dcrat | 0a0eebfca8553e921339c90b0060ceb6adcbc5f747696b1abecd376f50283911

Resubmissions

13-01-2025 04:05

250113-enzvbaxner 10

12-01-2025 14:56

250112-sa1fkszjhp 10

Analysis

max time kernel
150s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
12-01-2025 14:56

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

dabf40b2ed8d96638f713f6373ef64cb.exe
Size

2.5MB
MD5

dabf40b2ed8d96638f713f6373ef64cb
SHA1

4c9479e54b394722bdaeff1b36d903502cd1b1fe
SHA256

0a0eebfca8553e921339c90b0060ceb6adcbc5f747696b1abecd376f50283911
SHA512

0a9abca78917efea2b77dcccf862761e99001a26bba3de871c233b07500c7e414e32ebd41f93e23b332696db1d56aaa9e8357e60ac32efbf06c13bf40abf1fd0
SSDEEP

49152:UbA30QsSHlG56vO0T3/Nh/ptuw/C3TqGaDxr1NcWTMUvifV:UbcLlK6d3/Nh/bV/Oq3Dxp2RUGV

Score

10^/10

dcrat discovery evasion infostealer persistence rat trojan

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat
Dcrat family
dcrat

Modifies WinLogon for persistence 2 TTPs 6 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Windows\\SystemApps\\Microsoft.MicrosoftEdgeDevToolsClient_8wekyb3d8bbwe\\pris\\Idle.exe\""	Serverbroker.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Windows\\SystemApps\\Microsoft.MicrosoftEdgeDevToolsClient_8wekyb3d8bbwe\\pris\\Idle.exe\", \"C:\\Users\\Default User\\sppsvc.exe\""	Serverbroker.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Windows\\SystemApps\\Microsoft.MicrosoftEdgeDevToolsClient_8wekyb3d8bbwe\\pris\\Idle.exe\", \"C:\\Users\\Default User\\sppsvc.exe\", \"C:\\Program Files\\Uninstall Information\\System.exe\""	Serverbroker.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Windows\\SystemApps\\Microsoft.MicrosoftEdgeDevToolsClient_8wekyb3d8bbwe\\pris\\Idle.exe\", \"C:\\Users\\Default User\\sppsvc.exe\", \"C:\\Program Files\\Uninstall Information\\System.exe\", \"C:\\Program Files\\Microsoft Office\\Updates\\Apply\\FilesInUse\\D6CCB6DA-96A6-431E-8B63-86E4045EF441\\winlogon.exe\""	Serverbroker.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Windows\\SystemApps\\Microsoft.MicrosoftEdgeDevToolsClient_8wekyb3d8bbwe\\pris\\Idle.exe\", \"C:\\Users\\Default User\\sppsvc.exe\", \"C:\\Program Files\\Uninstall Information\\System.exe\", \"C:\\Program Files\\Microsoft Office\\Updates\\Apply\\FilesInUse\\D6CCB6DA-96A6-431E-8B63-86E4045EF441\\winlogon.exe\", \"C:\\Windows\\uk-UA\\Serverbroker.exe\""	Serverbroker.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Windows\\SystemApps\\Microsoft.MicrosoftEdgeDevToolsClient_8wekyb3d8bbwe\\pris\\Idle.exe\", \"C:\\Users\\Default User\\sppsvc.exe\", \"C:\\Program Files\\Uninstall Information\\System.exe\", \"C:\\Program Files\\Microsoft Office\\Updates\\Apply\\FilesInUse\\D6CCB6DA-96A6-431E-8B63-86E4045EF441\\winlogon.exe\", \"C:\\Windows\\uk-UA\\Serverbroker.exe\", \"C:\\Program Files (x86)\\Windows Defender\\fr-FR\\taskhostw.exe\""	Serverbroker.exe

Process spawned unexpected child process 18 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3016	3900	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4876	3900	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1208	3900	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3700	3900	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3872	3900	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	768	3900	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2532	3900	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3740	3900	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4760	3900	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4260	3900	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2236	3900	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1060	3900	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4484	3900	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	632	3900	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3648	3900	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1620	3900	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1220	3900	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3836	3900	schtasks.exe	86

