dcrat | f08bab568e1877365870d1d321bb77c1e6e36f5f91b29e73c7c33d13a01c31d1

Analysis

max time kernel
149s
max time network
150s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
12-01-2025 03:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f08bab568e1877365870d1d321bb77c1e6e36f5f91b29e73c7c33d13a01c31d1.exe
Size

2.2MB
MD5

67f998093c11d8a104aef7a92a2d5b26
SHA1

cea4392bfb620e2d5b303c7f39fe68a30080a771
SHA256

f08bab568e1877365870d1d321bb77c1e6e36f5f91b29e73c7c33d13a01c31d1
SHA512

e3572eaf810f95944206728a83c822244afd079f59cef2911e11dddd85216a09663edbd8041fe5281c0ca9a6182bc5b70d77cbcc403baccbfbdc1d9c6a137e92
SSDEEP

49152:AsSHlG56vO0T3/Nh/ptuw/C3TqGaDxr1NcWTMUvif:ALlK6d3/Nh/bV/Oq3Dxp2RUG

Score

10^/10

dcrat evasion infostealer persistence rat trojan

Malware Config

Signatures

DcRat 20 IoCs

DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

rat infostealer dcrat

description	ioc	pid	Process
		2844	schtasks.exe
		1720	schtasks.exe
		1892	schtasks.exe
		2396	schtasks.exe
File created	C:\Program Files\Uninstall Information\0a1fd5f707cd16		f08bab568e1877365870d1d321bb77c1e6e36f5f91b29e73c7c33d13a01c31d1.exe
		2852	schtasks.exe
		2580	schtasks.exe
		2608	schtasks.exe
		2076	schtasks.exe
		1604	schtasks.exe
		1220	schtasks.exe
		2024	schtasks.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA		f08bab568e1877365870d1d321bb77c1e6e36f5f91b29e73c7c33d13a01c31d1.exe
		1908	schtasks.exe
		3064	schtasks.exe
		2884	schtasks.exe
		1964	schtasks.exe
		2764	schtasks.exe
		2892	schtasks.exe
		1724	schtasks.exe

Dcrat family
dcrat

Modifies WinLogon for persistence 2 TTPs 6 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files\\Uninstall Information\\sppsvc.exe\", \"C:\\Windows\\AppCompat\\Programs\\wininit.exe\""	f08bab568e1877365870d1d321bb77c1e6e36f5f91b29e73c7c33d13a01c31d1.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files\\Uninstall Information\\sppsvc.exe\", \"C:\\Windows\\AppCompat\\Programs\\wininit.exe\", \"C:\\Recovery\\1f276ee2-69f6-11ef-8b31-62cb582c238c\\services.exe\""	f08bab568e1877365870d1d321bb77c1e6e36f5f91b29e73c7c33d13a01c31d1.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files\\Uninstall Information\\sppsvc.exe\", \"C:\\Windows\\AppCompat\\Programs\\wininit.exe\", \"C:\\Recovery\\1f276ee2-69f6-11ef-8b31-62cb582c238c\\services.exe\", \"C:\\Program Files (x86)\\Microsoft SQL Server Compact Edition\\v3.5\\System.exe\""	f08bab568e1877365870d1d321bb77c1e6e36f5f91b29e73c7c33d13a01c31d1.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files\\Uninstall Information\\sppsvc.exe\", \"C:\\Windows\\AppCompat\\Programs\\wininit.exe\", \"C:\\Recovery\\1f276ee2-69f6-11ef-8b31-62cb582c238c\\services.exe\", \"C:\\Program Files (x86)\\Microsoft SQL Server Compact Edition\\v3.5\\System.exe\", \"C:\\Windows\\fr-FR\\audiodg.exe\""	f08bab568e1877365870d1d321bb77c1e6e36f5f91b29e73c7c33d13a01c31d1.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files\\Uninstall Information\\sppsvc.exe\", \"C:\\Windows\\AppCompat\\Programs\\wininit.exe\", \"C:\\Recovery\\1f276ee2-69f6-11ef-8b31-62cb582c238c\\services.exe\", \"C:\\Program Files (x86)\\Microsoft SQL Server Compact Edition\\v3.5\\System.exe\", \"C:\\Windows\\fr-FR\\audiodg.exe\", \"C:\\Windows\\es-ES\\WmiPrvSE.exe\""	f08bab568e1877365870d1d321bb77c1e6e36f5f91b29e73c7c33d13a01c31d1.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files\\Uninstall Information\\sppsvc.exe\""	f08bab568e1877365870d1d321bb77c1e6e36f5f91b29e73c7c33d13a01c31d1.exe

