dcrat | 4f4ccdd39f7a7bc70111ea588c9b0c5dae626d17b3bd00f61b27f02a3ed75333

Analysis

max time kernel
35s
max time network
117s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
11/07/2026, 00:59

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
x4f4ccdd39f7a7bc70111ea588c9b0c5dae626d17b3bd00f61b27f02a3ed75333.exe
Size 1.7MB
Sample260711-bcj3yah14j
SHA256 4f4ccdd39f7a7bc70111ea588c9b0c5dae626d17b3bd00f61b27f02a3ed75333
MD5 46ebfcd9290b41d0c2c59c2b99f8364e
SHA1 e7cdb8aed48e391badb345c729889c0a6201a5b8
SHA512 7f82083c39e4f2807946ad3fec331adfcd68c2058bc2a665c8ecba89b2a9d4c3d573443f0692546c0b5a451d8c598a24d9f14b493c775fef453bed0f0f6a9afb
SSDEEP 49152:ckQTAjIwMtuvMDVPG4JdXeR4aT6LQ+d3mY/4qxTsx3sc5:caZuRD9JdOR4m+lmY/4rx8c5
TLSH
T1A68523097181D373C2FB003085C58FB55A2566224F7566EFFBE89B662F202F4BB661C9
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery execution dcrat infostealer persistence rat trojan

Malware Config

Signatures

Family: DcRat 35 IoCs

DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

rat infostealer dcrat

description	ioc	pid	Process
		4512	schtasks.exe
		1148	schtasks.exe
		3400	schtasks.exe
		1232	schtasks.exe
		6664	schtasks.exe
		3740	schtasks.exe
		1984	schtasks.exe
		1496	schtasks.exe
		2700	schtasks.exe
		6020	schtasks.exe
		548	schtasks.exe
		4128	schtasks.exe
		2516	schtasks.exe
		256	schtasks.exe
		5096	schtasks.exe
		5948	schtasks.exe
		2360	schtasks.exe
File created	C:\Windows\en-US\6203df4a6bafc7		x4f4ccdd39f7a7bc70111ea588c9b0c5dae626d17b3bd00f61b27f02a3ed75333.exe
		2292	schtasks.exe
		2056	schtasks.exe
		1236	schtasks.exe
		6076	schtasks.exe
		5728	schtasks.exe
		4908	schtasks.exe
		4708	schtasks.exe
		2352	schtasks.exe
		4664	schtasks.exe
		3084	schtasks.exe
		3336	schtasks.exe
		3200	schtasks.exe
		5924	schtasks.exe
		5012	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language		x4f4ccdd39f7a7bc70111ea588c9b0c5dae626d17b3bd00f61b27f02a3ed75333.exe
		2544	schtasks.exe
		6840	schtasks.exe

Modifies WinLogon for persistence 2 TTPs 4 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Windows\\en-US\\lsass.exe\""	x4f4ccdd39f7a7bc70111ea588c9b0c5dae626d17b3bd00f61b27f02a3ed75333.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Windows\\en-US\\lsass.exe\", \"C:\\Windows.old\\dllhost.exe\""	x4f4ccdd39f7a7bc70111ea588c9b0c5dae626d17b3bd00f61b27f02a3ed75333.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Windows\\en-US\\lsass.exe\", \"C:\\Windows.old\\dllhost.exe\", \"C:\\Users\\Default\\PrintHood\\csrss.exe\""	x4f4ccdd39f7a7bc70111ea588c9b0c5dae626d17b3bd00f61b27f02a3ed75333.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Windows\\en-US\\lsass.exe\", \"C:\\Windows.old\\dllhost.exe\", \"C:\\Users\\Default\\PrintHood\\csrss.exe\", \"C:\\Program Files\\Microsoft Office\\Office16\\ctfmon.exe\""	x4f4ccdd39f7a7bc70111ea588c9b0c5dae626d17b3bd00f61b27f02a3ed75333.exe

