zgrat | c252cbd5898c1d562170a12c1e2262ad101616ec0583cb647c01a5e3d1568fef

Analysis

max time kernel
147s
max time network
153s
platform
windows10-1703_x64
resource
win10-20240404-en
resource tags

arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system
submitted
12-05-2024 17:42

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

BlastedCracked.exe
Size

3.6MB
MD5

efa8a9b8529959e7384cce67f59420d8
SHA1

54159f633070d03a71ed6d5e1d9e40f2893510fe
SHA256

c252cbd5898c1d562170a12c1e2262ad101616ec0583cb647c01a5e3d1568fef
SHA512

7a97920a93a05d076ea6ddade8dbe82553b69d89c0a3d86fb11627193753bf12a85975ff01ccf84bcb9b030a38d4e0d7c3957d08a2ad11831601e80f24fd5aef
SSDEEP

98304:1syC4u5x0b8dF6eaeSjBeKxATO7IiiOra+Hc8:7C4u5x0wn6eaeSdyTO4Ora+Hc8

Score

10^/10

zgrat persistence rat

Malware Config

Signatures

Detect ZGRat V1 3 IoCs

resource	yara_rule
behavioral1/files/0x000a00000001aad0-8.dat	family_zgrat_v1
behavioral1/files/0x000900000001abb0-29.dat	family_zgrat_v1
behavioral1/memory/3584-32-0x0000000000AE0000-0x0000000000E6E000-memory.dmp	family_zgrat_v1

Modifies WinLogon for persistence 2 TTPs 6 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Recovery\\WindowsRE\\SearchUI.exe\", \"C:\\Recovery\\WindowsRE\\fontdrvhost.exe\", \"C:\\Recovery\\WindowsRE\\lsass.exe\""	surrogatesessionsvc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Recovery\\WindowsRE\\SearchUI.exe\", \"C:\\Recovery\\WindowsRE\\fontdrvhost.exe\", \"C:\\Recovery\\WindowsRE\\lsass.exe\", \"C:\\Program Files\\7-Zip\\Lang\\cmd.exe\""	surrogatesessionsvc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Recovery\\WindowsRE\\SearchUI.exe\", \"C:\\Recovery\\WindowsRE\\fontdrvhost.exe\", \"C:\\Recovery\\WindowsRE\\lsass.exe\", \"C:\\Program Files\\7-Zip\\Lang\\cmd.exe\", \"C:\\Program Files (x86)\\Windows Multimedia Platform\\dwm.exe\""	surrogatesessionsvc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Recovery\\WindowsRE\\SearchUI.exe\", \"C:\\Recovery\\WindowsRE\\fontdrvhost.exe\", \"C:\\Recovery\\WindowsRE\\lsass.exe\", \"C:\\Program Files\\7-Zip\\Lang\\cmd.exe\", \"C:\\Program Files (x86)\\Windows Multimedia Platform\\dwm.exe\", \"C:\\ProviderSession\\surrogatesessionsvc.exe\""	surrogatesessionsvc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Recovery\\WindowsRE\\SearchUI.exe\""	surrogatesessionsvc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Recovery\\WindowsRE\\SearchUI.exe\", \"C:\\Recovery\\WindowsRE\\fontdrvhost.exe\""	surrogatesessionsvc.exe

Process spawned unexpected child process 18 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2864	1460	schtasks.exe	79
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	220	1460	schtasks.exe	79
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1512	1460	schtasks.exe	79
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2376	1460	schtasks.exe	79
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3852	1460	schtasks.exe	79
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2784	1460	schtasks.exe	79
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3000	1460	schtasks.exe	79
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3740	1460	schtasks.exe	79
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	840	1460	schtasks.exe	79
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4424	1460	schtasks.exe	79
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4360	1460	schtasks.exe	79
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3812	1460	schtasks.exe	79
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	384	1460	schtasks.exe	79
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3756	1460	schtasks.exe	79
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4712	1460	schtasks.exe	79
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	972	1460	schtasks.exe	79
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2172	1460	schtasks.exe	79
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1668	1460	schtasks.exe	79

ZGRat
ZGRat is remote access trojan written in C#.
rat zgrat

Executes dropped EXE 11 IoCs

pid	Process
1868	Cracker.exe
5092	BlastedCrack.exe
3584	surrogatesessionsvc.exe
2952	cmd.exe
1868	cmd.exe
3116	cmd.exe
3728	cmd.exe
3684	cmd.exe
3672	cmd.exe
892	cmd.exe
3532	cmd.exe

