory.dmp

Download

memory/588-122-0x0000000005330000-0x00000000055E1000-memory.dmp

Download

memory/588-118-0x0000000005330000-0x00000000055E1000-memory.dmp

Download

memory/588-117-0x0000000005330000-0x00000000055E1000-memory.dmp

Download

memory/588-114-0x0000000005330000-0x00000000055E1000-memory.dmp

Download

memory/588-112-0x0000000005330000-0x00000000055E1000-memory.dmp

Download

memory/588-110-0x0000000005330000-0x00000000055E1000-memory.dmp

Download

memory/588-106-0x0000000005330000-0x00000000055E1000-memory.dmp

Download

memory/588-104-0x0000000005330000-0x00000000055E1000-memory.dmp

Download

memory/588-102-0x0000000005330000-0x00000000055E1000-memory.dmp

Download

memory/588-100-0x0000000005330000-0x00000000055E1000-memory.dmp

Download

memory/588-98-0x0000000005330000-0x00000000055E1000-memory.dmp

Download

memory/588-5228-0x0000000005320000-0x0000000005330000-memory.dmp

Download

memory/588-94-0x0000000005330000-0x00000000055E1000-memory.dmp

Download

memory/588-90-0x0000000005330000-0x00000000055E1000-memory.dmp

Download

memory/588-88-0x0000000005330000-0x00000000055E1000-memory.dmp

Download

memory/588-86-0x0000000005330000-0x00000000055E1000-memory.dmp

Download

memory/588-82-0x0000000005330000-0x00000000055E1000-memory.dmp

Download

memory/588-80-0x0000000005330000-0x00000000055E1000-memory.dmp

Download

memory/588-74-0x0000000005330000-0x00000000055E1000-memory.dmp

Download

memory/588-72-0x0000000005330000-0x00000000055E1000-memory.dmp

Download

memory/588-70-0x0000000005330000-0x00000000055E1000-memory.dmp

Download

memory/588-66-0x0000000005330000-0x00000000055E1000-memory.dmp

Download

memory/588-92-0x0000000005330000-0x00000000055E1000-memory.dmp

Download

memory/588-84-0x0000000005330000-0x00000000055E1000-memory.dmp

Download

memory/588-78-0x0000000005330000-0x00000000055E1000-memory.dmp

Download

memory/588-76-0x0000000005330000-0x00000000055E1000-memory.dmp

Download

memory/588-62-0x0000000005330000-0x00000000055E1000-memory.dmp

Download

memory/588-12-0x0000000005330000-0x00000000055E1000-memory.dmp

Download

memory/588-10-0x0000000005330000-0x00000000055E1000-memory.dmp

Download

memory/588-6-0x0000000005330000-0x00000000055E1000-memory.dmp

Download

memory/588-1669-0x0000000005320000-0x0000000005330000-memory.dmp

Download

memory/588-1967-0x0000000005320000-0x0000000005330000-memory.dmp

Download

memory/588-2254-0x0000000005320000-0x0000000005330000-memory.dmp

Download

memory/588-5230-0x00000000025B0000-0x0000000002600000-memory.dmp

Download

memory/588-5229-0x0000000002580000-0x000000000259C000-memory.dmp

Download

memory/588-96-0x0000000005330000-0x00000000055E1000-memory.dmp

Download

memory/588-5231-0x0000000002610000-0x0000000002618000-memory.dmp

Download

memory/588-5232-0x0000000006270000-0x0000000006280000-memory.dmp

Download

memory/588-5234-0x0000000006910000-0x0000000006918000-memory.dmp

Download

memory/588-5233-0x0000000006590000-0x00000000065A6000-memory.dmp

Download

memory/588-5235-0x0000000006A60000-0x0000000006A72000-memory.dmp

Download

memory/588-5237-0x0000000006930000-0x0000000006940000-memory.dmp

Download

memory/588-5236-0x0000000006990000-0x0000000006998000-memory.dmp

Download

memory/588-5238-0x0000000006B70000-0x0000000006C02000-memory.dmp

Download

memory/588-5239-0x00000000069B0000-0x00000000069BA000-memory.dmp

Download

memory/588-5241-0x0000000006A30000-0x0000000006A3C000-memory.dmp

Download

memory/588-5242-0x00000000069F0000-0x00000000069F8000-memory.dmp

Download

memory/588-5240-0x00000000069E0000-0x00000000069E8000-memory.dmp

Download

memory/588-5244-0x0000000006A00000-0x0000000006A12000-memory.dmp

Download

memory/588-5246-0x00000000081A0000-0x00000000081AC000-memory.dmp

