dcrat | 95e53d41dd242a3f707ffc7ea0b0a831ed85b9294192e039f0b255d5b65e732d

Analysis

max time kernel
117s
max time network
118s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
11-12-2024 11:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

95e53d41dd242a3f707ffc7ea0b0a831ed85b9294192e039f0b255d5b65e732d.exe
Size

1.7MB
MD5

68a655281c115869e423c1d7f5bea01d
SHA1

8193dcbfd44ca6bad7dd4c5824f9e0d4495220c2
SHA256

95e53d41dd242a3f707ffc7ea0b0a831ed85b9294192e039f0b255d5b65e732d
SHA512

c72d216bc5172e259226c624023aaf869cfdbebb29b2aa8421a15363f9c3c29acedb3436dbb829afce50aa13935f06c6baf40b3523c912ded39fb82f9b21c1db
SSDEEP

49152:D+gYXZTD1VXUqzX7VwjvMoh1IFyuyigWnMzm6sDBKvS:uTHUxUoh1IF9gl2d

Score

10^/10

dcrat execution infostealer rat

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat
Dcrat family
dcrat

Process spawned unexpected child process 9 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1708	5052	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2976	5052	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2320	5052	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3012	5052	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1156	5052	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	532	5052	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1160	5052	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3200	5052	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3672	5052	schtasks.exe	83

DCRat payload 3 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral2/memory/4824-1-0x0000000000410000-0x00000000005D0000-memory.dmp	dcrat
behavioral2/files/0x0007000000023c6f-32.dat	dcrat
behavioral2/files/0x000a000000023c5a-64.dat	dcrat

Command and Scripting Interpreter: PowerShell 1 TTPs 11 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
3532	powershell.exe
2284	powershell.exe
2872	powershell.exe
1328	powershell.exe
4544	powershell.exe
4440	powershell.exe
4660	powershell.exe
1492	powershell.exe
3428	powershell.exe
3020	powershell.exe
3040	powershell.exe

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\drivers\etc\hosts	95e53d41dd242a3f707ffc7ea0b0a831ed85b9294192e039f0b255d5b65e732d.exe

Checks computer location settings 2 TTPs 9 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\International\Geo\Nation	TextInputHost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\International\Geo\Nation	TextInputHost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\International\Geo\Nation	TextInputHost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\International\Geo\Nation	TextInputHost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\International\Geo\Nation	TextInputHost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\International\Geo\Nation	95e53d41dd242a3f707ffc7ea0b0a831ed85b9294192e039f0b255d5b65e732d.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\International\Geo\Nation	TextInputHost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\International\Geo\Nation	TextInputHost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\International\Geo\Nation	TextInputHost.exe

Executes dropped EXE 8 IoCs

pid	Process
4752	TextInputHost.exe
2124	TextInputHost.exe
3428	TextInputHost.exe
220	TextInputHost.exe
3820	TextInputHost.exe
4948	TextInputHost.exe
3324	TextInputHost.exe
4440	TextInputHost.exe