Process spawned unexpected child process 18 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2396	2984	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2892	2984	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2852	2984	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1908	2984	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2580	2984	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2608	2984	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3064	2984	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2884	2984	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2076	2984	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1964	2984	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2844	2984	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2764	2984	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1720	2984	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2024	2984	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1892	2984	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1604	2984	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1220	2984	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1724	2984	schtasks.exe	31

UAC bypass 3 TTPs 12 IoCs

evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	WmiPrvSE.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	f08bab568e1877365870d1d321bb77c1e6e36f5f91b29e73c7c33d13a01c31d1.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	f08bab568e1877365870d1d321bb77c1e6e36f5f91b29e73c7c33d13a01c31d1.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	f08bab568e1877365870d1d321bb77c1e6e36f5f91b29e73c7c33d13a01c31d1.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	WmiPrvSE.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	WmiPrvSE.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	WmiPrvSE.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	WmiPrvSE.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	WmiPrvSE.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	WmiPrvSE.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	WmiPrvSE.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	WmiPrvSE.exe

DCRat payload 6 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral1/memory/1928-1-0x00000000002B0000-0x00000000004DE000-memory.dmp	dcrat
behavioral1/files/0x0005000000019229-38.dat	dcrat
behavioral1/files/0x00080000000194d8-67.dat	dcrat
behavioral1/memory/624-128-0x0000000000220000-0x000000000044E000-memory.dmp	dcrat
behavioral1/memory/2804-139-0x0000000000B40000-0x0000000000D6E000-memory.dmp	dcrat
behavioral1/memory/2964-152-0x0000000000330000-0x000000000055E000-memory.dmp	dcrat

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\drivers\etc\hosts	f08bab568e1877365870d1d321bb77c1e6e36f5f91b29e73c7c33d13a01c31d1.exe

Executes dropped EXE 3 IoCs

pid	Process
624	WmiPrvSE.exe
2804	WmiPrvSE.exe
2964	WmiPrvSE.exe

Adds Run key to start application 2 TTPs 12 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Windows\CurrentVersion\Run\sppsvc = "\"C:\\Program Files\\Uninstall Information\\sppsvc.exe\""	f08bab568e1877365870d1d321bb77c1e6e36f5f91b29e73c7c33d13a01c31d1.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sppsvc = "\"C:\\Program Files\\Uninstall Information\\sppsvc.exe\""	f08bab568e1877365870d1d321bb77c1e6e36f5f91b29e73c7c33d13a01c31d1.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Windows\CurrentVersion\Run\wininit = "\"C:\\Windows\\AppCompat\\Programs\\wininit.exe\""	f08bab568e1877365870d1d321bb77c1e6e36f5f91b29e73c7c33d13a01c31d1.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\wininit = "\"C:\\Windows\\AppCompat\\Programs\\wininit.exe\""	f08bab568e1877365870d1d321bb77c1e6e36f5f91b29e73c7c33d13a01c31d1.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Windows\CurrentVersion\Run\System = "\"C:\\Program Files (x86)\\Microsoft SQL Server Compact Edition\\v3.5\\System.exe\""	f08bab568e1877365870d1d321bb77c1e6e36f5f91b29e73c7c33d13a01c31d1.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\System = "\"C:\\Program Files (x86)\\Microsoft SQL Server Compact Edition\\v3.5\\System.exe\""	f08bab568e1877365870d1d321bb77c1e6e36f5f91b29e73c7c33d13a01c31d1.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Windows\CurrentVersion\Run\audiodg = "\"C:\\Windows\\fr-FR\\audiodg.exe\""	f08bab568e1877365870d1d321bb77c1e6e36f5f91b29e73c7c33d13a01c31d1.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\audiodg = "\"C:\\Windows\\fr-FR\\audiodg.exe\""	f08bab568e1877365870d1d321bb77c1e6e36f5f91b29e73c7c33d13a01c31d1.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Windows\CurrentVersion\Run\WmiPrvSE = "\"C:\\Windows\\es-ES\\WmiPrvSE.exe\""	f08bab568e1877365870d1d321bb77c1e6e36f5f91b29e73c7c33d13a01c31d1.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WmiPrvSE = "\"C:\\Windows\\es-ES\\WmiPrvSE.exe\""	f08bab568e1877365870d1d321bb77c1e6e36f5f91b29e73c7c33d13a01c31d1.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Windows\CurrentVersion\Run\services = "\"C:\\Recovery\\1f276ee2-69f6-11ef-8b31-62cb582c238c\\services.exe\""	f08bab568e1877365870d1d321bb77c1e6e36f5f91b29e73c7c33d13a01c31d1.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\services = "\"C:\\Recovery\\1f276ee2-69f6-11ef-8b31-62cb582c238c\\services.exe\""	f08bab568e1877365870d1d321bb77c1e6e36f5f91b29e73c7c33d13a01c31d1.exe

