dcrat | 8a954daf417d6a178993a0f95e4834141abba3388c89730e6bfc52320550eac0

Analysis

max time kernel
120s
max time network
127s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
30/11/2024, 21:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8a954daf417d6a178993a0f95e4834141abba3388c89730e6bfc52320550eac0.exe
Size

2.1MB
MD5

2b20c837defe07c2daa39b9e7bad0792
SHA1

7a45498ccc92032286e3ca634e18cae747b03ec4
SHA256

8a954daf417d6a178993a0f95e4834141abba3388c89730e6bfc52320550eac0
SHA512

fcc3f32a534407cf81cb7cd5b4b866beec880a9d28076176118146afa212ad58fa593c231e33bbec860da1960b053ce1c496b2a2ab9068edb91477097d139e37
SSDEEP

24576:U2G/nvxW3Ww0tIj2AR3l2oxrLCQicJ1UqS6TvB7WjRRvvkjjFExbw9xs2d5X:UbA302JRnYwpjVS0mtUX

Score

10^/10

dcrat discovery execution infostealer rat

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat
Dcrat family
dcrat

Process spawned unexpected child process 51 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2668	2044	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2684	2044	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2788	2044	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2172	2044	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1624	2044	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1944	2044	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1468	2044	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2512	2044	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3048	2044	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3052	2044	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2844	2044	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2928	2044	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2144	2044	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2872	2044	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2952	2044	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1152	2044	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1148	2044	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2356	2044	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2188	2044	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	320	2044	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1660	2044	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2380	2044	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	272	2044	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	468	2044	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1788	2044	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	448	2044	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2412	2044	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1328	2044	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1360	2044	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	640	2044	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2304	2044	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1528	2044	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1048	2044	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1700	2044	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1608	2044	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1948	2044	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1980	2044	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2092	2044	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	576	2044	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	756	2044	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2088	2044	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2340	2044	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	868	2044	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2116	2044	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1544	2044	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1232	2044	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2436	2044	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2192	2044	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2232	2044	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2808	2044	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2248	2044	schtasks.exe	35

DCRat payload 3 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral1/files/0x0007000000016d0e-14.dat	dcrat
behavioral1/memory/2948-18-0x0000000000290000-0x000000000046E000-memory.dmp	dcrat
behavioral1/memory/1220-134-0x0000000000D20000-0x0000000000EFE000-memory.dmp	dcrat

Command and Scripting Interpreter: PowerShell 1 TTPs 13 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
1284	powershell.exe
2032	powershell.exe
2716	powershell.exe
2664	powershell.exe
2828	powershell.exe
2996	powershell.exe
2264	powershell.exe
2308	powershell.exe
2924	powershell.exe
2200	powershell.exe
2316	powershell.exe
2772	powershell.exe
2792	powershell.exe

Executes dropped EXE 2 IoCs

pid	Process
2948	crtNetsvc.exe
1220	services.exe

Loads dropped DLL 2 IoCs

pid	Process
2816	cmd.exe
2816	cmd.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\ja\explorer.exe	crtNetsvc.exe
File created	C:\Windows\SysWOW64\ja\7a0fd90576e088	crtNetsvc.exe