Drops file in Program Files directory 5 IoCs

description	ioc	Process
File created	C:\Program Files\VideoLAN\VLC\lua\TextInputHost.exe	95e53d41dd242a3f707ffc7ea0b0a831ed85b9294192e039f0b255d5b65e732d.exe
File created	C:\Program Files\VideoLAN\VLC\lua\22eafd247d37c3	95e53d41dd242a3f707ffc7ea0b0a831ed85b9294192e039f0b255d5b65e732d.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\RCXA491.tmp	95e53d41dd242a3f707ffc7ea0b0a831ed85b9294192e039f0b255d5b65e732d.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\RCXA492.tmp	95e53d41dd242a3f707ffc7ea0b0a831ed85b9294192e039f0b255d5b65e732d.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\TextInputHost.exe	95e53d41dd242a3f707ffc7ea0b0a831ed85b9294192e039f0b255d5b65e732d.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings	TextInputHost.exe
Key created	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings	TextInputHost.exe
Key created	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings	TextInputHost.exe
Key created	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings	95e53d41dd242a3f707ffc7ea0b0a831ed85b9294192e039f0b255d5b65e732d.exe
Key created	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings	TextInputHost.exe
Key created	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings	TextInputHost.exe
Key created	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings	TextInputHost.exe
Key created	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings	TextInputHost.exe
Key created	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings	TextInputHost.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 9 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
1160	schtasks.exe
2976	schtasks.exe
3012	schtasks.exe
1156	schtasks.exe
532	schtasks.exe
3200	schtasks.exe
3672	schtasks.exe
1708	schtasks.exe
2320	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4824	95e53d41dd242a3f707ffc7ea0b0a831ed85b9294192e039f0b255d5b65e732d.exe
4824	95e53d41dd242a3f707ffc7ea0b0a831ed85b9294192e039f0b255d5b65e732d.exe
4824	95e53d41dd242a3f707ffc7ea0b0a831ed85b9294192e039f0b255d5b65e732d.exe
4824	95e53d41dd242a3f707ffc7ea0b0a831ed85b9294192e039f0b255d5b65e732d.exe
4824	95e53d41dd242a3f707ffc7ea0b0a831ed85b9294192e039f0b255d5b65e732d.exe
4824	95e53d41dd242a3f707ffc7ea0b0a831ed85b9294192e039f0b255d5b65e732d.exe
4824	95e53d41dd242a3f707ffc7ea0b0a831ed85b9294192e039f0b255d5b65e732d.exe
4824	95e53d41dd242a3f707ffc7ea0b0a831ed85b9294192e039f0b255d5b65e732d.exe
4824	95e53d41dd242a3f707ffc7ea0b0a831ed85b9294192e039f0b255d5b65e732d.exe
4824	95e53d41dd242a3f707ffc7ea0b0a831ed85b9294192e039f0b255d5b65e732d.exe
4824	95e53d41dd242a3f707ffc7ea0b0a831ed85b9294192e039f0b255d5b65e732d.exe
4824	95e53d41dd242a3f707ffc7ea0b0a831ed85b9294192e039f0b255d5b65e732d.exe
4824	95e53d41dd242a3f707ffc7ea0b0a831ed85b9294192e039f0b255d5b65e732d.exe
4824	95e53d41dd242a3f707ffc7ea0b0a831ed85b9294192e039f0b255d5b65e732d.exe
1492	powershell.exe
1492	powershell.exe
4824	95e53d41dd242a3f707ffc7ea0b0a831ed85b9294192e039f0b255d5b65e732d.exe
4824	95e53d41dd242a3f707ffc7ea0b0a831ed85b9294192e039f0b255d5b65e732d.exe
2284	powershell.exe
2284	powershell.exe
4544	powershell.exe
4544	powershell.exe
1492	powershell.exe
3020	powershell.exe
3020	powershell.exe
4440	powershell.exe
4440	powershell.exe
4660	powershell.exe
4660	powershell.exe
3428	powershell.exe
3428	powershell.exe
3040	powershell.exe
3040	powershell.exe
2872	powershell.exe
2872	powershell.exe
1328	powershell.exe
1328	powershell.exe
3532	powershell.exe
3532	powershell.exe
3040	powershell.exe
2872	powershell.exe
4440	powershell.exe
2284	powershell.exe
4544	powershell.exe
4660	powershell.exe
3020	powershell.exe
3428	powershell.exe
1328	powershell.exe
3532	powershell.exe
4752	TextInputHost.exe
4752	TextInputHost.exe
4752	TextInputHost.exe
4752	TextInputHost.exe
4752	TextInputHost.exe
4752	TextInputHost.exe
4752	TextInputHost.exe
4752	TextInputHost.exe
4752	TextInputHost.exe
4752	TextInputHost.exe
4752	TextInputHost.exe
4752	TextInputHost.exe
4752	TextInputHost.exe
4752	TextInputHost.exe
4752	TextInputHost.exe

