dcrat | 0032705a736c09ccb7d06c156ceceee2c5915f486a32df2cd0d00d8393c9e0f2

Analysis

max time kernel
118s
max time network
122s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
26/01/2024, 10:51

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
a45e2d72a3718dd27e9b0703307a2e4a.exe
Size 2.0MB
Sample240126-mxtcwsdcar
SHA256 0032705a736c09ccb7d06c156ceceee2c5915f486a32df2cd0d00d8393c9e0f2
MD5 a45e2d72a3718dd27e9b0703307a2e4a
SHA1 f6ebbf64e1e39ec8a76abc083fa51a77fdac0f53
SHA512 7fa83f4efb85388434cf6528aec75408f68cd9f05af04e01d3be1cf9eef83adab71e5eee6478c1e55314a37dbe8373b44ae161a1e3d48ab2105b9f1719251528
SSDEEP 24576:9A9WcYe+oGCL+vBTgZeA26HSDz4nyTouez9kVfJdslp4SHvEMZyMApbABdW+Oocf:9az+tB3A2DzcyDYyMv4gZab0e3sM
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

dcrat infostealer persistence rat

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat

Modifies WinLogon for persistence 2 TTPs 9 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files\\MSBuild\\a45e2d72a3718dd27e9b0703307a2e4a.exe\", \"C:\\Windows\\ShellNew\\dllhost.exe\", \"C:\\Recovery\\463aa442-9b96-11ee-b087-e6b52eba4e86\\System.exe\""	a45e2d72a3718dd27e9b0703307a2e4a.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files\\MSBuild\\a45e2d72a3718dd27e9b0703307a2e4a.exe\", \"C:\\Windows\\ShellNew\\dllhost.exe\", \"C:\\Recovery\\463aa442-9b96-11ee-b087-e6b52eba4e86\\System.exe\", \"C:\\Program Files (x86)\\Windows Portable Devices\\dwm.exe\", \"C:\\Program Files (x86)\\Windows Mail\\it-IT\\a45e2d72a3718dd27e9b0703307a2e4a.exe\""	a45e2d72a3718dd27e9b0703307a2e4a.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files\\MSBuild\\a45e2d72a3718dd27e9b0703307a2e4a.exe\", \"C:\\Windows\\ShellNew\\dllhost.exe\", \"C:\\Recovery\\463aa442-9b96-11ee-b087-e6b52eba4e86\\System.exe\", \"C:\\Program Files (x86)\\Windows Portable Devices\\dwm.exe\", \"C:\\Program Files (x86)\\Windows Mail\\it-IT\\a45e2d72a3718dd27e9b0703307a2e4a.exe\", \"C:\\MSOCache\\All Users\\{90140000-001A-0409-0000-0000000FF1CE}-C\\a45e2d72a3718dd27e9b0703307a2e4a.exe\""	a45e2d72a3718dd27e9b0703307a2e4a.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files\\MSBuild\\a45e2d72a3718dd27e9b0703307a2e4a.exe\", \"C:\\Windows\\ShellNew\\dllhost.exe\", \"C:\\Recovery\\463aa442-9b96-11ee-b087-e6b52eba4e86\\System.exe\", \"C:\\Program Files (x86)\\Windows Portable Devices\\dwm.exe\", \"C:\\Program Files (x86)\\Windows Mail\\it-IT\\a45e2d72a3718dd27e9b0703307a2e4a.exe\", \"C:\\MSOCache\\All Users\\{90140000-001A-0409-0000-0000000FF1CE}-C\\a45e2d72a3718dd27e9b0703307a2e4a.exe\", \"C:\\Program Files (x86)\\Uninstall Information\\lsm.exe\""	a45e2d72a3718dd27e9b0703307a2e4a.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files\\MSBuild\\a45e2d72a3718dd27e9b0703307a2e4a.exe\""	a45e2d72a3718dd27e9b0703307a2e4a.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files\\MSBuild\\a45e2d72a3718dd27e9b0703307a2e4a.exe\", \"C:\\Windows\\ShellNew\\dllhost.exe\""	a45e2d72a3718dd27e9b0703307a2e4a.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files\\MSBuild\\a45e2d72a3718dd27e9b0703307a2e4a.exe\", \"C:\\Windows\\ShellNew\\dllhost.exe\", \"C:\\Recovery\\463aa442-9b96-11ee-b087-e6b52eba4e86\\System.exe\", \"C:\\Program Files (x86)\\Windows Portable Devices\\dwm.exe\""	a45e2d72a3718dd27e9b0703307a2e4a.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files\\MSBuild\\a45e2d72a3718dd27e9b0703307a2e4a.exe\", \"C:\\Windows\\ShellNew\\dllhost.exe\", \"C:\\Recovery\\463aa442-9b96-11ee-b087-e6b52eba4e86\\System.exe\", \"C:\\Program Files (x86)\\Windows Portable Devices\\dwm.exe\", \"C:\\Program Files (x86)\\Windows Mail\\it-IT\\a45e2d72a3718dd27e9b0703307a2e4a.exe\", \"C:\\MSOCache\\All Users\\{90140000-001A-0409-0000-0000000FF1CE}-C\\a45e2d72a3718dd27e9b0703307a2e4a.exe\", \"C:\\Program Files (x86)\\Uninstall Information\\lsm.exe\", \"C:\\Recovery\\463aa442-9b96-11ee-b087-e6b52eba4e86\\dwm.exe\""	a45e2d72a3718dd27e9b0703307a2e4a.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files\\MSBuild\\a45e2d72a3718dd27e9b0703307a2e4a.exe\", \"C:\\Windows\\ShellNew\\dllhost.exe\", \"C:\\Recovery\\463aa442-9b96-11ee-b087-e6b52eba4e86\\System.exe\", \"C:\\Program Files (x86)\\Windows Portable Devices\\dwm.exe\", \"C:\\Program Files (x86)\\Windows Mail\\it-IT\\a45e2d72a3718dd27e9b0703307a2e4a.exe\", \"C:\\MSOCache\\All Users\\{90140000-001A-0409-0000-0000000FF1CE}-C\\a45e2d72a3718dd27e9b0703307a2e4a.exe\", \"C:\\Program Files (x86)\\Uninstall Information\\lsm.exe\", \"C:\\Recovery\\463aa442-9b96-11ee-b087-e6b52eba4e86\\dwm.exe\", \"C:\\Windows\\de-DE\\dwm.exe\""	a45e2d72a3718dd27e9b0703307a2e4a.exe