Drops file in Program Files directory 16 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Common Files\System\Ole DB\crtNetsvc.exe	crtNetsvc.exe
File created	C:\Program Files\VideoLAN\088424020bedd6	crtNetsvc.exe
File created	C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\Desktop\c5b4cb5e9653cc	crtNetsvc.exe
File opened for modification	C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\Desktop\c5b4cb5e9653cc	crtNetsvc.exe
File created	C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\it\27d1bcfc3c54e0	crtNetsvc.exe
File created	C:\Program Files (x86)\Mozilla Maintenance Service\logs\csrss.exe	crtNetsvc.exe
File created	C:\Program Files (x86)\Mozilla Maintenance Service\logs\886983d96e3d3e	crtNetsvc.exe
File opened for modification	C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\Desktop\services.exe	crtNetsvc.exe
File created	C:\Program Files\7-Zip\Lang\explorer.exe	crtNetsvc.exe
File created	C:\Program Files\7-Zip\Lang\7a0fd90576e088	crtNetsvc.exe
File created	C:\Program Files\VideoLAN\conhost.exe	crtNetsvc.exe
File created	C:\Program Files (x86)\Google\CrashReports\6ccacd8608530f	crtNetsvc.exe
File created	C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\Desktop\services.exe	crtNetsvc.exe
File created	C:\Program Files (x86)\Common Files\System\Ole DB\50b9313dee8dc0	crtNetsvc.exe
File created	C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\it\System.exe	crtNetsvc.exe
File created	C:\Program Files (x86)\Google\CrashReports\Idle.exe	crtNetsvc.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File created	C:\Windows\diagnostics\system\HomeGroup\en-US\spoolsv.exe	crtNetsvc.exe
File created	C:\Windows\Migration\WTR\dllhost.exe	crtNetsvc.exe
File created	C:\Windows\Migration\WTR\5940a34987c991	crtNetsvc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	8a954daf417d6a178993a0f95e4834141abba3388c89730e6bfc52320550eac0.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 51 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2684	schtasks.exe
2144	schtasks.exe
2952	schtasks.exe
2188	schtasks.exe
640	schtasks.exe
1980	schtasks.exe
756	schtasks.exe
2668	schtasks.exe
1232	schtasks.exe
3052	schtasks.exe
1660	schtasks.exe
1700	schtasks.exe
1544	schtasks.exe
2788	schtasks.exe
272	schtasks.exe
576	schtasks.exe
868	schtasks.exe
2192	schtasks.exe
2356	schtasks.exe
320	schtasks.exe
2304	schtasks.exe
1528	schtasks.exe
1048	schtasks.exe
2232	schtasks.exe
2808	schtasks.exe
2172	schtasks.exe
2928	schtasks.exe
1328	schtasks.exe
1360	schtasks.exe
1948	schtasks.exe
1468	schtasks.exe
3048	schtasks.exe
2844	schtasks.exe
2872	schtasks.exe
1148	schtasks.exe
448	schtasks.exe
2412	schtasks.exe
2088	schtasks.exe
2512	schtasks.exe
2436	schtasks.exe
2340	schtasks.exe
2380	schtasks.exe
1788	schtasks.exe
1608	schtasks.exe
2248	schtasks.exe
1624	schtasks.exe
1152	schtasks.exe
468	schtasks.exe
2092	schtasks.exe
2116	schtasks.exe
1944	schtasks.exe

Suspicious behavior: EnumeratesProcesses 19 IoCs

pid	Process
2948	crtNetsvc.exe
2948	crtNetsvc.exe
2948	crtNetsvc.exe
2948	crtNetsvc.exe
2948	crtNetsvc.exe
2264	powershell.exe
2200	powershell.exe
2308	powershell.exe
2792	powershell.exe
2316	powershell.exe
2828	powershell.exe
2032	powershell.exe
2716	powershell.exe
2772	powershell.exe
2996	powershell.exe
2924	powershell.exe
1284	powershell.exe
2664	powershell.exe
1220	services.exe