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeDebugPrivilege	4824	95e53d41dd242a3f707ffc7ea0b0a831ed85b9294192e039f0b255d5b65e732d.exe
Token: SeDebugPrivilege	1492	powershell.exe
Token: SeDebugPrivilege	2284	powershell.exe
Token: SeDebugPrivilege	4544	powershell.exe
Token: SeDebugPrivilege	4660	powershell.exe
Token: SeDebugPrivilege	3020	powershell.exe
Token: SeDebugPrivilege	4440	powershell.exe
Token: SeDebugPrivilege	3428	powershell.exe
Token: SeDebugPrivilege	3040	powershell.exe
Token: SeDebugPrivilege	1328	powershell.exe
Token: SeDebugPrivilege	2872	powershell.exe
Token: SeDebugPrivilege	3532	powershell.exe
Token: SeDebugPrivilege	4752	TextInputHost.exe
Token: SeDebugPrivilege	2124	TextInputHost.exe
Token: SeDebugPrivilege	3428	TextInputHost.exe
Token: SeDebugPrivilege	220	TextInputHost.exe
Token: SeDebugPrivilege	3820	TextInputHost.exe
Token: SeDebugPrivilege	4948	TextInputHost.exe
Token: SeDebugPrivilege	3324	TextInputHost.exe
Token: SeDebugPrivilege	4440	TextInputHost.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4824 wrote to memory of 3532	4824	95e53d41dd242a3f707ffc7ea0b0a831ed85b9294192e039f0b255d5b65e732d.exe	94
PID 4824 wrote to memory of 3532	4824	95e53d41dd242a3f707ffc7ea0b0a831ed85b9294192e039f0b255d5b65e732d.exe	94
PID 4824 wrote to memory of 4440	4824	95e53d41dd242a3f707ffc7ea0b0a831ed85b9294192e039f0b255d5b65e732d.exe	95
PID 4824 wrote to memory of 4440	4824	95e53d41dd242a3f707ffc7ea0b0a831ed85b9294192e039f0b255d5b65e732d.exe	95
PID 4824 wrote to memory of 4660	4824	95e53d41dd242a3f707ffc7ea0b0a831ed85b9294192e039f0b255d5b65e732d.exe	96
PID 4824 wrote to memory of 4660	4824	95e53d41dd242a3f707ffc7ea0b0a831ed85b9294192e039f0b255d5b65e732d.exe	96
PID 4824 wrote to memory of 1492	4824	95e53d41dd242a3f707ffc7ea0b0a831ed85b9294192e039f0b255d5b65e732d.exe	97
PID 4824 wrote to memory of 1492	4824	95e53d41dd242a3f707ffc7ea0b0a831ed85b9294192e039f0b255d5b65e732d.exe	97
PID 4824 wrote to memory of 2284	4824	95e53d41dd242a3f707ffc7ea0b0a831ed85b9294192e039f0b255d5b65e732d.exe	98
PID 4824 wrote to memory of 2284	4824	95e53d41dd242a3f707ffc7ea0b0a831ed85b9294192e039f0b255d5b65e732d.exe	98
PID 4824 wrote to memory of 3428	4824	95e53d41dd242a3f707ffc7ea0b0a831ed85b9294192e039f0b255d5b65e732d.exe	99
PID 4824 wrote to memory of 3428	4824	95e53d41dd242a3f707ffc7ea0b0a831ed85b9294192e039f0b255d5b65e732d.exe	99
PID 4824 wrote to memory of 2872	4824	95e53d41dd242a3f707ffc7ea0b0a831ed85b9294192e039f0b255d5b65e732d.exe	100
PID 4824 wrote to memory of 2872	4824	95e53d41dd242a3f707ffc7ea0b0a831ed85b9294192e039f0b255d5b65e732d.exe	100
PID 4824 wrote to memory of 3020	4824	95e53d41dd242a3f707ffc7ea0b0a831ed85b9294192e039f0b255d5b65e732d.exe	101
PID 4824 wrote to memory of 3020	4824	95e53d41dd242a3f707ffc7ea0b0a831ed85b9294192e039f0b255d5b65e732d.exe	101
PID 4824 wrote to memory of 3040	4824	95e53d41dd242a3f707ffc7ea0b0a831ed85b9294192e039f0b255d5b65e732d.exe	102
PID 4824 wrote to memory of 3040	4824	95e53d41dd242a3f707ffc7ea0b0a831ed85b9294192e039f0b255d5b65e732d.exe	102
PID 4824 wrote to memory of 1328	4824	95e53d41dd242a3f707ffc7ea0b0a831ed85b9294192e039f0b255d5b65e732d.exe	103
PID 4824 wrote to memory of 1328	4824	95e53d41dd242a3f707ffc7ea0b0a831ed85b9294192e039f0b255d5b65e732d.exe	103
PID 4824 wrote to memory of 4544	4824	95e53d41dd242a3f707ffc7ea0b0a831ed85b9294192e039f0b255d5b65e732d.exe	104
PID 4824 wrote to memory of 4544	4824	95e53d41dd242a3f707ffc7ea0b0a831ed85b9294192e039f0b255d5b65e732d.exe	104
PID 4824 wrote to memory of 4964	4824	95e53d41dd242a3f707ffc7ea0b0a831ed85b9294192e039f0b255d5b65e732d.exe	116
PID 4824 wrote to memory of 4964	4824	95e53d41dd242a3f707ffc7ea0b0a831ed85b9294192e039f0b255d5b65e732d.exe	116
PID 4964 wrote to memory of 3032	4964	cmd.exe	118
PID 4964 wrote to memory of 3032	4964	cmd.exe	118
PID 4964 wrote to memory of 4752	4964	cmd.exe	125
PID 4964 wrote to memory of 4752	4964	cmd.exe	125
PID 4752 wrote to memory of 3596	4752	TextInputHost.exe	129
PID 4752 wrote to memory of 3596	4752	TextInputHost.exe	129
PID 4752 wrote to memory of 5068	4752	TextInputHost.exe	130
PID 4752 wrote to memory of 5068	4752	TextInputHost.exe	130
PID 3596 wrote to memory of 2124	3596	WScript.exe	135
PID 3596 wrote to memory of 2124	3596	WScript.exe	135
PID 2124 wrote to memory of 1276	2124	TextInputHost.exe	139
PID 2124 wrote to memory of 1276	2124	TextInputHost.exe	139
PID 2124 wrote to memory of 2920	2124	TextInputHost.exe	140
PID 2124 wrote to memory of 2920	2124	TextInputHost.exe	140
PID 1276 wrote to memory of 3428	1276	WScript.exe	142
PID 1276 wrote to memory of 3428	1276	WScript.exe	142
PID 3428 wrote to memory of 2744	3428	TextInputHost.exe	144
PID 3428 wrote to memory of 2744	3428	TextInputHost.exe	144
PID 3428 wrote to memory of 820	3428	TextInputHost.exe	145
PID 3428 wrote to memory of 820	3428	TextInputHost.exe	145
PID 2744 wrote to memory of 220	2744	WScript.exe	147
PID 2744 wrote to memory of 220	2744	WScript.exe	147
PID 220 wrote to memory of 4068	220	TextInputHost.exe	149
PID 220 wrote to memory of 4068	220	TextInputHost.exe	149
PID 220 wrote to memory of 4644	220	TextInputHost.exe	150
PID 220 wrote to memory of 4644	220	TextInputHost.exe	150
PID 4068 wrote to memory of 3820	4068	WScript.exe	153
PID 4068 wrote to memory of 3820	4068	WScript.exe	153
PID 3820 wrote to memory of 396	3820	TextInputHost.exe	155
PID 3820 wrote to memory of 396	3820	TextInputHost.exe	155
PID 3820 wrote to memory of 2764	3820	TextInputHost.exe	156
PID 3820 wrote to memory of 2764	3820	TextInputHost.exe	156
PID 396 wrote to memory of 4948	396	WScript.exe	158
PID 396 wrote to memory of 4948	396	WScript.exe	158
PID 4948 wrote to memory of 2520	4948	TextInputHost.exe	160
PID 4948 wrote to memory of 2520	4948	TextInputHost.exe	160
PID 4948 wrote to memory of 5040	4948	TextInputHost.exe	161
PID 4948 wrote to memory of 5040	4948	TextInputHost.exe	161
PID 2520 wrote to memory of 3324	2520	WScript.exe	163
PID 2520 wrote to memory of 3324	2520	WScript.exe	163