Process spawned unexpected child process 27 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2556	2800	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2440	2800	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2704	2800	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2560	2800	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2608	2800	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2064	2800	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3004	2800	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1720	2800	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2596	2800	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1472	2800	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2636	2800	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2460	2800	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2848	2800	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2464	2800	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1928	2800	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1596	2800	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1648	2800	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1556	2800	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	268	2800	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1240	2800	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3012	2800	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3032	2800	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2056	2800	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1052	2800	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2984	2800	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	592	2800	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2116	2800	schtasks.exe	28

DCRat payload 5 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral1/memory/2264-0-0x0000000000B70000-0x0000000000D7A000-memory.dmp	dcrat
behavioral1/files/0x0038000000016d32-31.dat	dcrat
behavioral1/files/0x000700000001736f-119.dat	dcrat
behavioral1/memory/568-141-0x0000000000150000-0x000000000035A000-memory.dmp	dcrat
behavioral1/files/0x000700000001736f-134.dat	dcrat

Executes dropped EXE 1 IoCs

pid	Process
568	System.exe

Adds Run key to start application 2 TTPs 18 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dllhost = "\"C:\\Windows\\ShellNew\\dllhost.exe\""	a45e2d72a3718dd27e9b0703307a2e4a.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Windows\CurrentVersion\Run\dwm = "\"C:\\Program Files (x86)\\Windows Portable Devices\\dwm.exe\""	a45e2d72a3718dd27e9b0703307a2e4a.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dwm = "\"C:\\Program Files (x86)\\Windows Portable Devices\\dwm.exe\""	a45e2d72a3718dd27e9b0703307a2e4a.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Windows\CurrentVersion\Run\dwm = "\"C:\\Recovery\\463aa442-9b96-11ee-b087-e6b52eba4e86\\dwm.exe\""	a45e2d72a3718dd27e9b0703307a2e4a.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dwm = "\"C:\\Recovery\\463aa442-9b96-11ee-b087-e6b52eba4e86\\dwm.exe\""	a45e2d72a3718dd27e9b0703307a2e4a.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dwm = "\"C:\\Windows\\de-DE\\dwm.exe\""	a45e2d72a3718dd27e9b0703307a2e4a.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Windows\CurrentVersion\Run\a45e2d72a3718dd27e9b0703307a2e4a = "\"C:\\Program Files\\MSBuild\\a45e2d72a3718dd27e9b0703307a2e4a.exe\""	a45e2d72a3718dd27e9b0703307a2e4a.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Windows\CurrentVersion\Run\System = "\"C:\\Recovery\\463aa442-9b96-11ee-b087-e6b52eba4e86\\System.exe\""	a45e2d72a3718dd27e9b0703307a2e4a.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Windows\CurrentVersion\Run\a45e2d72a3718dd27e9b0703307a2e4a = "\"C:\\MSOCache\\All Users\\{90140000-001A-0409-0000-0000000FF1CE}-C\\a45e2d72a3718dd27e9b0703307a2e4a.exe\""	a45e2d72a3718dd27e9b0703307a2e4a.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Windows\CurrentVersion\Run\dwm = "\"C:\\Windows\\de-DE\\dwm.exe\""	a45e2d72a3718dd27e9b0703307a2e4a.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Windows\CurrentVersion\Run\dllhost = "\"C:\\Windows\\ShellNew\\dllhost.exe\""	a45e2d72a3718dd27e9b0703307a2e4a.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Windows\CurrentVersion\Run\lsm = "\"C:\\Program Files (x86)\\Uninstall Information\\lsm.exe\""	a45e2d72a3718dd27e9b0703307a2e4a.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\a45e2d72a3718dd27e9b0703307a2e4a = "\"C:\\Program Files\\MSBuild\\a45e2d72a3718dd27e9b0703307a2e4a.exe\""	a45e2d72a3718dd27e9b0703307a2e4a.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\System = "\"C:\\Recovery\\463aa442-9b96-11ee-b087-e6b52eba4e86\\System.exe\""	a45e2d72a3718dd27e9b0703307a2e4a.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Windows\CurrentVersion\Run\a45e2d72a3718dd27e9b0703307a2e4a = "\"C:\\Program Files (x86)\\Windows Mail\\it-IT\\a45e2d72a3718dd27e9b0703307a2e4a.exe\""	a45e2d72a3718dd27e9b0703307a2e4a.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\a45e2d72a3718dd27e9b0703307a2e4a = "\"C:\\Program Files (x86)\\Windows Mail\\it-IT\\a45e2d72a3718dd27e9b0703307a2e4a.exe\""	a45e2d72a3718dd27e9b0703307a2e4a.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\a45e2d72a3718dd27e9b0703307a2e4a = "\"C:\\MSOCache\\All Users\\{90140000-001A-0409-0000-0000000FF1CE}-C\\a45e2d72a3718dd27e9b0703307a2e4a.exe\""	a45e2d72a3718dd27e9b0703307a2e4a.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\lsm = "\"C:\\Program Files (x86)\\Uninstall Information\\lsm.exe\""	a45e2d72a3718dd27e9b0703307a2e4a.exe