Checks whether UAC is enabled 1 TTPs 8 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	WmiPrvSE.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	WmiPrvSE.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	WmiPrvSE.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	WmiPrvSE.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	WmiPrvSE.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	f08bab568e1877365870d1d321bb77c1e6e36f5f91b29e73c7c33d13a01c31d1.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	f08bab568e1877365870d1d321bb77c1e6e36f5f91b29e73c7c33d13a01c31d1.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	WmiPrvSE.exe

Drops file in Program Files directory 10 IoCs

description	ioc	Process
File created	C:\Program Files\Uninstall Information\sppsvc.exe	f08bab568e1877365870d1d321bb77c1e6e36f5f91b29e73c7c33d13a01c31d1.exe
File opened for modification	C:\Program Files\Uninstall Information\sppsvc.exe	f08bab568e1877365870d1d321bb77c1e6e36f5f91b29e73c7c33d13a01c31d1.exe
File created	C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\System.exe	f08bab568e1877365870d1d321bb77c1e6e36f5f91b29e73c7c33d13a01c31d1.exe
File opened for modification	C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\RCXE308.tmp	f08bab568e1877365870d1d321bb77c1e6e36f5f91b29e73c7c33d13a01c31d1.exe
File created	C:\Program Files\Uninstall Information\0a1fd5f707cd16	f08bab568e1877365870d1d321bb77c1e6e36f5f91b29e73c7c33d13a01c31d1.exe
File created	C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\27d1bcfc3c54e0	f08bab568e1877365870d1d321bb77c1e6e36f5f91b29e73c7c33d13a01c31d1.exe
File opened for modification	C:\Program Files\Uninstall Information\RCXDCE9.tmp	f08bab568e1877365870d1d321bb77c1e6e36f5f91b29e73c7c33d13a01c31d1.exe
File opened for modification	C:\Program Files\Uninstall Information\RCXDCEA.tmp	f08bab568e1877365870d1d321bb77c1e6e36f5f91b29e73c7c33d13a01c31d1.exe
File opened for modification	C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\RCXE307.tmp	f08bab568e1877365870d1d321bb77c1e6e36f5f91b29e73c7c33d13a01c31d1.exe
File opened for modification	C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\System.exe	f08bab568e1877365870d1d321bb77c1e6e36f5f91b29e73c7c33d13a01c31d1.exe