Adds Run key to start application 2 TTPs 12 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\lsass = "\"C:\\Recovery\\WindowsRE\\lsass.exe\""	surrogatesessionsvc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1739856679-3467441365-73334005-1000\Software\Microsoft\Windows\CurrentVersion\Run\cmd = "\"C:\\Program Files\\7-Zip\\Lang\\cmd.exe\""	surrogatesessionsvc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1739856679-3467441365-73334005-1000\Software\Microsoft\Windows\CurrentVersion\Run\dwm = "\"C:\\Program Files (x86)\\Windows Multimedia Platform\\dwm.exe\""	surrogatesessionsvc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dwm = "\"C:\\Program Files (x86)\\Windows Multimedia Platform\\dwm.exe\""	surrogatesessionsvc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1739856679-3467441365-73334005-1000\Software\Microsoft\Windows\CurrentVersion\Run\surrogatesessionsvc = "\"C:\\ProviderSession\\surrogatesessionsvc.exe\""	surrogatesessionsvc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1739856679-3467441365-73334005-1000\Software\Microsoft\Windows\CurrentVersion\Run\SearchUI = "\"C:\\Recovery\\WindowsRE\\SearchUI.exe\""	surrogatesessionsvc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1739856679-3467441365-73334005-1000\Software\Microsoft\Windows\CurrentVersion\Run\fontdrvhost = "\"C:\\Recovery\\WindowsRE\\fontdrvhost.exe\""	surrogatesessionsvc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\fontdrvhost = "\"C:\\Recovery\\WindowsRE\\fontdrvhost.exe\""	surrogatesessionsvc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\surrogatesessionsvc = "\"C:\\ProviderSession\\surrogatesessionsvc.exe\""	surrogatesessionsvc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SearchUI = "\"C:\\Recovery\\WindowsRE\\SearchUI.exe\""	surrogatesessionsvc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1739856679-3467441365-73334005-1000\Software\Microsoft\Windows\CurrentVersion\Run\lsass = "\"C:\\Recovery\\WindowsRE\\lsass.exe\""	surrogatesessionsvc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\cmd = "\"C:\\Program Files\\7-Zip\\Lang\\cmd.exe\""	surrogatesessionsvc.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	\??\c:\Windows\System32\CSC9DAB097318FD4E14937CA7957010C0D2.TMP	csc.exe
File created	\??\c:\Windows\System32\enwe2z.exe	csc.exe

Drops file in Program Files directory 5 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Windows Multimedia Platform\dwm.exe	surrogatesessionsvc.exe
File opened for modification	C:\Program Files (x86)\Windows Multimedia Platform\dwm.exe	surrogatesessionsvc.exe
File created	C:\Program Files (x86)\Windows Multimedia Platform\6cb0b6c459d5d3	surrogatesessionsvc.exe
File created	C:\Program Files\7-Zip\Lang\cmd.exe	surrogatesessionsvc.exe
File created	C:\Program Files\7-Zip\Lang\ebf1f9fa8afd6d	surrogatesessionsvc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 18 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
840	schtasks.exe
3756	schtasks.exe
2864	schtasks.exe
1512	schtasks.exe
3852	schtasks.exe
4424	schtasks.exe
1668	schtasks.exe
2376	schtasks.exe
2784	schtasks.exe
4360	schtasks.exe
2172	schtasks.exe
384	schtasks.exe
4712	schtasks.exe
972	schtasks.exe
220	schtasks.exe
3000	schtasks.exe
3740	schtasks.exe
3812	schtasks.exe

Modifies registry class 10 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1739856679-3467441365-73334005-1000_Classes\Local Settings	Cracker.exe
Key created	\REGISTRY\USER\S-1-5-21-1739856679-3467441365-73334005-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-1739856679-3467441365-73334005-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-1739856679-3467441365-73334005-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-1739856679-3467441365-73334005-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-1739856679-3467441365-73334005-1000_Classes\Local Settings	surrogatesessionsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-1739856679-3467441365-73334005-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-1739856679-3467441365-73334005-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-1739856679-3467441365-73334005-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-1739856679-3467441365-73334005-1000_Classes\Local Settings	cmd.exe

