dcrat | ae7f38d1046b35971075b9f63352a21faee2f6ee0e77bebf83a5f4bac45779a4

Analysis

max time kernel
146s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
22-12-2024 00:23

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

JaffaCakes118_ae7f38d1046b35971075b9f63352a21faee2f6ee0e77bebf83a5f4bac45779a4.exe
Size

1.3MB
MD5

e2c50503a3a3e38102f75f04197b73ef
SHA1

7b5fa694c801890f078ca509a7fb948c03f5bdf1
SHA256

ae7f38d1046b35971075b9f63352a21faee2f6ee0e77bebf83a5f4bac45779a4
SHA512

4ae8c38ca0a983e4be6ddba989c900ed9ec4197c5736bb5481dbd20e83a4396a64457318020e07bd0a5728d8f4e7a062be313aca4f71c29b98d6c3240a7c364d
SSDEEP

24576:U2G/nvxW3Ww0t6TnzGmVBDh4+aknuRRZJND0gFJ4rD/IjC:UbA30GnzV/q+DnsXg

Score

10^/10

dcrat discovery execution infostealer rat

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat
Dcrat family
dcrat

Process spawned unexpected child process 9 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3212	1360	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2340	1360	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	228	1360	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4936	1360	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2180	1360	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3232	1360	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4076	1360	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4876	1360	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1840	1360	schtasks.exe	86

DCRat payload 2 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral2/files/0x0007000000023c9b-10.dat	dcrat
behavioral2/memory/644-13-0x0000000000F80000-0x0000000001090000-memory.dmp	dcrat

Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
3680	powershell.exe
3092	powershell.exe
4432	powershell.exe
2668	powershell.exe

Checks computer location settings 2 TTPs 17 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\International\Geo\Nation	SppExtComObj.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\International\Geo\Nation	DllCommonsvc.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\International\Geo\Nation	SppExtComObj.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\International\Geo\Nation	SppExtComObj.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\International\Geo\Nation	SppExtComObj.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\International\Geo\Nation	WScript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\International\Geo\Nation	SppExtComObj.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\International\Geo\Nation	JaffaCakes118_ae7f38d1046b35971075b9f63352a21faee2f6ee0e77bebf83a5f4bac45779a4.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\International\Geo\Nation	SppExtComObj.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\International\Geo\Nation	SppExtComObj.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\International\Geo\Nation	SppExtComObj.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\International\Geo\Nation	SppExtComObj.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\International\Geo\Nation	SppExtComObj.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\International\Geo\Nation	SppExtComObj.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\International\Geo\Nation	SppExtComObj.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\International\Geo\Nation	SppExtComObj.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\International\Geo\Nation	SppExtComObj.exe

Executes dropped EXE 15 IoCs

pid	Process
644	DllCommonsvc.exe
2040	SppExtComObj.exe
3512	SppExtComObj.exe
1592	SppExtComObj.exe
3216	SppExtComObj.exe
4032	SppExtComObj.exe
3384	SppExtComObj.exe
724	SppExtComObj.exe
3480	SppExtComObj.exe
2092	SppExtComObj.exe
460	SppExtComObj.exe
3988	SppExtComObj.exe
4032	SppExtComObj.exe
1916	SppExtComObj.exe
4684	SppExtComObj.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 15 IoCs

Web Service

T1102

flow	ioc
45	raw.githubusercontent.com
46	raw.githubusercontent.com
17	raw.githubusercontent.com
42	raw.githubusercontent.com
47	raw.githubusercontent.com
53	raw.githubusercontent.com
56	raw.githubusercontent.com
18	raw.githubusercontent.com
41	raw.githubusercontent.com
52	raw.githubusercontent.com
55	raw.githubusercontent.com
25	raw.githubusercontent.com
40	raw.githubusercontent.com
38	raw.githubusercontent.com
54	raw.githubusercontent.com