UAC bypass 3 TTPs 12 IoCs

evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	Serverbroker.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	Serverbroker.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	Serverbroker.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	winlogon.exe

DCRat payload 4 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral2/files/0x000a000000023b8e-9.dat	dcrat
behavioral2/memory/3516-13-0x00000000002B0000-0x00000000004DE000-memory.dmp	dcrat
behavioral2/files/0x0009000000023bc4-79.dat	dcrat
behavioral2/files/0x0010000000023bc3-116.dat	dcrat

Disables Task Manager via registry modification
evasion

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\drivers\etc\hosts	Serverbroker.exe

Checks computer location settings 2 TTPs 6 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\International\Geo\Nation	Serverbroker.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\International\Geo\Nation	winlogon.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\International\Geo\Nation	winlogon.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\International\Geo\Nation	winlogon.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\International\Geo\Nation	dabf40b2ed8d96638f713f6373ef64cb.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\International\Geo\Nation	WScript.exe

Executes dropped EXE 4 IoCs

pid	Process
3516	Serverbroker.exe
2320	winlogon.exe
1860	winlogon.exe
1976	winlogon.exe

Adds Run key to start application 2 TTPs 12 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\winlogon = "\"C:\\Program Files\\Microsoft Office\\Updates\\Apply\\FilesInUse\\D6CCB6DA-96A6-431E-8B63-86E4045EF441\\winlogon.exe\""	Serverbroker.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\winlogon = "\"C:\\Program Files\\Microsoft Office\\Updates\\Apply\\FilesInUse\\D6CCB6DA-96A6-431E-8B63-86E4045EF441\\winlogon.exe\""	Serverbroker.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\taskhostw = "\"C:\\Program Files (x86)\\Windows Defender\\fr-FR\\taskhostw.exe\""	Serverbroker.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Idle = "\"C:\\Windows\\SystemApps\\Microsoft.MicrosoftEdgeDevToolsClient_8wekyb3d8bbwe\\pris\\Idle.exe\""	Serverbroker.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Idle = "\"C:\\Windows\\SystemApps\\Microsoft.MicrosoftEdgeDevToolsClient_8wekyb3d8bbwe\\pris\\Idle.exe\""	Serverbroker.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sppsvc = "\"C:\\Users\\Default User\\sppsvc.exe\""	Serverbroker.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sppsvc = "\"C:\\Users\\Default User\\sppsvc.exe\""	Serverbroker.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\System = "\"C:\\Program Files\\Uninstall Information\\System.exe\""	Serverbroker.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\System = "\"C:\\Program Files\\Uninstall Information\\System.exe\""	Serverbroker.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Serverbroker = "\"C:\\Windows\\uk-UA\\Serverbroker.exe\""	Serverbroker.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Serverbroker = "\"C:\\Windows\\uk-UA\\Serverbroker.exe\""	Serverbroker.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\taskhostw = "\"C:\\Program Files (x86)\\Windows Defender\\fr-FR\\taskhostw.exe\""	Serverbroker.exe

Checks whether UAC is enabled 1 TTPs 8 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	Serverbroker.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	winlogon.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	winlogon.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	winlogon.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Serverbroker.exe