Drops file in Program Files directory 16 IoCs

description	ioc	Process
File created	C:\Program Files\MSBuild\a45e2d72a3718dd27e9b0703307a2e4a.exe	a45e2d72a3718dd27e9b0703307a2e4a.exe
File created	C:\Program Files (x86)\Windows Portable Devices\dwm.exe	a45e2d72a3718dd27e9b0703307a2e4a.exe
File created	C:\Program Files (x86)\Windows Mail\it-IT\a45e2d72a3718dd27e9b0703307a2e4a.exe	a45e2d72a3718dd27e9b0703307a2e4a.exe
File created	C:\Program Files (x86)\Windows Mail\it-IT\caf82bc0cc2190	a45e2d72a3718dd27e9b0703307a2e4a.exe
File created	C:\Program Files (x86)\Uninstall Information\lsm.exe	a45e2d72a3718dd27e9b0703307a2e4a.exe
File opened for modification	C:\Program Files\MSBuild\RCX2FC8.tmp	a45e2d72a3718dd27e9b0703307a2e4a.exe
File opened for modification	C:\Program Files (x86)\Windows Mail\it-IT\a45e2d72a3718dd27e9b0703307a2e4a.exe	a45e2d72a3718dd27e9b0703307a2e4a.exe
File opened for modification	C:\Program Files (x86)\Uninstall Information\lsm.exe	a45e2d72a3718dd27e9b0703307a2e4a.exe
File created	C:\Program Files\MSBuild\caf82bc0cc2190	a45e2d72a3718dd27e9b0703307a2e4a.exe
File created	C:\Program Files (x86)\Windows Portable Devices\6cb0b6c459d5d3	a45e2d72a3718dd27e9b0703307a2e4a.exe
File created	C:\Program Files (x86)\Uninstall Information\101b941d020240	a45e2d72a3718dd27e9b0703307a2e4a.exe
File opened for modification	C:\Program Files (x86)\Windows Mail\it-IT\RCX38B2.tmp	a45e2d72a3718dd27e9b0703307a2e4a.exe
File opened for modification	C:\Program Files (x86)\Uninstall Information\RCX3CB9.tmp	a45e2d72a3718dd27e9b0703307a2e4a.exe
File opened for modification	C:\Program Files\MSBuild\a45e2d72a3718dd27e9b0703307a2e4a.exe	a45e2d72a3718dd27e9b0703307a2e4a.exe
File opened for modification	C:\Program Files (x86)\Windows Portable Devices\RCX3641.tmp	a45e2d72a3718dd27e9b0703307a2e4a.exe
File opened for modification	C:\Program Files (x86)\Windows Portable Devices\dwm.exe	a45e2d72a3718dd27e9b0703307a2e4a.exe