Download

memory/588-5245-0x0000000007C40000-0x000000000816C000-memory.dmp

Download

memory/588-5248-0x00000000081D0000-0x00000000081DC000-memory.dmp

Download

memory/588-5247-0x00000000081C0000-0x00000000081CC000-memory.dmp

Download

memory/588-5249-0x00000000081F0000-0x00000000081FC000-memory.dmp

Download

memory/588-5254-0x00000000085F0000-0x00000000085F8000-memory.dmp

Download

memory/588-5253-0x00000000085E0000-0x00000000085E8000-memory.dmp

Download

memory/588-5255-0x0000000008600000-0x000000000860A000-memory.dmp

Download

memory/588-5252-0x00000000085D0000-0x00000000085DE000-memory.dmp

Download

memory/588-5251-0x00000000084C0000-0x00000000084CA000-memory.dmp

Download

memory/588-5250-0x00000000084A0000-0x00000000084A8000-memory.dmp

Download

memory/588-5257-0x0000000008610000-0x000000000861C000-memory.dmp

Download

memory/588-5256-0x0000000005320000-0x0000000005330000-memory.dmp

Download

memory/588-5260-0x0000000008660000-0x00000000086C6000-memory.dmp

Download

memory/588-58-0x0000000005330000-0x00000000055E1000-memory.dmp

Download

memory/588-60-0x0000000005330000-0x00000000055E1000-memory.dmp

Download

memory/588-1-0x00000000055F0000-0x00000000058A8000-memory.dmp

Download

memory/588-2-0x0000000005320000-0x0000000005330000-memory.dmp

Download

memory/588-8409-0x0000000005320000-0x0000000005330000-memory.dmp

Download

memory/588-8897-0x0000000005320000-0x0000000005330000-memory.dmp

Download

memory/588-3-0x00000000058B0000-0x0000000005E56000-memory.dmp

Download

memory/588-4-0x0000000005330000-0x00000000055E6000-memory.dmp

Download

memory/588-5-0x0000000005330000-0x00000000055E1000-memory.dmp

Download

memory/588-54-0x0000000005330000-0x00000000055E1000-memory.dmp

Download

memory/588-9-0x0000000005330000-0x00000000055E1000-memory.dmp

Download

memory/588-32-0x0000000005330000-0x00000000055E1000-memory.dmp

Download

memory/1656-31464-0x0000000070E50000-0x0000000070E9C000-memory.dmp

Download

memory/3016-7792-0x0000000005A40000-0x000000000606A000-memory.dmp

Download

memory/3016-7744-0x00000000052D0000-0x0000000005306000-memory.dmp

Download

memory/3016-13153-0x0000000006180000-0x00000000061E6000-memory.dmp

Download

memory/3016-13293-0x0000000006260000-0x00000000065B7000-memory.dmp

Download

memory/3016-31472-0x0000000070E50000-0x0000000070E9C000-memory.dmp

Download

memory/3016-13150-0x00000000060E0000-0x0000000006102000-memory.dmp

Download

memory/3592-30839-0x00000000078F0000-0x000000000790A000-memory.dmp

Download

memory/3592-30661-0x0000000007530000-0x00000000075D4000-memory.dmp

Download

memory/3592-31463-0x0000000007B00000-0x0000000007B11000-memory.dmp

Download

memory/3592-31093-0x0000000007970000-0x000000000797A000-memory.dmp

Download

memory/3592-30561-0x0000000070E50000-0x0000000070E9C000-memory.dmp

Download

memory/3592-30751-0x0000000007F30000-0x00000000085AA000-memory.dmp

Download

memory/3592-31479-0x0000000007B30000-0x0000000007B3E000-memory.dmp

Download

memory/3592-31487-0x0000000007B40000-0x0000000007B55000-memory.dmp

Download

memory/3592-31488-0x0000000007D40000-0x0000000007D5A000-memory.dmp

Download

memory/3592-31221-0x0000000007B80000-0x0000000007C16000-memory.dmp

Download

memory/5116-31489-0x0000000007D40000-0x0000000007D48000-memory.dmp

Download

memory/5116-19239-0x0000000006100000-0x000000000611E000-memory.dmp

Download

memory/5116-19609-0x0000000006BD0000-0x0000000006C1C000-memory.dmp

Download

memory/5116-30660-0x0000000001370000-0x000000000138E000-memory.dmp

Download

memory/5116-30554-0x0000000070E50000-0x0000000070E9C000-memory.dmp

Download

memory/5116-30553-0x0000000006AF0000-0x0000000006B24000-memory.dmp

Download

memory/5292-31480-0x0000000070E50000-0x0000000070E9C000-memory.dmp

Download