Drops file in Program Files directory 15 IoCs

description	ioc	Process
File created	C:\Program Files\Microsoft Office\Updates\Apply\FilesInUse\D6CCB6DA-96A6-431E-8B63-86E4045EF441\cc11b995f2a76d	Serverbroker.exe
File opened for modification	C:\Program Files\Microsoft Office\Updates\Apply\FilesInUse\D6CCB6DA-96A6-431E-8B63-86E4045EF441\RCXC3E5.tmp	Serverbroker.exe
File created	C:\Program Files\Uninstall Information\System.exe	Serverbroker.exe
File created	C:\Program Files\Microsoft Office\Updates\Apply\FilesInUse\D6CCB6DA-96A6-431E-8B63-86E4045EF441\winlogon.exe	Serverbroker.exe
File created	C:\Program Files (x86)\Windows Defender\fr-FR\taskhostw.exe	Serverbroker.exe
File opened for modification	C:\Program Files\Microsoft Office\Updates\Apply\FilesInUse\D6CCB6DA-96A6-431E-8B63-86E4045EF441\RCXC3E4.tmp	Serverbroker.exe
File opened for modification	C:\Program Files (x86)\Windows Defender\fr-FR\RCXC88C.tmp	Serverbroker.exe
File opened for modification	C:\Program Files (x86)\Windows Defender\fr-FR\taskhostw.exe	Serverbroker.exe
File opened for modification	C:\Program Files\Uninstall Information\System.exe	Serverbroker.exe
File created	C:\Program Files\Uninstall Information\27d1bcfc3c54e0	Serverbroker.exe
File created	C:\Program Files (x86)\Windows Defender\fr-FR\ea9f0e6c9e2dcd	Serverbroker.exe
File opened for modification	C:\Program Files\Uninstall Information\RCXC0E5.tmp	Serverbroker.exe
File opened for modification	C:\Program Files\Uninstall Information\RCXC163.tmp	Serverbroker.exe
File opened for modification	C:\Program Files\Microsoft Office\Updates\Apply\FilesInUse\D6CCB6DA-96A6-431E-8B63-86E4045EF441\winlogon.exe	Serverbroker.exe
File opened for modification	C:\Program Files (x86)\Windows Defender\fr-FR\RCXC89D.tmp	Serverbroker.exe

Drops file in Windows directory 10 IoCs

description	ioc	Process
File created	C:\Windows\SystemApps\Microsoft.MicrosoftEdgeDevToolsClient_8wekyb3d8bbwe\pris\6ccacd8608530f	Serverbroker.exe
File created	C:\Windows\uk-UA\Serverbroker.exe	Serverbroker.exe
File opened for modification	C:\Windows\SystemApps\Microsoft.MicrosoftEdgeDevToolsClient_8wekyb3d8bbwe\pris\RCXBC7C.tmp	Serverbroker.exe
File opened for modification	C:\Windows\SystemApps\Microsoft.MicrosoftEdgeDevToolsClient_8wekyb3d8bbwe\pris\RCXBC9C.tmp	Serverbroker.exe
File opened for modification	C:\Windows\uk-UA\RCXC678.tmp	Serverbroker.exe
File opened for modification	C:\Windows\uk-UA\Serverbroker.exe	Serverbroker.exe
File created	C:\Windows\SystemApps\Microsoft.MicrosoftEdgeDevToolsClient_8wekyb3d8bbwe\pris\Idle.exe	Serverbroker.exe
File created	C:\Windows\uk-UA\d6ea2b4d01a4d6	Serverbroker.exe
File opened for modification	C:\Windows\uk-UA\RCXC5FA.tmp	Serverbroker.exe
File opened for modification	C:\Windows\SystemApps\Microsoft.MicrosoftEdgeDevToolsClient_8wekyb3d8bbwe\pris\Idle.exe	Serverbroker.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dabf40b2ed8d96638f713f6373ef64cb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe

Modifies registry class 5 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\Local Settings	dabf40b2ed8d96638f713f6373ef64cb.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	Serverbroker.exe
Key created	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\Local Settings	winlogon.exe
Key created	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\Local Settings	winlogon.exe
Key created	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\Local Settings	winlogon.exe