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_ae7f38d1046b35971075b9f63352a21faee2f6ee0e77bebf83a5f4bac45779a4.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Modifies registry class 15 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000_Classes\Local Settings	SppExtComObj.exe
Key created	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000_Classes\Local Settings	SppExtComObj.exe
Key created	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000_Classes\Local Settings	SppExtComObj.exe
Key created	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000_Classes\Local Settings	SppExtComObj.exe
Key created	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000_Classes\Local Settings	SppExtComObj.exe
Key created	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000_Classes\Local Settings	SppExtComObj.exe
Key created	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000_Classes\Local Settings	SppExtComObj.exe
Key created	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000_Classes\Local Settings	SppExtComObj.exe
Key created	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000_Classes\Local Settings	SppExtComObj.exe
Key created	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000_Classes\Local Settings	SppExtComObj.exe
Key created	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000_Classes\Local Settings	JaffaCakes118_ae7f38d1046b35971075b9f63352a21faee2f6ee0e77bebf83a5f4bac45779a4.exe
Key created	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000_Classes\Local Settings	SppExtComObj.exe
Key created	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000_Classes\Local Settings	SppExtComObj.exe
Key created	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000_Classes\Local Settings	SppExtComObj.exe
Key created	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000_Classes\Local Settings	SppExtComObj.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 9 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4876	schtasks.exe
1840	schtasks.exe
3212	schtasks.exe
2340	schtasks.exe
2180	schtasks.exe
3232	schtasks.exe
228	schtasks.exe
4936	schtasks.exe
4076	schtasks.exe

Suspicious behavior: EnumeratesProcesses 29 IoCs

pid	Process
644	DllCommonsvc.exe
644	DllCommonsvc.exe
644	DllCommonsvc.exe
644	DllCommonsvc.exe
644	DllCommonsvc.exe
644	DllCommonsvc.exe
644	DllCommonsvc.exe
3680	powershell.exe
3092	powershell.exe
4432	powershell.exe
3680	powershell.exe
2668	powershell.exe
2040	SppExtComObj.exe
3092	powershell.exe
4432	powershell.exe
2668	powershell.exe
3512	SppExtComObj.exe
1592	SppExtComObj.exe
3216	SppExtComObj.exe
4032	SppExtComObj.exe
3384	SppExtComObj.exe
724	SppExtComObj.exe
3480	SppExtComObj.exe
2092	SppExtComObj.exe
460	SppExtComObj.exe
3988	SppExtComObj.exe
4032	SppExtComObj.exe
1916	SppExtComObj.exe
4684	SppExtComObj.exe