Process spawned unexpected child process 33 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5096	5004	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5012	5004	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1984	5004	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4664	5004	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5924	5004	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2292	5004	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3400	5004	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3336	5004	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1496	5004	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5728	5004	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5948	5004	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	548	5004	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1148	5004	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	6076	5004	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2360	5004	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3740	5004	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3084	5004	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	256	5004	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	6020	5004	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3200	5004	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4908	5004	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4708	5004	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2544	5004	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1232	5004	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4512	5004	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4128	5004	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	6664	5004	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	6840	5004	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2056	5004	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1236	5004	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2352	5004	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2700	5004	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2516	5004	schtasks.exe	89

UAC bypass 3 TTPs 3 IoCs

defense_evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	x4f4ccdd39f7a7bc70111ea588c9b0c5dae626d17b3bd00f61b27f02a3ed75333.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	x4f4ccdd39f7a7bc70111ea588c9b0c5dae626d17b3bd00f61b27f02a3ed75333.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	x4f4ccdd39f7a7bc70111ea588c9b0c5dae626d17b3bd00f61b27f02a3ed75333.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 12 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
6748	powershell.exe
6204	powershell.exe
2500	powershell.exe
4316	powershell.exe
2580	powershell.exe
4500	powershell.exe
3816	powershell.exe
1836	powershell.exe
6460	powershell.exe
4740	powershell.exe
1684	powershell.exe
4532	powershell.exe

Adds Run key to start application 2 TTPs 8 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Users\\Default\\PrintHood\\csrss.exe\""	x4f4ccdd39f7a7bc70111ea588c9b0c5dae626d17b3bd00f61b27f02a3ed75333.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Users\\Default\\PrintHood\\csrss.exe\""	x4f4ccdd39f7a7bc70111ea588c9b0c5dae626d17b3bd00f61b27f02a3ed75333.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Windows\CurrentVersion\Run\ctfmon = "\"C:\\Program Files\\Microsoft Office\\Office16\\ctfmon.exe\""	x4f4ccdd39f7a7bc70111ea588c9b0c5dae626d17b3bd00f61b27f02a3ed75333.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ctfmon = "\"C:\\Program Files\\Microsoft Office\\Office16\\ctfmon.exe\""	x4f4ccdd39f7a7bc70111ea588c9b0c5dae626d17b3bd00f61b27f02a3ed75333.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Windows\CurrentVersion\Run\lsass = "\"C:\\Windows\\en-US\\lsass.exe\""	x4f4ccdd39f7a7bc70111ea588c9b0c5dae626d17b3bd00f61b27f02a3ed75333.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\lsass = "\"C:\\Windows\\en-US\\lsass.exe\""	x4f4ccdd39f7a7bc70111ea588c9b0c5dae626d17b3bd00f61b27f02a3ed75333.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Windows\CurrentVersion\Run\dllhost = "\"C:\\Windows.old\\dllhost.exe\""	x4f4ccdd39f7a7bc70111ea588c9b0c5dae626d17b3bd00f61b27f02a3ed75333.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\dllhost = "\"C:\\Windows.old\\dllhost.exe\""	x4f4ccdd39f7a7bc70111ea588c9b0c5dae626d17b3bd00f61b27f02a3ed75333.exe

Checks whether UAC is enabled 1 TTPs 2 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	x4f4ccdd39f7a7bc70111ea588c9b0c5dae626d17b3bd00f61b27f02a3ed75333.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	x4f4ccdd39f7a7bc70111ea588c9b0c5dae626d17b3bd00f61b27f02a3ed75333.exe

SmartAssembly .NET packer 5 IoCs

Detects SmartAssembly .NET packer.