Suspicious use of AdjustPrivilegeToken 15 IoCs

description	pid	Process
Token: SeDebugPrivilege	2948	crtNetsvc.exe
Token: SeDebugPrivilege	2264	powershell.exe
Token: SeDebugPrivilege	2200	powershell.exe
Token: SeDebugPrivilege	2308	powershell.exe
Token: SeDebugPrivilege	2792	powershell.exe
Token: SeDebugPrivilege	2316	powershell.exe
Token: SeDebugPrivilege	2828	powershell.exe
Token: SeDebugPrivilege	2032	powershell.exe
Token: SeDebugPrivilege	2716	powershell.exe
Token: SeDebugPrivilege	2772	powershell.exe
Token: SeDebugPrivilege	2996	powershell.exe
Token: SeDebugPrivilege	2924	powershell.exe
Token: SeDebugPrivilege	1284	powershell.exe
Token: SeDebugPrivilege	2664	powershell.exe
Token: SeDebugPrivilege	1220	services.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2520 wrote to memory of 2164	2520	8a954daf417d6a178993a0f95e4834141abba3388c89730e6bfc52320550eac0.exe	30
PID 2520 wrote to memory of 2164	2520	8a954daf417d6a178993a0f95e4834141abba3388c89730e6bfc52320550eac0.exe	30
PID 2520 wrote to memory of 2164	2520	8a954daf417d6a178993a0f95e4834141abba3388c89730e6bfc52320550eac0.exe	30
PID 2520 wrote to memory of 2164	2520	8a954daf417d6a178993a0f95e4834141abba3388c89730e6bfc52320550eac0.exe	30
PID 2520 wrote to memory of 2176	2520	8a954daf417d6a178993a0f95e4834141abba3388c89730e6bfc52320550eac0.exe	31
PID 2520 wrote to memory of 2176	2520	8a954daf417d6a178993a0f95e4834141abba3388c89730e6bfc52320550eac0.exe	31
PID 2520 wrote to memory of 2176	2520	8a954daf417d6a178993a0f95e4834141abba3388c89730e6bfc52320550eac0.exe	31
PID 2520 wrote to memory of 2176	2520	8a954daf417d6a178993a0f95e4834141abba3388c89730e6bfc52320550eac0.exe	31
PID 2164 wrote to memory of 2816	2164	WScript.exe	32
PID 2164 wrote to memory of 2816	2164	WScript.exe	32
PID 2164 wrote to memory of 2816	2164	WScript.exe	32
PID 2164 wrote to memory of 2816	2164	WScript.exe	32
PID 2816 wrote to memory of 2948	2816	cmd.exe	34
PID 2816 wrote to memory of 2948	2816	cmd.exe	34
PID 2816 wrote to memory of 2948	2816	cmd.exe	34
PID 2816 wrote to memory of 2948	2816	cmd.exe	34
PID 2948 wrote to memory of 2308	2948	crtNetsvc.exe	87
PID 2948 wrote to memory of 2308	2948	crtNetsvc.exe	87
PID 2948 wrote to memory of 2308	2948	crtNetsvc.exe	87
PID 2948 wrote to memory of 2772	2948	crtNetsvc.exe	88
PID 2948 wrote to memory of 2772	2948	crtNetsvc.exe	88
PID 2948 wrote to memory of 2772	2948	crtNetsvc.exe	88
PID 2948 wrote to memory of 2264	2948	crtNetsvc.exe	90
PID 2948 wrote to memory of 2264	2948	crtNetsvc.exe	90
PID 2948 wrote to memory of 2264	2948	crtNetsvc.exe	90
PID 2948 wrote to memory of 2316	2948	crtNetsvc.exe	91
PID 2948 wrote to memory of 2316	2948	crtNetsvc.exe	91
PID 2948 wrote to memory of 2316	2948	crtNetsvc.exe	91
PID 2948 wrote to memory of 2996	2948	crtNetsvc.exe	92
PID 2948 wrote to memory of 2996	2948	crtNetsvc.exe	92
PID 2948 wrote to memory of 2996	2948	crtNetsvc.exe	92
PID 2948 wrote to memory of 2792	2948	crtNetsvc.exe	93
PID 2948 wrote to memory of 2792	2948	crtNetsvc.exe	93
PID 2948 wrote to memory of 2792	2948	crtNetsvc.exe	93
PID 2948 wrote to memory of 2828	2948	crtNetsvc.exe	94
PID 2948 wrote to memory of 2828	2948	crtNetsvc.exe	94
PID 2948 wrote to memory of 2828	2948	crtNetsvc.exe	94
PID 2948 wrote to memory of 2200	2948	crtNetsvc.exe	96
PID 2948 wrote to memory of 2200	2948	crtNetsvc.exe	96
PID 2948 wrote to memory of 2200	2948	crtNetsvc.exe	96
PID 2948 wrote to memory of 2664	2948	crtNetsvc.exe	98
PID 2948 wrote to memory of 2664	2948	crtNetsvc.exe	98
PID 2948 wrote to memory of 2664	2948	crtNetsvc.exe	98
PID 2948 wrote to memory of 2716	2948	crtNetsvc.exe	99
PID 2948 wrote to memory of 2716	2948	crtNetsvc.exe	99
PID 2948 wrote to memory of 2716	2948	crtNetsvc.exe	99
PID 2948 wrote to memory of 2032	2948	crtNetsvc.exe	101
PID 2948 wrote to memory of 2032	2948	crtNetsvc.exe	101
PID 2948 wrote to memory of 2032	2948	crtNetsvc.exe	101
PID 2948 wrote to memory of 2924	2948	crtNetsvc.exe	103
PID 2948 wrote to memory of 2924	2948	crtNetsvc.exe	103
PID 2948 wrote to memory of 2924	2948	crtNetsvc.exe	103
PID 2948 wrote to memory of 1284	2948	crtNetsvc.exe	104
PID 2948 wrote to memory of 1284	2948	crtNetsvc.exe	104
PID 2948 wrote to memory of 1284	2948	crtNetsvc.exe	104
PID 2948 wrote to memory of 748	2948	crtNetsvc.exe	113
PID 2948 wrote to memory of 748	2948	crtNetsvc.exe	113
PID 2948 wrote to memory of 748	2948	crtNetsvc.exe	113
PID 748 wrote to memory of 1672	748	cmd.exe	116
PID 748 wrote to memory of 1672	748	cmd.exe	116
PID 748 wrote to memory of 1672	748	cmd.exe	116
PID 748 wrote to memory of 1220	748	cmd.exe	117
PID 748 wrote to memory of 1220	748	cmd.exe	117
PID 748 wrote to memory of 1220	748	cmd.exe	117