Runs ping.exe 1 TTPs 4 IoCs

Remote System Discovery

T1018

pid	Process
420	PING.EXE
4396	PING.EXE
4168	PING.EXE
2184	PING.EXE

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
5092	BlastedCrack.exe
5092	BlastedCrack.exe
3584	surrogatesessionsvc.exe
3584	surrogatesessionsvc.exe
3584	surrogatesessionsvc.exe
3584	surrogatesessionsvc.exe
3584	surrogatesessionsvc.exe
3584	surrogatesessionsvc.exe
3584	surrogatesessionsvc.exe
3584	surrogatesessionsvc.exe
3584	surrogatesessionsvc.exe
3584	surrogatesessionsvc.exe
3584	surrogatesessionsvc.exe
3584	surrogatesessionsvc.exe
3584	surrogatesessionsvc.exe
3584	surrogatesessionsvc.exe
3584	surrogatesessionsvc.exe
3584	surrogatesessionsvc.exe
3584	surrogatesessionsvc.exe
3584	surrogatesessionsvc.exe
3584	surrogatesessionsvc.exe
3584	surrogatesessionsvc.exe
3584	surrogatesessionsvc.exe
3584	surrogatesessionsvc.exe
3584	surrogatesessionsvc.exe
3584	surrogatesessionsvc.exe
3584	surrogatesessionsvc.exe
3584	surrogatesessionsvc.exe
3584	surrogatesessionsvc.exe
3584	surrogatesessionsvc.exe
3584	surrogatesessionsvc.exe
3584	surrogatesessionsvc.exe
3584	surrogatesessionsvc.exe
3584	surrogatesessionsvc.exe
3584	surrogatesessionsvc.exe
3584	surrogatesessionsvc.exe
3584	surrogatesessionsvc.exe
3584	surrogatesessionsvc.exe
3584	surrogatesessionsvc.exe
3584	surrogatesessionsvc.exe
3584	surrogatesessionsvc.exe
3584	surrogatesessionsvc.exe
3584	surrogatesessionsvc.exe
3584	surrogatesessionsvc.exe
3584	surrogatesessionsvc.exe
3584	surrogatesessionsvc.exe
3584	surrogatesessionsvc.exe
3584	surrogatesessionsvc.exe
3584	surrogatesessionsvc.exe
3584	surrogatesessionsvc.exe
3584	surrogatesessionsvc.exe
3584	surrogatesessionsvc.exe
3584	surrogatesessionsvc.exe
3584	surrogatesessionsvc.exe
3584	surrogatesessionsvc.exe
3584	surrogatesessionsvc.exe
3584	surrogatesessionsvc.exe
3584	surrogatesessionsvc.exe
3584	surrogatesessionsvc.exe
3584	surrogatesessionsvc.exe
3584	surrogatesessionsvc.exe
3584	surrogatesessionsvc.exe
3584	surrogatesessionsvc.exe
3584	surrogatesessionsvc.exe

