dcrat | 6ab0890a2aedb8d21048be3cb8fcaf6ba8fe22d418fec483bdba53e68ab430f6

Analysis

max time kernel
149s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
28/02/2024, 16:44

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6ab0890a2aedb8d21048be3cb8fcaf6ba8fe22d418fec483bdba53e68ab430f6.exe
Size

3.1MB
MD5

2c03d2d911694cd33c23b0edafd33ff0
SHA1

c16efb40930aec5b7f894b78f9b6f04bfc03fa0f
SHA256

6ab0890a2aedb8d21048be3cb8fcaf6ba8fe22d418fec483bdba53e68ab430f6
SHA512

b02b123bfb5d5ef55820315887ceecbdb4ecdc50f7af241a9b6b722baedcce0b6441e1553d1ccbc85b091ac84c1c4801d8cdcc291575d8a4dc1afa974fc76dee
SSDEEP

49152:xp70LTonM7JrVV+t8Z6e8hyF9kdrq8ChhGpg2U/KQ7d5tQX:gfonMdBVZYyjACh0DUB71

Score

10^/10

dcrat infostealer rat

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat

Process spawned unexpected child process 30 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3716	4608	schtasks.exe	92
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4508	4608	schtasks.exe	92
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	496	4608	schtasks.exe	92
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4460	4608	schtasks.exe	92
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3568	4608	schtasks.exe	92
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4408	4608	schtasks.exe	92
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	684	4608	schtasks.exe	92
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1624	4608	schtasks.exe	92
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	976	4608	schtasks.exe	92
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1084	4608	schtasks.exe	92
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4064	4608	schtasks.exe	92
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2180	4608	schtasks.exe	92
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1920	4608	schtasks.exe	92
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2564	4608	schtasks.exe	92
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1640	4608	schtasks.exe	92
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4536	4608	schtasks.exe	92
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4048	4608	schtasks.exe	92
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4532	4608	schtasks.exe	92
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2448	4608	schtasks.exe	92
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3032	4608	schtasks.exe	92
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1148	4608	schtasks.exe	92
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3148	4608	schtasks.exe	92
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3436	4608	schtasks.exe	92
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4868	4608	schtasks.exe	92
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4468	4608	schtasks.exe	92
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3312	4608	schtasks.exe	92
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2436	4608	schtasks.exe	92
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1892	4608	schtasks.exe	92
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1256	4608	schtasks.exe	92
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1352	4608	schtasks.exe	92

DCRat payload 4 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral2/memory/4476-0-0x0000000000A30000-0x0000000000D54000-memory.dmp	dcrat
behavioral2/files/0x00070000000231fa-11.dat	dcrat
behavioral2/files/0x00080000000231ef-31.dat	dcrat
behavioral2/files/0x00080000000231ef-33.dat	dcrat

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-566096764-1992588923-1249862864-1000\Control Panel\International\Geo\Nation	6ab0890a2aedb8d21048be3cb8fcaf6ba8fe22d418fec483bdba53e68ab430f6.exe

Executes dropped EXE 1 IoCs

pid	Process
4144	backgroundTaskHost.exe

Drops file in Program Files directory 9 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Windows Mail\fontdrvhost.exe	6ab0890a2aedb8d21048be3cb8fcaf6ba8fe22d418fec483bdba53e68ab430f6.exe
File created	C:\Program Files (x86)\Windows Mail\5b884080fd4f94	6ab0890a2aedb8d21048be3cb8fcaf6ba8fe22d418fec483bdba53e68ab430f6.exe
File created	C:\Program Files (x86)\Mozilla Maintenance Service\logs\sihost.exe	6ab0890a2aedb8d21048be3cb8fcaf6ba8fe22d418fec483bdba53e68ab430f6.exe
File created	C:\Program Files (x86)\Common Files\System\de-DE\121e5b5079f7c0	6ab0890a2aedb8d21048be3cb8fcaf6ba8fe22d418fec483bdba53e68ab430f6.exe
File created	C:\Program Files (x86)\Common Files\System\de-DE\sysmon.exe	6ab0890a2aedb8d21048be3cb8fcaf6ba8fe22d418fec483bdba53e68ab430f6.exe
File created	C:\Program Files (x86)\Windows Mail\fontdrvhost.exe	6ab0890a2aedb8d21048be3cb8fcaf6ba8fe22d418fec483bdba53e68ab430f6.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EU8B19.tmp\backgroundTaskHost.exe	6ab0890a2aedb8d21048be3cb8fcaf6ba8fe22d418fec483bdba53e68ab430f6.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EU8B19.tmp\eddb19405b7ce1	6ab0890a2aedb8d21048be3cb8fcaf6ba8fe22d418fec483bdba53e68ab430f6.exe
File created	C:\Program Files (x86)\Mozilla Maintenance Service\logs\66fc9ff0ee96c2	6ab0890a2aedb8d21048be3cb8fcaf6ba8fe22d418fec483bdba53e68ab430f6.exe