Drops file in Windows directory 15 IoCs

description	ioc	Process
File opened for modification	C:\Windows\es-ES\RCXE712.tmp	f08bab568e1877365870d1d321bb77c1e6e36f5f91b29e73c7c33d13a01c31d1.exe
File created	C:\Windows\es-ES\WmiPrvSE.exe	f08bab568e1877365870d1d321bb77c1e6e36f5f91b29e73c7c33d13a01c31d1.exe
File created	C:\Windows\es-ES\24dbde2999530e	f08bab568e1877365870d1d321bb77c1e6e36f5f91b29e73c7c33d13a01c31d1.exe
File opened for modification	C:\Windows\AppCompat\Programs\RCXDEEF.tmp	f08bab568e1877365870d1d321bb77c1e6e36f5f91b29e73c7c33d13a01c31d1.exe
File opened for modification	C:\Windows\fr-FR\RCXE50C.tmp	f08bab568e1877365870d1d321bb77c1e6e36f5f91b29e73c7c33d13a01c31d1.exe
File opened for modification	C:\Windows\fr-FR\RCXE50D.tmp	f08bab568e1877365870d1d321bb77c1e6e36f5f91b29e73c7c33d13a01c31d1.exe
File opened for modification	C:\Windows\fr-FR\audiodg.exe	f08bab568e1877365870d1d321bb77c1e6e36f5f91b29e73c7c33d13a01c31d1.exe
File created	C:\Windows\AppCompat\Programs\wininit.exe	f08bab568e1877365870d1d321bb77c1e6e36f5f91b29e73c7c33d13a01c31d1.exe
File created	C:\Windows\AppCompat\Programs\56085415360792	f08bab568e1877365870d1d321bb77c1e6e36f5f91b29e73c7c33d13a01c31d1.exe
File opened for modification	C:\Windows\AppCompat\Programs\RCXDEEE.tmp	f08bab568e1877365870d1d321bb77c1e6e36f5f91b29e73c7c33d13a01c31d1.exe
File opened for modification	C:\Windows\AppCompat\Programs\wininit.exe	f08bab568e1877365870d1d321bb77c1e6e36f5f91b29e73c7c33d13a01c31d1.exe
File opened for modification	C:\Windows\es-ES\RCXE711.tmp	f08bab568e1877365870d1d321bb77c1e6e36f5f91b29e73c7c33d13a01c31d1.exe
File opened for modification	C:\Windows\es-ES\WmiPrvSE.exe	f08bab568e1877365870d1d321bb77c1e6e36f5f91b29e73c7c33d13a01c31d1.exe
File created	C:\Windows\fr-FR\42af1c969fbb7b	f08bab568e1877365870d1d321bb77c1e6e36f5f91b29e73c7c33d13a01c31d1.exe
File created	C:\Windows\fr-FR\audiodg.exe	f08bab568e1877365870d1d321bb77c1e6e36f5f91b29e73c7c33d13a01c31d1.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Scheduled Task/Job: Scheduled Task 1 TTPs 18 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2844	schtasks.exe
1604	schtasks.exe
2396	schtasks.exe
2580	schtasks.exe
3064	schtasks.exe
2764	schtasks.exe
1892	schtasks.exe
2852	schtasks.exe
1908	schtasks.exe
2076	schtasks.exe
1220	schtasks.exe
1724	schtasks.exe
2892	schtasks.exe
2608	schtasks.exe
2884	schtasks.exe
1964	schtasks.exe
1720	schtasks.exe
2024	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1928	f08bab568e1877365870d1d321bb77c1e6e36f5f91b29e73c7c33d13a01c31d1.exe
1928	f08bab568e1877365870d1d321bb77c1e6e36f5f91b29e73c7c33d13a01c31d1.exe
1928	f08bab568e1877365870d1d321bb77c1e6e36f5f91b29e73c7c33d13a01c31d1.exe
1928	f08bab568e1877365870d1d321bb77c1e6e36f5f91b29e73c7c33d13a01c31d1.exe
1928	f08bab568e1877365870d1d321bb77c1e6e36f5f91b29e73c7c33d13a01c31d1.exe
1928	f08bab568e1877365870d1d321bb77c1e6e36f5f91b29e73c7c33d13a01c31d1.exe
1928	f08bab568e1877365870d1d321bb77c1e6e36f5f91b29e73c7c33d13a01c31d1.exe
1928	f08bab568e1877365870d1d321bb77c1e6e36f5f91b29e73c7c33d13a01c31d1.exe
1928	f08bab568e1877365870d1d321bb77c1e6e36f5f91b29e73c7c33d13a01c31d1.exe
1928	f08bab568e1877365870d1d321bb77c1e6e36f5f91b29e73c7c33d13a01c31d1.exe
1928	f08bab568e1877365870d1d321bb77c1e6e36f5f91b29e73c7c33d13a01c31d1.exe
1928	f08bab568e1877365870d1d321bb77c1e6e36f5f91b29e73c7c33d13a01c31d1.exe
1928	f08bab568e1877365870d1d321bb77c1e6e36f5f91b29e73c7c33d13a01c31d1.exe
1928	f08bab568e1877365870d1d321bb77c1e6e36f5f91b29e73c7c33d13a01c31d1.exe
1928	f08bab568e1877365870d1d321bb77c1e6e36f5f91b29e73c7c33d13a01c31d1.exe
1928	f08bab568e1877365870d1d321bb77c1e6e36f5f91b29e73c7c33d13a01c31d1.exe
1928	f08bab568e1877365870d1d321bb77c1e6e36f5f91b29e73c7c33d13a01c31d1.exe
1928	f08bab568e1877365870d1d321bb77c1e6e36f5f91b29e73c7c33d13a01c31d1.exe
1928	f08bab568e1877365870d1d321bb77c1e6e36f5f91b29e73c7c33d13a01c31d1.exe
624	WmiPrvSE.exe
624	WmiPrvSE.exe
624	WmiPrvSE.exe
624	WmiPrvSE.exe
624	WmiPrvSE.exe
624	WmiPrvSE.exe
624	WmiPrvSE.exe
624	WmiPrvSE.exe
624	WmiPrvSE.exe
624	WmiPrvSE.exe
624	WmiPrvSE.exe
624	WmiPrvSE.exe
624	WmiPrvSE.exe
624	WmiPrvSE.exe
624	WmiPrvSE.exe
624	WmiPrvSE.exe
624	WmiPrvSE.exe
624	WmiPrvSE.exe
624	WmiPrvSE.exe
624	WmiPrvSE.exe
624	WmiPrvSE.exe
624	WmiPrvSE.exe
624	WmiPrvSE.exe
624	WmiPrvSE.exe
624	WmiPrvSE.exe
624	WmiPrvSE.exe
624	WmiPrvSE.exe
624	WmiPrvSE.exe
624	WmiPrvSE.exe
624	WmiPrvSE.exe
624	WmiPrvSE.exe
624	WmiPrvSE.exe
624	WmiPrvSE.exe
624	WmiPrvSE.exe
624	WmiPrvSE.exe
624	WmiPrvSE.exe
624	WmiPrvSE.exe
624	WmiPrvSE.exe
624	WmiPrvSE.exe
624	WmiPrvSE.exe
624	WmiPrvSE.exe
624	WmiPrvSE.exe
624	WmiPrvSE.exe
624	WmiPrvSE.exe
624	WmiPrvSE.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	1928	f08bab568e1877365870d1d321bb77c1e6e36f5f91b29e73c7c33d13a01c31d1.exe
Token: SeDebugPrivilege	624	WmiPrvSE.exe
Token: SeDebugPrivilege	2804	WmiPrvSE.exe
Token: SeDebugPrivilege	2964	WmiPrvSE.exe

