dcrat | 9dd421db26445019a9fb120bb04a2ddc8ee339692af14749688d007afbeee5a1

Analysis

max time kernel
146s
max time network
147s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
05-12-2024 11:13

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

9dd421db26445019a9fb120bb04a2ddc8ee339692af14749688d007afbeee5a1.exe
Size

1.5MB
MD5

04c9152dc94eab52c92ddf3133f3ac7b
SHA1

59be48b0636b28831dc5436e0fb75c27d3384cd6
SHA256

9dd421db26445019a9fb120bb04a2ddc8ee339692af14749688d007afbeee5a1
SHA512

6a8c302eb67a44a32dcc2461b64ab3193b65b8570d5f0b998b8924899943a9227fe45b71d5dc16f50674f9cff94cb477159d95670340f12f7eca8c71be8e3560
SSDEEP

24576:0NNUtQhWhtqDfDXQdy+N+gfQqRsgFlDRluQ70eJiVbWpRo:EzhWhCXQFN+0IEuQgyiVKw

Score

10^/10

dcrat evasion execution infostealer persistence rat trojan

Malware Config

Signatures

DcRat 7 IoCs

DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

rat infostealer dcrat

description	ioc	pid	Process
		2640	schtasks.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA		9dd421db26445019a9fb120bb04a2ddc8ee339692af14749688d007afbeee5a1.exe
File created	C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPWMI\1610b97d3ab4a7		9dd421db26445019a9fb120bb04a2ddc8ee339692af14749688d007afbeee5a1.exe
		2884	schtasks.exe
		2716	schtasks.exe
		2752	schtasks.exe
		2728	schtasks.exe

Dcrat family
dcrat

Modifies WinLogon for persistence 2 TTPs 5 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPWMI\\OSPPSVC.exe\", \"C:\\ProgramData\\Start Menu\\9dd421db26445019a9fb120bb04a2ddc8ee339692af14749688d007afbeee5a1.exe\", \"C:\\Windows\\System32\\msctf\\lsm.exe\", \"C:\\ProgramData\\Desktop\\lsm.exe\""	9dd421db26445019a9fb120bb04a2ddc8ee339692af14749688d007afbeee5a1.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPWMI\\OSPPSVC.exe\", \"C:\\ProgramData\\Start Menu\\9dd421db26445019a9fb120bb04a2ddc8ee339692af14749688d007afbeee5a1.exe\", \"C:\\Windows\\System32\\msctf\\lsm.exe\", \"C:\\ProgramData\\Desktop\\lsm.exe\", \"C:\\Program Files\\7-Zip\\Lang\\spoolsv.exe\""	9dd421db26445019a9fb120bb04a2ddc8ee339692af14749688d007afbeee5a1.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPWMI\\OSPPSVC.exe\""	9dd421db26445019a9fb120bb04a2ddc8ee339692af14749688d007afbeee5a1.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPWMI\\OSPPSVC.exe\", \"C:\\ProgramData\\Start Menu\\9dd421db26445019a9fb120bb04a2ddc8ee339692af14749688d007afbeee5a1.exe\""	9dd421db26445019a9fb120bb04a2ddc8ee339692af14749688d007afbeee5a1.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPWMI\\OSPPSVC.exe\", \"C:\\ProgramData\\Start Menu\\9dd421db26445019a9fb120bb04a2ddc8ee339692af14749688d007afbeee5a1.exe\", \"C:\\Windows\\System32\\msctf\\lsm.exe\""	9dd421db26445019a9fb120bb04a2ddc8ee339692af14749688d007afbeee5a1.exe

Process spawned unexpected child process 5 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2884	2748	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2716	2748	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2752	2748	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2728	2748	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2640	2748	schtasks.exe	30

UAC bypass 3 TTPs 42 IoCs

evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	lsm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	lsm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	9dd421db26445019a9fb120bb04a2ddc8ee339692af14749688d007afbeee5a1.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	lsm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	lsm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	lsm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	lsm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	lsm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	lsm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	lsm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	lsm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	lsm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	lsm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	lsm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	lsm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	lsm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	lsm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	lsm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	lsm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	lsm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	lsm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	9dd421db26445019a9fb120bb04a2ddc8ee339692af14749688d007afbeee5a1.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	lsm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	lsm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	lsm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	lsm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	lsm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	lsm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	lsm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	9dd421db26445019a9fb120bb04a2ddc8ee339692af14749688d007afbeee5a1.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	lsm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	lsm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	lsm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	lsm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	lsm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	lsm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	lsm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	lsm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	lsm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	lsm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	lsm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	lsm.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 6 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
2516	powershell.exe
2792	powershell.exe
836	powershell.exe
1876	powershell.exe
2504	powershell.exe
1164	powershell.exe

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\drivers\etc\hosts	9dd421db26445019a9fb120bb04a2ddc8ee339692af14749688d007afbeee5a1.exe

Executes dropped EXE 13 IoCs

pid	Process
2492	lsm.exe
1656	lsm.exe
2576	lsm.exe
488	lsm.exe
2024	lsm.exe
2060	lsm.exe
2816	lsm.exe
1764	lsm.exe
1188	lsm.exe
1904	lsm.exe
680	lsm.exe
2708	lsm.exe
1764	lsm.exe