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\8a954daf417d6a178993a0f95e4834141abba3388c89730e6bfc52320550eac0.exe
"C:\Users\Admin\AppData\Local\Temp\8a954daf417d6a178993a0f95e4834141abba3388c89730e6bfc52320550eac0.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2520
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\blockbrokerSvc\aF5Mcv0tMPIHTbR5M7SkO8kNkyv8iN.vbe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2164
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c ""C:\blockbrokerSvc\TGZpXeFRkkNVmIaQ.bat" "
    3⤵
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2816
  - - C:\blockbrokerSvc\crtNetsvc.exe
      "C:\blockbrokerSvc\crtNetsvc.exe"
      4⤵
      Executes dropped EXE
      Drops file in System32 directory
      Drops file in Program Files directory
      Drops file in Windows directory
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:2948
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:/'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2308
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:/$Recycle.Bin/'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2772
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:/blockbrokerSvc/'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2264
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Documents and Settings/'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2316
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:/MSOCache/'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2996
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:/PerfLogs/'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2792
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files/'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2828
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files (x86)/'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2200
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:/ProgramData/'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2664
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Recovery/'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2716
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:/System Volume Information/'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2032
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Users/'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2924
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Windows/'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1284
    - - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\4xeXPpAM80.bat"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:748
      - C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        6⤵
        
        PID:1672
      - C:\blockbrokerSvc\services.exe
        
        "C:\blockbrokerSvc\services.exe"
        6⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1220
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\blockbrokerSvc\file.vbs"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2176

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "crtNetsvcc" /sc MINUTE /mo 10 /tr "'C:\MSOCache\All Users\{90140000-0019-0409-0000-0000000FF1CE}-C\crtNetsvc.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2668

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "crtNetsvc" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-0019-0409-0000-0000000FF1CE}-C\crtNetsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2684

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "crtNetsvcc" /sc MINUTE /mo 10 /tr "'C:\MSOCache\All Users\{90140000-0019-0409-0000-0000000FF1CE}-C\crtNetsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2788

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "crtNetsvcc" /sc MINUTE /mo 10 /tr "'C:\Program Files (x86)\Common Files\System\Ole DB\crtNetsvc.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2172

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "crtNetsvc" /sc ONLOGON /tr "'C:\Program Files (x86)\Common Files\System\Ole DB\crtNetsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1624

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "crtNetsvcc" /sc MINUTE /mo 12 /tr "'C:\Program Files (x86)\Common Files\System\Ole DB\crtNetsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1944

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 14 /tr "'C:\Program Files\7-Zip\Lang\explorer.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1468

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorer" /sc ONLOGON /tr "'C:\Program Files\7-Zip\Lang\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2512

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 6 /tr "'C:\Program Files\7-Zip\Lang\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3048

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 11 /tr "'C:\blockbrokerSvc\WmiPrvSE.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3052

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSE" /sc ONLOGON /tr "'C:\blockbrokerSvc\WmiPrvSE.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2844