Suspicious use of WriteProcessMemory 33 IoCs

description	pid	Process	procid_target
PID 1928 wrote to memory of 1716	1928	f08bab568e1877365870d1d321bb77c1e6e36f5f91b29e73c7c33d13a01c31d1.exe	50
PID 1928 wrote to memory of 1716	1928	f08bab568e1877365870d1d321bb77c1e6e36f5f91b29e73c7c33d13a01c31d1.exe	50
PID 1928 wrote to memory of 1716	1928	f08bab568e1877365870d1d321bb77c1e6e36f5f91b29e73c7c33d13a01c31d1.exe	50
PID 1716 wrote to memory of 1912	1716	cmd.exe	52
PID 1716 wrote to memory of 1912	1716	cmd.exe	52
PID 1716 wrote to memory of 1912	1716	cmd.exe	52
PID 1716 wrote to memory of 624	1716	cmd.exe	53
PID 1716 wrote to memory of 624	1716	cmd.exe	53
PID 1716 wrote to memory of 624	1716	cmd.exe	53
PID 624 wrote to memory of 2412	624	WmiPrvSE.exe	54
PID 624 wrote to memory of 2412	624	WmiPrvSE.exe	54
PID 624 wrote to memory of 2412	624	WmiPrvSE.exe	54
PID 624 wrote to memory of 2524	624	WmiPrvSE.exe	55
PID 624 wrote to memory of 2524	624	WmiPrvSE.exe	55
PID 624 wrote to memory of 2524	624	WmiPrvSE.exe	55
PID 2412 wrote to memory of 2804	2412	WScript.exe	56
PID 2412 wrote to memory of 2804	2412	WScript.exe	56
PID 2412 wrote to memory of 2804	2412	WScript.exe	56
PID 2804 wrote to memory of 2320	2804	WmiPrvSE.exe	57
PID 2804 wrote to memory of 2320	2804	WmiPrvSE.exe	57
PID 2804 wrote to memory of 2320	2804	WmiPrvSE.exe	57
PID 2804 wrote to memory of 1876	2804	WmiPrvSE.exe	58
PID 2804 wrote to memory of 1876	2804	WmiPrvSE.exe	58
PID 2804 wrote to memory of 1876	2804	WmiPrvSE.exe	58
PID 2320 wrote to memory of 2964	2320	WScript.exe	59
PID 2320 wrote to memory of 2964	2320	WScript.exe	59
PID 2320 wrote to memory of 2964	2320	WScript.exe	59
PID 2964 wrote to memory of 1960	2964	WmiPrvSE.exe	60
PID 2964 wrote to memory of 1960	2964	WmiPrvSE.exe	60
PID 2964 wrote to memory of 1960	2964	WmiPrvSE.exe	60
PID 2964 wrote to memory of 2148	2964	WmiPrvSE.exe	61
PID 2964 wrote to memory of 2148	2964	WmiPrvSE.exe	61
PID 2964 wrote to memory of 2148	2964	WmiPrvSE.exe	61