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\95e53d41dd242a3f707ffc7ea0b0a831ed85b9294192e039f0b255d5b65e732d.exe
"C:\Users\Admin\AppData\Local\Temp\95e53d41dd242a3f707ffc7ea0b0a831ed85b9294192e039f0b255d5b65e732d.exe"
1⤵
- Drops file in Drivers directory
- Checks computer location settings
- Drops file in Program Files directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4824
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3532
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/$Recycle.Bin/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4440
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Documents and Settings/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4660
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/PerfLogs/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1492
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2284
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files (x86)/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3428
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/ProgramData/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2872
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Recovery/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3020
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/System Volume Information/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3040
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Users/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1328
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Windows/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4544
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\amHMU2DnZz.bat"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4964
- - C:\Windows\system32\w32tm.exe
    w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
    3⤵
    PID:3032
- - C:\Program Files\VideoLAN\VLC\lua\TextInputHost.exe
    "C:\Program Files\VideoLAN\VLC\lua\TextInputHost.exe"
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Modifies registry class
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:4752
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\d74fd20f-d4f3-47f3-9f5a-5b5e6ebb55b0.vbs"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:3596
    - - C:\Program Files\VideoLAN\VLC\lua\TextInputHost.exe
        
        "C:\Program Files\VideoLAN\VLC\lua\TextInputHost.exe"
        5⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2124
      - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\f4e720fc-fa8c-486f-946b-c4836831a1dd.vbs"
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:1276
        