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 10 /tr "'C:\blockbrokerSvc\WmiPrvSE.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2928

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 8 /tr "'C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\it\System.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2144

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "System" /sc ONLOGON /tr "'C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\it\System.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2872

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 11 /tr "'C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\it\System.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2952

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 6 /tr "'C:\blockbrokerSvc\dwm.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1152

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwm" /sc ONLOGON /tr "'C:\blockbrokerSvc\dwm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1148

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 13 /tr "'C:\blockbrokerSvc\dwm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2356

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 14 /tr "'C:\blockbrokerSvc\services.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2188

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "services" /sc ONLOGON /tr "'C:\blockbrokerSvc\services.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:320

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 14 /tr "'C:\blockbrokerSvc\services.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1660

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 11 /tr "'C:\Program Files (x86)\Mozilla Maintenance Service\logs\csrss.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2380

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Program Files (x86)\Mozilla Maintenance Service\logs\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:272

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 10 /tr "'C:\Program Files (x86)\Mozilla Maintenance Service\logs\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:468

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 12 /tr "'C:\Users\Default\dwm.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1788

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwm" /sc ONLOGON /tr "'C:\Users\Default\dwm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:448

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 12 /tr "'C:\Users\Default\dwm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2412

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 13 /tr "'C:\Windows\SysWOW64\ja\explorer.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1328

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorer" /sc ONLOGON /tr "'C:\Windows\SysWOW64\ja\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1360

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 10 /tr "'C:\Windows\SysWOW64\ja\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:640

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 7 /tr "'C:\Program Files\VideoLAN\conhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2304

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhost" /sc ONLOGON /tr "'C:\Program Files\VideoLAN\conhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1528

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 10 /tr "'C:\Program Files\VideoLAN\conhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1048

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 14 /tr "'C:\Program Files (x86)\Google\CrashReports\Idle.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1700

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Idle" /sc ONLOGON /tr "'C:\Program Files (x86)\Google\CrashReports\Idle.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1608

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 10 /tr "'C:\Program Files (x86)\Google\CrashReports\Idle.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1948

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 13 /tr "'C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\Desktop\services.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1980

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "services" /sc ONLOGON /tr "'C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\Desktop\services.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2092

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 7 /tr "'C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\Desktop\services.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:576

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "audiodga" /sc MINUTE /mo 12 /tr "'C:\MSOCache\All Users\{90140000-0116-0409-1000-0000000FF1CE}-C\audiodg.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:756

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "audiodg" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-0116-0409-1000-0000000FF1CE}-C\audiodg.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2088

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "audiodga" /sc MINUTE /mo 7 /tr "'C:\MSOCache\All Users\{90140000-0116-0409-1000-0000000FF1CE}-C\audiodg.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2340

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 14 /tr "'C:\Windows\Migration\WTR\dllhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:868

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Windows\Migration\WTR\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2116

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 6 /tr "'C:\Windows\Migration\WTR\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1544

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 14 /tr "'C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\Desktop\services.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1232

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "services" /sc ONLOGON /tr "'C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\Desktop\services.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2436

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 10 /tr "'C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\Desktop\services.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2192

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 13 /tr "'C:\Users\Public\Pictures\Sample Pictures\services.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2232

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "services" /sc ONLOGON /tr "'C:\Users\Public\Pictures\Sample Pictures\services.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2808

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 14 /tr "'C:\Users\Public\Pictures\Sample Pictures\services.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2248

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\4xeXPpAM80.bat

Filesize
195B

MD5
eeadd5b0d208cc9b2a1effdf21e6ae48

SHA1
92bd04cea7b11487aaf5e9a24f52694089819fb9

SHA256
944b9e208884b8d514de92691468cdab70382423c6bab717458cd29c878300ac

SHA512
948516e7d527935ef4ace3444bbf85388f1acef7986996452a3bb2466e3fe7e32d51a75c2cd82da6cd5188228deb383def5d24ba8642e7677ab2480ed3b1c74c

