dcrat | dc606f7747fa155a685f7462373a8cc218c33ccd3c083d1421662c96932669ff

Analysis

max time kernel
140s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
13/03/2024, 01:38

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
dc606f7747fa155a685f7462373a8cc218c33ccd3c083d1421662c96932669ff.exe
Size 2.0MB
Sample240313-b2tnnsha2y
SHA256 dc606f7747fa155a685f7462373a8cc218c33ccd3c083d1421662c96932669ff
MD5 e323e7fb6f5b1908c0d11e8e5c65f930
SHA1 1688785ea0c6359c58c63d5b789d3c6f923e5a14
SHA512 e718cb49d17c95c1665e5b4131ed47b8b96914b0954444fbd8a4593e50c68233505a3125e01954f34be1fb7f9aa5a36777606075117e49f22ab5bb9c8fe05a7a
SSDEEP 49152:PgylO+adjZ+RWMK8Fha66hwJVTxsjbSDDW5d1:PPOxdjrI7txbDW
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

dcrat evasion infostealer rat trojan

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat

Process spawned unexpected child process 18 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	448	2220	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2488	2220	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2848	2220	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4876	2220	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2536	2220	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3116	2220	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2528	2220	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	732	2220	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2344	2220	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3100	2220	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2656	2220	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4212	2220	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3800	2220	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3716	2220	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4076	2220	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1688	2220	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2604	2220	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3744	2220	schtasks.exe	91

UAC bypass 3 TTPs 9 IoCs

evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	dc606f7747fa155a685f7462373a8cc218c33ccd3c083d1421662c96932669ff.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	dc606f7747fa155a685f7462373a8cc218c33ccd3c083d1421662c96932669ff.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	explorer.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	explorer.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	explorer.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	dc606f7747fa155a685f7462373a8cc218c33ccd3c083d1421662c96932669ff.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	explorer.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	explorer.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	explorer.exe

DCRat payload 6 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral2/memory/1192-0-0x0000000000E30000-0x000000000103A000-memory.dmp	dcrat
behavioral2/files/0x0007000000023243-37.dat	dcrat
behavioral2/files/0x000b000000023138-269.dat	dcrat
behavioral2/files/0x000b000000023138-270.dat	dcrat
behavioral2/files/0x0007000000023263-278.dat	dcrat
behavioral2/files/0x000b000000023138-286.dat	dcrat

Detects executables packed with SmartAssembly 8 IoCs

resource	yara_rule
behavioral2/memory/1192-7-0x000000001BB80000-0x000000001BB90000-memory.dmp	INDICATOR_EXE_Packed_SmartAssembly
behavioral2/memory/1192-11-0x000000001BBD0000-0x000000001BBDA000-memory.dmp	INDICATOR_EXE_Packed_SmartAssembly
behavioral2/memory/1192-17-0x000000001C390000-0x000000001C39C000-memory.dmp	INDICATOR_EXE_Packed_SmartAssembly
behavioral2/memory/1192-19-0x000000001C3B0000-0x000000001C3BC000-memory.dmp	INDICATOR_EXE_Packed_SmartAssembly
behavioral2/memory/1192-21-0x000000001C4D0000-0x000000001C4DC000-memory.dmp	INDICATOR_EXE_Packed_SmartAssembly
behavioral2/memory/1192-22-0x000000001C4E0000-0x000000001C4EA000-memory.dmp	INDICATOR_EXE_Packed_SmartAssembly
behavioral2/memory/1192-25-0x000000001C610000-0x000000001C61C000-memory.dmp	INDICATOR_EXE_Packed_SmartAssembly
behavioral2/memory/1192-27-0x000000001C630000-0x000000001C63A000-memory.dmp	INDICATOR_EXE_Packed_SmartAssembly

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\drivers\etc\hosts	dc606f7747fa155a685f7462373a8cc218c33ccd3c083d1421662c96932669ff.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-275798769-4264537674-1142822080-1000\Control Panel\International\Geo\Nation	dc606f7747fa155a685f7462373a8cc218c33ccd3c083d1421662c96932669ff.exe
Key value queried	\REGISTRY\USER\S-1-5-21-275798769-4264537674-1142822080-1000\Control Panel\International\Geo\Nation	explorer.exe

Executes dropped EXE 2 IoCs

pid	Process
5492	explorer.exe
336	explorer.exe

Checks whether UAC is enabled 1 TTPs 6 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	dc606f7747fa155a685f7462373a8cc218c33ccd3c083d1421662c96932669ff.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	explorer.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	explorer.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	explorer.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	explorer.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	dc606f7747fa155a685f7462373a8cc218c33ccd3c083d1421662c96932669ff.exe