Adds Run key to start application 2 TTPs 10 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\9dd421db26445019a9fb120bb04a2ddc8ee339692af14749688d007afbeee5a1 = "\"C:\\ProgramData\\Start Menu\\9dd421db26445019a9fb120bb04a2ddc8ee339692af14749688d007afbeee5a1.exe\""	9dd421db26445019a9fb120bb04a2ddc8ee339692af14749688d007afbeee5a1.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Windows\CurrentVersion\Run\lsm = "\"C:\\ProgramData\\Desktop\\lsm.exe\""	9dd421db26445019a9fb120bb04a2ddc8ee339692af14749688d007afbeee5a1.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Windows\CurrentVersion\Run\spoolsv = "\"C:\\Program Files\\7-Zip\\Lang\\spoolsv.exe\""	9dd421db26445019a9fb120bb04a2ddc8ee339692af14749688d007afbeee5a1.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\spoolsv = "\"C:\\Program Files\\7-Zip\\Lang\\spoolsv.exe\""	9dd421db26445019a9fb120bb04a2ddc8ee339692af14749688d007afbeee5a1.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Windows\CurrentVersion\Run\OSPPSVC = "\"C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPWMI\\OSPPSVC.exe\""	9dd421db26445019a9fb120bb04a2ddc8ee339692af14749688d007afbeee5a1.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Windows\CurrentVersion\Run\9dd421db26445019a9fb120bb04a2ddc8ee339692af14749688d007afbeee5a1 = "\"C:\\ProgramData\\Start Menu\\9dd421db26445019a9fb120bb04a2ddc8ee339692af14749688d007afbeee5a1.exe\""	9dd421db26445019a9fb120bb04a2ddc8ee339692af14749688d007afbeee5a1.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Windows\CurrentVersion\Run\lsm = "\"C:\\Windows\\System32\\msctf\\lsm.exe\""	9dd421db26445019a9fb120bb04a2ddc8ee339692af14749688d007afbeee5a1.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\lsm = "\"C:\\Windows\\System32\\msctf\\lsm.exe\""	9dd421db26445019a9fb120bb04a2ddc8ee339692af14749688d007afbeee5a1.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\lsm = "\"C:\\ProgramData\\Desktop\\lsm.exe\""	9dd421db26445019a9fb120bb04a2ddc8ee339692af14749688d007afbeee5a1.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OSPPSVC = "\"C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPWMI\\OSPPSVC.exe\""	9dd421db26445019a9fb120bb04a2ddc8ee339692af14749688d007afbeee5a1.exe

Checks whether UAC is enabled 1 TTPs 28 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	lsm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	lsm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	lsm.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	lsm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	lsm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	9dd421db26445019a9fb120bb04a2ddc8ee339692af14749688d007afbeee5a1.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	lsm.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	lsm.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	lsm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	lsm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	lsm.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	lsm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	lsm.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	lsm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	lsm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	lsm.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	lsm.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	9dd421db26445019a9fb120bb04a2ddc8ee339692af14749688d007afbeee5a1.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	lsm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	lsm.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	lsm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	lsm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	lsm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	lsm.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	lsm.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	lsm.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	lsm.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	lsm.exe

Drops file in System32 directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\msctf\RCXC008.tmp	9dd421db26445019a9fb120bb04a2ddc8ee339692af14749688d007afbeee5a1.exe
File opened for modification	C:\Windows\System32\msctf\lsm.exe	9dd421db26445019a9fb120bb04a2ddc8ee339692af14749688d007afbeee5a1.exe
File created	C:\Windows\System32\msctf\lsm.exe	9dd421db26445019a9fb120bb04a2ddc8ee339692af14749688d007afbeee5a1.exe
File created	C:\Windows\System32\msctf\101b941d020240	9dd421db26445019a9fb120bb04a2ddc8ee339692af14749688d007afbeee5a1.exe