System policy modification 1 TTPs 12 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	f08bab568e1877365870d1d321bb77c1e6e36f5f91b29e73c7c33d13a01c31d1.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	f08bab568e1877365870d1d321bb77c1e6e36f5f91b29e73c7c33d13a01c31d1.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	f08bab568e1877365870d1d321bb77c1e6e36f5f91b29e73c7c33d13a01c31d1.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	WmiPrvSE.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	WmiPrvSE.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	WmiPrvSE.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	WmiPrvSE.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	WmiPrvSE.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	WmiPrvSE.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	WmiPrvSE.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	WmiPrvSE.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	WmiPrvSE.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\f08bab568e1877365870d1d321bb77c1e6e36f5f91b29e73c7c33d13a01c31d1.exe
"C:\Users\Admin\AppData\Local\Temp\f08bab568e1877365870d1d321bb77c1e6e36f5f91b29e73c7c33d13a01c31d1.exe"
1⤵
- DcRat
- Modifies WinLogon for persistence
- UAC bypass
- Drops file in Drivers directory
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1928
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\wNL0dL8YnE.bat"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1716
- - C:\Windows\system32\w32tm.exe
    w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
    3⤵
    PID:1912
- - C:\Windows\es-ES\WmiPrvSE.exe
    "C:\Windows\es-ES\WmiPrvSE.exe"
    3⤵
    - UAC bypass
    - Executes dropped EXE
    - Checks whether UAC is enabled
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    - System policy modification
    PID:624
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\ff24ee68-17d7-4902-8dd3-5422abdb9c11.vbs"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:2412
    - - C:\Windows\es-ES\WmiPrvSE.exe
        
        C:\Windows\es-ES\WmiPrvSE.exe
        5⤵
        UAC bypass
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        System policy modification
        
        PID:2804
      - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\3386ffa4-5889-442f-8999-3d7e45c0b579.vbs"
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:2320
        
        C:\Windows\es-ES\WmiPrvSE.exe
        
        C:\Windows\es-ES\WmiPrvSE.exe
        7⤵
        UAC bypass
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        System policy modification
        
        PID:2964
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\8175194c-83d9-4975-b7ba-c406c7c6b4f4.vbs"
        8⤵
        
        PID:1960
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\e5e7d90a-b511-44e6-a4d3-8d15c936dcdb.vbs"
        8⤵
        
        PID:2148
      - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\83e541ae-4677-424f-a5dd-614a02249a06.vbs"
        6⤵
        
        PID:1876
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\e7617842-653d-40e1-b844-882c64d03df3.vbs"
      4⤵
      PID:2524

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 11 /tr "'C:\Program Files\Uninstall Information\sppsvc.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2396

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvc" /sc ONLOGON /tr "'C:\Program Files\Uninstall Information\sppsvc.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2892

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 6 /tr "'C:\Program Files\Uninstall Information\sppsvc.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2852

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 5 /tr "'C:\Windows\AppCompat\Programs\wininit.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1908

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininit" /sc ONLOGON /tr "'C:\Windows\AppCompat\Programs\wininit.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2580

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 14 /tr "'C:\Windows\AppCompat\Programs\wininit.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2608

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 11 /tr "'C:\Recovery\1f276ee2-69f6-11ef-8b31-62cb582c238c\services.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3064

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "services" /sc ONLOGON /tr "'C:\Recovery\1f276ee2-69f6-11ef-8b31-62cb582c238c\services.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2884

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 12 /tr "'C:\Recovery\1f276ee2-69f6-11ef-8b31-62cb582c238c\services.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2076

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 5 /tr "'C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\System.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1964

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "System" /sc ONLOGON /tr "'C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\System.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2844

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 8 /tr "'C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\System.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2764

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "audiodga" /sc MINUTE /mo 12 /tr "'C:\Windows\fr-FR\audiodg.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1720

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "audiodg" /sc ONLOGON /tr "'C:\Windows\fr-FR\audiodg.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2024