resource	yara_rule
behavioral2/memory/4780-5232-0x00000000065F0000-0x0000000006600000-memory.dmp	SmartAssembly
behavioral2/memory/4780-5236-0x00000000066C0000-0x00000000066CA000-memory.dmp	SmartAssembly
behavioral2/memory/4780-5241-0x0000000006FD0000-0x0000000006FDC000-memory.dmp	SmartAssembly
behavioral2/memory/4780-5244-0x00000000073B0000-0x00000000073BC000-memory.dmp	SmartAssembly
behavioral2/memory/4780-5242-0x0000000007390000-0x000000000739A000-memory.dmp	SmartAssembly

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files\Microsoft Office\Office16\ctfmon.exe	x4f4ccdd39f7a7bc70111ea588c9b0c5dae626d17b3bd00f61b27f02a3ed75333.exe
File created	C:\Program Files\Microsoft Office\Office16\26c12092da979c	x4f4ccdd39f7a7bc70111ea588c9b0c5dae626d17b3bd00f61b27f02a3ed75333.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\en-US\lsass.exe	x4f4ccdd39f7a7bc70111ea588c9b0c5dae626d17b3bd00f61b27f02a3ed75333.exe
File created	C:\Windows\en-US\6203df4a6bafc7	x4f4ccdd39f7a7bc70111ea588c9b0c5dae626d17b3bd00f61b27f02a3ed75333.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	x4f4ccdd39f7a7bc70111ea588c9b0c5dae626d17b3bd00f61b27f02a3ed75333.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 33 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2544	schtasks.exe
4128	schtasks.exe
6840	schtasks.exe
5012	schtasks.exe
256	schtasks.exe
4708	schtasks.exe
2056	schtasks.exe
2292	schtasks.exe
1148	schtasks.exe
6076	schtasks.exe
1232	schtasks.exe
1236	schtasks.exe
2352	schtasks.exe
2700	schtasks.exe
2516	schtasks.exe
5924	schtasks.exe
5728	schtasks.exe
4512	schtasks.exe
5948	schtasks.exe
1984	schtasks.exe
4664	schtasks.exe
1496	schtasks.exe
3084	schtasks.exe
6020	schtasks.exe
3200	schtasks.exe
3400	schtasks.exe
3336	schtasks.exe
548	schtasks.exe
4908	schtasks.exe
6664	schtasks.exe
5096	schtasks.exe
2360	schtasks.exe
3740	schtasks.exe

Suspicious behavior: EnumeratesProcesses 19 IoCs

pid	Process
4780	x4f4ccdd39f7a7bc70111ea588c9b0c5dae626d17b3bd00f61b27f02a3ed75333.exe
4780	x4f4ccdd39f7a7bc70111ea588c9b0c5dae626d17b3bd00f61b27f02a3ed75333.exe
4780	x4f4ccdd39f7a7bc70111ea588c9b0c5dae626d17b3bd00f61b27f02a3ed75333.exe
4780	x4f4ccdd39f7a7bc70111ea588c9b0c5dae626d17b3bd00f61b27f02a3ed75333.exe
4780	x4f4ccdd39f7a7bc70111ea588c9b0c5dae626d17b3bd00f61b27f02a3ed75333.exe
4780	x4f4ccdd39f7a7bc70111ea588c9b0c5dae626d17b3bd00f61b27f02a3ed75333.exe
4780	x4f4ccdd39f7a7bc70111ea588c9b0c5dae626d17b3bd00f61b27f02a3ed75333.exe
4780	x4f4ccdd39f7a7bc70111ea588c9b0c5dae626d17b3bd00f61b27f02a3ed75333.exe
4780	x4f4ccdd39f7a7bc70111ea588c9b0c5dae626d17b3bd00f61b27f02a3ed75333.exe
4780	x4f4ccdd39f7a7bc70111ea588c9b0c5dae626d17b3bd00f61b27f02a3ed75333.exe
4780	x4f4ccdd39f7a7bc70111ea588c9b0c5dae626d17b3bd00f61b27f02a3ed75333.exe
4780	x4f4ccdd39f7a7bc70111ea588c9b0c5dae626d17b3bd00f61b27f02a3ed75333.exe
4780	x4f4ccdd39f7a7bc70111ea588c9b0c5dae626d17b3bd00f61b27f02a3ed75333.exe
4780	x4f4ccdd39f7a7bc70111ea588c9b0c5dae626d17b3bd00f61b27f02a3ed75333.exe
4780	x4f4ccdd39f7a7bc70111ea588c9b0c5dae626d17b3bd00f61b27f02a3ed75333.exe
4780	x4f4ccdd39f7a7bc70111ea588c9b0c5dae626d17b3bd00f61b27f02a3ed75333.exe
4780	x4f4ccdd39f7a7bc70111ea588c9b0c5dae626d17b3bd00f61b27f02a3ed75333.exe
4780	x4f4ccdd39f7a7bc70111ea588c9b0c5dae626d17b3bd00f61b27f02a3ed75333.exe
4780	x4f4ccdd39f7a7bc70111ea588c9b0c5dae626d17b3bd00f61b27f02a3ed75333.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4780	x4f4ccdd39f7a7bc70111ea588c9b0c5dae626d17b3bd00f61b27f02a3ed75333.exe