Suspicious use of AdjustPrivilegeToken 10 IoCs

description	pid	Process
Token: SeDebugPrivilege	5092	BlastedCrack.exe
Token: SeDebugPrivilege	3584	surrogatesessionsvc.exe
Token: SeDebugPrivilege	2952	cmd.exe
Token: SeDebugPrivilege	1868	cmd.exe
Token: SeDebugPrivilege	3116	cmd.exe
Token: SeDebugPrivilege	3728	cmd.exe
Token: SeDebugPrivilege	3684	cmd.exe
Token: SeDebugPrivilege	3672	cmd.exe
Token: SeDebugPrivilege	892	cmd.exe
Token: SeDebugPrivilege	3532	cmd.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
5092	BlastedCrack.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1580 wrote to memory of 1868	1580	BlastedCracked.exe	72
PID 1580 wrote to memory of 1868	1580	BlastedCracked.exe	72
PID 1580 wrote to memory of 1868	1580	BlastedCracked.exe	72
PID 1580 wrote to memory of 5092	1580	BlastedCracked.exe	74
PID 1580 wrote to memory of 5092	1580	BlastedCracked.exe	74
PID 1580 wrote to memory of 5092	1580	BlastedCracked.exe	74
PID 1868 wrote to memory of 4996	1868	Cracker.exe	75
PID 1868 wrote to memory of 4996	1868	Cracker.exe	75
PID 1868 wrote to memory of 4996	1868	Cracker.exe	75
PID 4996 wrote to memory of 3568	4996	WScript.exe	76
PID 4996 wrote to memory of 3568	4996	WScript.exe	76
PID 4996 wrote to memory of 3568	4996	WScript.exe	76
PID 3568 wrote to memory of 3584	3568	cmd.exe	78
PID 3568 wrote to memory of 3584	3568	cmd.exe	78
PID 3584 wrote to memory of 2844	3584	surrogatesessionsvc.exe	83
PID 3584 wrote to memory of 2844	3584	surrogatesessionsvc.exe	83
PID 2844 wrote to memory of 2388	2844	csc.exe	85
PID 2844 wrote to memory of 2388	2844	csc.exe	85
PID 3584 wrote to memory of 2452	3584	surrogatesessionsvc.exe	101
PID 3584 wrote to memory of 2452	3584	surrogatesessionsvc.exe	101
PID 2452 wrote to memory of 1040	2452	cmd.exe	103
PID 2452 wrote to memory of 1040	2452	cmd.exe	103
PID 2452 wrote to memory of 420	2452	cmd.exe	104
PID 2452 wrote to memory of 420	2452	cmd.exe	104
PID 2452 wrote to memory of 2952	2452	cmd.exe	105
PID 2452 wrote to memory of 2952	2452	cmd.exe	105
PID 2952 wrote to memory of 672	2952	cmd.exe	106
PID 2952 wrote to memory of 672	2952	cmd.exe	106
PID 672 wrote to memory of 4992	672	cmd.exe	108
PID 672 wrote to memory of 4992	672	cmd.exe	108
PID 672 wrote to memory of 4396	672	cmd.exe	109
PID 672 wrote to memory of 4396	672	cmd.exe	109
PID 672 wrote to memory of 1868	672	cmd.exe	110
PID 672 wrote to memory of 1868	672	cmd.exe	110
PID 1868 wrote to memory of 3384	1868	cmd.exe	111
PID 1868 wrote to memory of 3384	1868	cmd.exe	111
PID 3384 wrote to memory of 2584	3384	cmd.exe	113
PID 3384 wrote to memory of 2584	3384	cmd.exe	113
PID 3384 wrote to memory of 1604	3384	cmd.exe	114
PID 3384 wrote to memory of 1604	3384	cmd.exe	114
PID 3384 wrote to memory of 3116	3384	cmd.exe	115
PID 3384 wrote to memory of 3116	3384	cmd.exe	115
PID 3116 wrote to memory of 728	3116	cmd.exe	116
PID 3116 wrote to memory of 728	3116	cmd.exe	116
PID 728 wrote to memory of 1676	728	cmd.exe	118
PID 728 wrote to memory of 1676	728	cmd.exe	118
PID 728 wrote to memory of 720	728	cmd.exe	119
PID 728 wrote to memory of 720	728	cmd.exe	119
PID 728 wrote to memory of 3728	728	cmd.exe	120
PID 728 wrote to memory of 3728	728	cmd.exe	120
PID 3728 wrote to memory of 4780	3728	cmd.exe	121
PID 3728 wrote to memory of 4780	3728	cmd.exe	121
PID 4780 wrote to memory of 2768	4780	cmd.exe	123
PID 4780 wrote to memory of 2768	4780	cmd.exe	123
PID 4780 wrote to memory of 4408	4780	cmd.exe	124
PID 4780 wrote to memory of 4408	4780	cmd.exe	124
PID 4780 wrote to memory of 3684	4780	cmd.exe	125
PID 4780 wrote to memory of 3684	4780	cmd.exe	125
PID 3684 wrote to memory of 4888	3684	cmd.exe	126
PID 3684 wrote to memory of 4888	3684	cmd.exe	126
PID 4888 wrote to memory of 5036	4888	cmd.exe	128
PID 4888 wrote to memory of 5036	4888	cmd.exe	128
PID 4888 wrote to memory of 4168	4888	cmd.exe	129
PID 4888 wrote to memory of 4168	4888	cmd.exe	129

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\BlastedCracked.exe
"C:\Users\Admin\AppData\Local\Temp\BlastedCracked.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1580
- C:\Users\Admin\AppData\Local\Temp\Cracker.exe
  "C:\Users\Admin\AppData\Local\Temp\Cracker.exe"
  2⤵
  - Executes dropped EXE
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:1868
- - C:\Windows\SysWOW64\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\ProviderSession\bsSZWUX62rbs.vbe"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4996
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\ProviderSession\zpmu3ESIavPlU5h4gyS3YPEo2FY3dCgO4x55.bat" "
      4⤵
      Suspicious use of WriteProcessMemory
      PID:3568
    - - C:\ProviderSession\surrogatesessionsvc.exe
        
        "C:\ProviderSession/surrogatesessionsvc.exe"
        5⤵
        Modifies WinLogon for persistence
        Executes dropped EXE
        Adds Run key to start application
        Drops file in Program Files directory
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3584
      - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\cjgds0ho\cjgds0ho.cmdline"
        6⤵
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:2844
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES5176.tmp" "c:\Windows\System32\CSC9DAB097318FD4E14937CA7957010C0D2.TMP"
        7⤵
        
        PID:2388
      - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\AG8wyCpg7S.bat"
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:2452
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        7⤵
        
        PID:1040
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        7⤵
        Runs ping.exe
        
        PID:420
        
        C:\Program Files\7-Zip\Lang\cmd.exe
        
        "C:\Program Files\7-Zip\Lang\cmd.exe"
        7⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2952
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\BOi8pHAIsy.bat"
        8⤵
        Suspicious use of WriteProcessMemory
        
        PID:672
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        9⤵
        
        PID:4992
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        9⤵
        Runs ping.exe
        
        PID:4396
        
        C:\Program Files\7-Zip\Lang\cmd.exe
        
        "C:\Program Files\7-Zip\Lang\cmd.exe"
        9⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1868
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\HLyChA1PXA.bat"
        10⤵
        Suspicious use of WriteProcessMemory
        