Modifies registry key 1 TTPs 1 IoCs

Modify Registry

T1112

pid	Process
656	reg.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 18 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
3016	schtasks.exe
4260	schtasks.exe
632	schtasks.exe
3648	schtasks.exe
3740	schtasks.exe
2236	schtasks.exe
1220	schtasks.exe
3836	schtasks.exe
4876	schtasks.exe
1208	schtasks.exe
3700	schtasks.exe
3872	schtasks.exe
768	schtasks.exe
4484	schtasks.exe
2532	schtasks.exe
4760	schtasks.exe
1060	schtasks.exe
1620	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3516	Serverbroker.exe
3516	Serverbroker.exe
3516	Serverbroker.exe
3516	Serverbroker.exe
3516	Serverbroker.exe
3516	Serverbroker.exe
3516	Serverbroker.exe
3516	Serverbroker.exe
3516	Serverbroker.exe
3516	Serverbroker.exe
3516	Serverbroker.exe
3516	Serverbroker.exe
3516	Serverbroker.exe
3516	Serverbroker.exe
3516	Serverbroker.exe
3516	Serverbroker.exe
3516	Serverbroker.exe
3516	Serverbroker.exe
3516	Serverbroker.exe
3516	Serverbroker.exe
3516	Serverbroker.exe
3516	Serverbroker.exe
3516	Serverbroker.exe
2320	winlogon.exe
2320	winlogon.exe
2320	winlogon.exe
2320	winlogon.exe
2320	winlogon.exe
2320	winlogon.exe
2320	winlogon.exe
2320	winlogon.exe
2320	winlogon.exe
2320	winlogon.exe
2320	winlogon.exe
2320	winlogon.exe
2320	winlogon.exe
2320	winlogon.exe
2320	winlogon.exe
2320	winlogon.exe
2320	winlogon.exe
2320	winlogon.exe
2320	winlogon.exe
2320	winlogon.exe
2320	winlogon.exe
2320	winlogon.exe
2320	winlogon.exe
2320	winlogon.exe
2320	winlogon.exe
2320	winlogon.exe
2320	winlogon.exe
2320	winlogon.exe
2320	winlogon.exe
2320	winlogon.exe
2320	winlogon.exe
2320	winlogon.exe
2320	winlogon.exe
2320	winlogon.exe
2320	winlogon.exe
2320	winlogon.exe
2320	winlogon.exe
2320	winlogon.exe
2320	winlogon.exe
2320	winlogon.exe
2320	winlogon.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	3516	Serverbroker.exe
Token: SeDebugPrivilege	2320	winlogon.exe
Token: SeDebugPrivilege	1860	winlogon.exe
Token: SeDebugPrivilege	1976	winlogon.exe

Suspicious use of WriteProcessMemory 29 IoCs

description	pid	Process	procid_target
PID 3096 wrote to memory of 2400	3096	dabf40b2ed8d96638f713f6373ef64cb.exe	82
PID 3096 wrote to memory of 2400	3096	dabf40b2ed8d96638f713f6373ef64cb.exe	82
PID 3096 wrote to memory of 2400	3096	dabf40b2ed8d96638f713f6373ef64cb.exe	82
PID 2400 wrote to memory of 2016	2400	WScript.exe	83
PID 2400 wrote to memory of 2016	2400	WScript.exe	83
PID 2400 wrote to memory of 2016	2400	WScript.exe	83
PID 2016 wrote to memory of 3516	2016	cmd.exe	85
PID 2016 wrote to memory of 3516	2016	cmd.exe	85
PID 3516 wrote to memory of 2320	3516	Serverbroker.exe	105
PID 3516 wrote to memory of 2320	3516	Serverbroker.exe	105
PID 2016 wrote to memory of 656	2016	cmd.exe	106
PID 2016 wrote to memory of 656	2016	cmd.exe	106
PID 2016 wrote to memory of 656	2016	cmd.exe	106
PID 2320 wrote to memory of 776	2320	winlogon.exe	107
PID 2320 wrote to memory of 776	2320	winlogon.exe	107
PID 2320 wrote to memory of 1132	2320	winlogon.exe	108
PID 2320 wrote to memory of 1132	2320	winlogon.exe	108
PID 776 wrote to memory of 1860	776	WScript.exe	117
PID 776 wrote to memory of 1860	776	WScript.exe	117
PID 1860 wrote to memory of 1400	1860	winlogon.exe	118
PID 1860 wrote to memory of 1400	1860	winlogon.exe	118
PID 1860 wrote to memory of 3324	1860	winlogon.exe	119
PID 1860 wrote to memory of 3324	1860	winlogon.exe	119
PID 1400 wrote to memory of 1976	1400	WScript.exe	120
PID 1400 wrote to memory of 1976	1400	WScript.exe	120
PID 1976 wrote to memory of 948	1976	winlogon.exe	121
PID 1976 wrote to memory of 948	1976	winlogon.exe	121
PID 1976 wrote to memory of 3308	1976	winlogon.exe	122
PID 1976 wrote to memory of 3308	1976	winlogon.exe	122