Drops file in Windows directory 6 IoCs

description	ioc	Process
File created	C:\Windows\Setup\State\backgroundTaskHost.exe	6ab0890a2aedb8d21048be3cb8fcaf6ba8fe22d418fec483bdba53e68ab430f6.exe
File created	C:\Windows\Setup\State\eddb19405b7ce1	6ab0890a2aedb8d21048be3cb8fcaf6ba8fe22d418fec483bdba53e68ab430f6.exe
File created	C:\Windows\en-US\csrss.exe	6ab0890a2aedb8d21048be3cb8fcaf6ba8fe22d418fec483bdba53e68ab430f6.exe
File created	C:\Windows\en-US\886983d96e3d3e	6ab0890a2aedb8d21048be3cb8fcaf6ba8fe22d418fec483bdba53e68ab430f6.exe
File created	C:\Windows\TAPI\MusNotification.exe	6ab0890a2aedb8d21048be3cb8fcaf6ba8fe22d418fec483bdba53e68ab430f6.exe
File created	C:\Windows\TAPI\aa97147c4c782d	6ab0890a2aedb8d21048be3cb8fcaf6ba8fe22d418fec483bdba53e68ab430f6.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 30 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
3716	schtasks.exe
3568	schtasks.exe
1148	schtasks.exe
3148	schtasks.exe
1892	schtasks.exe
684	schtasks.exe
976	schtasks.exe
1920	schtasks.exe
2448	schtasks.exe
4868	schtasks.exe
1352	schtasks.exe
1084	schtasks.exe
2180	schtasks.exe
3032	schtasks.exe
3436	schtasks.exe
4468	schtasks.exe
4508	schtasks.exe
4536	schtasks.exe
4532	schtasks.exe
1256	schtasks.exe
4408	schtasks.exe
2564	schtasks.exe
496	schtasks.exe
1624	schtasks.exe
4064	schtasks.exe
4048	schtasks.exe
3312	schtasks.exe
2436	schtasks.exe
4460	schtasks.exe
1640	schtasks.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4476	6ab0890a2aedb8d21048be3cb8fcaf6ba8fe22d418fec483bdba53e68ab430f6.exe
4476	6ab0890a2aedb8d21048be3cb8fcaf6ba8fe22d418fec483bdba53e68ab430f6.exe
4476	6ab0890a2aedb8d21048be3cb8fcaf6ba8fe22d418fec483bdba53e68ab430f6.exe
4476	6ab0890a2aedb8d21048be3cb8fcaf6ba8fe22d418fec483bdba53e68ab430f6.exe
4476	6ab0890a2aedb8d21048be3cb8fcaf6ba8fe22d418fec483bdba53e68ab430f6.exe
4476	6ab0890a2aedb8d21048be3cb8fcaf6ba8fe22d418fec483bdba53e68ab430f6.exe
4476	6ab0890a2aedb8d21048be3cb8fcaf6ba8fe22d418fec483bdba53e68ab430f6.exe
4476	6ab0890a2aedb8d21048be3cb8fcaf6ba8fe22d418fec483bdba53e68ab430f6.exe
4476	6ab0890a2aedb8d21048be3cb8fcaf6ba8fe22d418fec483bdba53e68ab430f6.exe
4144	backgroundTaskHost.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	4476	6ab0890a2aedb8d21048be3cb8fcaf6ba8fe22d418fec483bdba53e68ab430f6.exe
Token: SeDebugPrivilege	4144	backgroundTaskHost.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4476 wrote to memory of 4144	4476	6ab0890a2aedb8d21048be3cb8fcaf6ba8fe22d418fec483bdba53e68ab430f6.exe	124
PID 4476 wrote to memory of 4144	4476	6ab0890a2aedb8d21048be3cb8fcaf6ba8fe22d418fec483bdba53e68ab430f6.exe	124

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\6ab0890a2aedb8d21048be3cb8fcaf6ba8fe22d418fec483bdba53e68ab430f6.exe
"C:\Users\Admin\AppData\Local\Temp\6ab0890a2aedb8d21048be3cb8fcaf6ba8fe22d418fec483bdba53e68ab430f6.exe"
1⤵
- Checks computer location settings
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4476
- C:\Windows\Setup\State\backgroundTaskHost.exe
  "C:\Windows\Setup\State\backgroundTaskHost.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4144

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 14 /tr "'C:\Program Files (x86)\Windows Mail\fontdrvhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3716

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Mail\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4508

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 12 /tr "'C:\Program Files (x86)\Windows Mail\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:496

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "backgroundTaskHostb" /sc MINUTE /mo 9 /tr "'C:\Windows\Setup\State\backgroundTaskHost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4460

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "backgroundTaskHost" /sc ONLOGON /tr "'C:\Windows\Setup\State\backgroundTaskHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3568

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "backgroundTaskHostb" /sc MINUTE /mo 7 /tr "'C:\Windows\Setup\State\backgroundTaskHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4408

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "backgroundTaskHostb" /sc MINUTE /mo 10 /tr "'C:\Program Files (x86)\Microsoft\Temp\EU8B19.tmp\backgroundTaskHost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:684

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "backgroundTaskHost" /sc ONLOGON /tr "'C:\Program Files (x86)\Microsoft\Temp\EU8B19.tmp\backgroundTaskHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1624