        PID:3384
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        11⤵
        
        PID:2584
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        11⤵
        
        PID:1604
        
        C:\Program Files\7-Zip\Lang\cmd.exe
        
        "C:\Program Files\7-Zip\Lang\cmd.exe"
        11⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3116
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\w6HeTDdWXW.bat"
        12⤵
        Suspicious use of WriteProcessMemory
        
        PID:728
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        13⤵
        
        PID:1676
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        13⤵
        
        PID:720
        
        C:\Program Files\7-Zip\Lang\cmd.exe
        
        "C:\Program Files\7-Zip\Lang\cmd.exe"
        13⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3728
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\COegk83zmU.bat"
        14⤵
        Suspicious use of WriteProcessMemory
        
        PID:4780
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        15⤵
        
        PID:2768
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        15⤵
        
        PID:4408
        
        C:\Program Files\7-Zip\Lang\cmd.exe
        
        "C:\Program Files\7-Zip\Lang\cmd.exe"
        15⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3684
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\4XCyKdTKaY.bat"
        16⤵
        Suspicious use of WriteProcessMemory
        
        PID:4888
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        17⤵
        
        PID:5036
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        17⤵
        Runs ping.exe
        
        PID:4168
        
        C:\Program Files\7-Zip\Lang\cmd.exe
        
        "C:\Program Files\7-Zip\Lang\cmd.exe"
        17⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        
        PID:3672
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\GOaFRNgcv9.bat"
        18⤵
        
        PID:3156
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        19⤵
        
        PID:2576
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        19⤵
        
        PID:672
        
        C:\Program Files\7-Zip\Lang\cmd.exe
        
        "C:\Program Files\7-Zip\Lang\cmd.exe"
        19⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        
        PID:892
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\mLBZigXOC1.bat"
        20⤵
        
        PID:3856
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        21⤵
        
        PID:4528
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        21⤵
        
        PID:2896
        
        C:\Program Files\7-Zip\Lang\cmd.exe
        
        "C:\Program Files\7-Zip\Lang\cmd.exe"
        21⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        
        PID:3532
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\aYLtGzs08v.bat"
        22⤵
        
        PID:4448
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        23⤵
        
        PID:720
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        23⤵
        Runs ping.exe
        
        PID:2184
- C:\Users\Admin\AppData\Local\Temp\BlastedCrack.exe
  "C:\Users\Admin\AppData\Local\Temp\BlastedCrack.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  PID:5092

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SearchUIS" /sc MINUTE /mo 13 /tr "'C:\Recovery\WindowsRE\SearchUI.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2864

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SearchUI" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\SearchUI.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:220

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SearchUIS" /sc MINUTE /mo 14 /tr "'C:\Recovery\WindowsRE\SearchUI.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1512

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 14 /tr "'C:\Recovery\WindowsRE\fontdrvhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2376

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3852

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 12 /tr "'C:\Recovery\WindowsRE\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2784

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 7 /tr "'C:\Recovery\WindowsRE\lsass.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3000

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsass" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3740

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 9 /tr "'C:\Recovery\WindowsRE\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:840

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "cmdc" /sc MINUTE /mo 10 /tr "'C:\Program Files\7-Zip\Lang\cmd.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4424

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "cmd" /sc ONLOGON /tr "'C:\Program Files\7-Zip\Lang\cmd.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4360

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "cmdc" /sc MINUTE /mo 6 /tr "'C:\Program Files\7-Zip\Lang\cmd.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3812

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 6 /tr "'C:\Program Files (x86)\Windows Multimedia Platform\dwm.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:384

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwm" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Multimedia Platform\dwm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3756

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 9 /tr "'C:\Program Files (x86)\Windows Multimedia Platform\dwm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4712

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "surrogatesessionsvcs" /sc MINUTE /mo 6 /tr "'C:\ProviderSession\surrogatesessionsvc.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:972

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "surrogatesessionsvc" /sc ONLOGON /tr "'C:\ProviderSession\surrogatesessionsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2172

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "surrogatesessionsvcs" /sc MINUTE /mo 9 /tr "'C:\ProviderSession\surrogatesessionsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1668

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Scheduled Task/Job

T1053

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Scheduled Task/Job

T1053

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProviderSession\bsSZWUX62rbs.vbe

Filesize
230B

MD5
c59360784e5ae0db16c6e319cc53bf8d

SHA1
7e7b6afc92d466512f383f01d24d3fc0ba5d249d

SHA256
4edef9b23ac770fb41a5dec471ddf37d3d1c5dc868999b79358bbdd34523b7c1

SHA512
8a3fcbcc366567b11444bcc033dbf4597c33ab3230c9f6d603bb60fb2b9ee746271e4f6b332109973eb54a9247569feac76691dcc2602a9727e960e78f0968ff