Drops file in Program Files directory 8 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPWMI\RCXBB06.tmp	9dd421db26445019a9fb120bb04a2ddc8ee339692af14749688d007afbeee5a1.exe
File opened for modification	C:\Program Files\7-Zip\Lang\RCXC40F.tmp	9dd421db26445019a9fb120bb04a2ddc8ee339692af14749688d007afbeee5a1.exe
File opened for modification	C:\Program Files\7-Zip\Lang\spoolsv.exe	9dd421db26445019a9fb120bb04a2ddc8ee339692af14749688d007afbeee5a1.exe
File created	C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPWMI\OSPPSVC.exe	9dd421db26445019a9fb120bb04a2ddc8ee339692af14749688d007afbeee5a1.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPWMI\OSPPSVC.exe	9dd421db26445019a9fb120bb04a2ddc8ee339692af14749688d007afbeee5a1.exe
File created	C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPWMI\1610b97d3ab4a7	9dd421db26445019a9fb120bb04a2ddc8ee339692af14749688d007afbeee5a1.exe
File created	C:\Program Files\7-Zip\Lang\spoolsv.exe	9dd421db26445019a9fb120bb04a2ddc8ee339692af14749688d007afbeee5a1.exe
File created	C:\Program Files\7-Zip\Lang\f3b6ecef712a24	9dd421db26445019a9fb120bb04a2ddc8ee339692af14749688d007afbeee5a1.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Scheduled Task/Job: Scheduled Task 1 TTPs 5 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2716	schtasks.exe
2752	schtasks.exe
2728	schtasks.exe
2640	schtasks.exe
2884	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2584	9dd421db26445019a9fb120bb04a2ddc8ee339692af14749688d007afbeee5a1.exe
2584	9dd421db26445019a9fb120bb04a2ddc8ee339692af14749688d007afbeee5a1.exe
2584	9dd421db26445019a9fb120bb04a2ddc8ee339692af14749688d007afbeee5a1.exe
2584	9dd421db26445019a9fb120bb04a2ddc8ee339692af14749688d007afbeee5a1.exe
2584	9dd421db26445019a9fb120bb04a2ddc8ee339692af14749688d007afbeee5a1.exe
2584	9dd421db26445019a9fb120bb04a2ddc8ee339692af14749688d007afbeee5a1.exe
2584	9dd421db26445019a9fb120bb04a2ddc8ee339692af14749688d007afbeee5a1.exe
2584	9dd421db26445019a9fb120bb04a2ddc8ee339692af14749688d007afbeee5a1.exe
2584	9dd421db26445019a9fb120bb04a2ddc8ee339692af14749688d007afbeee5a1.exe
2584	9dd421db26445019a9fb120bb04a2ddc8ee339692af14749688d007afbeee5a1.exe
2584	9dd421db26445019a9fb120bb04a2ddc8ee339692af14749688d007afbeee5a1.exe
2584	9dd421db26445019a9fb120bb04a2ddc8ee339692af14749688d007afbeee5a1.exe
2584	9dd421db26445019a9fb120bb04a2ddc8ee339692af14749688d007afbeee5a1.exe
2584	9dd421db26445019a9fb120bb04a2ddc8ee339692af14749688d007afbeee5a1.exe
2584	9dd421db26445019a9fb120bb04a2ddc8ee339692af14749688d007afbeee5a1.exe
2584	9dd421db26445019a9fb120bb04a2ddc8ee339692af14749688d007afbeee5a1.exe
2584	9dd421db26445019a9fb120bb04a2ddc8ee339692af14749688d007afbeee5a1.exe
2504	powershell.exe
1876	powershell.exe
2516	powershell.exe
1164	powershell.exe
836	powershell.exe
2792	powershell.exe
2492	lsm.exe
2492	lsm.exe
2492	lsm.exe
2492	lsm.exe
2492	lsm.exe
2492	lsm.exe
2492	lsm.exe
2492	lsm.exe
2492	lsm.exe
2492	lsm.exe
2492	lsm.exe
2492	lsm.exe
2492	lsm.exe
2492	lsm.exe
2492	lsm.exe
2492	lsm.exe
2492	lsm.exe
2492	lsm.exe
2492	lsm.exe
2492	lsm.exe
2492	lsm.exe
2492	lsm.exe
2492	lsm.exe
2492	lsm.exe
2492	lsm.exe
2492	lsm.exe
2492	lsm.exe
2492	lsm.exe
2492	lsm.exe
2492	lsm.exe
2492	lsm.exe
2492	lsm.exe
2492	lsm.exe
2492	lsm.exe
2492	lsm.exe
2492	lsm.exe
2492	lsm.exe
2492	lsm.exe
2492	lsm.exe
2492	lsm.exe
2492	lsm.exe