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
7KB

MD5
e6a1f8f338e1955767945d170422b00a

SHA1
9343a292cfeedc744a540cf91d5e7794d2245bed

SHA256
bfbba079a94f7cc9636c9f0564eb2a090fb5e9e07fc4668a172cd2c1fb29c960

SHA512
133a1e0299f641c595767bb2d3b73c299e54db0a6345069223186aed5954589a9fb2b2e4e5d9a1a23de7f417710ea7eef236a92581817530b339516debff3a0b

Download Submit
C:\blockbrokerSvc\TGZpXeFRkkNVmIaQ.bat

Filesize
33B

MD5
b47918c8444fec1ba5a991bf189d5ad4

SHA1
79dfc132a44830fa6e157ea080d7cce5c8c16f4e

SHA256
eb4f02ded5f820353413c2154557a7baa1ebf1e98a7730f42fa6ca24183edac6

SHA512
dff2853f2532dad5001bab574c8960b7a3fc683e013c07033f95c6de265eb67aa3a3cbaa4135f1d13fedeee36723fc384c0b61d47c0912163df862ef29846274

Download Submit
C:\blockbrokerSvc\aF5Mcv0tMPIHTbR5M7SkO8kNkyv8iN.vbe

Filesize
207B

MD5
2d8bbf2dc853488b7edf32c271268a37

SHA1
9075e285b95c57f3f123a23d7cd4161b7fe5e409

SHA256
766969fa141897d7a92931a8e8c4fab4151b54fe419f0b7cbd09b49ea861d9ec

SHA512
201353b80c986b91cecc74db5503ee03d82e8960837f2ed1efac392d07c0641f6e52ce4949c2661724b42bdadbb6a82e09c8d980a60051e6cd849208c1cb5b44

Download Submit
C:\blockbrokerSvc\file.vbs

Filesize
34B

MD5
677cc4360477c72cb0ce00406a949c61

SHA1
b679e8c3427f6c5fc47c8ac46cd0e56c9424de05

SHA256
f1cccb5ae4aa51d293bd3c7d2a1a04cb7847d22c5db8e05ac64e9a6d7455aa0b

SHA512
7cfe2cc92f9e659f0a15a295624d611b3363bd01eb5bcf9bc7681ea9b70b0564d192d570d294657c8dc2c93497fa3b4526c975a9bf35d69617c31d9936573c6a

Download Submit
\blockbrokerSvc\crtNetsvc.exe

Filesize
1.8MB

MD5
a1f7dc028623603fc6679da86c395a50

SHA1
cbdbe7473a73038476616db88de8a97980058c98

SHA256
f33cb818506699190556413520aea94529eceeb0129e2337b13311bbba3aea00

SHA512
ef799ba64fa023301ebfc323ae95694b90d239877c98f0dc3d625c2ace5c759b53df7729f8a8c1bdf25f7784a3221cea9a5518ecb4873a641682b3c8bca8c29f

Download Submit
memory/1220-135-0x00000000001D0000-0x00000000001E2000-memory.dmp

Filesize
72KB

Download
memory/1220-134-0x0000000000D20000-0x0000000000EFE000-memory.dmp

Filesize
1.9MB

Download
memory/2264-70-0x000000001B5A0000-0x000000001B882000-memory.dmp

Filesize
2.9MB

Download
memory/2264-75-0x00000000022A0000-0x00000000022A8000-memory.dmp

Filesize
32KB

Download
memory/2948-22-0x0000000000550000-0x0000000000562000-memory.dmp

Filesize
72KB

Download
memory/2948-25-0x00000000008A0000-0x00000000008A8000-memory.dmp

Filesize
32KB

Download
memory/2948-26-0x00000000008B0000-0x00000000008BC000-memory.dmp

Filesize
48KB

Download
memory/2948-24-0x0000000000780000-0x0000000000788000-memory.dmp

Filesize
32KB

Download
memory/2948-23-0x0000000000770000-0x000000000077E000-memory.dmp

Filesize
56KB

Download
memory/2948-21-0x0000000002390000-0x00000000023E6000-memory.dmp

Filesize
344KB

Download
memory/2948-20-0x0000000000270000-0x0000000000286000-memory.dmp

Filesize
88KB

Download
memory/2948-19-0x0000000000250000-0x000000000026C000-memory.dmp

Filesize
112KB

Download
memory/2948-18-0x0000000000290000-0x000000000046E000-memory.dmp

Filesize
1.9MB

Download