Download Submit
C:\ProviderSession\surrogatesessionsvc.exe

Filesize
3.5MB

MD5
5a75e59d28b7b443280c733ebd3c22cf

SHA1
8d4781c8cf4a42ec9f6d5a57633eaf0e589dd11b

SHA256
651072ebbd54a10b843d35b050186915e876b513d09d3cdbf864e4277f5ebb6a

SHA512
4674881eb1923cbe19456d6b7822153213dd2a914a7f66f9898ea6ab8569e42f09b7702c0eabbcdb7182c4b37afa2b9d0edfa92b53e68ef9c213c0ee7903f2fc

Download Submit
C:\ProviderSession\zpmu3ESIavPlU5h4gyS3YPEo2FY3dCgO4x55.bat

Filesize
74B

MD5
bdd66a5a523ff5c2d0546fdefcfde8aa

SHA1
76eb5ea9114693dc22b4241732fe5dd6b25037bb

SHA256
222da2e8abc8fe3b8acb5c84f61f635078fc7237816126348e600f458506398c

SHA512
b79c03ffb10bfdc16268a6872e4b9b522366b9d7edca992212c315133ce920768a0726595b65c0aa4878d25b143e65c42ec271863e9be8ad726dfe63062a6e3c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\cmd.exe.log

Filesize
1KB

MD5
bb987b943ab9637f57b430c5c3c7f120

SHA1
06fe9081a43d23c9537f44a3cef2de6826e9cf42

SHA256
651c0afdea1507e6c6be1f97f003c2f40000403504adb5c9f3d581b3349c492f

SHA512
6221bbcf0a618f7cbb25238d6fbb3d75d3d03ca3df4f806b0991ab0fa43ad783acf549c81724c7e65eebebe6ca70557ff874b8d74708447a9999c0ef0558c6f5

Download Submit
C:\Users\Admin\AppData\Local\Temp\4XCyKdTKaY.bat

Filesize
163B

MD5
211ebcee46e46c432f7dbbc299422839

SHA1
598111ec7da155433551061290657b4417cdac51

SHA256
d552f94949c8c8f1e53bba0d43bc99b5c919c7061d31994adc5aa29514deff18

SHA512
dfc5efa1e1ccc8e182a3f2a42bbabc17eb8de0fc5636833d74b117aac9f1e252a77c43d351f2f0248f77c8dde5e9b15624ce3836b9b17261e26ea8c5385ff209

Download Submit
C:\Users\Admin\AppData\Local\Temp\AG8wyCpg7S.bat

Filesize
163B

MD5
ff6fa62eec329a56cbc480d211723ae3

SHA1
f33f49cd7224f31cb4c977905c4f6d3775f72697

SHA256
029c11adce1197c8ff1cf2471a22eaea0af43a886b949c1df89e68b61e939aa5

SHA512
f8e601268a62ab63b1d36cef15862df7cca5292555a2937b815658287a95e8bb7133fe8f296fbe2155f07764c6a4201f167e3fcaaf36945f4b1283f1644bb90c

Download Submit
C:\Users\Admin\AppData\Local\Temp\BOi8pHAIsy.bat

Filesize
163B

MD5
af0d9946a2c14ba2b773b90a3144b75f

SHA1
b16ef911d2f0d5ea926df53d84e6a91edf002f5d

SHA256
528a200d73b773895d49bd1a1df2b5b38767dec51c2e1ceaa6d6e92b46036c8e

SHA512
99af4db282c9a84749bc69f609600cb185289cf533f025cd04b9aefcbe3a4aa6544634684c3e2112299ee186c6f3214e9e2415cc5fa5ba1f25f0b247980c1955

Download Submit
C:\Users\Admin\AppData\Local\Temp\BlastedCrack.exe

Filesize
17KB

MD5
21f525dd782bb2ccf33e2f3ec6c85660

SHA1
5bc5763dd316385d5feab0274b24ac7cbb2790a0

SHA256
ea2e948a4c0224a15195153a0aa10600047d04aa634a19fd388c26810db6847e

SHA512
0f56a381db55c17f570aaccfa46ab17900e563a0307bb232b61b17cebf305dbe7b762ad722daa239e71dfedc024df076806cdf9b4702d009457a6b054a753c0c

Download Submit
C:\Users\Admin\AppData\Local\Temp\COegk83zmU.bat

Filesize
211B

MD5
2f59f26aaf81ca19acae5692344413c9

SHA1
8927b84fd0bc73c1eeee4bbf65eed1c93296bff9

SHA256
ed71914dbc58c6c4eea034202c24a8fe5aba99b150cb2036928d3d80a5a70e3b

SHA512
dab27ae248ef8c620e6fa253687351cb54e68ee8e923f225106d31177d9a5d925f241b887d8a38c97c4399df318fff116166144c66bf46ff53d910e70ec9b7ef