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeDebugPrivilege	2584	9dd421db26445019a9fb120bb04a2ddc8ee339692af14749688d007afbeee5a1.exe
Token: SeDebugPrivilege	2504	powershell.exe
Token: SeDebugPrivilege	1876	powershell.exe
Token: SeDebugPrivilege	2516	powershell.exe
Token: SeDebugPrivilege	1164	powershell.exe
Token: SeDebugPrivilege	836	powershell.exe
Token: SeDebugPrivilege	2792	powershell.exe
Token: SeDebugPrivilege	2492	lsm.exe
Token: SeDebugPrivilege	1656	lsm.exe
Token: SeDebugPrivilege	2576	lsm.exe
Token: SeDebugPrivilege	488	lsm.exe
Token: SeDebugPrivilege	2024	lsm.exe
Token: SeDebugPrivilege	2060	lsm.exe
Token: SeDebugPrivilege	2816	lsm.exe
Token: SeDebugPrivilege	1764	lsm.exe
Token: SeDebugPrivilege	1188	lsm.exe
Token: SeDebugPrivilege	1904	lsm.exe
Token: SeDebugPrivilege	680	lsm.exe
Token: SeDebugPrivilege	2708	lsm.exe
Token: SeDebugPrivilege	1764	lsm.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2584 wrote to memory of 1876	2584	9dd421db26445019a9fb120bb04a2ddc8ee339692af14749688d007afbeee5a1.exe	37
PID 2584 wrote to memory of 1876	2584	9dd421db26445019a9fb120bb04a2ddc8ee339692af14749688d007afbeee5a1.exe	37
PID 2584 wrote to memory of 1876	2584	9dd421db26445019a9fb120bb04a2ddc8ee339692af14749688d007afbeee5a1.exe	37
PID 2584 wrote to memory of 2504	2584	9dd421db26445019a9fb120bb04a2ddc8ee339692af14749688d007afbeee5a1.exe	38
PID 2584 wrote to memory of 2504	2584	9dd421db26445019a9fb120bb04a2ddc8ee339692af14749688d007afbeee5a1.exe	38
PID 2584 wrote to memory of 2504	2584	9dd421db26445019a9fb120bb04a2ddc8ee339692af14749688d007afbeee5a1.exe	38
PID 2584 wrote to memory of 2516	2584	9dd421db26445019a9fb120bb04a2ddc8ee339692af14749688d007afbeee5a1.exe	39
PID 2584 wrote to memory of 2516	2584	9dd421db26445019a9fb120bb04a2ddc8ee339692af14749688d007afbeee5a1.exe	39
PID 2584 wrote to memory of 2516	2584	9dd421db26445019a9fb120bb04a2ddc8ee339692af14749688d007afbeee5a1.exe	39
PID 2584 wrote to memory of 1164	2584	9dd421db26445019a9fb120bb04a2ddc8ee339692af14749688d007afbeee5a1.exe	40
PID 2584 wrote to memory of 1164	2584	9dd421db26445019a9fb120bb04a2ddc8ee339692af14749688d007afbeee5a1.exe	40
PID 2584 wrote to memory of 1164	2584	9dd421db26445019a9fb120bb04a2ddc8ee339692af14749688d007afbeee5a1.exe	40
PID 2584 wrote to memory of 836	2584	9dd421db26445019a9fb120bb04a2ddc8ee339692af14749688d007afbeee5a1.exe	43
PID 2584 wrote to memory of 836	2584	9dd421db26445019a9fb120bb04a2ddc8ee339692af14749688d007afbeee5a1.exe	43
PID 2584 wrote to memory of 836	2584	9dd421db26445019a9fb120bb04a2ddc8ee339692af14749688d007afbeee5a1.exe	43
PID 2584 wrote to memory of 2792	2584	9dd421db26445019a9fb120bb04a2ddc8ee339692af14749688d007afbeee5a1.exe	46
PID 2584 wrote to memory of 2792	2584	9dd421db26445019a9fb120bb04a2ddc8ee339692af14749688d007afbeee5a1.exe	46
PID 2584 wrote to memory of 2792	2584	9dd421db26445019a9fb120bb04a2ddc8ee339692af14749688d007afbeee5a1.exe	46
PID 2584 wrote to memory of 1976	2584	9dd421db26445019a9fb120bb04a2ddc8ee339692af14749688d007afbeee5a1.exe	49
PID 2584 wrote to memory of 1976	2584	9dd421db26445019a9fb120bb04a2ddc8ee339692af14749688d007afbeee5a1.exe	49
PID 2584 wrote to memory of 1976	2584	9dd421db26445019a9fb120bb04a2ddc8ee339692af14749688d007afbeee5a1.exe	49
PID 1976 wrote to memory of 792	1976	cmd.exe	51
PID 1976 wrote to memory of 792	1976	cmd.exe	51
PID 1976 wrote to memory of 792	1976	cmd.exe	51
PID 1976 wrote to memory of 2492	1976	cmd.exe	53
PID 1976 wrote to memory of 2492	1976	cmd.exe	53
PID 1976 wrote to memory of 2492	1976	cmd.exe	53
PID 2492 wrote to memory of 632	2492	lsm.exe	54
PID 2492 wrote to memory of 632	2492	lsm.exe	54
PID 2492 wrote to memory of 632	2492	lsm.exe	54
PID 2492 wrote to memory of 2296	2492	lsm.exe	55
PID 2492 wrote to memory of 2296	2492	lsm.exe	55
PID 2492 wrote to memory of 2296	2492	lsm.exe	55
PID 632 wrote to memory of 1656	632	WScript.exe	56
PID 632 wrote to memory of 1656	632	WScript.exe	56
PID 632 wrote to memory of 1656	632	WScript.exe	56
PID 1656 wrote to memory of 2632	1656	lsm.exe	57
PID 1656 wrote to memory of 2632	1656	lsm.exe	57
PID 1656 wrote to memory of 2632	1656	lsm.exe	57
PID 1656 wrote to memory of 2604	1656	lsm.exe	58
PID 1656 wrote to memory of 2604	1656	lsm.exe	58
PID 1656 wrote to memory of 2604	1656	lsm.exe	58
PID 2632 wrote to memory of 2576	2632	WScript.exe	59
PID 2632 wrote to memory of 2576	2632	WScript.exe	59
PID 2632 wrote to memory of 2576	2632	WScript.exe	59
PID 2576 wrote to memory of 376	2576	lsm.exe	60
PID 2576 wrote to memory of 376	2576	lsm.exe	60
PID 2576 wrote to memory of 376	2576	lsm.exe	60
PID 2576 wrote to memory of 2196	2576	lsm.exe	61
PID 2576 wrote to memory of 2196	2576	lsm.exe	61
PID 2576 wrote to memory of 2196	2576	lsm.exe	61
PID 376 wrote to memory of 488	376	WScript.exe	62
PID 376 wrote to memory of 488	376	WScript.exe	62
PID 376 wrote to memory of 488	376	WScript.exe	62
PID 488 wrote to memory of 1476	488	lsm.exe	63
PID 488 wrote to memory of 1476	488	lsm.exe	63
PID 488 wrote to memory of 1476	488	lsm.exe	63
PID 488 wrote to memory of 2208	488	lsm.exe	64
PID 488 wrote to memory of 2208	488	lsm.exe	64
PID 488 wrote to memory of 2208	488	lsm.exe	64
PID 1476 wrote to memory of 2024	1476	WScript.exe	65
PID 1476 wrote to memory of 2024	1476	WScript.exe	65
PID 1476 wrote to memory of 2024	1476	WScript.exe	65
PID 2024 wrote to memory of 2584	2024	lsm.exe	66