Suspicious use of AdjustPrivilegeToken 19 IoCs

description	pid	Process
Token: SeDebugPrivilege	644	DllCommonsvc.exe
Token: SeDebugPrivilege	3680	powershell.exe
Token: SeDebugPrivilege	3092	powershell.exe
Token: SeDebugPrivilege	2668	powershell.exe
Token: SeDebugPrivilege	4432	powershell.exe
Token: SeDebugPrivilege	2040	SppExtComObj.exe
Token: SeDebugPrivilege	3512	SppExtComObj.exe
Token: SeDebugPrivilege	1592	SppExtComObj.exe
Token: SeDebugPrivilege	3216	SppExtComObj.exe
Token: SeDebugPrivilege	4032	SppExtComObj.exe
Token: SeDebugPrivilege	3384	SppExtComObj.exe
Token: SeDebugPrivilege	724	SppExtComObj.exe
Token: SeDebugPrivilege	3480	SppExtComObj.exe
Token: SeDebugPrivilege	2092	SppExtComObj.exe
Token: SeDebugPrivilege	460	SppExtComObj.exe
Token: SeDebugPrivilege	3988	SppExtComObj.exe
Token: SeDebugPrivilege	4032	SppExtComObj.exe
Token: SeDebugPrivilege	1916	SppExtComObj.exe
Token: SeDebugPrivilege	4684	SppExtComObj.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2172 wrote to memory of 1648	2172	JaffaCakes118_ae7f38d1046b35971075b9f63352a21faee2f6ee0e77bebf83a5f4bac45779a4.exe	82
PID 2172 wrote to memory of 1648	2172	JaffaCakes118_ae7f38d1046b35971075b9f63352a21faee2f6ee0e77bebf83a5f4bac45779a4.exe	82
PID 2172 wrote to memory of 1648	2172	JaffaCakes118_ae7f38d1046b35971075b9f63352a21faee2f6ee0e77bebf83a5f4bac45779a4.exe	82
PID 1648 wrote to memory of 4324	1648	WScript.exe	83
PID 1648 wrote to memory of 4324	1648	WScript.exe	83
PID 1648 wrote to memory of 4324	1648	WScript.exe	83
PID 4324 wrote to memory of 644	4324	cmd.exe	85
PID 4324 wrote to memory of 644	4324	cmd.exe	85
PID 644 wrote to memory of 3680	644	DllCommonsvc.exe	96
PID 644 wrote to memory of 3680	644	DllCommonsvc.exe	96
PID 644 wrote to memory of 3092	644	DllCommonsvc.exe	97
PID 644 wrote to memory of 3092	644	DllCommonsvc.exe	97
PID 644 wrote to memory of 2668	644	DllCommonsvc.exe	98
PID 644 wrote to memory of 2668	644	DllCommonsvc.exe	98
PID 644 wrote to memory of 4432	644	DllCommonsvc.exe	99
PID 644 wrote to memory of 4432	644	DllCommonsvc.exe	99
PID 644 wrote to memory of 2040	644	DllCommonsvc.exe	104
PID 644 wrote to memory of 2040	644	DllCommonsvc.exe	104
PID 2040 wrote to memory of 2388	2040	SppExtComObj.exe	110
PID 2040 wrote to memory of 2388	2040	SppExtComObj.exe	110
PID 2388 wrote to memory of 2692	2388	cmd.exe	112
PID 2388 wrote to memory of 2692	2388	cmd.exe	112
PID 2388 wrote to memory of 3512	2388	cmd.exe	115
PID 2388 wrote to memory of 3512	2388	cmd.exe	115
PID 3512 wrote to memory of 3980	3512	SppExtComObj.exe	116
PID 3512 wrote to memory of 3980	3512	SppExtComObj.exe	116
PID 3980 wrote to memory of 1368	3980	cmd.exe	118
PID 3980 wrote to memory of 1368	3980	cmd.exe	118
PID 3980 wrote to memory of 1592	3980	cmd.exe	119
PID 3980 wrote to memory of 1592	3980	cmd.exe	119
PID 1592 wrote to memory of 2896	1592	SppExtComObj.exe	122
PID 1592 wrote to memory of 2896	1592	SppExtComObj.exe	122
PID 2896 wrote to memory of 1524	2896	cmd.exe	124
PID 2896 wrote to memory of 1524	2896	cmd.exe	124
PID 2896 wrote to memory of 3216	2896	cmd.exe	125
PID 2896 wrote to memory of 3216	2896	cmd.exe	125
PID 3216 wrote to memory of 2624	3216	SppExtComObj.exe	126
PID 3216 wrote to memory of 2624	3216	SppExtComObj.exe	126
PID 2624 wrote to memory of 748	2624	cmd.exe	128
PID 2624 wrote to memory of 748	2624	cmd.exe	128
PID 2624 wrote to memory of 4032	2624	cmd.exe	129
PID 2624 wrote to memory of 4032	2624	cmd.exe	129
PID 4032 wrote to memory of 1504	4032	SppExtComObj.exe	130
PID 4032 wrote to memory of 1504	4032	SppExtComObj.exe	130
PID 1504 wrote to memory of 4052	1504	cmd.exe	132
PID 1504 wrote to memory of 4052	1504	cmd.exe	132
PID 1504 wrote to memory of 3384	1504	cmd.exe	133
PID 1504 wrote to memory of 3384	1504	cmd.exe	133
PID 3384 wrote to memory of 1588	3384	SppExtComObj.exe	134
PID 3384 wrote to memory of 1588	3384	SppExtComObj.exe	134
PID 1588 wrote to memory of 1816	1588	cmd.exe	136
PID 1588 wrote to memory of 1816	1588	cmd.exe	136
PID 1588 wrote to memory of 724	1588	cmd.exe	137
PID 1588 wrote to memory of 724	1588	cmd.exe	137
PID 724 wrote to memory of 1468	724	SppExtComObj.exe	138
PID 724 wrote to memory of 1468	724	SppExtComObj.exe	138
PID 1468 wrote to memory of 4944	1468	cmd.exe	140
PID 1468 wrote to memory of 4944	1468	cmd.exe	140
PID 1468 wrote to memory of 3480	1468	cmd.exe	141
PID 1468 wrote to memory of 3480	1468	cmd.exe	141
PID 3480 wrote to memory of 2744	3480	SppExtComObj.exe	142
PID 3480 wrote to memory of 2744	3480	SppExtComObj.exe	142
PID 2744 wrote to memory of 3360	2744	cmd.exe	144
PID 2744 wrote to memory of 3360	2744	cmd.exe	144