        C:\Program Files\VideoLAN\VLC\lua\TextInputHost.exe
        
        "C:\Program Files\VideoLAN\VLC\lua\TextInputHost.exe"
        7⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3428
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\70344bfb-d890-4bfa-a024-673b45f4da88.vbs"
        8⤵
        Suspicious use of WriteProcessMemory
        
        PID:2744
        
        C:\Program Files\VideoLAN\VLC\lua\TextInputHost.exe
        
        "C:\Program Files\VideoLAN\VLC\lua\TextInputHost.exe"
        9⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:220
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\ca6c2f59-8799-4fc0-b04e-2abfe4b0cd34.vbs"
        10⤵
        Suspicious use of WriteProcessMemory
        
        PID:4068
        
        C:\Program Files\VideoLAN\VLC\lua\TextInputHost.exe
        
        "C:\Program Files\VideoLAN\VLC\lua\TextInputHost.exe"
        11⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3820
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\a56a79bb-8da6-4a7c-a1f6-6a4f81136313.vbs"
        12⤵
        Suspicious use of WriteProcessMemory
        
        PID:396
        
        C:\Program Files\VideoLAN\VLC\lua\TextInputHost.exe
        
        "C:\Program Files\VideoLAN\VLC\lua\TextInputHost.exe"
        13⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4948
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\8552a650-b9c9-4782-9c73-3fc729ef8db6.vbs"
        14⤵
        Suspicious use of WriteProcessMemory
        
        PID:2520
        
        C:\Program Files\VideoLAN\VLC\lua\TextInputHost.exe
        
        "C:\Program Files\VideoLAN\VLC\lua\TextInputHost.exe"
        15⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        
        PID:3324
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\fbabdfde-bdb7-4507-9af1-f049b9fcc4e2.vbs"
        16⤵
        
        PID:4088
        
        C:\Program Files\VideoLAN\VLC\lua\TextInputHost.exe
        
        "C:\Program Files\VideoLAN\VLC\lua\TextInputHost.exe"
        17⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        
        PID:4440
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\905978da-df6d-433a-b48a-9472259fb48b.vbs"
        18⤵
        
        PID:4312
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\715a9efa-76fd-4bff-a8b0-11eb3e653b4b.vbs"
        18⤵
        
        PID:1148
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\40725b7d-dae3-4ab2-bd34-f526f369dd59.vbs"
        16⤵
        
        PID:4260
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\67baecc1-152f-4a02-a4d6-7b9dff31397c.vbs"
        14⤵
        
        PID:5040
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\238805f4-6b0f-4ebe-82db-bbe8551df164.vbs"
        12⤵
        
        PID:2764
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\90efd9cd-b460-4e7e-a0f7-df4e17643d55.vbs"
        10⤵
        
        PID:4644
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\22e4f295-5143-4ae4-b6bc-1e287c2c954e.vbs"
        8⤵
        
        PID:820
      - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\a6826e27-6833-48db-92b7-b96089f23b06.vbs"
        6⤵
        
        PID:2920
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\5679071b-7c30-4002-ac57-48e41033260d.vbs"
      4⤵
      PID:5068

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 6 /tr "'C:\Users\Default\SendTo\fontdrvhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1708

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\Users\Default\SendTo\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2976

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 12 /tr "'C:\Users\Default\SendTo\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2320

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "TextInputHostT" /sc MINUTE /mo 13 /tr "'C:\Program Files\VideoLAN\VLC\lua\TextInputHost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3012

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "TextInputHost" /sc ONLOGON /tr "'C:\Program Files\VideoLAN\VLC\lua\TextInputHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1156

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "TextInputHostT" /sc MINUTE /mo 6 /tr "'C:\Program Files\VideoLAN\VLC\lua\TextInputHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:532

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 14 /tr "'C:\Users\Default User\csrss.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3672

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Users\Default User\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1160

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 11 /tr "'C:\Users\Default User\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3200

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\TextInputHost.exe.log

Filesize
1KB

MD5
4a667f150a4d1d02f53a9f24d89d53d1

SHA1
306e125c9edce66f28fdb63e6c4ca5c9ad6e8c97

SHA256
414659decfd237dde09625a49811e03b5b30ee06ee2ee97ea8bcfac394d281fd

SHA512
4edd8e73ce03488a6d92750a782cd4042fbb54a5b3f8d8ba3ea227fda0653c2cd84f0c5d64976c7cdc1f518a2fdc8ff10e2a015ec7acf3cd01b0d62bc98542d8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
a43e653ffb5ab07940f4bdd9cc8fade4