System policy modification 1 TTPs 42 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	lsm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	lsm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	lsm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	lsm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	lsm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	lsm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	lsm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	lsm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	lsm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	lsm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	lsm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	lsm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	lsm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	lsm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	lsm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	lsm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	lsm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	lsm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	lsm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	lsm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	lsm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	lsm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	lsm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	lsm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	9dd421db26445019a9fb120bb04a2ddc8ee339692af14749688d007afbeee5a1.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	lsm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	lsm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	lsm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	lsm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	lsm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	9dd421db26445019a9fb120bb04a2ddc8ee339692af14749688d007afbeee5a1.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	lsm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	lsm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	lsm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	lsm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	lsm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	lsm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	lsm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	9dd421db26445019a9fb120bb04a2ddc8ee339692af14749688d007afbeee5a1.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	lsm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	lsm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	lsm.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\9dd421db26445019a9fb120bb04a2ddc8ee339692af14749688d007afbeee5a1.exe
"C:\Users\Admin\AppData\Local\Temp\9dd421db26445019a9fb120bb04a2ddc8ee339692af14749688d007afbeee5a1.exe"
1⤵
- DcRat
- Modifies WinLogon for persistence
- UAC bypass
- Drops file in Drivers directory
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2584
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\9dd421db26445019a9fb120bb04a2ddc8ee339692af14749688d007afbeee5a1.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1876
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPWMI\OSPPSVC.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2504
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\ProgramData\Start Menu\9dd421db26445019a9fb120bb04a2ddc8ee339692af14749688d007afbeee5a1.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2516
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\System32\msctf\lsm.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1164
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\ProgramData\Desktop\lsm.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:836
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\7-Zip\Lang\spoolsv.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2792
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\3nKVmVHhtI.bat"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1976
- - C:\Windows\system32\w32tm.exe
    w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
    3⤵
    PID:792
- - C:\ProgramData\Desktop\lsm.exe
    "C:\ProgramData\Desktop\lsm.exe"
    3⤵
    - UAC bypass
    - Executes dropped EXE
    - Checks whether UAC is enabled
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    - System policy modification
    PID:2492
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\bee27b3e-c017-425b-b18c-9b186b6b9460.vbs"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:632
    - - C:\ProgramData\Desktop\lsm.exe
        
        C:\ProgramData\Desktop\lsm.exe
        5⤵
        UAC bypass
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        System policy modification
        
        PID:1656
      - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\c94fc62f-0453-4b5f-875d-455b96342e30.vbs"
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:2632
        
        C:\ProgramData\Desktop\lsm.exe
        
        C:\ProgramData\Desktop\lsm.exe
        7⤵
        UAC bypass
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        System policy modification
        
        PID:2576
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\87b1e117-8b9c-4bc5-ac01-fcdf30de3883.vbs"
        8⤵
        Suspicious use of WriteProcessMemory
        
        PID:376
        
        C:\ProgramData\Desktop\lsm.exe
        
        C:\ProgramData\Desktop\lsm.exe
        9⤵
        UAC bypass
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        System policy modification
        
        PID:488
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\c79eacca-3be2-45b7-b862-48f4aa53e295.vbs"
        10⤵
        Suspicious use of WriteProcessMemory
        
        PID:1476
        
        C:\ProgramData\Desktop\lsm.exe
        
        C:\ProgramData\Desktop\lsm.exe
        11⤵
        UAC bypass
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        System policy modification
        
        PID:2024
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\bc751165-8a42-422c-ad7b-acd4712824b1.vbs"
        12⤵
        
        PID:2584
        
        C:\ProgramData\Desktop\lsm.exe
        
        C:\ProgramData\Desktop\lsm.exe
        13⤵
        UAC bypass
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:2060
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\6472546a-610d-41e1-8980-e2f870e35886.vbs"
        14⤵
        
        PID:1980
        
        C:\ProgramData\Desktop\lsm.exe
        
        C:\ProgramData\Desktop\lsm.exe
        15⤵
        UAC bypass
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:2816
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\b3977067-20ad-406a-8186-2fe3c91a11a2.vbs"
        16⤵
        
        PID:2844
        
        C:\ProgramData\Desktop\lsm.exe
        
        C:\ProgramData\Desktop\lsm.exe
        17⤵
        UAC bypass
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:1764
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\b3ed2509-6733-4052-a27f-ec54dc81332d.vbs"
        18⤵
        
        PID:2352
        
        C:\ProgramData\Desktop\lsm.exe
        
        C:\ProgramData\Desktop\lsm.exe
        19⤵
        UAC bypass
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:1188
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\3dc6d09a-e81a-4108-bb14-990dc86a446a.vbs"
        20⤵
        
        PID:2500
        
        C:\ProgramData\Desktop\lsm.exe
        
        C:\ProgramData\Desktop\lsm.exe
        21⤵
        UAC bypass
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:1904
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\e2aba6d4-852a-4b29-af83-fba82597f4b1.vbs"
        22⤵
        
        PID:268
        
        C:\ProgramData\Desktop\lsm.exe
        
        C:\ProgramData\Desktop\lsm.exe
        23⤵
        UAC bypass
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:680
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\f73a28c3-e3b0-4c20-a7fb-6581a86c305a.vbs"
        24⤵
        
        PID:2236
        
        C:\ProgramData\Desktop\lsm.exe
        
        C:\ProgramData\Desktop\lsm.exe
        25⤵
        UAC bypass
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:2708
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\2a976294-fd74-4981-aafd-2d0e99959c1c.vbs"
        26⤵
        
        PID:1236
        
        C:\ProgramData\Desktop\lsm.exe
        
        C:\ProgramData\Desktop\lsm.exe
        27⤵
        UAC bypass
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:1764
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\2cf46d5c-bee8-4dc0-9a0a-d1f6e86cfc3b.vbs"
        28⤵
        
        PID:2004
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\c729f843-7104-4516-9d4c-e00c589436c3.vbs"
        28⤵
        
        PID:1816
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\7906c312-5d66-4372-a66b-9a14fe8512d1.vbs"
        26⤵
        
        PID:1260
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\2e7fd88c-717c-49a7-a373-ee3b51d0915d.vbs"
        24⤵
        