Drops file in Program Files directory 8 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Microsoft Office\Updates\RCX5A49.tmp	dc606f7747fa155a685f7462373a8cc218c33ccd3c083d1421662c96932669ff.exe
File opened for modification	C:\Program Files\Microsoft Office\Updates\unsecapp.exe	dc606f7747fa155a685f7462373a8cc218c33ccd3c083d1421662c96932669ff.exe
File created	C:\Program Files\Windows Defender\de-DE\backgroundTaskHost.exe	dc606f7747fa155a685f7462373a8cc218c33ccd3c083d1421662c96932669ff.exe
File created	C:\Program Files\Windows Defender\de-DE\eddb19405b7ce1	dc606f7747fa155a685f7462373a8cc218c33ccd3c083d1421662c96932669ff.exe
File created	C:\Program Files\Microsoft Office\Updates\unsecapp.exe	dc606f7747fa155a685f7462373a8cc218c33ccd3c083d1421662c96932669ff.exe
File created	C:\Program Files\Microsoft Office\Updates\29c1c3cc0f7685	dc606f7747fa155a685f7462373a8cc218c33ccd3c083d1421662c96932669ff.exe
File opened for modification	C:\Program Files\Windows Defender\de-DE\RCX5640.tmp	dc606f7747fa155a685f7462373a8cc218c33ccd3c083d1421662c96932669ff.exe
File opened for modification	C:\Program Files\Windows Defender\de-DE\backgroundTaskHost.exe	dc606f7747fa155a685f7462373a8cc218c33ccd3c083d1421662c96932669ff.exe

Drops file in Windows directory 9 IoCs

description	ioc	Process
File created	C:\Windows\addins\explorer.exe	dc606f7747fa155a685f7462373a8cc218c33ccd3c083d1421662c96932669ff.exe
File opened for modification	C:\Windows\addins\explorer.exe	dc606f7747fa155a685f7462373a8cc218c33ccd3c083d1421662c96932669ff.exe
File created	C:\Windows\addins\7a0fd90576e088	dc606f7747fa155a685f7462373a8cc218c33ccd3c083d1421662c96932669ff.exe
File created	C:\Windows\System\Speech\spoolsv.exe	dc606f7747fa155a685f7462373a8cc218c33ccd3c083d1421662c96932669ff.exe
File created	C:\Windows\SystemApps\Microsoft.Windows.PinningConfirmationDialog_cw5n1h2txyewy\6203df4a6bafc7	dc606f7747fa155a685f7462373a8cc218c33ccd3c083d1421662c96932669ff.exe
File opened for modification	C:\Windows\addins\RCX53BE.tmp	dc606f7747fa155a685f7462373a8cc218c33ccd3c083d1421662c96932669ff.exe
File opened for modification	C:\Windows\SystemApps\Microsoft.Windows.PinningConfirmationDialog_cw5n1h2txyewy\RCX5C4E.tmp	dc606f7747fa155a685f7462373a8cc218c33ccd3c083d1421662c96932669ff.exe
File opened for modification	C:\Windows\SystemApps\Microsoft.Windows.PinningConfirmationDialog_cw5n1h2txyewy\lsass.exe	dc606f7747fa155a685f7462373a8cc218c33ccd3c083d1421662c96932669ff.exe
File created	C:\Windows\SystemApps\Microsoft.Windows.PinningConfirmationDialog_cw5n1h2txyewy\lsass.exe	dc606f7747fa155a685f7462373a8cc218c33ccd3c083d1421662c96932669ff.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 18 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
2656	schtasks.exe
4076	schtasks.exe
1688	schtasks.exe
2488	schtasks.exe
4876	schtasks.exe
2536	schtasks.exe
3100	schtasks.exe
3744	schtasks.exe
448	schtasks.exe
2848	schtasks.exe
3716	schtasks.exe
2604	schtasks.exe
2528	schtasks.exe
4212	schtasks.exe
2344	schtasks.exe
3800	schtasks.exe
3116	schtasks.exe