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "backgroundTaskHostb" /sc MINUTE /mo 12 /tr "'C:\Program Files (x86)\Microsoft\Temp\EU8B19.tmp\backgroundTaskHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:976

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sihosts" /sc MINUTE /mo 11 /tr "'C:\Program Files (x86)\Mozilla Maintenance Service\logs\sihost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1084

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sihost" /sc ONLOGON /tr "'C:\Program Files (x86)\Mozilla Maintenance Service\logs\sihost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4064

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sihosts" /sc MINUTE /mo 5 /tr "'C:\Program Files (x86)\Mozilla Maintenance Service\logs\sihost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2180

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 5 /tr "'C:\odt\smss.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1920

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smss" /sc ONLOGON /tr "'C:\odt\smss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2564

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 12 /tr "'C:\odt\smss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1640

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 14 /tr "'C:\Windows\en-US\csrss.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4536

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Windows\en-US\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4048

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 9 /tr "'C:\Windows\en-US\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4532

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sysmons" /sc MINUTE /mo 13 /tr "'C:\Program Files (x86)\Common Files\System\de-DE\sysmon.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2448

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sysmon" /sc ONLOGON /tr "'C:\Program Files (x86)\Common Files\System\de-DE\sysmon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3032

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sysmons" /sc MINUTE /mo 12 /tr "'C:\Program Files (x86)\Common Files\System\de-DE\sysmon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1148

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "MusNotificationM" /sc MINUTE /mo 6 /tr "'C:\Windows\TAPI\MusNotification.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3148

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "MusNotification" /sc ONLOGON /tr "'C:\Windows\TAPI\MusNotification.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3436

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "MusNotificationM" /sc MINUTE /mo 13 /tr "'C:\Windows\TAPI\MusNotification.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4868

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 12 /tr "'C:\Recovery\WindowsRE\Idle.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4468

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Idle" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\Idle.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3312

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 11 /tr "'C:\Recovery\WindowsRE\Idle.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2436

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sihosts" /sc MINUTE /mo 8 /tr "'C:\Users\Public\sihost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1892

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sihost" /sc ONLOGON /tr "'C:\Users\Public\sihost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1256

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sihosts" /sc MINUTE /mo 14 /tr "'C:\Users\Public\sihost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1352

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Scheduled Task/Job

T1053

Privilege Escalation

Scheduled Task/Job

T1053

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\Setup\State\backgroundTaskHost.exe

Filesize
1.2MB

MD5
666e5550b80681e32bfd5a0e6b59e521

SHA1
72dadc545f9d2e6b8dfd6362b3626d9be384a777

SHA256
ceda91b6d750f1e451c06c6c8c8896c64826d7c0e64e359d0692e2d9a91e95f3

SHA512
e91ae82a0bf53d79c00198ecfc7d649b695ebdad7b561efce0ddf5f9b5c01b6cb0d9b0976375749cec4702eec038da92b7e0cf081c63e10d0d8001c39e0df69d

Download Submit
C:\Windows\Setup\State\backgroundTaskHost.exe

Filesize
1.3MB

MD5
51ea81686aef5e6d503c1ed719ac4787

SHA1
42b7a2823f1f77744b21b2f5f4ca6ea6489e9bd5

SHA256
ca45b6891d00a57ccbf4d4e012079eaab863c1bb3bef1a4b8414dacdcc91db67

SHA512
564a035c3b998884a91c5aabd09632606ad0aa29b554b538f4a7de59f2547b51e80c29d197fbdd55c7ee9c8d3a1765b11bc745d5356e949c4c82dbd61d8fa3e1

Download Submit
C:\odt\smss.exe

Filesize
3.1MB

MD5
2c03d2d911694cd33c23b0edafd33ff0

SHA1
c16efb40930aec5b7f894b78f9b6f04bfc03fa0f

SHA256
6ab0890a2aedb8d21048be3cb8fcaf6ba8fe22d418fec483bdba53e68ab430f6

SHA512
b02b123bfb5d5ef55820315887ceecbdb4ecdc50f7af241a9b6b722baedcce0b6441e1553d1ccbc85b091ac84c1c4801d8cdcc291575d8a4dc1afa974fc76dee

Download Submit
memory/4144-35-0x00007FFA5F780000-0x00007FFA60241000-memory.dmp

Filesize
10.8MB

Download
memory/4144-36-0x00000000019E0000-0x00000000019F0000-memory.dmp

Filesize
64KB

Download
memory/4144-38-0x00007FFA5F780000-0x00007FFA60241000-memory.dmp

Filesize
10.8MB

Download
memory/4476-0-0x0000000000A30000-0x0000000000D54000-memory.dmp

Filesize
3.1MB

Download
memory/4476-1-0x00007FFA5F780000-0x00007FFA60241000-memory.dmp

Filesize
10.8MB

Download
memory/4476-2-0x0000000001670000-0x0000000001680000-memory.dmp

Filesize
64KB

Download
memory/4476-34-0x00007FFA5F780000-0x00007FFA60241000-memory.dmp

Filesize
10.8MB

Download