        PID:2736
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\5a418881-3579-446b-8e5d-a3af94dd76d9.vbs"
        22⤵
        
        PID:1304
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\c79d8690-2558-4b55-8a62-0eda6b340324.vbs"
        20⤵
        
        PID:584
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\fa10ba8a-03ad-4d3f-8546-712afda160a7.vbs"
        18⤵
        
        PID:2892
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\b84d3dd9-1af8-4528-9633-cbe2af761d41.vbs"
        16⤵
        
        PID:1968
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\c9e5e554-c82c-4ed5-84fb-dcadc7221ef6.vbs"
        14⤵
        
        PID:3056
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\432f80d8-36f9-42c0-8905-5779e9f14f05.vbs"
        12⤵
        
        PID:1640
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\99d4e962-da3f-4151-906f-d9068b5f87b8.vbs"
        10⤵
        
        PID:2208
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\dd9323e6-bdf5-4331-a2eb-b9574322ac96.vbs"
        8⤵
        
        PID:2196
      - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\5ade8e29-4343-48d3-aae5-1c22f062d4d7.vbs"
        6⤵
        
        PID:2604
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\76c9c7ab-09e8-43ed-89b4-0d8a9c9d3342.vbs"
      4⤵
      PID:2296

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OSPPSVC" /sc ONLOGON /tr "'C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPWMI\OSPPSVC.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2884

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "9dd421db26445019a9fb120bb04a2ddc8ee339692af14749688d007afbeee5a1" /sc ONLOGON /tr "'C:\ProgramData\Start Menu\9dd421db26445019a9fb120bb04a2ddc8ee339692af14749688d007afbeee5a1.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2716

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsm" /sc ONLOGON /tr "'C:\Windows\System32\msctf\lsm.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2752

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsm" /sc ONLOGON /tr "'C:\ProgramData\Desktop\lsm.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2728

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsv" /sc ONLOGON /tr "'C:\Program Files\7-Zip\Lang\spoolsv.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2640

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\7-Zip\Lang\spoolsv.exe

Filesize
1.5MB

MD5
04c9152dc94eab52c92ddf3133f3ac7b

SHA1
59be48b0636b28831dc5436e0fb75c27d3384cd6

SHA256
9dd421db26445019a9fb120bb04a2ddc8ee339692af14749688d007afbeee5a1

SHA512
6a8c302eb67a44a32dcc2461b64ab3193b65b8570d5f0b998b8924899943a9227fe45b71d5dc16f50674f9cff94cb477159d95670340f12f7eca8c71be8e3560

Download Submit
C:\Users\Admin\AppData\Local\Temp\2a976294-fd74-4981-aafd-2d0e99959c1c.vbs

Filesize
706B

MD5
9af31c8f2a0682359b7ea7e059204732

SHA1
63e93081c931f0f3ccd754b977b422ac0624b9b2

SHA256
11aee021f19f3c205e2109f9071e593c51973e1fa62b98f0c1a7dfbe1b6eb706

SHA512
7b78570725ac0c10f83c426fc37bd5cc85e6a5635e888bee333e154b8d77b4fb9fd5693641e3b49c16059d9384583650e2c33abb30f1fc5f87334b5fc5db99de

Download Submit
C:\Users\Admin\AppData\Local\Temp\3dc6d09a-e81a-4108-bb14-990dc86a446a.vbs

Filesize
706B

MD5
c86484cc34286b169ec75a21d1859d75

SHA1
0c3ad1b063e98190e9c4d60fca2943b9c25509da

SHA256
c72b0420d1123ce07521abce2c01c1b205daa93fc54362b0da3cfb9cf39ccf0d

SHA512
613aed62496811d8f9958553f9c66e9382a5ed769809c84d4d9d423997905ca4eb997744e22d5c81ebab372be5bcef40ba3f5257e8d1ec9d9ee6fd06d43cb7ce

Download Submit
C:\Users\Admin\AppData\Local\Temp\3nKVmVHhtI.bat

Filesize
194B

MD5
e560e45bd06e27186e35046b211d9bd7

SHA1
c2fc47d9c0df7869e39333607ba119abc4e72ac0

SHA256
e93e2a3cb721835d810a9064bdf5eafb8698f6ee9d1c1cab2d59c48d39e8fdca

SHA512
1e108e01e29fbcad1ee6705ef25f920f58ffd9e1043c20d32c783ea1f21e0647659cd09b6c6d3b44e9f772a51a2096d1a27080f971dde04cc8a317bbcf4b4094

Download Submit
C:\Users\Admin\AppData\Local\Temp\6472546a-610d-41e1-8980-e2f870e35886.vbs

Filesize
706B

MD5
80798fbe1f50b2687fcadb225515283d

SHA1
2557bbeaefc49e73dfe423783a16d9dce18491d9

SHA256
8cc012764e21a1c3ba7033e51305327677b0f1873151e15aab4c743886b12de3

SHA512
135aef4b9fda1105e3f55bee13a2e49ec4ae9de9994a126516b3228aa01dcd3fa61fe2249ea72286188746384e9a91cc7e3df49e3848689f5f8fe65c75f18de6

Download Submit
C:\Users\Admin\AppData\Local\Temp\76c9c7ab-09e8-43ed-89b4-0d8a9c9d3342.vbs

Filesize
482B

MD5
7cc8e6e960bea2fce5e61fe83f5c52ef

SHA1
715247865db5572e73e0bb01c7fc328172540147

SHA256
20f09a8961bede7bf25622326d45c3bd19d8e251e53b1e6098f3bc58a9a04baa

SHA512
5b548b2094545da7859259818e80f6d8746d6ea8d1909ba2d6efea6b0acd27d10d1b5e6d8c130bf86a479e66e4dd9bea14d2789f585e8c7f5955ac83db5785a9