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cracker.exe

Filesize
4.0MB

MD5
2b7ed32dc61c861ffd3e9e35a208aafe

SHA1
307dcf28a2b397e8b22a3f31290bb30045853787

SHA256
568030e4ac1923f3d261c5bb137481c2db277a30957db6fef76b60381f75051b

SHA512
a1550f037c74ffee99ca0db21fcc46e06f24394c88c8b3b9171de97dc8eb7f5aa74eb4c3185b9956c529430da5511c901a5488c54b7370d7758476e31dfe254d

Download Submit
C:\Users\Admin\AppData\Local\Temp\GOaFRNgcv9.bat

Filesize
211B

MD5
99faef80e443d155bbefdd22ebaecf69

SHA1
59ee1142856eeddb2fdc579b0bfab0b66dd81344

SHA256
57c2c6179fdd64f2395aa81c5d8839051e70189610067aec8598ff64892004b7

SHA512
322554aabfc0091a3769091fbb740066ab21972a21dbc1c5a4096c48cd4d5863779c0927a90861153e894071ecf3a22b8beccbee1dcc7d4670af17d2d956570f

Download Submit
C:\Users\Admin\AppData\Local\Temp\HLyChA1PXA.bat

Filesize
211B

MD5
c5e888963a448d81877863370eb9d6ae

SHA1
441fae4c3f37d9acaeb390fd99c098db3962d804

SHA256
7c2103bb69af9322d1c59aef850b8497689965cd3bb2d0792de6b1953a0cedc7

SHA512
3bbd58761ec53c2dbc84320bb51315dd0edab61dcb6ea095166aaeb8fc2d4e5a602f5317c313a1bf0754233cb6409d1ef5758bc3000ece8de47362723e07d124

Download Submit
C:\Users\Admin\AppData\Local\Temp\RES5176.tmp

Filesize
1KB

MD5
a48c2aab5b25bbd08e079e3c6aee8311

SHA1
2ce3110b457251a7b5f85e60015a4e8cd51f2bf5

SHA256
9d0147d40ed79af0065d4ec1745654ae0352b5660945b074177462e5c158caac

SHA512
c690f9fbd2e3fc8bbe89bb7f15a4f3f0164af13b48b4b857bd26e20ebda0b61fa27dfe5c3fa306ca1c8324892747da57de95744e9fe4a0316964c5cc896753cd

Download Submit
C:\Users\Admin\AppData\Local\Temp\aYLtGzs08v.bat

Filesize
163B

MD5
d9ef7b483617b3169b7d4fd8eac017f9

SHA1
0640bb68b124a11d8a757cc62b8b23ecc2aeaba6

SHA256
f61812c19fdd8a457c7c811910cd45dd93f3990df8c6647df71aa94aecfc250c

SHA512
4f61590dc05c79ed96cb39b4a874e573b22a3b64cb3c669cfc6de03bf09e130a882df8648c909cafe05351c90edd24032f3feaf1a53b7369e1ec51870eb2bd6c

Download Submit
C:\Users\Admin\AppData\Local\Temp\mLBZigXOC1.bat

Filesize
211B

MD5
0d9d3a6e2a261e099c2d9c7cfe38d14b

SHA1
57024b31f1833005daf9f30674666cbc4ddb3310

SHA256
6b2c7082c97eab05de7333bd55a7c4344290e9fd400f31d98f4fb6928a3cd30e

SHA512
7bceb53e620d879df39511ec4e95a152c8ed95be4c3bf9361fcabf4b312b9099e7db991e1ccfe5bb29036fc97db5e7e89277c091a3b55dc7785795e153a4c490

Download Submit
C:\Users\Admin\AppData\Local\Temp\w6HeTDdWXW.bat

Filesize
211B

MD5
c2f97080a9092151ac26942b069ba82d

SHA1
b2b15f10f3d601a344ea92bd19f44e6d356dcd89

SHA256
7542bc471accf506f0f1590b2fd56773970e954e2979924a94abe1883b31fc24

SHA512
369a6a1a863d795fb1787ab361101a13045d8b932ebe51e7c4503d610eb0f3f2069ddd920e2f82e8e11a0014fdfc78cf85921e056d4cfe35d3d0a0eaebf9753d

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\cjgds0ho\cjgds0ho.0.cs

Filesize
366B

MD5
16fb8360f5c1c830a784d4f7562187f4

SHA1
8245e3fd75525feb2464f48cd981dc8daa4693a6

SHA256
2c5806cf1d5b252ccaa3b5ac3a865bab8128a1eaa3c19d0512a982394fefeef1

SHA512
08564650167877e23cabe436550e530e358b3c9dcdef2b7481129e91dbd0828c90f5f3aa899ff9e3af16efe604dcc9930294ca2ac002b371d281f46302b6d189