System policy modification 1 TTPs 12 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	Serverbroker.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	Serverbroker.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	Serverbroker.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	winlogon.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\dabf40b2ed8d96638f713f6373ef64cb.exe
"C:\Users\Admin\AppData\Local\Temp\dabf40b2ed8d96638f713f6373ef64cb.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3096
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Mssurrogatebrowserhostperf\8kPsHmvrEcJwjafU40gzsGMXV7Gtxc.vbe"
  2⤵
  - Checks computer location settings
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2400
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Mssurrogatebrowserhostperf\SmjPROQS4143k.bat" "
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2016
  - - C:\Mssurrogatebrowserhostperf\Serverbroker.exe
      "C:\Mssurrogatebrowserhostperf\Serverbroker.exe"
      4⤵
      Modifies WinLogon for persistence
      UAC bypass
      Drops file in Drivers directory
      Checks computer location settings
      Executes dropped EXE
      Adds Run key to start application
      Checks whether UAC is enabled
      Drops file in Program Files directory
      Drops file in Windows directory
      Modifies registry class
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      System policy modification
      PID:3516
    - - C:\Program Files\Microsoft Office\Updates\Apply\FilesInUse\D6CCB6DA-96A6-431E-8B63-86E4045EF441\winlogon.exe
        
        "C:\Program Files\Microsoft Office\Updates\Apply\FilesInUse\D6CCB6DA-96A6-431E-8B63-86E4045EF441\winlogon.exe"
        5⤵
        UAC bypass
        Checks computer location settings
        Executes dropped EXE
        Checks whether UAC is enabled
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        System policy modification
        
        PID:2320
      - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\ae722c66-e3c0-4082-af96-cdff0c6edf7a.vbs"
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:776
        
        C:\Program Files\Microsoft Office\Updates\Apply\FilesInUse\D6CCB6DA-96A6-431E-8B63-86E4045EF441\winlogon.exe
        
        "C:\Program Files\Microsoft Office\Updates\Apply\FilesInUse\D6CCB6DA-96A6-431E-8B63-86E4045EF441\winlogon.exe"
        7⤵
        UAC bypass
        Checks computer location settings
        Executes dropped EXE
        Checks whether UAC is enabled
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        System policy modification
        
        PID:1860
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\5b663ded-d058-4f3e-b7d8-e14f2094ce08.vbs"
        8⤵
        Suspicious use of WriteProcessMemory
        
        PID:1400
        
        C:\Program Files\Microsoft Office\Updates\Apply\FilesInUse\D6CCB6DA-96A6-431E-8B63-86E4045EF441\winlogon.exe
        
        "C:\Program Files\Microsoft Office\Updates\Apply\FilesInUse\D6CCB6DA-96A6-431E-8B63-86E4045EF441\winlogon.exe"
        9⤵
        UAC bypass
        Checks computer location settings
        Executes dropped EXE
        Checks whether UAC is enabled
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        System policy modification
        
        PID:1976
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\1774c9c6-1350-4ef7-aa81-9ab4e89244b3.vbs"
        10⤵
        
        PID:948
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\ed8c3125-6863-4023-bb9b-01ff53e6113d.vbs"
        10⤵
        
        PID:3308
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\0cb23e15-0d3d-4c46-93ac-771ceab12554.vbs"
        8⤵
        
        PID:3324
      - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\cb9f760f-4958-438d-a96e-c75caf883a4b.vbs"
        6⤵
        
        PID:1132
  - - C:\Windows\SysWOW64\reg.exe
      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f
      4⤵
      System Location Discovery: System Language Discovery
      Modifies registry key
      PID:656