Drops file in Windows directory 8 IoCs

description	ioc	Process
File created	C:\Windows\ShellNew\dllhost.exe	a45e2d72a3718dd27e9b0703307a2e4a.exe
File created	C:\Windows\ShellNew\5940a34987c991	a45e2d72a3718dd27e9b0703307a2e4a.exe
File created	C:\Windows\de-DE\dwm.exe	a45e2d72a3718dd27e9b0703307a2e4a.exe
File created	C:\Windows\de-DE\6cb0b6c459d5d3	a45e2d72a3718dd27e9b0703307a2e4a.exe
File opened for modification	C:\Windows\ShellNew\RCX3239.tmp	a45e2d72a3718dd27e9b0703307a2e4a.exe
File opened for modification	C:\Windows\ShellNew\dllhost.exe	a45e2d72a3718dd27e9b0703307a2e4a.exe
File opened for modification	C:\Windows\de-DE\RCX419B.tmp	a45e2d72a3718dd27e9b0703307a2e4a.exe
File opened for modification	C:\Windows\de-DE\dwm.exe	a45e2d72a3718dd27e9b0703307a2e4a.exe

Creates scheduled task(s) 1 TTPs 27 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
2560	schtasks.exe
3004	schtasks.exe
268	schtasks.exe
1596	schtasks.exe
1556	schtasks.exe
2460	schtasks.exe
1240	schtasks.exe
592	schtasks.exe
1928	schtasks.exe
2556	schtasks.exe
2064	schtasks.exe
2636	schtasks.exe
2848	schtasks.exe
2984	schtasks.exe
2596	schtasks.exe
2464	schtasks.exe
2056	schtasks.exe
1052	schtasks.exe
1720	schtasks.exe
3032	schtasks.exe
1648	schtasks.exe
3012	schtasks.exe
2116	schtasks.exe
2440	schtasks.exe
2704	schtasks.exe
2608	schtasks.exe
1472	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2264	a45e2d72a3718dd27e9b0703307a2e4a.exe
2264	a45e2d72a3718dd27e9b0703307a2e4a.exe
2264	a45e2d72a3718dd27e9b0703307a2e4a.exe
2264	a45e2d72a3718dd27e9b0703307a2e4a.exe
2264	a45e2d72a3718dd27e9b0703307a2e4a.exe
2264	a45e2d72a3718dd27e9b0703307a2e4a.exe
2264	a45e2d72a3718dd27e9b0703307a2e4a.exe
2264	a45e2d72a3718dd27e9b0703307a2e4a.exe
2264	a45e2d72a3718dd27e9b0703307a2e4a.exe
2264	a45e2d72a3718dd27e9b0703307a2e4a.exe
2264	a45e2d72a3718dd27e9b0703307a2e4a.exe
2264	a45e2d72a3718dd27e9b0703307a2e4a.exe
2264	a45e2d72a3718dd27e9b0703307a2e4a.exe
2264	a45e2d72a3718dd27e9b0703307a2e4a.exe
2264	a45e2d72a3718dd27e9b0703307a2e4a.exe
2264	a45e2d72a3718dd27e9b0703307a2e4a.exe
2264	a45e2d72a3718dd27e9b0703307a2e4a.exe
2264	a45e2d72a3718dd27e9b0703307a2e4a.exe
2264	a45e2d72a3718dd27e9b0703307a2e4a.exe
2264	a45e2d72a3718dd27e9b0703307a2e4a.exe
2264	a45e2d72a3718dd27e9b0703307a2e4a.exe
2264	a45e2d72a3718dd27e9b0703307a2e4a.exe
2264	a45e2d72a3718dd27e9b0703307a2e4a.exe
2264	a45e2d72a3718dd27e9b0703307a2e4a.exe
2264	a45e2d72a3718dd27e9b0703307a2e4a.exe
2264	a45e2d72a3718dd27e9b0703307a2e4a.exe
2264	a45e2d72a3718dd27e9b0703307a2e4a.exe
2896	powershell.exe
2252	powershell.exe
1636	powershell.exe
3052	powershell.exe
1480	powershell.exe
3056	powershell.exe
1856	powershell.exe
320	powershell.exe
1796	powershell.exe
1912	powershell.exe
568	System.exe
568	System.exe
568	System.exe
568	System.exe
568	System.exe
568	System.exe
568	System.exe
568	System.exe
568	System.exe
568	System.exe
568	System.exe
568	System.exe
568	System.exe
568	System.exe
568	System.exe
568	System.exe
568	System.exe
568	System.exe
568	System.exe
568	System.exe
568	System.exe
568	System.exe
568	System.exe
568	System.exe
568	System.exe
568	System.exe
568	System.exe

Suspicious use of AdjustPrivilegeToken 12 IoCs

description	pid	Process
Token: SeDebugPrivilege	2264	a45e2d72a3718dd27e9b0703307a2e4a.exe
Token: SeDebugPrivilege	2896	powershell.exe
Token: SeDebugPrivilege	2252	powershell.exe
Token: SeDebugPrivilege	568	System.exe
Token: SeDebugPrivilege	1636	powershell.exe
Token: SeDebugPrivilege	3052	powershell.exe
Token: SeDebugPrivilege	1480	powershell.exe
Token: SeDebugPrivilege	3056	powershell.exe
Token: SeDebugPrivilege	1856	powershell.exe
Token: SeDebugPrivilege	320	powershell.exe
Token: SeDebugPrivilege	1796	powershell.exe
Token: SeDebugPrivilege	1912	powershell.exe