System policy modification 1 TTPs 3 IoCs

defense_evasion

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	x4f4ccdd39f7a7bc70111ea588c9b0c5dae626d17b3bd00f61b27f02a3ed75333.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	x4f4ccdd39f7a7bc70111ea588c9b0c5dae626d17b3bd00f61b27f02a3ed75333.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	x4f4ccdd39f7a7bc70111ea588c9b0c5dae626d17b3bd00f61b27f02a3ed75333.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\x4f4ccdd39f7a7bc70111ea588c9b0c5dae626d17b3bd00f61b27f02a3ed75333.exe
"C:\Users\Admin\AppData\Local\Temp\x4f4ccdd39f7a7bc70111ea588c9b0c5dae626d17b3bd00f61b27f02a3ed75333.exe"
1⤵
- Family: DcRat
- Modifies WinLogon for persistence
- UAC bypass
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- System policy modification
PID:4780
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:3816
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/$Recycle.Bin/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:4500
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Documents and Settings/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:4532
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/PerfLogs/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:1684
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:2580
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files (x86)/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:4740
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/ProgramData/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:4316
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Recovery/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:6460
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/System Volume Information/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:2500
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Users/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:1836
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Windows/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:6204
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Windows.old/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:6748

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 11 /tr "'C:\Windows\en-US\lsass.exe'" /f
1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5096

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsass" /sc ONLOGON /tr "'C:\Windows\en-US\lsass.exe'" /rl HIGHEST /f
1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5012

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 8 /tr "'C:\Windows\en-US\lsass.exe'" /rl HIGHEST /f
1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1984

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 13 /tr "'C:\Windows.old\dllhost.exe'" /f
1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4664

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Windows.old\dllhost.exe'" /rl HIGHEST /f
1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5924

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 6 /tr "'C:\Windows.old\dllhost.exe'" /rl HIGHEST /f
1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2292

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 10 /tr "'C:\Users\Default\PrintHood\csrss.exe'" /f
1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3400

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Users\Default\PrintHood\csrss.exe'" /rl HIGHEST /f
1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3336

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 9 /tr "'C:\Users\Default\PrintHood\csrss.exe'" /rl HIGHEST /f
1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1496

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "ctfmonc" /sc MINUTE /mo 11 /tr "'C:\Program Files\Microsoft Office\Office16\ctfmon.exe'" /f
1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5728

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "ctfmon" /sc ONLOGON /tr "'C:\Program Files\Microsoft Office\Office16\ctfmon.exe'" /rl HIGHEST /f
1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5948

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "ctfmonc" /sc MINUTE /mo 14 /tr "'C:\Program Files\Microsoft Office\Office16\ctfmon.exe'" /rl HIGHEST /f
1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:548

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 9 /tr "'C:\Users\Admin\Documents\My Music\dwm.exe'" /f
1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1148

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwm" /sc ONLOGON /tr "'C:\Users\Admin\Documents\My Music\dwm.exe'" /rl HIGHEST /f
1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:6076