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "audiodga" /sc MINUTE /mo 8 /tr "'C:\Windows\fr-FR\audiodg.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1892

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 5 /tr "'C:\Windows\es-ES\WmiPrvSE.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1604

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSE" /sc ONLOGON /tr "'C:\Windows\es-ES\WmiPrvSE.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1220

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 7 /tr "'C:\Windows\es-ES\WmiPrvSE.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1724

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\3386ffa4-5889-442f-8999-3d7e45c0b579.vbs

Filesize
705B

MD5
7cdce46924b4936319b6135da2ff02df

SHA1
96afd1e20863d9b182be10b736bd3d924f5b611a

SHA256
417c00eeabd31bc0af717e6b4533480461264bb76d0823994f4f979e28ae1051

SHA512
bf6eb6c290da0ac8e92031b413a11fcf33f09ae87910c28221e66f6105cecd3fa4d635fe0089100d24d63cfabdd26042386625d7a7d7360ef7151191a225c720

Download Submit
C:\Users\Admin\AppData\Local\Temp\8175194c-83d9-4975-b7ba-c406c7c6b4f4.vbs

Filesize
705B

MD5
e78b958cc1a6f3c5c83c54ce3e0f797c

SHA1
ca52db585418f0813034e03c58a086bbbfcd5bf7

SHA256
efc36083cc1ed7e49eecb80ccece75525311282f2b009c8f5ff8f5d401920e40

SHA512
7b7f1b5033fe7cb60741f49e08ef75f36977e9f3f1562b4735fe8656cd740b3d9fcd3b484195ab928f1d84964bbc8edc820d290d7de9a37f61bbf2ed2e80eb71

Download Submit
C:\Users\Admin\AppData\Local\Temp\e7617842-653d-40e1-b844-882c64d03df3.vbs

Filesize
481B

MD5
58d3684cf7bb9142bcade7b2d21aca30

SHA1
1b9c7ffb9aa7bd01ee9e455f6658475eb5c6b97f

SHA256
cfddebefaf1501b299d8cb0d4907f6a7144d6f275ef12750ef9122442e288aed

SHA512
4e802ab417b6bdc80f9c02676850811058ff146d7f80dae3f8e9baaff800005fe1834ffe3eabc8af187e22737fef1f68631cf02cdfe1a04597d9d74fffaf5485

Download Submit
C:\Users\Admin\AppData\Local\Temp\ff24ee68-17d7-4902-8dd3-5422abdb9c11.vbs

Filesize
704B

MD5
6ec468829da35b952d3169c0ade3a8fa

SHA1
63ba4ed42f0e732eb0618eb67a9d74cbecd0897f

SHA256
340ede3cf3dd1ebbf0c4e166c72d894df52dff583c5707b27c2258b9ce1b4c3b

SHA512
588fe95f1c0eac5da4cd7c8f2421e74b8f60d801f44d5910f558a78835cce006452c1aec2a9742d304e5a872f9928a44dfce3a18ad4577bf7208c540ced0095c

Download Submit
C:\Users\Admin\AppData\Local\Temp\wNL0dL8YnE.bat

Filesize
194B

MD5
704de5522b9d4e65fad093e7d233ad9b

SHA1
972244a80bf974f4c85c311d754a9fa3f7ea09e2

SHA256
39bd028eb0d75ced67147a8535e96f91dec95bfb3c41f6f2d5bb38221b98d0db

SHA512
f579f78138baaa91506dc91283e0a3197c76c49a30790cace2175747a48f7d02d2a427111a804fbca94c6e353dd8cbe7fa8c305e9a1900be16a2688f70ec4c69

Download Submit
C:\Windows\AppCompat\Programs\RCXDEEF.tmp

Filesize
2.2MB

MD5
70f35d04041d9c029d59586fc6aa3819

SHA1
a9f37462584d22bad8909ffc1c047cdfee84f049

SHA256
517ef97c6f4481e5d6eac2ebd79fbbfe34c9dbe59a0f775c0c2a3e3b942aaae6

SHA512
1739c6ce05e4fbee9d2829a95b3ca910b28a0f853d2a6e11e779fae7b419c46b7fd22641f28c2b91b826dd3905e478a23fa1e55c31665adea3f6a042d7078f53