732	schtasks.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-275798769-4264537674-1142822080-1000_Classes\Local Settings	dc606f7747fa155a685f7462373a8cc218c33ccd3c083d1421662c96932669ff.exe
Key created	\REGISTRY\USER\S-1-5-21-275798769-4264537674-1142822080-1000_Classes\Local Settings	explorer.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1192	dc606f7747fa155a685f7462373a8cc218c33ccd3c083d1421662c96932669ff.exe
1192	dc606f7747fa155a685f7462373a8cc218c33ccd3c083d1421662c96932669ff.exe
1192	dc606f7747fa155a685f7462373a8cc218c33ccd3c083d1421662c96932669ff.exe
1192	dc606f7747fa155a685f7462373a8cc218c33ccd3c083d1421662c96932669ff.exe
1192	dc606f7747fa155a685f7462373a8cc218c33ccd3c083d1421662c96932669ff.exe
1192	dc606f7747fa155a685f7462373a8cc218c33ccd3c083d1421662c96932669ff.exe
1192	dc606f7747fa155a685f7462373a8cc218c33ccd3c083d1421662c96932669ff.exe
1192	dc606f7747fa155a685f7462373a8cc218c33ccd3c083d1421662c96932669ff.exe
1192	dc606f7747fa155a685f7462373a8cc218c33ccd3c083d1421662c96932669ff.exe
1192	dc606f7747fa155a685f7462373a8cc218c33ccd3c083d1421662c96932669ff.exe
1192	dc606f7747fa155a685f7462373a8cc218c33ccd3c083d1421662c96932669ff.exe
1192	dc606f7747fa155a685f7462373a8cc218c33ccd3c083d1421662c96932669ff.exe
1192	dc606f7747fa155a685f7462373a8cc218c33ccd3c083d1421662c96932669ff.exe
1192	dc606f7747fa155a685f7462373a8cc218c33ccd3c083d1421662c96932669ff.exe
1192	dc606f7747fa155a685f7462373a8cc218c33ccd3c083d1421662c96932669ff.exe
1192	dc606f7747fa155a685f7462373a8cc218c33ccd3c083d1421662c96932669ff.exe
1192	dc606f7747fa155a685f7462373a8cc218c33ccd3c083d1421662c96932669ff.exe
1192	dc606f7747fa155a685f7462373a8cc218c33ccd3c083d1421662c96932669ff.exe
1192	dc606f7747fa155a685f7462373a8cc218c33ccd3c083d1421662c96932669ff.exe
1192	dc606f7747fa155a685f7462373a8cc218c33ccd3c083d1421662c96932669ff.exe
1192	dc606f7747fa155a685f7462373a8cc218c33ccd3c083d1421662c96932669ff.exe
1192	dc606f7747fa155a685f7462373a8cc218c33ccd3c083d1421662c96932669ff.exe
1192	dc606f7747fa155a685f7462373a8cc218c33ccd3c083d1421662c96932669ff.exe
2920	powershell.exe
2920	powershell.exe
1192	dc606f7747fa155a685f7462373a8cc218c33ccd3c083d1421662c96932669ff.exe
1192	dc606f7747fa155a685f7462373a8cc218c33ccd3c083d1421662c96932669ff.exe
1192	dc606f7747fa155a685f7462373a8cc218c33ccd3c083d1421662c96932669ff.exe
1192	dc606f7747fa155a685f7462373a8cc218c33ccd3c083d1421662c96932669ff.exe
4532	powershell.exe
4532	powershell.exe
1328	powershell.exe
1328	powershell.exe
4680	powershell.exe
4680	powershell.exe
1044	powershell.exe
1044	powershell.exe
1488	powershell.exe
3720	powershell.exe
1488	powershell.exe
3720	powershell.exe
336	powershell.exe
336	powershell.exe
4304	powershell.exe
4304	powershell.exe
1524	powershell.exe
1524	powershell.exe
4288	powershell.exe
4288	powershell.exe
1436	powershell.exe
1436	powershell.exe
336	powershell.exe
4288	powershell.exe
2920	powershell.exe
1488	powershell.exe
4532	powershell.exe
4680	powershell.exe
3720	powershell.exe
1328	powershell.exe
4304	powershell.exe
1044	powershell.exe
1524	powershell.exe
1436	powershell.exe
5492	explorer.exe