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 10 /tr "'C:\Windows\SystemApps\Microsoft.MicrosoftEdgeDevToolsClient_8wekyb3d8bbwe\pris\Idle.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3016

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Idle" /sc ONLOGON /tr "'C:\Windows\SystemApps\Microsoft.MicrosoftEdgeDevToolsClient_8wekyb3d8bbwe\pris\Idle.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4876

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 10 /tr "'C:\Windows\SystemApps\Microsoft.MicrosoftEdgeDevToolsClient_8wekyb3d8bbwe\pris\Idle.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1208

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 6 /tr "'C:\Users\Default User\sppsvc.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3700

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvc" /sc ONLOGON /tr "'C:\Users\Default User\sppsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3872

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 8 /tr "'C:\Users\Default User\sppsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:768

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 10 /tr "'C:\Program Files\Uninstall Information\System.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2532

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "System" /sc ONLOGON /tr "'C:\Program Files\Uninstall Information\System.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3740

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 10 /tr "'C:\Program Files\Uninstall Information\System.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4760

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 11 /tr "'C:\Program Files\Microsoft Office\Updates\Apply\FilesInUse\D6CCB6DA-96A6-431E-8B63-86E4045EF441\winlogon.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4260

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogon" /sc ONLOGON /tr "'C:\Program Files\Microsoft Office\Updates\Apply\FilesInUse\D6CCB6DA-96A6-431E-8B63-86E4045EF441\winlogon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2236

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 6 /tr "'C:\Program Files\Microsoft Office\Updates\Apply\FilesInUse\D6CCB6DA-96A6-431E-8B63-86E4045EF441\winlogon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1060

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "ServerbrokerS" /sc MINUTE /mo 6 /tr "'C:\Windows\uk-UA\Serverbroker.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4484

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Serverbroker" /sc ONLOGON /tr "'C:\Windows\uk-UA\Serverbroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:632

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "ServerbrokerS" /sc MINUTE /mo 13 /tr "'C:\Windows\uk-UA\Serverbroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3648

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostwt" /sc MINUTE /mo 9 /tr "'C:\Program Files (x86)\Windows Defender\fr-FR\taskhostw.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1620

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostw" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Defender\fr-FR\taskhostw.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1220

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostwt" /sc MINUTE /mo 13 /tr "'C:\Program Files (x86)\Windows Defender\fr-FR\taskhostw.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3836

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Mssurrogatebrowserhostperf\8kPsHmvrEcJwjafU40gzsGMXV7Gtxc.vbe

Filesize
216B

MD5
a7e0475eb8e2e26e457a4c752dc26444

SHA1
060c460c794a47f44686b717eb8d15f1945edb58

SHA256
8ece9e304ffb5cba5d51cb2187907d4910167fca5f67a59d316fd9d2ce47ae52

SHA512
9d7cac7d9fd93e3b88c1ea7663af7687ae08e8ee39dcc1549c4fb25d7342f3a9774b7f8e7c1b50ab96b09629ab4c587548a5b1063c843132277c7baa2069cad6

Download Submit
C:\Mssurrogatebrowserhostperf\Serverbroker.exe

Filesize
2.2MB

MD5
67f998093c11d8a104aef7a92a2d5b26

SHA1
cea4392bfb620e2d5b303c7f39fe68a30080a771

SHA256
f08bab568e1877365870d1d321bb77c1e6e36f5f91b29e73c7c33d13a01c31d1

SHA512
e3572eaf810f95944206728a83c822244afd079f59cef2911e11dddd85216a09663edbd8041fe5281c0ca9a6182bc5b70d77cbcc403baccbfbdc1d9c6a137e92

Download Submit
C:\Mssurrogatebrowserhostperf\SmjPROQS4143k.bat

Filesize
160B

MD5
fa37ae621180833b315a091613c1540f

SHA1
88d6ec7192566b085231e6a6f05f813a8355514d

SHA256
f3f37ca346054c66639f1320cccc5b8f618ce747c5f9086bd18376a9a42a3484

SHA512
d77768e84e9e01e3e64e00914c5e8f1067796a369c71939641f052c9f9b7d17aef5c9b5e96449d610976f45e291b567c49fc374099a9284c8045ca51d51c9bd0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\winlogon.exe.log