SHA1
af43d04e3427f111b22dc891c5c7ee8a10ac4123

SHA256
c4c53abb13e99475aebfbe9fec7a8fead81c14c80d9dcc2b81375304f3a683fe

SHA512
62a97e95e1f19a8d4302847110dae44f469877eed6aa8ea22345c6eb25ee220e7d310fa0b7ec5df42356815421c0af7c46a0f1fee8933cc446641800eda6cd1b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
e9b83f48f6d18a70a0204fc6927471ba

SHA1
b2122ea0ba394a320b53605bdc9991c14c87ec8e

SHA256
cfc12de174fffd850f98ddc488818e207c6c0f7e80685a6055665062b9f057a5

SHA512
32ca1b677be6c80696e2a053862ba21f361d4e58ec96dd77950e88a3be4ed18b5ce3dc7ed4702ce61b261e62cc3fcf42a1f45ef7dc25297cb53bdc6a30ada38c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
bd5940f08d0be56e65e5f2aaf47c538e

SHA1
d7e31b87866e5e383ab5499da64aba50f03e8443

SHA256
2d2f364c75bd2897504249f42cdf1d19374f5230aad68fa9154ea3d03e3031a6

SHA512
c34d10c7e07da44a180fae9889b61f08903aa84e8ddfa80c31c272b1ef9d491b8cec6b8a4c836c3cb1583fe8f4955c6a8db872515de3a9e10eae09610c959406

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
a8e8360d573a4ff072dcc6f09d992c88

SHA1
3446774433ceaf0b400073914facab11b98b6807

SHA256
bf5e284e8f95122bf75ead61c7e2b40f55c96742b05330b5b1cb7915991df13b

SHA512
4ee5167643d82082f57c42616007ef9be57f43f9731921bdf7bca611a914724ad94072d3c8f5b130fa54129e5328ccdebf37ba74339c37deb53e79df5cdf0dbe

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
2e907f77659a6601fcc408274894da2e

SHA1
9f5b72abef1cd7145bf37547cdb1b9254b4efe9d

SHA256
385da35673330e21ac02545220552fe301fe54dedefbdafc097ac4342a295233

SHA512
34fa0fff24f6550f55f828541aaefe5d75c86f8f0842d54b50065e9746f9662bb7209c74c9a9571540b9855bb3851f01db613190024e89b198d485bb5dc07721

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
cadef9abd087803c630df65264a6c81c

SHA1
babbf3636c347c8727c35f3eef2ee643dbcc4bd2

SHA256
cce65b73cdfe9304bcd5207913e8b60fb69faa20cd3b684f2b0343b755b99438

SHA512
7278aa87124abb382d9024a645e881e7b7cf1b84e8894943b36e018dbf0399e6858392f77980b599fa5488e2e21bf757a0702fe6419417edac93b68e0c2ec085

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
8320aeea03d40a74715d8b9613f9d0cc

SHA1
09fcf3cf06de496b434aaf3181f5aed78731425e

SHA256
54d89ac6af0379f2fa8afc5137450f796cd22f70da2b6b68a299b23c521eb205

SHA512
7d6fd85c54a4c8a63069fa02cd8b892f448be8b11b97190653864a076bfe5f2d4061b354ce2e3ad8b49a0e482ee90992493bb823f5e6f664dc7ac3937a547dba

Download Submit
C:\Users\Admin\AppData\Local\Temp\5679071b-7c30-4002-ac57-48e41033260d.vbs

Filesize
503B

MD5
391d85da34b3122acae3daf04f13575c

SHA1
10d08c45be05590a0daf44b7c6184e9f9d3d77c5

SHA256
cc7f19aa222c0ede507206bfd68a61952fa3e2c09e9f430cce8f5929c979552c

SHA512
177707b16698dfd43ef05a08d3e126c3d78f70e69ed813085100c09e4309010d9d8ddcee9463ef2852685373cc168cb2b897efc828fa09d9f1a873c4e650ad55

Download Submit
C:\Users\Admin\AppData\Local\Temp\70344bfb-d890-4bfa-a024-673b45f4da88.vbs

Filesize
727B

MD5
0caa73a61b073d4089f41715a1435ee1

SHA1
4a167da2b94bb17e197999312edb1f95975b5ee2

SHA256
53d214ab5af7c9f8ae3e153aa2b5f81cbd406f4108a01b807fd297f3c1ca538f

SHA512
e362358b7974cf8dc715f6e14eef5cb394ce20655e14e264147d9d3a5660e7d7d7a646bb36421354ba6ea01333eddeddea96b02c9e3aa6be30f46d8de17f71b6