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_ae7f38d1046b35971075b9f63352a21faee2f6ee0e77bebf83a5f4bac45779a4.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_ae7f38d1046b35971075b9f63352a21faee2f6ee0e77bebf83a5f4bac45779a4.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2172
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\providercommon\yTUdeXjbLOhnrN32dgrxVg.vbe"
  2⤵
  - Checks computer location settings
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1648
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\providercommon\1zu9dW.bat" "
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4324
  - - C:\providercommon\DllCommonsvc.exe
      "C:\providercommon\DllCommonsvc.exe"
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:644
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\DllCommonsvc.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3680
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\services.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3092
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\WindowsRE\csrss.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2668
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\All Users\Desktop\SppExtComObj.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4432
    - - C:\Users\All Users\Desktop\SppExtComObj.exe
        
        "C:\Users\All Users\Desktop\SppExtComObj.exe"
        5⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2040
      - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\5ixwcMXCIg.bat"
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:2388
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        7⤵
        
        PID:2692
        
        C:\Users\All Users\Desktop\SppExtComObj.exe
        
        "C:\Users\All Users\Desktop\SppExtComObj.exe"
        7⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3512
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\0WHmS6dpJ0.bat"
        8⤵
        Suspicious use of WriteProcessMemory
        
        PID:3980
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        9⤵
        
        PID:1368
        
        C:\Users\All Users\Desktop\SppExtComObj.exe
        
        "C:\Users\All Users\Desktop\SppExtComObj.exe"
        9⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1592
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\XIXHPi7vyc.bat"
        10⤵
        Suspicious use of WriteProcessMemory
        
        PID:2896
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        11⤵
        
        PID:1524
        
        C:\Users\All Users\Desktop\SppExtComObj.exe
        
        "C:\Users\All Users\Desktop\SppExtComObj.exe"
        11⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3216
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\g1eT93LUFj.bat"
        12⤵
        Suspicious use of WriteProcessMemory
        
        PID:2624
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        13⤵
        
        PID:748
        
        C:\Users\All Users\Desktop\SppExtComObj.exe
        
        "C:\Users\All Users\Desktop\SppExtComObj.exe"
        13⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4032
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\j8BV8simza.bat"
        14⤵
        Suspicious use of WriteProcessMemory
        
        PID:1504
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        15⤵
        
        PID:4052
        
        C:\Users\All Users\Desktop\SppExtComObj.exe
        
        "C:\Users\All Users\Desktop\SppExtComObj.exe"
        15⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3384
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\qwHeC7tSxv.bat"
        16⤵
        Suspicious use of WriteProcessMemory
        
        PID:1588
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        17⤵
        
        PID:1816
        
        C:\Users\All Users\Desktop\SppExtComObj.exe
        
        "C:\Users\All Users\Desktop\SppExtComObj.exe"
        17⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:724
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\8Usvo58uhQ.bat"
        18⤵
        Suspicious use of WriteProcessMemory
        