Suspicious use of AdjustPrivilegeToken 15 IoCs

description	pid	Process
Token: SeDebugPrivilege	1192	dc606f7747fa155a685f7462373a8cc218c33ccd3c083d1421662c96932669ff.exe
Token: SeDebugPrivilege	2920	powershell.exe
Token: SeDebugPrivilege	4532	powershell.exe
Token: SeDebugPrivilege	1328	powershell.exe
Token: SeDebugPrivilege	4288	powershell.exe
Token: SeDebugPrivilege	4680	powershell.exe
Token: SeDebugPrivilege	1044	powershell.exe
Token: SeDebugPrivilege	1488	powershell.exe
Token: SeDebugPrivilege	3720	powershell.exe
Token: SeDebugPrivilege	336	powershell.exe
Token: SeDebugPrivilege	4304	powershell.exe
Token: SeDebugPrivilege	1524	powershell.exe
Token: SeDebugPrivilege	1436	powershell.exe
Token: SeDebugPrivilege	5492	explorer.exe
Token: SeDebugPrivilege	336	explorer.exe

Suspicious use of WriteProcessMemory 36 IoCs

description	pid	Process	procid_target
PID 1192 wrote to memory of 1524	1192	dc606f7747fa155a685f7462373a8cc218c33ccd3c083d1421662c96932669ff.exe	114
PID 1192 wrote to memory of 1524	1192	dc606f7747fa155a685f7462373a8cc218c33ccd3c083d1421662c96932669ff.exe	114
PID 1192 wrote to memory of 1488	1192	dc606f7747fa155a685f7462373a8cc218c33ccd3c083d1421662c96932669ff.exe	115
PID 1192 wrote to memory of 1488	1192	dc606f7747fa155a685f7462373a8cc218c33ccd3c083d1421662c96932669ff.exe	115
PID 1192 wrote to memory of 1328	1192	dc606f7747fa155a685f7462373a8cc218c33ccd3c083d1421662c96932669ff.exe	116
PID 1192 wrote to memory of 1328	1192	dc606f7747fa155a685f7462373a8cc218c33ccd3c083d1421662c96932669ff.exe	116
PID 1192 wrote to memory of 4532	1192	dc606f7747fa155a685f7462373a8cc218c33ccd3c083d1421662c96932669ff.exe	117
PID 1192 wrote to memory of 4532	1192	dc606f7747fa155a685f7462373a8cc218c33ccd3c083d1421662c96932669ff.exe	117
PID 1192 wrote to memory of 1044	1192	dc606f7747fa155a685f7462373a8cc218c33ccd3c083d1421662c96932669ff.exe	118
PID 1192 wrote to memory of 1044	1192	dc606f7747fa155a685f7462373a8cc218c33ccd3c083d1421662c96932669ff.exe	118
PID 1192 wrote to memory of 4288	1192	dc606f7747fa155a685f7462373a8cc218c33ccd3c083d1421662c96932669ff.exe	119
PID 1192 wrote to memory of 4288	1192	dc606f7747fa155a685f7462373a8cc218c33ccd3c083d1421662c96932669ff.exe	119
PID 1192 wrote to memory of 4304	1192	dc606f7747fa155a685f7462373a8cc218c33ccd3c083d1421662c96932669ff.exe	120
PID 1192 wrote to memory of 4304	1192	dc606f7747fa155a685f7462373a8cc218c33ccd3c083d1421662c96932669ff.exe	120
PID 1192 wrote to memory of 2920	1192	dc606f7747fa155a685f7462373a8cc218c33ccd3c083d1421662c96932669ff.exe	121
PID 1192 wrote to memory of 2920	1192	dc606f7747fa155a685f7462373a8cc218c33ccd3c083d1421662c96932669ff.exe	121
PID 1192 wrote to memory of 336	1192	dc606f7747fa155a685f7462373a8cc218c33ccd3c083d1421662c96932669ff.exe	122
PID 1192 wrote to memory of 336	1192	dc606f7747fa155a685f7462373a8cc218c33ccd3c083d1421662c96932669ff.exe	122
PID 1192 wrote to memory of 4680	1192	dc606f7747fa155a685f7462373a8cc218c33ccd3c083d1421662c96932669ff.exe	123
PID 1192 wrote to memory of 4680	1192	dc606f7747fa155a685f7462373a8cc218c33ccd3c083d1421662c96932669ff.exe	123
PID 1192 wrote to memory of 1436	1192	dc606f7747fa155a685f7462373a8cc218c33ccd3c083d1421662c96932669ff.exe	124
PID 1192 wrote to memory of 1436	1192	dc606f7747fa155a685f7462373a8cc218c33ccd3c083d1421662c96932669ff.exe	124
PID 1192 wrote to memory of 3720	1192	dc606f7747fa155a685f7462373a8cc218c33ccd3c083d1421662c96932669ff.exe	129
PID 1192 wrote to memory of 3720	1192	dc606f7747fa155a685f7462373a8cc218c33ccd3c083d1421662c96932669ff.exe	129
PID 1192 wrote to memory of 4168	1192	dc606f7747fa155a685f7462373a8cc218c33ccd3c083d1421662c96932669ff.exe	138
PID 1192 wrote to memory of 4168	1192	dc606f7747fa155a685f7462373a8cc218c33ccd3c083d1421662c96932669ff.exe	138
PID 4168 wrote to memory of 5948	4168	cmd.exe	140
PID 4168 wrote to memory of 5948	4168	cmd.exe	140
PID 4168 wrote to memory of 5492	4168	cmd.exe	144
PID 4168 wrote to memory of 5492	4168	cmd.exe	144
PID 5492 wrote to memory of 5784	5492	explorer.exe	145
PID 5492 wrote to memory of 5784	5492	explorer.exe	145
PID 5492 wrote to memory of 1816	5492	explorer.exe	146
PID 5492 wrote to memory of 1816	5492	explorer.exe	146
PID 5784 wrote to memory of 336	5784	WScript.exe	148
PID 5784 wrote to memory of 336	5784	WScript.exe	148