Filesize
1KB

MD5
49b64127208271d8f797256057d0b006

SHA1
b99bd7e2b4e9ed24de47fb3341ea67660b84cca1

SHA256
2a5d403a2e649d8eceef8f785eeb0f6d33888ec6bbf251b3c347e34cb32b1e77

SHA512
f7c728923c893dc9bc88ad2159e0abcda41e1b40ff7e7756e6252d135ed238a2248a2662b3392449836dd1b0b580f0c866cc33e409527484fe4602e3d3f10e3e

Download Submit
C:\Users\Admin\AppData\Local\Temp\1774c9c6-1350-4ef7-aa81-9ab4e89244b3.vbs

Filesize
784B

MD5
8a77932c1db0dea5ddeddb7ef899e52c

SHA1
6750e53b57becb46878bf4c33e236812042288d5

SHA256
11d2c3f051d02fc9c023ec8977b45e188f54b892acff20f08bdcd3b375ecf01f

SHA512
4764f17b15d7516086f2c0e4848e2cb30f47e0e8ade0f2f5f51ac8902bce03c3a31c0b7b5901451f36fff6eef7ab1ca22fbe4b65d845724bf016a92fd1edc34d

Download Submit
C:\Users\Admin\AppData\Local\Temp\5b663ded-d058-4f3e-b7d8-e14f2094ce08.vbs

Filesize
784B

MD5
985c17c33c199ba0b6c801267612f8b7

SHA1
fa5b4ac2dc3458004af8b0c9e383d721bcf8867b

SHA256
563c4aeba058023aaba8850a9ea64c4eb97c58acc93ea268635ddf4ccd4fc0ba

SHA512
29fc7570ba5352cbf02b8207432dcf3dbde832e21202aaec37488ef2dafc2cca2615ee71c6ce52633ac3c077d1f48cb2e3ded2b8e26fa77ba35273389d81f4c6

Download Submit
C:\Users\Admin\AppData\Local\Temp\ae722c66-e3c0-4082-af96-cdff0c6edf7a.vbs

Filesize
784B

MD5
07cbe78754d181875e21939d11578423

SHA1
1c574e71bdd3c8229ff28b5b2c12eaa34029739a

SHA256
8014e6d3daf3702306c1d9e249b43c67d232075fbba17d8fecfa59aae824ff59

SHA512
2164546682e2b54d6ace152034b6a33a41058d70bcac1ad2113eac2d34fca484c08d768e42d1e8cb14170969f7116b8163ae778ba766e7a1814723b7327592e4

Download Submit
C:\Users\Admin\AppData\Local\Temp\cb9f760f-4958-438d-a96e-c75caf883a4b.vbs

Filesize
560B

MD5
d045b2e2915f70397edc9f78a9c6de1d

SHA1
d6d59ab6d721604934a57240bdc9a47981f6ed2b

SHA256
f457ae5307ecc267d6f5a4067dfb84004cea9ebe0597a40d0457f3132d079ec4

SHA512
7b3cb2167348de5ea0e5b79853d1433d7d82f958bf959f539214e44e9d2e2df4a54f5c28471526cda100c28c90b65aef4237e984bbfbec7cbbb24e4599bf90c8

Download Submit
C:\Users\Default\RCXBED1.tmp

Filesize
2.2MB

MD5
70f35d04041d9c029d59586fc6aa3819

SHA1
a9f37462584d22bad8909ffc1c047cdfee84f049

SHA256
517ef97c6f4481e5d6eac2ebd79fbbfe34c9dbe59a0f775c0c2a3e3b942aaae6

SHA512
1739c6ce05e4fbee9d2829a95b3ca910b28a0f853d2a6e11e779fae7b419c46b7fd22641f28c2b91b826dd3905e478a23fa1e55c31665adea3f6a042d7078f53