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 9 /tr "'C:\Users\Admin\Documents\My Music\dwm.exe'" /rl HIGHEST /f
1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2360

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SearchHostS" /sc MINUTE /mo 13 /tr "'C:\Program Files\Windows Defender Advanced Threat Protection\it-IT\SearchHost.exe'" /f
1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3740

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SearchHost" /sc ONLOGON /tr "'C:\Program Files\Windows Defender Advanced Threat Protection\it-IT\SearchHost.exe'" /rl HIGHEST /f
1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3084

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SearchHostS" /sc MINUTE /mo 10 /tr "'C:\Program Files\Windows Defender Advanced Threat Protection\it-IT\SearchHost.exe'" /rl HIGHEST /f
1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:256

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 6 /tr "'C:\Windows.old\services.exe'" /f
1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:6020

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "services" /sc ONLOGON /tr "'C:\Windows.old\services.exe'" /rl HIGHEST /f
1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3200

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 10 /tr "'C:\Windows.old\services.exe'" /rl HIGHEST /f
1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4908

C:\Windows\en-US\lsass.exe
"C:\Windows\en-US\lsass.exe"
1⤵
PID:964

C:\Program Files\Microsoft Office\Office16\ctfmon.exe
"C:\Program Files\Microsoft Office\Office16\ctfmon.exe"
1⤵
PID:5000

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "StartMenuExperienceHostS" /sc MINUTE /mo 14 /tr "'C:\Recovery\WindowsRE\StartMenuExperienceHost.exe'" /f
1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4708

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "StartMenuExperienceHost" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\StartMenuExperienceHost.exe'" /rl HIGHEST /f
1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2544

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "StartMenuExperienceHostS" /sc MINUTE /mo 8 /tr "'C:\Recovery\WindowsRE\StartMenuExperienceHost.exe'" /rl HIGHEST /f
1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1232

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 6 /tr "'C:\Windows.old\dllhost.exe'" /f
1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4512

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Windows.old\dllhost.exe'" /rl HIGHEST /f
1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4128

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 6 /tr "'C:\Windows.old\dllhost.exe'" /rl HIGHEST /f
1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:6664

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SearchHostS" /sc MINUTE /mo 9 /tr "'C:\Windows\bcastdvr\SearchHost.exe'" /f
1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:6840

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SearchHost" /sc ONLOGON /tr "'C:\Windows\bcastdvr\SearchHost.exe'" /rl HIGHEST /f
1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2056

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SearchHostS" /sc MINUTE /mo 12 /tr "'C:\Windows\bcastdvr\SearchHost.exe'" /rl HIGHEST /f
1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1236

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 10 /tr "'C:\Windows.old\smss.exe'" /f
1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2352

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smss" /sc ONLOGON /tr "'C:\Windows.old\smss.exe'" /rl HIGHEST /f
1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2700

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 7 /tr "'C:\Windows.old\smss.exe'" /rl HIGHEST /f
1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2516

C:\Windows.old\smss.exe
"C:\Windows.old\smss.exe"
1⤵
PID:2284

C:\Users\Default\PrintHood\csrss.exe
"C:\Users\Default\PrintHood\csrss.exe"
1⤵
PID:6408

C:\Windows.old\dllhost.exe
"C:\Windows.old\dllhost.exe"
1⤵
PID:2304

C:\Windows\bcastdvr\SearchHost.exe
"C:\Windows\bcastdvr\SearchHost.exe"
1⤵
PID:4824

C:\Recovery\WindowsRE\StartMenuExperienceHost.exe
"C:\Recovery\WindowsRE\StartMenuExperienceHost.exe"
1⤵
PID:1652

C:\Users\Admin\Documents\My Music\dwm.exe
"C:\Users\Admin\Documents\My Music\dwm.exe"
1⤵
PID:6848