Suspicious use of WriteProcessMemory 33 IoCs

description	pid	Process	procid_target
PID 2264 wrote to memory of 2896	2264	a45e2d72a3718dd27e9b0703307a2e4a.exe	56
PID 2264 wrote to memory of 2896	2264	a45e2d72a3718dd27e9b0703307a2e4a.exe	56
PID 2264 wrote to memory of 2896	2264	a45e2d72a3718dd27e9b0703307a2e4a.exe	56
PID 2264 wrote to memory of 1856	2264	a45e2d72a3718dd27e9b0703307a2e4a.exe	57
PID 2264 wrote to memory of 1856	2264	a45e2d72a3718dd27e9b0703307a2e4a.exe	57
PID 2264 wrote to memory of 1856	2264	a45e2d72a3718dd27e9b0703307a2e4a.exe	57
PID 2264 wrote to memory of 2252	2264	a45e2d72a3718dd27e9b0703307a2e4a.exe	58
PID 2264 wrote to memory of 2252	2264	a45e2d72a3718dd27e9b0703307a2e4a.exe	58
PID 2264 wrote to memory of 2252	2264	a45e2d72a3718dd27e9b0703307a2e4a.exe	58
PID 2264 wrote to memory of 1636	2264	a45e2d72a3718dd27e9b0703307a2e4a.exe	59
PID 2264 wrote to memory of 1636	2264	a45e2d72a3718dd27e9b0703307a2e4a.exe	59
PID 2264 wrote to memory of 1636	2264	a45e2d72a3718dd27e9b0703307a2e4a.exe	59
PID 2264 wrote to memory of 1912	2264	a45e2d72a3718dd27e9b0703307a2e4a.exe	60
PID 2264 wrote to memory of 1912	2264	a45e2d72a3718dd27e9b0703307a2e4a.exe	60
PID 2264 wrote to memory of 1912	2264	a45e2d72a3718dd27e9b0703307a2e4a.exe	60
PID 2264 wrote to memory of 1480	2264	a45e2d72a3718dd27e9b0703307a2e4a.exe	61
PID 2264 wrote to memory of 1480	2264	a45e2d72a3718dd27e9b0703307a2e4a.exe	61
PID 2264 wrote to memory of 1480	2264	a45e2d72a3718dd27e9b0703307a2e4a.exe	61
PID 2264 wrote to memory of 1796	2264	a45e2d72a3718dd27e9b0703307a2e4a.exe	69
PID 2264 wrote to memory of 1796	2264	a45e2d72a3718dd27e9b0703307a2e4a.exe	69
PID 2264 wrote to memory of 1796	2264	a45e2d72a3718dd27e9b0703307a2e4a.exe	69
PID 2264 wrote to memory of 320	2264	a45e2d72a3718dd27e9b0703307a2e4a.exe	66
PID 2264 wrote to memory of 320	2264	a45e2d72a3718dd27e9b0703307a2e4a.exe	66
PID 2264 wrote to memory of 320	2264	a45e2d72a3718dd27e9b0703307a2e4a.exe	66
PID 2264 wrote to memory of 3052	2264	a45e2d72a3718dd27e9b0703307a2e4a.exe	67
PID 2264 wrote to memory of 3052	2264	a45e2d72a3718dd27e9b0703307a2e4a.exe	67
PID 2264 wrote to memory of 3052	2264	a45e2d72a3718dd27e9b0703307a2e4a.exe	67
PID 2264 wrote to memory of 3056	2264	a45e2d72a3718dd27e9b0703307a2e4a.exe	68
PID 2264 wrote to memory of 3056	2264	a45e2d72a3718dd27e9b0703307a2e4a.exe	68
PID 2264 wrote to memory of 3056	2264	a45e2d72a3718dd27e9b0703307a2e4a.exe	68
PID 2264 wrote to memory of 568	2264	a45e2d72a3718dd27e9b0703307a2e4a.exe	76
PID 2264 wrote to memory of 568	2264	a45e2d72a3718dd27e9b0703307a2e4a.exe	76
PID 2264 wrote to memory of 568	2264	a45e2d72a3718dd27e9b0703307a2e4a.exe	76