Download Submit
C:\Users\Admin\AppData\Local\Temp\87b1e117-8b9c-4bc5-ac01-fcdf30de3883.vbs

Filesize
706B

MD5
88d6b5daa3aa232185ab871f10dc812f

SHA1
2514d256c1fbc1ebe7ff1da05f941ec36572fee1

SHA256
5308e44283e60b760a1ae870763ca5ca562615540c58c9cede0d978e90fe2bdc

SHA512
1a01035a0044e1853ba2282ff84169fd40c92397bc6c241e84f1f067efdf0b080eb15e2150e3c9972e2ac189518190bb2f08568f61d4bdf72b6e9d26e5b822dd

Download Submit
C:\Users\Admin\AppData\Local\Temp\b3977067-20ad-406a-8186-2fe3c91a11a2.vbs

Filesize
706B

MD5
1e25aa18d27e934aee04ce5f3c1802b0

SHA1
06aee247803dbb05216cff4fa10a37743620781e

SHA256
3b829c8d13a642e490c80f84750ca91c98e482d35e1e855f52983c11f076bbb9

SHA512
f97b7bbd2b9c522f313e34039afe684e610410acdc896b9fe7ed740dcc80e0276928c0ef3ca055a2bbf91c9a9bbff54405d533be02c5ed0bc6c6805877de9efc

Download Submit
C:\Users\Admin\AppData\Local\Temp\b3ed2509-6733-4052-a27f-ec54dc81332d.vbs

Filesize
706B

MD5
d45a67ad925a9700506c38edbab2df0a

SHA1
cd0b2324a6162902eb819875e31fae0b7e02e19d

SHA256
493ebcf0608effd830a647f421b28e2a4ef1a47302d7da6522abe269359a82e4

SHA512
8f17ed03addbad50a4b64081d809e7a1b0a82df26925d802306e72ae65e2ed16a4db896f76fc5b94f1a96169a50b5ffc23202c6777aeedd1b5ee1ac9886a07a7

Download Submit
C:\Users\Admin\AppData\Local\Temp\bc751165-8a42-422c-ad7b-acd4712824b1.vbs

Filesize
706B

MD5
f2b9b4782a44d87718f64531bb498cd7

SHA1
7e8abf2ff6d72d97cd953cf88d758886e50dcd90

SHA256
dd821142c91c2a5faf17ab05b9f9f5e690162949123a80f0672823b61bd3a644

SHA512
493ba85901fe33fd38218b7cdd396f7cb0487f50e9c28773de335fd8519a4147318c3b4222e5f67d8f791173b8be818af38bdf15f3e5d522e196ea84e75e467a

Download Submit
C:\Users\Admin\AppData\Local\Temp\bee27b3e-c017-425b-b18c-9b186b6b9460.vbs

Filesize
706B

MD5
73178813c502ea81ecea8d50fe82a534

SHA1
24a1ab616774053f3af72c4a293fc7aa24b12d69

SHA256
b5fb387459486687f667935fad4552ed702a1133a8eb3dc71027705f62c74151

SHA512
72d78a17253273c3aa71d223084757a908ce493fae1e896b0582c218d523f569585d53ef84c44b87fe18adaf73bfbf2a248a1b6788d73f78f5f4e73101941670

Download Submit
C:\Users\Admin\AppData\Local\Temp\c79eacca-3be2-45b7-b862-48f4aa53e295.vbs

Filesize
705B

MD5
8642d5ede4e72694ab7acbee2ec70281

SHA1
0bc85f92f55a0e09806ed9a361a339390e538f04

SHA256
d647c81683d003b2b45e513c1e0f2e0b3b62f70b125db625ce3c1c3a6ef7d106

SHA512
aab653a3b6d2e1689893e3b9aa221bf1a13742bc6e3ae7e761706f77d008f319aea84d6aa5d619c23770268b67bec6b0b722561462b3c589dec42d4810d684fd

Download Submit
C:\Users\Admin\AppData\Local\Temp\c94fc62f-0453-4b5f-875d-455b96342e30.vbs

Filesize
706B

MD5
49bdeb3baf623d898cda5fbb0d3a58ae

SHA1
1a5adda1c1e063972a98f1c64fdf1a0c0fbd0674

SHA256
adce723aad5960bb8d1b8396d0de6081c2f871dd7f16948d06cb9e3a9e888240

SHA512
4b46c7f1a06ba4421b9df2f078a796d67b6c2d04366463d2c24bc032fafce6432a95f5f193124124bf79051a59ba9da05040d8fae3fa0923d6127aa496dbbf45

Download Submit
C:\Users\Admin\AppData\Local\Temp\e2aba6d4-852a-4b29-af83-fba82597f4b1.vbs

Filesize
706B

MD5
922ffdb41811b39fc69cd132edfb4543

SHA1
02043f1eece93ae42e83c4f06051fd91f20d191e

SHA256
bc0e08f8d04c2a4d3a277d6158374ca0c823548420e6e11c17a8143ec770aab7

SHA512
158338e39b35724f3b7fdd133d0e96f04428240d454901b70f2252217c9d5a8fa413dd7f3846895a8acda6204aa9d8fc4aeb3b7c326f5cb5fddc18314780a76f

Download Submit
C:\Users\Admin\AppData\Local\Temp\f73a28c3-e3b0-4c20-a7fb-6581a86c305a.vbs