C:\Windows.old\services.exe
"C:\Windows.old\services.exe"
1⤵
PID:4352

C:\Program Files\Windows Defender Advanced Threat Protection\it-IT\SearchHost.exe
"C:\Program Files\Windows Defender Advanced Threat Protection\it-IT\SearchHost.exe"
1⤵
PID:1876

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

RCXA8CC.tmp

Path C:\Program Files\Microsoft Office\Office16\RCXA8CC.tmp
Size 1.7MB
SHA256 c05ea6e058fdfdaccca926b8d608cfffdff190c50b36be7eba32aa5f45936f2d
MD5 9923f2cb78bd29fc33187913c72151c0
SHA1 5abed86ab1e4c03206284bab4cc10cebde1d5eef
SHA512 338885b1c7b1031ba49a3469322dbb290f6cbd69bd940c80b9dfd2b0cc253464130e3dfed703b0a01eb26ba54615a98feaa706194483373a2cf71f8f9c192717
SSDEEP 49152:ckQTAjIwMtuvMDVPG4JdXeR4aT6LQ+d3mY/4qxTsx3sc4:caZuRD9JdOR4m+lmY/4rx8c4
TLSH
T1BF8523097181D373C2FB003085C58FB55A2566224F7566EFFBE89B662F202F4BB661C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_gxtpgxdt.uii.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_gxtpgxdt.uii.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

lsass.exe

Path C:\Windows\en-US\lsass.exe
Size 1.7MB
SHA256 4f4ccdd39f7a7bc70111ea588c9b0c5dae626d17b3bd00f61b27f02a3ed75333
MD5 46ebfcd9290b41d0c2c59c2b99f8364e
SHA1 e7cdb8aed48e391badb345c729889c0a6201a5b8
SHA512 7f82083c39e4f2807946ad3fec331adfcd68c2058bc2a665c8ecba89b2a9d4c3d573443f0692546c0b5a451d8c598a24d9f14b493c775fef453bed0f0f6a9afb
SSDEEP 49152:ckQTAjIwMtuvMDVPG4JdXeR4aT6LQ+d3mY/4qxTsx3sc5:caZuRD9JdOR4m+lmY/4rx8c5
TLSH
T1A68523097181D373C2FB003085C58FB55A2566224F7566EFFBE89B662F202F4BB661C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1684-17542-0x0000000005380000-0x00000000059CA000-memory.dmp