        PID:1468
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        19⤵
        
        PID:4944
        
        C:\Users\All Users\Desktop\SppExtComObj.exe
        
        "C:\Users\All Users\Desktop\SppExtComObj.exe"
        19⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3480
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\EOJxze5tr1.bat"
        20⤵
        Suspicious use of WriteProcessMemory
        
        PID:2744
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        21⤵
        
        PID:3360
        
        C:\Users\All Users\Desktop\SppExtComObj.exe
        
        "C:\Users\All Users\Desktop\SppExtComObj.exe"
        21⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2092
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\6Zqs8041Oe.bat"
        22⤵
        
        PID:1680
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        23⤵
        
        PID:1672
        
        C:\Users\All Users\Desktop\SppExtComObj.exe
        
        "C:\Users\All Users\Desktop\SppExtComObj.exe"
        23⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:460
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\zlkj4ltLQI.bat"
        24⤵
        
        PID:1644
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        25⤵
        
        PID:468
        
        C:\Users\All Users\Desktop\SppExtComObj.exe
        
        "C:\Users\All Users\Desktop\SppExtComObj.exe"
        25⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3988
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\c0TJHXkWh8.bat"
        26⤵
        
        PID:4984
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        27⤵
        
        PID:2132
        
        C:\Users\All Users\Desktop\SppExtComObj.exe
        
        "C:\Users\All Users\Desktop\SppExtComObj.exe"
        27⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4032
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\AQtyVABn1C.bat"
        28⤵
        
        PID:3668
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        29⤵
        
        PID:2524
        
        C:\Users\All Users\Desktop\SppExtComObj.exe
        
        "C:\Users\All Users\Desktop\SppExtComObj.exe"
        29⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1916
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\srJhtCwLGi.bat"
        30⤵
        
        PID:4456
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        31⤵
        
        PID:1788
        
        C:\Users\All Users\Desktop\SppExtComObj.exe
        
        "C:\Users\All Users\Desktop\SppExtComObj.exe"
        31⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4684
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\Y23Kn3rQqK.bat"
        32⤵
        
        PID:3544
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        33⤵
        
        PID:4144

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 14 /tr "'C:\providercommon\services.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3212

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "services" /sc ONLOGON /tr "'C:\providercommon\services.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2340

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 13 /tr "'C:\providercommon\services.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:228

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 5 /tr "'C:\Recovery\WindowsRE\csrss.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4936

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2180

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 8 /tr "'C:\Recovery\WindowsRE\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3232

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SppExtComObjS" /sc MINUTE /mo 9 /tr "'C:\Users\All Users\Desktop\SppExtComObj.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4076

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SppExtComObj" /sc ONLOGON /tr "'C:\Users\All Users\Desktop\SppExtComObj.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4876

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SppExtComObjS" /sc MINUTE /mo 9 /tr "'C:\Users\All Users\Desktop\SppExtComObj.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1840

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\SppExtComObj.exe.log

Filesize
1KB

MD5
baf55b95da4a601229647f25dad12878

SHA1
abc16954ebfd213733c4493fc1910164d825cac8

SHA256
ee954c5d8156fd8890e582c716e5758ed9b33721258f10e758bdc31ccbcb1924

SHA512
24f502fedb1a305d0d7b08857ffc1db9b2359ff34e06d5748ecc84e35c985f29a20d9f0a533bea32d234ab37097ec0481620c63b14ac89b280e75e14d19fd545

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
d85ba6ff808d9e5444a4b369f5bc2730

SHA1
31aa9d96590fff6981b315e0b391b575e4c0804a

SHA256
84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

SHA512
8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
77d622bb1a5b250869a3238b9bc1402b

SHA1
d47f4003c2554b9dfc4c16f22460b331886b191b

SHA256
f97ff12a8abf4bf88bb6497bd2ac2da12628c8847a8ba5a9026bdbb76507cdfb

SHA512
d6789b5499f23c9035375a102271e17a8a82e57d6f5312fa24242e08a83efdeb8becb7622f55c4cf1b89c7d864b445df11f4d994cf7e2f87a900535bcca12fd9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
d28a889fd956d5cb3accfbaf1143eb6f