System policy modification 1 TTPs 9 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	explorer.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	explorer.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	dc606f7747fa155a685f7462373a8cc218c33ccd3c083d1421662c96932669ff.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	dc606f7747fa155a685f7462373a8cc218c33ccd3c083d1421662c96932669ff.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	explorer.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	explorer.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	explorer.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	explorer.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	dc606f7747fa155a685f7462373a8cc218c33ccd3c083d1421662c96932669ff.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\dc606f7747fa155a685f7462373a8cc218c33ccd3c083d1421662c96932669ff.exe
"C:\Users\Admin\AppData\Local\Temp\dc606f7747fa155a685f7462373a8cc218c33ccd3c083d1421662c96932669ff.exe"
1⤵
- UAC bypass
- Drops file in Drivers directory
- Checks computer location settings
- Checks whether UAC is enabled
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1192
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/'
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1524
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/$Recycle.Bin/'
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1488
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Documents and Settings/'
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1328
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/odt/'
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4532
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/PerfLogs/'
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1044
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files/'
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4288
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files (x86)/'
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4304
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/ProgramData/'
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2920
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Recovery/'
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:336
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/System Volume Information/'
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4680
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Users/'
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1436
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Windows/'
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3720
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\83I8ebEZ50.bat"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4168
- - C:\Windows\system32\w32tm.exe
    w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
    3⤵
    PID:5948
- - C:\Windows\addins\explorer.exe
    "C:\Windows\addins\explorer.exe"
    3⤵
    - UAC bypass
    - Checks computer location settings
    - Executes dropped EXE
    - Checks whether UAC is enabled
    - Modifies registry class
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    - System policy modification
    PID:5492
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\35ccd009-7c11-4212-862d-a5422c365c83.vbs"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:5784
    - - C:\Windows\addins\explorer.exe
        
        C:\Windows\addins\explorer.exe
        5⤵
        UAC bypass
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:336
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\06ef62c4-5dd0-4daf-a722-d53e08fe2685.vbs"
      4⤵
      PID:1816

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 13 /tr "'C:\Windows\addins\explorer.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:448

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorer" /sc ONLOGON /tr "'C:\Windows\addins\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2848

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 13 /tr "'C:\Windows\addins\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2488

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "backgroundTaskHostb" /sc MINUTE /mo 10 /tr "'C:\Program Files\Windows Defender\de-DE\backgroundTaskHost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4876

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "backgroundTaskHost" /sc ONLOGON /tr "'C:\Program Files\Windows Defender\de-DE\backgroundTaskHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2536

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "backgroundTaskHostb" /sc MINUTE /mo 6 /tr "'C:\Program Files\Windows Defender\de-DE\backgroundTaskHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3116

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 9 /tr "'C:\Users\All Users\wininit.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2528

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininit" /sc ONLOGON /tr "'C:\Users\All Users\wininit.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2344

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 6 /tr "'C:\Users\All Users\wininit.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:732

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "unsecappu" /sc MINUTE /mo 6 /tr "'C:\Program Files\Microsoft Office\Updates\unsecapp.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3100

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "unsecapp" /sc ONLOGON /tr "'C:\Program Files\Microsoft Office\Updates\unsecapp.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2656

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "unsecappu" /sc MINUTE /mo 6 /tr "'C:\Program Files\Microsoft Office\Updates\unsecapp.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4212

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 11 /tr "'C:\Windows\SystemApps\Microsoft.Windows.PinningConfirmationDialog_cw5n1h2txyewy\lsass.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3800

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsass" /sc ONLOGON /tr "'C:\Windows\SystemApps\Microsoft.Windows.PinningConfirmationDialog_cw5n1h2txyewy\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3716

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 12 /tr "'C:\Windows\SystemApps\Microsoft.Windows.PinningConfirmationDialog_cw5n1h2txyewy\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4076

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 6 /tr "'C:\Users\Default\Downloads\dllhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1688

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Users\Default\Downloads\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2604

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 9 /tr "'C:\Users\Default\Downloads\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3744

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Scheduled Task/Job

T1053

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Scheduled Task/Job

T1053

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

explorer.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\explorer.exe.log
Size 1KB
SHA256 414659decfd237dde09625a49811e03b5b30ee06ee2ee97ea8bcfac394d281fd
MD5 4a667f150a4d1d02f53a9f24d89d53d1
SHA1 306e125c9edce66f28fdb63e6c4ca5c9ad6e8c97
SHA512 4edd8e73ce03488a6d92750a782cd4042fbb54a5b3f8d8ba3ea227fda0653c2cd84f0c5d64976c7cdc1f518a2fdc8ff10e2a015ec7acf3cd01b0d62bc98542d8
MD5 SHA1 SHA512

Submit Download

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 2KB
SHA256 84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f
MD5 d85ba6ff808d9e5444a4b369f5bc2730
SHA1 31aa9d96590fff6981b315e0b391b575e4c0804a
SHA512 8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249
MD5 SHA1 SHA512