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\a45e2d72a3718dd27e9b0703307a2e4a.exe
"C:\Users\Admin\AppData\Local\Temp\a45e2d72a3718dd27e9b0703307a2e4a.exe"
1⤵
- Modifies WinLogon for persistence
- Adds Run key to start application
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2264
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\a45e2d72a3718dd27e9b0703307a2e4a.exe'
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2896
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\MSBuild\a45e2d72a3718dd27e9b0703307a2e4a.exe'
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1856
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\ShellNew\dllhost.exe'
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2252
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\463aa442-9b96-11ee-b087-e6b52eba4e86\System.exe'
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1636
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Windows Portable Devices\dwm.exe'
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1912
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Windows Mail\it-IT\a45e2d72a3718dd27e9b0703307a2e4a.exe'
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1480
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Uninstall Information\lsm.exe'
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:320
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\463aa442-9b96-11ee-b087-e6b52eba4e86\dwm.exe'
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3052
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\de-DE\dwm.exe'
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3056
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\MSOCache\All Users\{90140000-001A-0409-0000-0000000FF1CE}-C\a45e2d72a3718dd27e9b0703307a2e4a.exe'
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1796
- C:\Recovery\463aa442-9b96-11ee-b087-e6b52eba4e86\System.exe
  "C:\Recovery\463aa442-9b96-11ee-b087-e6b52eba4e86\System.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:568

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 13 /tr "'C:\Windows\ShellNew\dllhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2556

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "a45e2d72a3718dd27e9b0703307a2e4aa" /sc MINUTE /mo 11 /tr "'C:\Program Files\MSBuild\a45e2d72a3718dd27e9b0703307a2e4a.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2440

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "a45e2d72a3718dd27e9b0703307a2e4a" /sc ONLOGON /tr "'C:\Program Files\MSBuild\a45e2d72a3718dd27e9b0703307a2e4a.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2704

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "a45e2d72a3718dd27e9b0703307a2e4aa" /sc MINUTE /mo 14 /tr "'C:\Program Files\MSBuild\a45e2d72a3718dd27e9b0703307a2e4a.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2560

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Windows\ShellNew\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2608

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 13 /tr "'C:\Windows\ShellNew\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2064

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 9 /tr "'C:\Recovery\463aa442-9b96-11ee-b087-e6b52eba4e86\System.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3004

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "System" /sc ONLOGON /tr "'C:\Recovery\463aa442-9b96-11ee-b087-e6b52eba4e86\System.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1720

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 12 /tr "'C:\Recovery\463aa442-9b96-11ee-b087-e6b52eba4e86\System.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2596

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 10 /tr "'C:\Program Files (x86)\Windows Portable Devices\dwm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1472

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwm" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Portable Devices\dwm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2636

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "a45e2d72a3718dd27e9b0703307a2e4aa" /sc MINUTE /mo 5 /tr "'C:\Program Files (x86)\Windows Mail\it-IT\a45e2d72a3718dd27e9b0703307a2e4a.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2460

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 11 /tr "'C:\Program Files (x86)\Windows Portable Devices\dwm.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2848

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "a45e2d72a3718dd27e9b0703307a2e4a" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Mail\it-IT\a45e2d72a3718dd27e9b0703307a2e4a.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2464

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "a45e2d72a3718dd27e9b0703307a2e4aa" /sc MINUTE /mo 12 /tr "'C:\Program Files (x86)\Windows Mail\it-IT\a45e2d72a3718dd27e9b0703307a2e4a.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1928

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "a45e2d72a3718dd27e9b0703307a2e4a" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-001A-0409-0000-0000000FF1CE}-C\a45e2d72a3718dd27e9b0703307a2e4a.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1596

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "a45e2d72a3718dd27e9b0703307a2e4aa" /sc MINUTE /mo 11 /tr "'C:\MSOCache\All Users\{90140000-001A-0409-0000-0000000FF1CE}-C\a45e2d72a3718dd27e9b0703307a2e4a.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1648

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "a45e2d72a3718dd27e9b0703307a2e4aa" /sc MINUTE /mo 6 /tr "'C:\MSOCache\All Users\{90140000-001A-0409-0000-0000000FF1CE}-C\a45e2d72a3718dd27e9b0703307a2e4a.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1556

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsml" /sc MINUTE /mo 8 /tr "'C:\Program Files (x86)\Uninstall Information\lsm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:268

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwm" /sc ONLOGON /tr "'C:\Recovery\463aa442-9b96-11ee-b087-e6b52eba4e86\dwm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1240

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 7 /tr "'C:\Windows\de-DE\dwm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3012

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwm" /sc ONLOGON /tr "'C:\Windows\de-DE\dwm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3032

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 12 /tr "'C:\Windows\de-DE\dwm.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2056

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 13 /tr "'C:\Recovery\463aa442-9b96-11ee-b087-e6b52eba4e86\dwm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1052

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 7 /tr "'C:\Recovery\463aa442-9b96-11ee-b087-e6b52eba4e86\dwm.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2984

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsm" /sc ONLOGON /tr "'C:\Program Files (x86)\Uninstall Information\lsm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:592

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsml" /sc MINUTE /mo 10 /tr "'C:\Program Files (x86)\Uninstall Information\lsm.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2116