SHA1
157ba54b365341f8ff06707d996b3635da8446f7

SHA256
21e5d7ccf80a293e6ba30ed728846ca19c929c52b96e2c8d34e27cd2234f1d45

SHA512
0b6d88deb9be85722e6a78d5886d49f2caf407a59e128d2b4ed74c1356f9928c40048a62731959f2460e9ff9d9feee311043d2a37abe3bb92c2b76a44281478c

Download Submit
C:\Users\Admin\AppData\Local\Temp\0WHmS6dpJ0.bat

Filesize
208B

MD5
3cb41dace5befb0381405e4d93815d4b

SHA1
579d7e559d1d9f217966927b7e436551a5eb4958

SHA256
74e82e68fce73957250d77bd54d6a310d855576404fd03ef5792ac3ced4446fe

SHA512
62af04926f746c634000bc4c1b561a6ce541c9bdfd1d961296a941879f37ee4ab33f9f7c9ca425ac26cfb98a2250b2554706029134b24ca24bd9791ab3655efe

Download Submit
C:\Users\Admin\AppData\Local\Temp\5ixwcMXCIg.bat

Filesize
208B

MD5
8998e46ccf018659676844b36bdb1159

SHA1
172f9b2201b1b1bb6a8cf83a7921c4fa019e7de8

SHA256
f5da73cd71175d534b52adb9255acdb85ef1ea4c3603c866c34943e140a4a89c

SHA512
fde918dce80772abf803ca3460ec8676f7190e191b1730b472aa8f5069faf2c38705e2992e32074eb4ed9b776e39c0317055b0af18a9c3a494f585d826d1a1a0

Download Submit
C:\Users\Admin\AppData\Local\Temp\6Zqs8041Oe.bat

Filesize
208B

MD5
8266d31a5b3165e50b9d6e165950a2db

SHA1
8bc6bc9f1ec42aa10171ad59debc9027430590ad

SHA256
40426dcdd215ed3ed9d5088a57675614740cbe3a6276bc739e1f32d7fddddff4

SHA512
8532e8697c7d99af5b80a9039ebf8dd62a866c5ae21b22e55907aca60fee6367ed0db662795c5cb7699664359640572ef0d43cfa3c6c6c0eaab845d302d176f9

Download Submit
C:\Users\Admin\AppData\Local\Temp\8Usvo58uhQ.bat

Filesize
208B

MD5
9f394b9187e5a554d339e2e678441b02

SHA1
d15a5fdfb2099638600ebcb7d56283001017834c

SHA256
118029efc6d04a74269448a4d7d76c78e20d2292acb85223a96ec545a4408f7f

SHA512
6728d168b06a1f65e74378e92b3f3de20349e158068133395dc0fb1f677647ccdc7014737858c1490bde46e26b8e891034bfc60be0869ca7701be0ba8d2bdf05

Download Submit
C:\Users\Admin\AppData\Local\Temp\AQtyVABn1C.bat

Filesize
208B

MD5
763b35ea9b97f0037ded649afbf9161e

SHA1
63e3bcb6f95b10bbeb9dae6b36c02931fed46402

SHA256
a3d8ac14c1acf43435ad4da2de44f42e13e96dc3bcabd2c0d9283acfbe5a0d58

SHA512
814d7920c9e9c73bc492f92dd46b9c08ac20b09fb14e5e76a768e0342893e2aecea80b25f6cd4da34750ded66c65a2a22ca2c70595a2e7bab597e4a663e7e819

Download Submit
C:\Users\Admin\AppData\Local\Temp\EOJxze5tr1.bat

Filesize
208B

MD5
6c9b234085a6cc69c8ad03a90b049f5f

SHA1
1b1d519fa8b6991ebb36c1d270fb08edffea8884

SHA256
c859e2d0e359bcca7a083ddd72487ae884b57a27ce7fe5df5f1696925af7511b

SHA512
72274bc0953f09200d929ecb6af3deda6dfe0651b164aea3654e6088b42c5ca1c379a996db36694e672c85606d666ae4b4db36c3fea5e19a982323140bcd89e5