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 944B
SHA256 8724dc2c3c8e8f17aeefae44a23741b1ea3b43c490fbc52fd61575ffe1cd82bb
MD5 aaaac7c68d2b7997ed502c26fd9f65c2
SHA1 7c5a3731300d672bf53c43e2f9e951c745f7fbdf
SHA512 c526febd9430413b48bed976edd9a795793ad1f06c8ff4f6b768b4ad63f4d2f06b9da72d4fcfa7cb9530a64e2dc3554f5ad97fd0ab60129701d175f2724ef1ac
MD5 SHA1 SHA512

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 944B
SHA256 876100d0ce1aff677a0cab677787ca9858a989f4e5c13b05c8931f709232b835
MD5 243347db405974f6277b941306d57ddb
SHA1 48a7563230d78ecfe8aaa7b749bf985c6078b4e4
SHA512 1c45eae761fb4224943debe2f2d553793146bb6d4bf2535de2bded3f9c78665607bc1fce7d4ecf905569488e42e42d0bf4b6d20dfcf8cda77a354b8faf17a951
MD5 SHA1 SHA512

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 944B
SHA256 7a73ac126468f3a94954656a0da1b494b18b6f7fc4ee09beb87573e82f300a10
MD5 377c375f814a335a131901ed5d5eca44
SHA1 9919811b18b4f8153541b332232ae88eec42f9f7
SHA512 c511dff1a34a5e32cf0ce2c56aa3adf71bd51e9a5afc7ae75320ac7563ebb4571f6ac5cd771fa52e9c7966112431bbdd20e4b74e1a125c273bc835f127b599b5
MD5 SHA1 SHA512

Submit Download

06ef62c4-5dd0-4daf-a722-d53e08fe2685.vbs

Path C:\Users\Admin\AppData\Local\Temp\06ef62c4-5dd0-4daf-a722-d53e08fe2685.vbs
Size 482B
SHA256 883908aec107b1ceb3f5752df4af11503ac7f8385d1f6055863e7e48948f7fb0
MD5 6dcbf7e06fc52c317ea20d4ae60460a3
SHA1 f858a171d58fbff9a5445d3babbab3d4925c38af
SHA512 c38fe56f06016e35f58e97a7a21bf0b404f53e23dc923ec1fc3bb2e93fb7683b511bc9d73419bef5fb58a29f87179f8b192fe78affe1b535f3abf8301dd25d99
MD5 SHA1 SHA512

Submit Download

35ccd009-7c11-4212-862d-a5422c365c83.vbs

Path C:\Users\Admin\AppData\Local\Temp\35ccd009-7c11-4212-862d-a5422c365c83.vbs
Size 706B
SHA256 0ea10a0becbc0123a26fe8a688720aef139cfb837d186d6a39d15f3f6434ac53
MD5 12713bcd32a3c9f975af5812db978dbf
SHA1 b81478a0f42333c66217c3356c6647b42709bc4f
SHA512 5057213519fbaa86c52103a0fcf852d0405f62601afa331f1b8bc38a9fef1ed03db427fc36ea03e6a368d4142af6d1dd01bc501664c2e1e522d9aace6db1fc9a
MD5 SHA1 SHA512

Submit Download

75902bd59893fe5ad2348da817903f46987348d3.exe

Path C:\Users\Admin\AppData\Local\Temp\75902bd59893fe5ad2348da817903f46987348d3.exe
Size 473KB
SHA256 15e2332a0e317662ccab690c96b93da99b37f50f37abe64048e3d390690554dc
MD5 82ab56c835fbda552987d4eed5b5fd49
SHA1 795c8621e5ea747324edd132ddab19cffe9ec52b
SHA512 3e8b1b3ba7caa31881d067807537134a001a91b1812b99ef3061f3cc9cbb0d193f5e9fc3acdb19fbf813cd9ae5354ffa48b73793b6ca040c1aaa8f934534299d
SSDEEP 6144:/L827+GfTZN/En2RQ3xLyqZ31QgA2aGksi+njQYqVEHEKvCDMntx7D:/vfLMnJLyC31I2aGf2akKwMnX
MD5 SHA1 SHA512 SSDEEP

Submit Download

83I8ebEZ50.bat

Path C:\Users\Admin\AppData\Local\Temp\83I8ebEZ50.bat
Size 195B
SHA256 fa419ef0e2b9d2bb5aae6699e5b080a0dfbfb6cbf93eecf225230fb0127e1e33
MD5 89a45cc6735796bd8cfc52e47785560c
SHA1 ec39134c9144be122e7e20e746d3fc33f2652ab4
SHA512 b9f77752987d01d5d74e18388e5d454097d3e39ce505e44e69ca6437755d8cebf5d62c35241534be1ebb9522a5b4c1bc665871f1bfe10d90f5d00a0f564e2d22
MD5 SHA1 SHA512

Submit Download

__PSScriptPolicyTest_3xerpai4.2pg.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_3xerpai4.2pg.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
MD5 SHA1 SHA512