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Scheduled Task/Job

T1053

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Scheduled Task/Job

T1053

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

a45e2d72a3718dd27e9b0703307a2e4a.exe

Path C:\Program Files (x86)\Windows Mail\it-IT\a45e2d72a3718dd27e9b0703307a2e4a.exe
Size 903KB
SHA256 db2088178208c684f1ab9ebe1298a4faa22b222212f320da65d8e140018c45cb
MD5 4d27fa40cbda011f491631ba0b7a4f83
SHA1 fd692c2de10cffc5afd882d327aa89ee0a43dd62
SHA512 8e649a4d96576cb556167e24b1e27344339d1a0e4f7e06c04acc0266b5dbc88b9d692e0e1fc3f4b3afdf8b4e18033d7dbd596c221bfc3f66679dbdda2e45c356
SSDEEP 12288:9AB2CBxPPud4rYe+i1fs/kGCLZCkn8v4uHBN5akVUZTD+bn0+f4r:9A9WcYe+oGCL+vBTgZeAr
MD5 SHA1 SHA512 SSDEEP

Submit Download

System.exe

Path C:\Recovery\463aa442-9b96-11ee-b087-e6b52eba4e86\System.exe
Size 327KB
SHA256 9a3536cc5f8391935afa6f6117a07880ddf54ca49b63e42c3b4f9b3e47a87d3a
MD5 dff1950afea2cf87ceea84543a2b39bf
SHA1 02eec83cb4ccf1ac49ae9aa87f7ea07be8b24212
SHA512 e446fc7af23dc487b8d3acc5d19100f59e977cd818694b2f31ac3e4891c62197a6754a39d851bfe4d6056d34e9c70882b4b8f86d2540434ee2e8ad8c83f1a61b
SSDEEP 3072:BmO4aKS5d7+RtXEsTHtCCqBl8zzvo4+4iMsNIx3R1UbWY/AvjP6LCq4rp2je+cNB:9ABpsCqBD4iGxPPY1d4rYe+qz1fscF
MD5 SHA1 SHA512 SSDEEP

Submit Download

System.exe

Path C:\Recovery\463aa442-9b96-11ee-b087-e6b52eba4e86\System.exe
Size 190KB
SHA256 a6cf36f5b6450efc3868fd7dcb55f5256f3dfa6cf7db235fce257a4bd5460375
MD5 c389ab71f277a87a9daac84bedd19049
SHA1 64e3d51d38feb96f861479c01712418722ec6f59
SHA512 32b3fdd2c000fb32a66972ab7665696f33d2ebafde6b638a4001f3c65ece4ad1ecedc215e3de86e281b8fd3328fdda47ebacc06948abc207edf36b993f7a7923
SSDEEP 3072:BmO4aKS5d7+RtXEsTHtCCqBl8zzvo4+4iMsNIx3R1Q:9ABpsCqBD4iGxPQ
MD5 SHA1 SHA512 SSDEEP

Submit Download

590aee7bdd69b59b.customDestinations-ms

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms
Size 7KB
SHA256 05221218da2a8628bf82786c5122f4fce50f10c084e07ee0c596683017d0c513
MD5 624c6c5080fa1d43eedcc1e706fb5498
SHA1 ed7c6d8b18bbbc72eca7bbb7d2faaa0457cfa7ca
SHA512 f888ca65260a139573390147d94d49716a3962e26931d82cd78752f13b38de2875314a24b8e0be87ba9ea48230d62cac8b13c019e83798f1a99384e657f405ea
SSDEEP 96:gBX2C1M8PnqvsqvJCwo8BX2C1M8PnqvsEHyqvJCworlNxCQHoa7qlXlUVP:Q7DUok7DAHnorlGla7qlg
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/320-192-0x0000000002C30000-0x0000000002CB0000-memory.dmp