Download Submit
C:\Windows\uk-UA\Serverbroker.exe

Filesize
2.2MB

MD5
8f7cc78342ce512f1cb58ab616e3010a

SHA1
a8e089e630df31248c5fdbc637ab991d530e32fc

SHA256
474431790aea65c97c1373cd6eb4af6dd9a3578d86cec3992c3967c6102f0e0d

SHA512
bd358c203f821883131921fe34454ce89eb27f59b516501960dc477ade5b100fe992b1803f100c822cb812c1c6a06cd42ac53da355fab90c582ecff7251edbdb

Download Submit
memory/3516-27-0x000000001B1C0000-0x000000001B1CC000-memory.dmp

Filesize
48KB

Download
memory/3516-35-0x000000001BC80000-0x000000001BC8A000-memory.dmp

Filesize
40KB

Download
memory/3516-20-0x0000000002650000-0x0000000002666000-memory.dmp

Filesize
88KB

Download
memory/3516-22-0x0000000002680000-0x0000000002688000-memory.dmp

Filesize
32KB

Download
memory/3516-23-0x00000000026A0000-0x00000000026B0000-memory.dmp

Filesize
64KB

Download
memory/3516-24-0x0000000002690000-0x000000000269A000-memory.dmp

Filesize
40KB

Download
memory/3516-25-0x00000000026B0000-0x00000000026BC000-memory.dmp

Filesize
48KB

Download
memory/3516-26-0x000000001B1B0000-0x000000001B1B8000-memory.dmp

Filesize
32KB

Download
memory/3516-19-0x0000000000F00000-0x0000000000F10000-memory.dmp

Filesize
64KB

Download
memory/3516-28-0x000000001B1D0000-0x000000001B1D8000-memory.dmp

Filesize
32KB

Download
memory/3516-30-0x000000001B9B0000-0x000000001B9C2000-memory.dmp

Filesize
72KB

Download
memory/3516-31-0x000000001BF10000-0x000000001C438000-memory.dmp

Filesize
5.2MB

Download
memory/3516-32-0x000000001B9E0000-0x000000001B9EC000-memory.dmp

Filesize
48KB

Download
memory/3516-33-0x000000001B9F0000-0x000000001B9FC000-memory.dmp

Filesize
48KB

Download
memory/3516-34-0x000000001BA00000-0x000000001BA0C000-memory.dmp

Filesize
48KB

Download
memory/3516-21-0x0000000002670000-0x000000000267C000-memory.dmp

Filesize
48KB

Download
memory/3516-38-0x000000001BC50000-0x000000001BC5E000-memory.dmp

Filesize
56KB

Download
memory/3516-37-0x000000001BC30000-0x000000001BC38000-memory.dmp

Filesize
32KB

Download
memory/3516-36-0x000000001BC10000-0x000000001BC1E000-memory.dmp

Filesize
56KB

Download
memory/3516-41-0x000000001BC40000-0x000000001BC4C000-memory.dmp

Filesize
48KB

Download
memory/3516-39-0x000000001BC60000-0x000000001BC6C000-memory.dmp

Filesize
48KB

Download
memory/3516-40-0x000000001BC20000-0x000000001BC28000-memory.dmp

Filesize
32KB

Download
memory/3516-18-0x0000000000D10000-0x0000000000D18000-memory.dmp

Filesize
32KB

Download
memory/3516-17-0x000000001B960000-0x000000001B9B0000-memory.dmp

Filesize
320KB

Download
memory/3516-16-0x0000000002630000-0x000000000264C000-memory.dmp

Filesize
112KB

Download
memory/3516-15-0x0000000000D00000-0x0000000000D0E000-memory.dmp

Filesize
56KB

Download
memory/3516-14-0x0000000000CF0000-0x0000000000CFE000-memory.dmp

Filesize
56KB

Download
memory/3516-13-0x00000000002B0000-0x00000000004DE000-memory.dmp

Filesize
2.2MB

Download
memory/3516-12-0x00007FF878703000-0x00007FF878705000-memory.dmp

Filesize
8KB

Download