Submit Download

lsass.exe

Path C:\Windows\SystemApps\Microsoft.Windows.PinningConfirmationDialog_cw5n1h2txyewy\lsass.exe
Size 2.0MB
SHA256 dc606f7747fa155a685f7462373a8cc218c33ccd3c083d1421662c96932669ff
MD5 e323e7fb6f5b1908c0d11e8e5c65f930
SHA1 1688785ea0c6359c58c63d5b789d3c6f923e5a14
SHA512 e718cb49d17c95c1665e5b4131ed47b8b96914b0954444fbd8a4593e50c68233505a3125e01954f34be1fb7f9aa5a36777606075117e49f22ab5bb9c8fe05a7a
SSDEEP 49152:PgylO+adjZ+RWMK8Fha66hwJVTxsjbSDDW5d1:PPOxdjrI7txbDW
MD5 SHA1 SHA512 SSDEEP

Submit Download

explorer.exe

Path C:\Windows\addins\explorer.exe
Size 588KB
SHA256 10f3a9c220fa6e843ea1f3f8c8a07f26315dd667aca86ce0ab5cb1b2eadb8e4f
MD5 4f31e76e647860e2c7fa5c4faa30915e
SHA1 4232852d01100058783899bcc2f4e5a0e872fa2f
SHA512 2110fdf05e2231a353e00d280b3a5c3853b4717beb56610749ba709b96cb704d6dd7ed33fc376b49304faca75269be257e52fda0150a080648894b4eac93dd5e
SSDEEP 12288:/vfLMnJLyC31I2aGf2akKwMnEp6Vy67OWva:/gyC31IOf2adwMnEYV79va
MD5 SHA1 SHA512 SSDEEP

Submit Download

explorer.exe

Path C:\Windows\addins\explorer.exe
Size 665KB
SHA256 e1778c9a4574f2cc46b5f457fc24968b889ff70b81185a78a1a94d1583003680
MD5 f73d6dd0385edd6320f61bc0c43cb6a6
SHA1 30c31e3d11b950fcc95d29bafa3461ac2afd1c1c
SHA512 f2748895f6c65f99cf2b3c3f00dbae41696b21eab2b9596530482f4b6558dcc0d0e4af7b4d56017c78d9db1f9a7c0f7195e4fe406bc84d5324cf53a2ab99a381
SSDEEP 12288:/vfLMnJLyC31I2aGf2akKwMnEp6Vy67OWv+o4RQ7C:/gyC31IOf2adwMnEYV79v+o4RkC
MD5 SHA1 SHA512 SSDEEP

Submit Download

explorer.exe

Path C:\Windows\addins\explorer.exe
Size 2.0MB
SHA256 f6deff855b042433fcce69c065891d7437b4dbf2eb508858e0a0614935476dff
MD5 f2f4cd40b8991b370b0a8ffa596e1af1
SHA1 fd77d80e7890760aa1a3e3c85cab194e21925dac
SHA512 3c4a81e6c0cc9966bcfaf140b72b42db3c2f842c8b0f60d6ce402dd03f3338ef172a3c67c7a7bc1de7faa8884ff7389f94693c2274257d1df3d767d6809e45e3
SSDEEP 49152:/gylO+adjZ+RWMK8Fha66hwJVTxsjbSDDW5d1:/POxdjrI7txbDW
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/336-241-0x00007FF962FE0000-0x00007FF963AA1000-memory.dmp