Download Submit
C:\Windows\fr-FR\audiodg.exe

Filesize
2.2MB

MD5
67f998093c11d8a104aef7a92a2d5b26

SHA1
cea4392bfb620e2d5b303c7f39fe68a30080a771

SHA256
f08bab568e1877365870d1d321bb77c1e6e36f5f91b29e73c7c33d13a01c31d1

SHA512
e3572eaf810f95944206728a83c822244afd079f59cef2911e11dddd85216a09663edbd8041fe5281c0ca9a6182bc5b70d77cbcc403baccbfbdc1d9c6a137e92

Download Submit
memory/624-128-0x0000000000220000-0x000000000044E000-memory.dmp

Filesize
2.2MB

Download
memory/1928-10-0x0000000000570000-0x0000000000578000-memory.dmp

Filesize
32KB

Download
memory/1928-26-0x0000000000920000-0x000000000092C000-memory.dmp

Filesize
48KB

Download
memory/1928-0-0x000007FEF5EE3000-0x000007FEF5EE4000-memory.dmp

Filesize
4KB

Download
memory/1928-11-0x0000000000620000-0x0000000000630000-memory.dmp

Filesize
64KB

Download
memory/1928-12-0x0000000000600000-0x000000000060A000-memory.dmp

Filesize
40KB

Download
memory/1928-13-0x0000000000610000-0x000000000061C000-memory.dmp

Filesize
48KB

Download
memory/1928-14-0x0000000000630000-0x0000000000638000-memory.dmp

Filesize
32KB

Download
memory/1928-15-0x0000000000640000-0x000000000064C000-memory.dmp

Filesize
48KB

Download
memory/1928-16-0x0000000000650000-0x0000000000658000-memory.dmp

Filesize
32KB

Download
memory/1928-18-0x0000000000660000-0x0000000000672000-memory.dmp

Filesize
72KB

Download
memory/1928-19-0x0000000000690000-0x000000000069C000-memory.dmp

Filesize
48KB

Download
memory/1928-20-0x00000000006B0000-0x00000000006BC000-memory.dmp

Filesize
48KB

Download
memory/1928-21-0x00000000006C0000-0x00000000006CC000-memory.dmp

Filesize
48KB

Download
memory/1928-22-0x00000000006D0000-0x00000000006DA000-memory.dmp

Filesize
40KB

Download
memory/1928-23-0x00000000006E0000-0x00000000006EE000-memory.dmp

Filesize
56KB

Download
memory/1928-25-0x0000000000910000-0x000000000091E000-memory.dmp

Filesize
56KB

Download
memory/1928-24-0x0000000000900000-0x0000000000908000-memory.dmp

Filesize
32KB

Download
memory/1928-9-0x0000000000560000-0x000000000056C000-memory.dmp

Filesize
48KB

Download
memory/1928-27-0x0000000000930000-0x0000000000938000-memory.dmp

Filesize
32KB

Download
memory/1928-29-0x000007FEF5EE0000-0x000007FEF68CC000-memory.dmp

Filesize
9.9MB

Download
memory/1928-28-0x0000000000940000-0x000000000094C000-memory.dmp

Filesize
48KB

Download
memory/1928-8-0x0000000000540000-0x0000000000556000-memory.dmp

Filesize
88KB

Download
memory/1928-6-0x0000000000520000-0x0000000000528000-memory.dmp

Filesize
32KB

Download
memory/1928-124-0x000007FEF5EE0000-0x000007FEF68CC000-memory.dmp

Filesize
9.9MB

Download
memory/1928-7-0x0000000000530000-0x0000000000540000-memory.dmp

Filesize
64KB

Download
memory/1928-5-0x0000000000500000-0x000000000051C000-memory.dmp

Filesize
112KB

Download
memory/1928-4-0x00000000004F0000-0x00000000004FE000-memory.dmp

Filesize
56KB

Download
memory/1928-3-0x00000000004E0000-0x00000000004EE000-memory.dmp

Filesize
56KB

Download
memory/1928-1-0x00000000002B0000-0x00000000004DE000-memory.dmp

Filesize
2.2MB

Download
memory/1928-2-0x000007FEF5EE0000-0x000007FEF68CC000-memory.dmp

Filesize
9.9MB

Download
memory/2804-140-0x0000000002200000-0x0000000002212000-memory.dmp

Filesize
72KB

Download
memory/2804-139-0x0000000000B40000-0x0000000000D6E000-memory.dmp

Filesize
2.2MB

Download
memory/2964-152-0x0000000000330000-0x000000000055E000-memory.dmp

Filesize
2.2MB

Download