Download

memory/320-195-0x000007FEEC8D0000-0x000007FEED26D000-memory.dmp

Download

memory/568-141-0x0000000000150000-0x000000000035A000-memory.dmp

Download

memory/568-174-0x000007FEF56C0000-0x000007FEF60AC000-memory.dmp

Download

memory/1480-187-0x0000000002D50000-0x0000000002DD0000-memory.dmp

Download

memory/1480-190-0x0000000002D50000-0x0000000002DD0000-memory.dmp

Download

memory/1480-182-0x0000000002D50000-0x0000000002DD0000-memory.dmp

Download

memory/1480-185-0x000007FEEC8D0000-0x000007FEED26D000-memory.dmp

Download

memory/1636-175-0x000007FEEC8D0000-0x000007FEED26D000-memory.dmp

Download

memory/1636-196-0x000007FEEC8D0000-0x000007FEED26D000-memory.dmp

Download

memory/1636-176-0x0000000002C50000-0x0000000002CD0000-memory.dmp

Download

memory/1636-177-0x0000000002C50000-0x0000000002CD0000-memory.dmp

Download

memory/1796-194-0x0000000002D3B000-0x0000000002DA2000-memory.dmp

Download

memory/1856-197-0x0000000002DCB000-0x0000000002E32000-memory.dmp

Download

memory/1912-188-0x000007FEEC8D0000-0x000007FEED26D000-memory.dmp

Download

memory/1912-191-0x0000000002404000-0x0000000002407000-memory.dmp

Download

memory/1912-184-0x000000000240B000-0x0000000002472000-memory.dmp

Download

memory/2252-169-0x000007FEEC8D0000-0x000007FEED26D000-memory.dmp

Download

memory/2252-168-0x0000000002C8B000-0x0000000002CF2000-memory.dmp

Download

memory/2252-171-0x0000000002C84000-0x0000000002C87000-memory.dmp

Download

memory/2252-167-0x0000000002C80000-0x0000000002D00000-memory.dmp

Download

memory/2264-16-0x000000001AF90000-0x000000001B010000-memory.dmp

Download

memory/2264-10-0x0000000000460000-0x000000000046C000-memory.dmp

Download

memory/2264-44-0x000000001AF90000-0x000000001B010000-memory.dmp

Download

memory/2264-1-0x000007FEF56C0000-0x000007FEF60AC000-memory.dmp

Download

memory/2264-148-0x000007FEF56C0000-0x000007FEF60AC000-memory.dmp

Download

memory/2264-20-0x00000000024B0000-0x00000000024BC000-memory.dmp

Download

memory/2264-21-0x0000000002500000-0x000000000250A000-memory.dmp

Download

memory/2264-2-0x000000001AF90000-0x000000001B010000-memory.dmp

Download

memory/2264-3-0x0000000000140000-0x000000000014E000-memory.dmp

Download

memory/2264-4-0x0000000000350000-0x000000000035E000-memory.dmp

Download

memory/2264-6-0x0000000000380000-0x000000000039C000-memory.dmp

Download

memory/2264-22-0x0000000002510000-0x000000000251C000-memory.dmp

Download

memory/2264-9-0x00000000003D0000-0x00000000003E0000-memory.dmp

Download

memory/2264-5-0x0000000000360000-0x0000000000368000-memory.dmp

Download

memory/2264-11-0x00000000004F0000-0x0000000000502000-memory.dmp

Download

memory/2264-15-0x0000000000B60000-0x0000000000B6C000-memory.dmp

Download

memory/2264-0-0x0000000000B70000-0x0000000000D7A000-memory.dmp

Download

memory/2264-17-0x0000000002260000-0x000000000226E000-memory.dmp

Download

memory/2264-8-0x00000000003B0000-0x00000000003C6000-memory.dmp

Download

memory/2264-7-0x00000000003A0000-0x00000000003B0000-memory.dmp

Download

memory/2264-19-0x00000000024A0000-0x00000000024AE000-memory.dmp

Download

memory/2264-12-0x0000000000520000-0x000000000052C000-memory.dmp

Download

memory/2264-18-0x0000000002480000-0x0000000002488000-memory.dmp

Download

memory/2264-13-0x0000000000B50000-0x0000000000B5C000-memory.dmp

Download

memory/2264-14-0x0000000002490000-0x0000000002498000-memory.dmp

Download

memory/2896-165-0x000007FEEC8D0000-0x000007FEED26D000-memory.dmp

Download

memory/2896-166-0x0000000002B90000-0x0000000002C10000-memory.dmp

Download

memory/2896-140-0x0000000001D30000-0x0000000001D38000-memory.dmp

Download

memory/2896-163-0x000007FEEC8D0000-0x000007FEED26D000-memory.dmp

Download

memory/2896-173-0x000007FEEC8D0000-0x000007FEED26D000-memory.dmp

Download

memory/2896-172-0x0000000002B90000-0x0000000002C10000-memory.dmp

Download

memory/2896-113-0x000000001B480000-0x000000001B762000-memory.dmp

Download

memory/2896-170-0x0000000002B9B000-0x0000000002C02000-memory.dmp

Download

memory/2896-164-0x0000000002B90000-0x0000000002C10000-memory.dmp

Download

memory/3052-180-0x0000000002D80000-0x0000000002E00000-memory.dmp

Download

memory/3052-181-0x0000000002D80000-0x0000000002E00000-memory.dmp

Download

memory/3052-198-0x000007FEEC8D0000-0x000007FEED26D000-memory.dmp

Download

memory/3052-193-0x0000000002D8B000-0x0000000002DF2000-memory.dmp

Download

memory/3052-178-0x000007FEEC8D0000-0x000007FEED26D000-memory.dmp

Download

memory/3052-179-0x0000000002D80000-0x0000000002E00000-memory.dmp

Download

memory/3056-189-0x0000000002DC4000-0x0000000002DC7000-memory.dmp

Download

memory/3056-186-0x000007FEEC8D0000-0x000007FEED26D000-memory.dmp

Download

memory/3056-183-0x0000000002DCB000-0x0000000002E32000-memory.dmp

Download