Download

memory/336-219-0x00000192C0610000-0x00000192C0620000-memory.dmp

Download

memory/336-218-0x00007FF962FE0000-0x00007FF963AA1000-memory.dmp

Download

memory/1044-97-0x0000013F62D10000-0x0000013F62D20000-memory.dmp

Download

memory/1044-95-0x00007FF962FE0000-0x00007FF963AA1000-memory.dmp

Download

memory/1192-96-0x00007FF962FE0000-0x00007FF963AA1000-memory.dmp

Download

memory/1192-18-0x000000001C3A0000-0x000000001C3AC000-memory.dmp

Download

memory/1192-22-0x000000001C4E0000-0x000000001C4EA000-memory.dmp

Download

memory/1192-23-0x000000001C5F0000-0x000000001C5FE000-memory.dmp

Download

memory/1192-24-0x000000001C600000-0x000000001C60E000-memory.dmp

Download

memory/1192-25-0x000000001C610000-0x000000001C61C000-memory.dmp

Download

memory/1192-27-0x000000001C630000-0x000000001C63A000-memory.dmp

Download

memory/1192-26-0x000000001C620000-0x000000001C628000-memory.dmp

Download

memory/1192-28-0x000000001C640000-0x000000001C64C000-memory.dmp

Download

memory/1192-20-0x000000001C4C0000-0x000000001C4C8000-memory.dmp

Download

memory/1192-1-0x00007FF962FE0000-0x00007FF963AA1000-memory.dmp

Download

memory/1192-2-0x000000001BB60000-0x000000001BB70000-memory.dmp

Download

memory/1192-4-0x000000001BB40000-0x000000001BB5C000-memory.dmp

Download

memory/1192-3-0x000000001BB30000-0x000000001BB38000-memory.dmp

Download

memory/1192-7-0x000000001BB80000-0x000000001BB90000-memory.dmp

Download

memory/1192-19-0x000000001C3B0000-0x000000001C3BC000-memory.dmp

Download

memory/1192-6-0x000000001BB70000-0x000000001BB78000-memory.dmp

Download

memory/1192-13-0x000000001C350000-0x000000001C358000-memory.dmp

Download

memory/1192-16-0x000000001C8C0000-0x000000001CDE8000-memory.dmp

Download

memory/1192-5-0x000000001C300000-0x000000001C350000-memory.dmp

Download

memory/1192-0-0x0000000000E30000-0x000000000103A000-memory.dmp

Download

memory/1192-8-0x000000001BB90000-0x000000001BBA6000-memory.dmp

Download

memory/1192-9-0x000000001BBB0000-0x000000001BBB8000-memory.dmp

Download

memory/1192-10-0x000000001BBC0000-0x000000001BBD0000-memory.dmp

Download

memory/1192-11-0x000000001BBD0000-0x000000001BBDA000-memory.dmp

Download

memory/1192-17-0x000000001C390000-0x000000001C39C000-memory.dmp

Download

memory/1192-12-0x000000001BBE0000-0x000000001BBEC000-memory.dmp

Download

memory/1192-15-0x000000001C360000-0x000000001C372000-memory.dmp

Download

memory/1192-21-0x000000001C4D0000-0x000000001C4DC000-memory.dmp

Download

memory/1328-221-0x000002257B2D0000-0x000002257B2E0000-memory.dmp

Download

memory/1328-220-0x00007FF962FE0000-0x00007FF963AA1000-memory.dmp

Download

memory/1328-222-0x000002257B2D0000-0x000002257B2E0000-memory.dmp

Download

memory/1436-227-0x000001B0570F0000-0x000001B057100000-memory.dmp

Download

memory/1436-228-0x000001B0570F0000-0x000001B057100000-memory.dmp

Download

memory/1436-230-0x00007FF962FE0000-0x00007FF963AA1000-memory.dmp

Download

memory/1488-217-0x000001EB529B0000-0x000001EB529C0000-memory.dmp

Download

memory/1488-216-0x00007FF962FE0000-0x00007FF963AA1000-memory.dmp

Download

memory/1488-243-0x00007FF962FE0000-0x00007FF963AA1000-memory.dmp

Download

memory/1524-223-0x00007FF962FE0000-0x00007FF963AA1000-memory.dmp

Download

memory/2920-242-0x00007FF962FE0000-0x00007FF963AA1000-memory.dmp

Download

memory/2920-212-0x000001F97BD50000-0x000001F97BD60000-memory.dmp

Download

memory/2920-197-0x00007FF962FE0000-0x00007FF963AA1000-memory.dmp

Download

memory/3720-215-0x000001B1B1A80000-0x000001B1B1A90000-memory.dmp

Download

memory/3720-214-0x000001B1B1A80000-0x000001B1B1A90000-memory.dmp

Download

memory/3720-211-0x00007FF962FE0000-0x00007FF963AA1000-memory.dmp

Download

memory/4288-240-0x00007FF962FE0000-0x00007FF963AA1000-memory.dmp

Download

memory/4288-229-0x00007FF962FE0000-0x00007FF963AA1000-memory.dmp

Download

memory/4288-92-0x000002694DB50000-0x000002694DB60000-memory.dmp

Download

memory/4288-93-0x000002694DB50000-0x000002694DB60000-memory.dmp

Download

memory/4304-224-0x00007FF962FE0000-0x00007FF963AA1000-memory.dmp

Download

memory/4304-225-0x0000024D29F90000-0x0000024D29FA0000-memory.dmp

Download

memory/4304-226-0x0000024D29F90000-0x0000024D29FA0000-memory.dmp

Download

memory/4532-107-0x000001A140680000-0x000001A1406A2000-memory.dmp

Download

memory/4532-90-0x000001A1406B0000-0x000001A1406C0000-memory.dmp

Download

memory/4532-91-0x000001A1406B0000-0x000001A1406C0000-memory.dmp

Download

memory/4532-89-0x00007FF962FE0000-0x00007FF963AA1000-memory.dmp

Download

memory/4680-166-0x000002B638B30000-0x000002B638B40000-memory.dmp

Download

memory/4680-170-0x000002B638B30000-0x000002B638B40000-memory.dmp

Download

memory/4680-126-0x00007FF962FE0000-0x00007FF963AA1000-memory.dmp

Download