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\cjgds0ho\cjgds0ho.cmdline

Filesize
235B

MD5
efbc5e1d60932e7c50df2b50d0d06b06

SHA1
fb81d77e71d127c4689e70659a69596e353e43ae

SHA256
8a460a4b7edfac1ef3b899c54ec6deaa3cfb1a981d52e59af086b12bfa94c698

SHA512
2f700dc876e4d6c46ef05b9dfc6966da381ab4f23bfc773dc4a2a0028957f1f21d656d98f361fcd830100114ab38da96bbe4cb4ebfe2ddb047c93d4898aaf56c

Download Submit
\??\c:\Windows\System32\CSC9DAB097318FD4E14937CA7957010C0D2.TMP

Filesize
1KB

MD5
62b4971e895296fa5622d960c4d03829

SHA1
c9358a0f53eb5ca18a70f7e475c2d9d0945e3f64

SHA256
8e73ac46048412900ead515f59c33d523cf5b0e20d84e453208e9107a57e7a21

SHA512
8ca6635cf475eebc2deaaefd42a73b7ffff5d5e0bcb694fee2814b8ceb8c13ba26b97e245a16cc3625f2b5f85ae49af7126979cd0175700bf7a7a9151b1226f1

Download Submit
memory/3584-39-0x0000000003080000-0x000000000309C000-memory.dmp

Filesize
112KB

Download
memory/3584-52-0x0000000003250000-0x0000000003262000-memory.dmp

Filesize
72KB

Download
memory/3584-56-0x000000001BAD0000-0x000000001BAE6000-memory.dmp

Filesize
88KB

Download
memory/3584-58-0x000000001BAF0000-0x000000001BB02000-memory.dmp

Filesize
72KB

Download
memory/3584-59-0x000000001C5A0000-0x000000001CAC6000-memory.dmp

Filesize
5.1MB

Download
memory/3584-61-0x0000000003240000-0x000000000324E000-memory.dmp

Filesize
56KB

Download
memory/3584-63-0x000000001BA90000-0x000000001BAA0000-memory.dmp

Filesize
64KB

Download
memory/3584-65-0x000000001BAB0000-0x000000001BAC0000-memory.dmp

Filesize
64KB

Download
memory/3584-67-0x000000001C0D0000-0x000000001C12A000-memory.dmp

Filesize
360KB

Download
memory/3584-69-0x000000001BAC0000-0x000000001BACE000-memory.dmp

Filesize
56KB

Download
memory/3584-71-0x000000001BB10000-0x000000001BB20000-memory.dmp

Filesize
64KB

Download
memory/3584-73-0x000000001BB20000-0x000000001BB2E000-memory.dmp

Filesize
56KB

Download
memory/3584-75-0x000000001C070000-0x000000001C088000-memory.dmp

Filesize
96KB

Download
memory/3584-77-0x000000001BB30000-0x000000001BB3C000-memory.dmp

Filesize
48KB

Download
memory/3584-79-0x000000001C180000-0x000000001C1CE000-memory.dmp

Filesize
312KB

Download
memory/3584-54-0x0000000003230000-0x0000000003240000-memory.dmp

Filesize
64KB

Download
memory/3584-50-0x0000000003200000-0x000000000320E000-memory.dmp

Filesize
56KB

Download
memory/3584-48-0x00000000031F0000-0x0000000003200000-memory.dmp

Filesize
64KB

Download
memory/3584-46-0x0000000003070000-0x0000000003080000-memory.dmp

Filesize
64KB

Download
memory/3584-44-0x0000000003210000-0x0000000003228000-memory.dmp

Filesize
96KB

Download
memory/3584-42-0x0000000003060000-0x0000000003070000-memory.dmp

Filesize
64KB

Download
memory/3584-40-0x000000001BA40000-0x000000001BA90000-memory.dmp

Filesize
320KB

Download
memory/3584-37-0x0000000001720000-0x000000000172E000-memory.dmp

Filesize
56KB

Download
memory/3584-34-0x00000000031C0000-0x00000000031E6000-memory.dmp

Filesize
152KB

Download
memory/3584-32-0x0000000000AE0000-0x0000000000E6E000-memory.dmp

Filesize
3.6MB

Download
memory/5092-27-0x0000000005060000-0x000000000506A000-memory.dmp

Filesize
40KB

Download
memory/5092-26-0x00000000050B0000-0x0000000005142000-memory.dmp

Filesize
584KB

Download
memory/5092-24-0x00000000055B0000-0x0000000005AAE000-memory.dmp

Filesize
5.0MB

Download
memory/5092-16-0x00000000007F0000-0x00000000007FA000-memory.dmp

Filesize
40KB

Download