Filesize
705B

MD5
29a2f41a2eec517c53d3a3b12a1138eb

SHA1
26fd18aaf011bc948b7426cc9d2a8dbab7a6858d

SHA256
4a514306cfe095e906efd85ef0aea63df12358aff5ac3e8a9154ea82dcf8e730

SHA512
f4cccd82c292aea1c7ae7e346e7a75546e88e123876148dce617361195b749e6ff11dedbc284c3c69bdcd418f25811d7b84688dc007bdcfae814d120576a02a0

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
7KB

MD5
a691c5b37a997aa837b80a4fb9e41423

SHA1
78db57b948286c3aa07404cf6d392acb16519c93

SHA256
869580ec7a9299ab8d58062943a2ac00ed3fdc9836fd3faf36ec17807707b452

SHA512
9d2d1cc5645356a75d5bb4d13d8f428c98b3f77d948c45aa3d4453a722895d93d87f0f1905e5483b04a2ef00707fc1536779f641b51c282d6bbeb09795a38e4a

Download Submit
memory/488-146-0x0000000000F70000-0x00000000010EE000-memory.dmp

Filesize
1.5MB

Download
memory/680-230-0x0000000000250000-0x00000000003CE000-memory.dmp

Filesize
1.5MB

Download
memory/1188-207-0x0000000000DB0000-0x0000000000F2E000-memory.dmp

Filesize
1.5MB

Download
memory/1656-122-0x00000000003C0000-0x000000000053E000-memory.dmp

Filesize
1.5MB

Download
memory/1764-195-0x00000000003D0000-0x000000000054E000-memory.dmp

Filesize
1.5MB

Download
memory/2024-158-0x0000000001070000-0x00000000011EE000-memory.dmp

Filesize
1.5MB

Download
memory/2060-170-0x00000000001A0000-0x000000000031E000-memory.dmp

Filesize
1.5MB

Download
memory/2060-171-0x0000000000550000-0x0000000000562000-memory.dmp

Filesize
72KB

Download
memory/2492-111-0x0000000001190000-0x000000000130E000-memory.dmp

Filesize
1.5MB

Download
memory/2504-91-0x0000000001CD0000-0x0000000001CD8000-memory.dmp

Filesize
32KB

Download
memory/2504-90-0x000000001B670000-0x000000001B952000-memory.dmp

Filesize
2.9MB

Download
memory/2576-134-0x0000000000CC0000-0x0000000000E3E000-memory.dmp

Filesize
1.5MB

Download
memory/2584-12-0x0000000000830000-0x0000000000838000-memory.dmp

Filesize
32KB

Download
memory/2584-24-0x000007FEF67C0000-0x000007FEF71AC000-memory.dmp

Filesize
9.9MB

Download
memory/2584-11-0x0000000000820000-0x0000000000830000-memory.dmp

Filesize
64KB

Download
memory/2584-10-0x0000000000810000-0x0000000000820000-memory.dmp

Filesize
64KB

Download
memory/2584-20-0x0000000000E60000-0x0000000000E6C000-memory.dmp

Filesize
48KB

Download
memory/2584-18-0x0000000000E50000-0x0000000000E58000-memory.dmp

Filesize
32KB

Download
memory/2584-107-0x000007FEF67C0000-0x000007FEF71AC000-memory.dmp

Filesize
9.9MB

Download
memory/2584-17-0x0000000000DC0000-0x0000000000DCC000-memory.dmp

Filesize
48KB

Download
memory/2584-16-0x0000000000DB0000-0x0000000000DB8000-memory.dmp

Filesize
32KB

Download
memory/2584-15-0x0000000000DA0000-0x0000000000DAA000-memory.dmp

Filesize
40KB

Download
memory/2584-14-0x0000000000D90000-0x0000000000D9C000-memory.dmp

Filesize
48KB

Download
memory/2584-13-0x0000000000840000-0x000000000084A000-memory.dmp

Filesize
40KB

Download
memory/2584-1-0x0000000001330000-0x00000000014AE000-memory.dmp

Filesize
1.5MB

Download
memory/2584-42-0x000007FEF67C0000-0x000007FEF71AC000-memory.dmp

Filesize
9.9MB

Download
memory/2584-21-0x00000000012F0000-0x00000000012F8000-memory.dmp

Filesize
32KB

Download
memory/2584-0-0x000007FEF67C3000-0x000007FEF67C4000-memory.dmp

Filesize
4KB

Download
memory/2584-9-0x0000000000610000-0x000000000061C000-memory.dmp

Filesize
48KB

Download
memory/2584-8-0x0000000000580000-0x0000000000588000-memory.dmp

Filesize
32KB

Download
memory/2584-7-0x0000000000570000-0x000000000057C000-memory.dmp

Filesize
48KB

Download
memory/2584-6-0x0000000000560000-0x000000000056A000-memory.dmp

Filesize
40KB

Download
memory/2584-5-0x0000000000550000-0x000000000055C000-memory.dmp

Filesize
48KB

Download
memory/2584-4-0x0000000000540000-0x0000000000552000-memory.dmp

Filesize
72KB

Download
memory/2584-3-0x0000000000530000-0x0000000000538000-memory.dmp

Filesize
32KB

Download
memory/2584-2-0x000007FEF67C0000-0x000007FEF71AC000-memory.dmp

Filesize
9.9MB

Download
memory/2708-242-0x0000000001310000-0x000000000148E000-memory.dmp

Filesize
1.5MB

Download
memory/2816-183-0x0000000000A90000-0x0000000000C0E000-memory.dmp

Filesize
1.5MB

Download