Download

memory/1684-17508-0x0000000002780000-0x00000000027B6000-memory.dmp

Download

memory/2580-18070-0x0000000005470000-0x0000000005492000-memory.dmp

Download

memory/2580-22092-0x0000000006050000-0x00000000063AB000-memory.dmp

Download

memory/2580-18114-0x0000000005510000-0x0000000005576000-memory.dmp

Download

memory/4780-67-0x00000000053A0000-0x0000000005614000-memory.dmp

Download

memory/4780-5240-0x0000000006FC0000-0x0000000006FCC000-memory.dmp

Download

memory/4780-3-0x0000000074B20000-0x00000000752DC000-memory.dmp

Download

memory/4780-47-0x00000000053A0000-0x0000000005614000-memory.dmp

Download

memory/4780-85-0x00000000053A0000-0x0000000005614000-memory.dmp

Download

memory/4780-91-0x00000000053A0000-0x0000000005614000-memory.dmp

Download

memory/4780-125-0x00000000053A0000-0x0000000005614000-memory.dmp

Download

memory/4780-132-0x00000000053A0000-0x0000000005614000-memory.dmp

Download

memory/4780-129-0x00000000053A0000-0x0000000005614000-memory.dmp

Download

memory/4780-127-0x00000000053A0000-0x0000000005614000-memory.dmp

Download

memory/4780-123-0x00000000053A0000-0x0000000005614000-memory.dmp

Download

memory/4780-121-0x00000000053A0000-0x0000000005614000-memory.dmp

Download

memory/4780-119-0x00000000053A0000-0x0000000005614000-memory.dmp

Download

memory/4780-117-0x00000000053A0000-0x0000000005614000-memory.dmp

Download

memory/4780-115-0x00000000053A0000-0x0000000005614000-memory.dmp

Download

memory/4780-113-0x00000000053A0000-0x0000000005614000-memory.dmp

Download

memory/4780-112-0x00000000053A0000-0x0000000005614000-memory.dmp

Download

memory/4780-109-0x00000000053A0000-0x0000000005614000-memory.dmp

Download

memory/4780-107-0x00000000053A0000-0x0000000005614000-memory.dmp

Download

memory/4780-105-0x00000000053A0000-0x0000000005614000-memory.dmp

Download

memory/4780-104-0x00000000053A0000-0x0000000005614000-memory.dmp

Download

memory/4780-101-0x00000000053A0000-0x0000000005614000-memory.dmp

Download

memory/4780-99-0x00000000053A0000-0x0000000005614000-memory.dmp

Download

memory/4780-95-0x00000000053A0000-0x0000000005614000-memory.dmp

Download

memory/4780-93-0x00000000053A0000-0x0000000005614000-memory.dmp

Download

memory/4780-89-0x00000000053A0000-0x0000000005614000-memory.dmp

Download

memory/4780-87-0x00000000053A0000-0x0000000005614000-memory.dmp

Download

memory/4780-83-0x00000000053A0000-0x0000000005614000-memory.dmp

Download

memory/4780-79-0x00000000053A0000-0x0000000005614000-memory.dmp

Download

memory/4780-73-0x00000000053A0000-0x0000000005614000-memory.dmp

Download

memory/4780-71-0x00000000053A0000-0x0000000005614000-memory.dmp

Download

memory/4780-70-0x00000000053A0000-0x0000000005614000-memory.dmp

Download

memory/4780-65-0x00000000053A0000-0x0000000005614000-memory.dmp

Download

memory/4780-64-0x00000000053A0000-0x0000000005614000-memory.dmp

Download

memory/4780-61-0x00000000053A0000-0x0000000005614000-memory.dmp

Download

memory/4780-59-0x00000000053A0000-0x0000000005614000-memory.dmp

Download

memory/4780-55-0x00000000053A0000-0x0000000005614000-memory.dmp

Download

memory/4780-53-0x00000000053A0000-0x0000000005614000-memory.dmp

Download

memory/4780-51-0x00000000053A0000-0x0000000005614000-memory.dmp

Download

memory/4780-49-0x00000000053A0000-0x0000000005614000-memory.dmp

Download

memory/4780-98-0x00000000053A0000-0x0000000005614000-memory.dmp

Download

memory/4780-82-0x00000000053A0000-0x0000000005614000-memory.dmp

Download

memory/4780-77-0x00000000053A0000-0x0000000005614000-memory.dmp

Download

memory/4780-75-0x00000000053A0000-0x0000000005614000-memory.dmp

Download

memory/4780-4-0x00000000058A0000-0x0000000005E5A000-memory.dmp

Download

memory/4780-57-0x00000000053A0000-0x0000000005614000-memory.dmp

Download

memory/4780-43-0x00000000053A0000-0x0000000005614000-memory.dmp