Download Submit
C:\Users\Admin\AppData\Local\Temp\XIXHPi7vyc.bat

Filesize
208B

MD5
606f6eef9c0f375f92d7d189e8612f9b

SHA1
40e24328f476257138feac80c5d109cee0775159

SHA256
b4af4deef41f6ab446d42c3a32b9f81a56bcdb6ea7b2d2aa698b190b02704937

SHA512
e6bb4ed116fb5611ddafcd51ddbb715d68aed8f01509f2341f600b97b3568ed502c434d58d82a9d8ed68ef6b43a80a4bb9d901933a1fac82a7644ba5b4d9a8f2

Download Submit
C:\Users\Admin\AppData\Local\Temp\Y23Kn3rQqK.bat

Filesize
208B

MD5
a1b49bbb7293a345b6d72c33ab29d852

SHA1
d59333e9cd4b37322d98da769e86e0bf1b569ac8

SHA256
e4233b56e17df68feaa0390b58d7df6059397d0f974734b2c1d390c06505b954

SHA512
8ccf64a9945de2a2ebc317e7a091bc057de0e3d8c02e917e6c9fbd85ce958e3e71201c677383721d8a65a480f00bf0b70f52b01510fb04af60273892a7accc75

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_pbbkm45a.co3.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\c0TJHXkWh8.bat

Filesize
208B

MD5
7dd7ff4945216f47f353265e31fe90fa

SHA1
2e5525a361d20e66718a6fd843c3ff6af1ed10b3

SHA256
518681a98c637e6348e5cebee13b9ecb3154c230efbf79410a967cbd18f45b43

SHA512
8b2c3756b6dc115abb5b4e5c3ac82657776bf1834cb5e2a4a5250bcdca249eb2a2cd461224a2175d606348030ab0442ea68f655969a7916b31ae8fc1956c1764

Download Submit
C:\Users\Admin\AppData\Local\Temp\g1eT93LUFj.bat

Filesize
208B

MD5
b3f1bd7626b9ab4bdf57931a0fb84334

SHA1
8c00e9d0e16481a95e759cc4be6ef4c136d94a1a

SHA256
fee3597d23c27b7995b56c134598e6f36ac3f249b347ba16d5d509930880daa6

SHA512
c293ab4971f3b84b3c0f62cd5985ed05a6954b9303950dab53dc83a5d8b05a2dea1089722fdd9cd0cea69b840e9d68215b4f4d911734dda37ae922d48fdfe42a

Download Submit
C:\Users\Admin\AppData\Local\Temp\j8BV8simza.bat

Filesize
208B

MD5
14aea102148dac30f4c3b91ce43b474c

SHA1
a8f7250755783a29f39ee9f3b54be770b40afc77

SHA256
52fcfa5e1f9f74207d75712fdc8e517310c3e9d70cc34eac533651037ee3e408

SHA512
b18c1195864d48e0bb7104eb8f4a66e8314bc884724f03c5a04adaf30489024473cf0304be28683a78800b7eb69d2605cc5fab7e0e0865a3af6ecbc436bc4222

Download Submit
C:\Users\Admin\AppData\Local\Temp\qwHeC7tSxv.bat

Filesize
208B

MD5
22bbf1e3f8d18bbae08801640bbaaab6

SHA1
d128f008ee030107309ac49b753ad678423cfed1

SHA256
cac4ff5e7a1c51c5e1d2e5692ae0f7ae90e6dfc9ec75868c158d93d3cfd9fdbf

SHA512
34550ba78ea47f5f5c39e6cea634732472e24cfcfcba96cf8df202f444364f3a8b1daf23118fcc0b6ad46f0c4223e1ddc35812d1efa360972a5dc8ee649408a5