Download Submit
C:\Users\Admin\AppData\Local\Temp\8552a650-b9c9-4782-9c73-3fc729ef8db6.vbs

Filesize
727B

MD5
07068f6174f956ee8d098b90ce28a065

SHA1
dec39412a5cb3cf2b03b3a74bca7ae5d7d98e275

SHA256
9385be60ae66b787e4f45054dacc58cf98c91ca5f95e2e63375de03a17865d87

SHA512
341a064b9c371911df1fdf29dddec6419bfc28dd532454124c4583bbce6360eecdb21310b3cc694312f804e0a2e6da9a015337a35886acf30267fcbd3db1227a

Download Submit
C:\Users\Admin\AppData\Local\Temp\905978da-df6d-433a-b48a-9472259fb48b.vbs

Filesize
727B

MD5
527d146af4b9032ee388b4ebc94d0318

SHA1
bdc3869b647dce682513835607adf89baa4f049c

SHA256
3189f8a1447c6639eba1769dbff6694681c9aee06a2e474ad56496f7ed73e73a

SHA512
54938aa02173e5eecc408814fa0300daa8d736a0b6fae78988b20fe415222b819e992b4064707f75be32b0e0758d962394f758ed32572a3f0bb4492da6768338

Download Submit
C:\Users\Admin\AppData\Local\Temp\RCX9DB8.tmp

Filesize
1.7MB

MD5
9bc6e385c3ed07d8041688367cd4c950

SHA1
f33c82f203ce08807d5f4429e6f4c858ec8b8dc6

SHA256
33caab6b7bafb73cfbce6985958218a9cbba607227265077489621521e8555bc

SHA512
57d183506d509d587a998e9a2069f3c0c8ef5cdeb31f8a8fbbfa280c120f5e373f9ff213081fea07f8fa1c55d2d95353cf7a78979703df5eb3a5602126b4e2ad

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_seealusb.yuk.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\a56a79bb-8da6-4a7c-a1f6-6a4f81136313.vbs

Filesize
727B

MD5
9b48e6ea2adef575a74d1f5f6ecc8bbd

SHA1
ab66467b5ec977507664968ba16fb2e47c3735f8

SHA256
f705c155e64fca1080d3e31cec37efa6dd33164bc526fee890bf8ae5e6109469

SHA512
310ed9a072ae385686a0f99e1d32633d17f2e9b76e810d674093dafe6b6c6758a206818026e5b7f53c605f7a551b9ab5ec46bbe0e6102751b0b5eeaee204d40b

Download Submit
C:\Users\Admin\AppData\Local\Temp\amHMU2DnZz.bat

Filesize
216B

MD5
2aaca0366e6d55bc809e03855d05c544

SHA1
244834e368f46730c32c63b0cd757ea1676298b2

SHA256
5bc414c9c806110a52b90f62934525a4376a7dccdf439b5ab8ab327fc7f86833

SHA512
3e947027d99e10b6b19de175d4c08ff88151499a36c4449e4aed56a54e6965825656ea8b44ca42721e8b0ffb0869d3bf2757a7abff996571f0bca273acd009f3

Download Submit
C:\Users\Admin\AppData\Local\Temp\ca6c2f59-8799-4fc0-b04e-2abfe4b0cd34.vbs

Filesize
726B

MD5
f98a761a7526699451bdd804269a4163

SHA1
73ae825da79bf7c1cfbbaf0f4b7a2434aceb3931

SHA256
36d0f5b532724b00e19e281902cd898b72e37272673d6ec48e7e45385c4ac1d7

SHA512
71e5f721044ab6359a0f3c2ce3580243ab8e5d0033fe5cbe4f0c88b16e22ecdcf98faf0ead40d81cdd78afd9506e96dc29e5ba4fa505feb5c8ed98500785d072

Download Submit
C:\Users\Admin\AppData\Local\Temp\d74fd20f-d4f3-47f3-9f5a-5b5e6ebb55b0.vbs

Filesize
727B

MD5
dc55eefb7075a55f3f687175a6916f09

SHA1
cc0f6a27c8bfe51eac47a7cb7b0093d028e9c28a

SHA256
9466b62991ed581c57b7397d08fa2a546e69c8c55b86d90f2814a4f55f9c75b2

SHA512
b66fc30f528117865f25ab7faf8b3028e397e9ee1594064a03bc383504278c6ce0492fa3604020271921d64102e5972afce6f19741e6bc251a166bbcea46ed03

Download Submit
C:\Users\Admin\AppData\Local\Temp\f4e720fc-fa8c-486f-946b-c4836831a1dd.vbs