Download

memory/4780-39-0x00000000053A0000-0x0000000005614000-memory.dmp

Download

memory/4780-5-0x00000000053A0000-0x000000000561A000-memory.dmp

Download

memory/4780-33-0x00000000053A0000-0x0000000005614000-memory.dmp

Download

memory/4780-38-0x00000000053A0000-0x0000000005614000-memory.dmp

Download

memory/4780-31-0x00000000053A0000-0x0000000005614000-memory.dmp

Download

memory/4780-28-0x00000000053A0000-0x0000000005614000-memory.dmp

Download

memory/4780-23-0x00000000053A0000-0x0000000005614000-memory.dmp

Download

memory/4780-21-0x00000000053A0000-0x0000000005614000-memory.dmp

Download

memory/4780-19-0x00000000053A0000-0x0000000005614000-memory.dmp

Download

memory/4780-17-0x00000000053A0000-0x0000000005614000-memory.dmp

Download

memory/4780-15-0x00000000053A0000-0x0000000005614000-memory.dmp

Download

memory/4780-13-0x00000000053A0000-0x0000000005614000-memory.dmp

Download

memory/4780-11-0x00000000053A0000-0x0000000005614000-memory.dmp

Download

memory/4780-45-0x00000000053A0000-0x0000000005614000-memory.dmp

Download

memory/4780-41-0x00000000053A0000-0x0000000005614000-memory.dmp

Download

memory/4780-29-0x00000000053A0000-0x0000000005614000-memory.dmp

Download

memory/4780-25-0x00000000053A0000-0x0000000005614000-memory.dmp

Download

memory/4780-10-0x00000000053A0000-0x0000000005614000-memory.dmp

Download

memory/4780-7-0x00000000053A0000-0x0000000005614000-memory.dmp

Download

memory/4780-6-0x00000000053A0000-0x0000000005614000-memory.dmp

Download

memory/4780-2280-0x0000000074B32000-0x0000000074B33000-memory.dmp

Download

memory/4780-2281-0x0000000074B20000-0x00000000752DC000-memory.dmp

Download

memory/4780-5228-0x0000000074B20000-0x00000000752DC000-memory.dmp

Download

memory/4780-5229-0x0000000002C20000-0x0000000002C3C000-memory.dmp

Download

memory/4780-5230-0x0000000002C50000-0x0000000002CA0000-memory.dmp

Download

memory/4780-5231-0x0000000002CB0000-0x0000000002CB8000-memory.dmp

Download

memory/4780-5232-0x00000000065F0000-0x0000000006600000-memory.dmp

Download

memory/4780-5233-0x0000000006650000-0x0000000006666000-memory.dmp

Download

memory/4780-5234-0x0000000006630000-0x0000000006638000-memory.dmp

Download

memory/4780-5235-0x0000000006670000-0x0000000006680000-memory.dmp

Download

memory/4780-5236-0x00000000066C0000-0x00000000066CA000-memory.dmp

Download

memory/4780-5237-0x00000000069F0000-0x00000000069FC000-memory.dmp

Download

memory/4780-5238-0x0000000006A00000-0x0000000006A12000-memory.dmp

Download

memory/4780-5239-0x0000000006A30000-0x0000000006F5C000-memory.dmp

Download

memory/4780-35-0x00000000053A0000-0x0000000005614000-memory.dmp

Download

memory/4780-5241-0x0000000006FD0000-0x0000000006FDC000-memory.dmp

Download

memory/4780-5244-0x00000000073B0000-0x00000000073BC000-memory.dmp

Download

memory/4780-5243-0x00000000073A0000-0x00000000073A8000-memory.dmp

Download

memory/4780-5242-0x0000000007390000-0x000000000739A000-memory.dmp

Download

memory/4780-5245-0x00000000073C0000-0x0000000007452000-memory.dmp

Download

memory/4780-5246-0x00000000074A0000-0x00000000074AC000-memory.dmp

Download

memory/4780-5247-0x0000000074B20000-0x00000000752DC000-memory.dmp

Download

memory/4780-5249-0x00000000074C0000-0x0000000007526000-memory.dmp

Download

memory/4780-2-0x0000000074B20000-0x00000000752DC000-memory.dmp

Download

memory/4780-1-0x0000000005620000-0x000000000589C000-memory.dmp

Download

memory/4780-0-0x0000000074B32000-0x0000000074B33000-memory.dmp

Download

memory/4780-5250-0x0000000074B20000-0x00000000752DC000-memory.dmp

Download

memory/4780-6966-0x0000000074B20000-0x00000000752DC000-memory.dmp

Download

memory/4780-7707-0x0000000074B20000-0x00000000752DC000-memory.dmp

Download

memory/4780-8125-0x0000000074B20000-0x00000000752DC000-memory.dmp

Download