Download Submit
C:\Users\Admin\AppData\Local\Temp\srJhtCwLGi.bat

Filesize
208B

MD5
18746bf7aadcba4204021053b64fdc43

SHA1
e673a44444f51b876c6761aefe8579912dbc2b5a

SHA256
570c58184f34a93d08c23a41f71e924e9113bf19af50cd1bfab78ef439298254

SHA512
d3a92f7b82cdca8fae6c85971a27b6f1a886f255b244281495cc88098bc333af1013d89e55c2548a19cbf70a5144fb05a1bd54d288705128ebef91cbd86e07c9

Download Submit
C:\Users\Admin\AppData\Local\Temp\zlkj4ltLQI.bat

Filesize
208B

MD5
8a2e0e4af1cf0d9863a61c5b535ad370

SHA1
f81c9240b878c43132b1f373220a707e6ed80e9b

SHA256
064ef7fd33a1b3a2af027381c6710245642829e84be3fe54c219a9d5cadc90cd

SHA512
3be679c67d69820fa4aff94cc769170dbc312823f9771db5d502552546c31547fa1ca1df0ff12f16ebf71c88dc0dfabb05f81ca43ff5284a7281445dae512cb0

Download Submit
C:\providercommon\1zu9dW.bat

Filesize
36B

MD5
6783c3ee07c7d151ceac57f1f9c8bed7

SHA1
17468f98f95bf504cc1f83c49e49a78526b3ea03

SHA256
8ab782f0f327a2021530e7230d3aee8abbecb7eed59482a3a46e78b9e3862322

SHA512
c6012d4bfac1ed14d0fd9f0eabd0e1c3d647b343db292a907b246271d52a4b7469c809db43910ddba2e8c5045f9cb3d24d0af62d363281e6cb8b39ee94a183e8

Download Submit
C:\providercommon\DllCommonsvc.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\providercommon\yTUdeXjbLOhnrN32dgrxVg.vbe

Filesize
197B

MD5
8088241160261560a02c84025d107592

SHA1
083121f7027557570994c9fc211df61730455bb5

SHA256
2072cc9a4a3b84d4c5178ab41c5588eea7d0103e3928e34d64f17bf97f3d1cc1

SHA512
20d9369dd359315848ea30144383a0bb479d86059fdbc3b3256ac84f998193512feb3b1799ab663619920c99fe7e0ebba33ada31a3855094b956fcd351c90478

Download Submit
memory/460-147-0x000000001C920000-0x000000001CAC9000-memory.dmp

Filesize
1.7MB

Download
memory/644-14-0x00000000033B0000-0x00000000033C2000-memory.dmp

Filesize
72KB

Download
memory/644-13-0x0000000000F80000-0x0000000001090000-memory.dmp

Filesize
1.1MB

Download
memory/644-12-0x00007FFA7BDB3000-0x00007FFA7BDB5000-memory.dmp

Filesize
8KB

Download
memory/644-15-0x000000001BC90000-0x000000001BC9C000-memory.dmp

Filesize
48KB

Download
memory/644-16-0x000000001BCA0000-0x000000001BCAC000-memory.dmp

Filesize
48KB

Download
memory/644-17-0x000000001BCB0000-0x000000001BCBC000-memory.dmp

Filesize
48KB

Download
memory/2040-73-0x000000001B3F0000-0x000000001B402000-memory.dmp

Filesize
72KB

Download
memory/3216-103-0x00000000014C0000-0x00000000014D2000-memory.dmp

Filesize
72KB

Download
memory/3384-117-0x0000000002170000-0x0000000002182000-memory.dmp

Filesize
72KB

Download
memory/3680-36-0x000002356DEA0000-0x000002356DEC2000-memory.dmp

Filesize
136KB

Download
memory/3988-154-0x000000001BF90000-0x000000001C139000-memory.dmp

Filesize
1.7MB

Download
memory/4032-110-0x00000000014A0000-0x00000000014B2000-memory.dmp

Filesize
72KB

Download
memory/4032-160-0x000000001C2A0000-0x000000001C449000-memory.dmp

Filesize
1.7MB

Download