Filesize
727B

MD5
1d5809a0c9f3d9b85f66efdfd7e1e840

SHA1
cfdc455410130c8d943286fe4aa903db84a410b2

SHA256
eaad3679a593ba1e5b763ae62c8d9da6da5275e284cf2412c08be354c6a83c42

SHA512
7f6fffb69cabf7dd531210f7501c4a50367521242f4d4d6c041b0e778ef35d37da529058967d3ebfef27e2768bf8df9e574c2c71ea5a5f593377544e27e43c17

Download Submit
C:\Users\Admin\AppData\Local\Temp\fbabdfde-bdb7-4507-9af1-f049b9fcc4e2.vbs

Filesize
727B

MD5
8733d2f7d5cff76fc4ba52eedab36eb1

SHA1
4bd1e7285b8666ac0c142f551142a8601b1b8ab9

SHA256
f4106996da3548d5935019afc3bcb85ebcb622ac9fe762f8e8c1ea1448448185

SHA512
eabafb0bbf350e917078cd36cb6ac2101b778e5e190449f6ef29a1eae6f5ecd58c7f5b8ae7d72765f7b5f914567d7e3ef00822469596161c43f742d7ba43b777

Download Submit
C:\Users\Default\csrss.exe

Filesize
1.7MB

MD5
7c97a2dee41b987eae2f01394bb56c65

SHA1
af9619a3f2ebc2a8eb53bff32e3d7a91900ced01

SHA256
58a31dd3771ec81553d07b69e2c2d10d7fd0e8e101b5fc69565c7f60e65233bf

SHA512
4cb44db9a2a1a5e2816b5aa63798fe971614b135ea824d2fe1e7bdbd44b6e144315d20a7a88383278c604b9b84450216fb780795a48d0e8ce94b926a6128d690

Download Submit
memory/1492-83-0x0000019B42A20000-0x0000019B42A42000-memory.dmp

Filesize
136KB

Download
memory/4824-14-0x000000001B8A0000-0x000000001B8AC000-memory.dmp

Filesize
48KB

Download
memory/4824-22-0x00007FFA81940000-0x00007FFA82401000-memory.dmp

Filesize
10.8MB

Download
memory/4824-12-0x000000001B870000-0x000000001B882000-memory.dmp

Filesize
72KB

Download
memory/4824-0-0x00007FFA81943000-0x00007FFA81945000-memory.dmp

Filesize
8KB

Download
memory/4824-15-0x000000001BA00000-0x000000001BA0A000-memory.dmp

Filesize
40KB

Download
memory/4824-19-0x000000001BB40000-0x000000001BB4C000-memory.dmp

Filesize
48KB

Download
memory/4824-16-0x000000001BA10000-0x000000001BA1E000-memory.dmp

Filesize
56KB

Download
memory/4824-17-0x000000001BA20000-0x000000001BA28000-memory.dmp

Filesize
32KB

Download
memory/4824-10-0x000000001B860000-0x000000001B868000-memory.dmp

Filesize
32KB

Download
memory/4824-23-0x00007FFA81940000-0x00007FFA82401000-memory.dmp

Filesize
10.8MB

Download
memory/4824-1-0x0000000000410000-0x00000000005D0000-memory.dmp

Filesize
1.8MB

Download
memory/4824-73-0x00007FFA81940000-0x00007FFA82401000-memory.dmp

Filesize
10.8MB

Download
memory/4824-18-0x000000001BB30000-0x000000001BB3C000-memory.dmp

Filesize
48KB

Download
memory/4824-9-0x000000001B240000-0x000000001B24C000-memory.dmp

Filesize
48KB

Download
memory/4824-7-0x000000001B220000-0x000000001B236000-memory.dmp

Filesize
88KB

Download
memory/4824-8-0x000000001B170000-0x000000001B180000-memory.dmp

Filesize
64KB

Download
memory/4824-5-0x0000000002740000-0x0000000002748000-memory.dmp

Filesize
32KB

Download
memory/4824-6-0x0000000002780000-0x0000000002790000-memory.dmp

Filesize
64KB

Download
memory/4824-4-0x000000001B8B0000-0x000000001B900000-memory.dmp

Filesize
320KB

Download
memory/4824-3-0x0000000002760000-0x000000000277C000-memory.dmp

Filesize
112KB

Download
memory/4824-2-0x00007FFA81940000-0x00007FFA82401000-memory.dmp

Filesize
10.8MB

Download
memory/4824-13-0x000000001BE30000-0x000000001C358000-memory.dmp

Filesize
5.2MB

Download