dcrat | edb7c41437f94c8941985169d46a079c70c10f0be1f58faf8751895541414322

Analysis

max time kernel
93s
max time network
95s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
21-01-2025 01:41

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

edb7c41437f94c8941985169d46a079c70c10f0be1f58faf8751895541414322.exe
Size

1.7MB
MD5

70cce5da5f92bbe6d8cb1d38b7071a61
SHA1

3aa3958772bec55307a2181982f063415278e761
SHA256

edb7c41437f94c8941985169d46a079c70c10f0be1f58faf8751895541414322
SHA512

959b63af4e19cafa2be83a63eda2bf8192c779a70772372b42e1954786d292b2991278e3221f29e25dd9ea4f88801d177e81a79340d8ed548453b51888cafaba
SSDEEP

24576:t3QwuLyEbVoCtPreIjNLoN/VNGeSQDx1m17zezKOkCzeJGFUJK:tgwuuEpdDLNwVMeXDL0fdSzAGf

Score

10^/10

dcrat execution infostealer rat

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat
Dcrat family
dcrat

Process spawned unexpected child process 33 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2440	436	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2640	436	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1188	436	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	348	436	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5040	436	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4672	436	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	432	436	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	32	436	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1168	436	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2320	436	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3888	436	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4712	436	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1432	436	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3984	436	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2384	436	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4644	436	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1328	436	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2952	436	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2556	436	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2664	436	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4056	436	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	740	436	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2812	436	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3484	436	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1696	436	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2724	436	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4692	436	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4956	436	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3508	436	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2736	436	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4848	436	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4092	436	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1008	436	schtasks.exe	85

DCRat payload 4 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral2/memory/5092-1-0x0000000000C30000-0x0000000000DE6000-memory.dmp	dcrat
behavioral2/files/0x0007000000023cce-29.dat	dcrat
behavioral2/files/0x000e000000023ce5-104.dat	dcrat
behavioral2/files/0x0008000000023cdd-299.dat	dcrat

Command and Scripting Interpreter: PowerShell 1 TTPs 11 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
2248	powershell.exe
4344	powershell.exe
3380	powershell.exe
4964	powershell.exe
4580	powershell.exe
4448	powershell.exe
4460	powershell.exe
2264	powershell.exe
4852	powershell.exe
3908	powershell.exe
4784	powershell.exe

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\drivers\etc\hosts	edb7c41437f94c8941985169d46a079c70c10f0be1f58faf8751895541414322.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation	edb7c41437f94c8941985169d46a079c70c10f0be1f58faf8751895541414322.exe
Key value queried	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation	Idle.exe

Executes dropped EXE 2 IoCs

pid	Process
3420	Idle.exe
3604	Idle.exe

Drops file in Program Files directory 25 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\SaslPrep\RCXB633.tmp	edb7c41437f94c8941985169d46a079c70c10f0be1f58faf8751895541414322.exe
File opened for modification	C:\Program Files\Windows Security\BrowserCore\en-US\RCXB849.tmp	edb7c41437f94c8941985169d46a079c70c10f0be1f58faf8751895541414322.exe
File opened for modification	C:\Program Files\dotnet\host\RCXCA99.tmp	edb7c41437f94c8941985169d46a079c70c10f0be1f58faf8751895541414322.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\SaslPrep\explorer.exe	edb7c41437f94c8941985169d46a079c70c10f0be1f58faf8751895541414322.exe
File created	C:\Program Files\Windows NT\Accessories\dllhost.exe	edb7c41437f94c8941985169d46a079c70c10f0be1f58faf8751895541414322.exe
File created	C:\Program Files (x86)\Windows Mail\38384e6a620884	edb7c41437f94c8941985169d46a079c70c10f0be1f58faf8751895541414322.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\SaslPrep\RCXB623.tmp	edb7c41437f94c8941985169d46a079c70c10f0be1f58faf8751895541414322.exe
File opened for modification	C:\Program Files\Windows NT\Accessories\dllhost.exe	edb7c41437f94c8941985169d46a079c70c10f0be1f58faf8751895541414322.exe
File opened for modification	C:\Program Files (x86)\Windows Mail\RCXC600.tmp	edb7c41437f94c8941985169d46a079c70c10f0be1f58faf8751895541414322.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\SaslPrep\explorer.exe	edb7c41437f94c8941985169d46a079c70c10f0be1f58faf8751895541414322.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\SaslPrep\7a0fd90576e088	edb7c41437f94c8941985169d46a079c70c10f0be1f58faf8751895541414322.exe
File created	C:\Program Files\Windows Security\BrowserCore\en-US\ea1d8f6d871115	edb7c41437f94c8941985169d46a079c70c10f0be1f58faf8751895541414322.exe
File opened for modification	C:\Program Files (x86)\Windows Mail\RCXC610.tmp	edb7c41437f94c8941985169d46a079c70c10f0be1f58faf8751895541414322.exe
File opened for modification	C:\Program Files (x86)\Windows Mail\SearchApp.exe	edb7c41437f94c8941985169d46a079c70c10f0be1f58faf8751895541414322.exe
File created	C:\Program Files\Windows NT\Accessories\5940a34987c991	edb7c41437f94c8941985169d46a079c70c10f0be1f58faf8751895541414322.exe
File opened for modification	C:\Program Files\Windows Security\BrowserCore\en-US\RCXB848.tmp	edb7c41437f94c8941985169d46a079c70c10f0be1f58faf8751895541414322.exe
File opened for modification	C:\Program Files\Windows NT\Accessories\RCXBCA2.tmp	edb7c41437f94c8941985169d46a079c70c10f0be1f58faf8751895541414322.exe
File created	C:\Program Files\dotnet\host\6ccacd8608530f	edb7c41437f94c8941985169d46a079c70c10f0be1f58faf8751895541414322.exe
File opened for modification	C:\Program Files\Windows Security\BrowserCore\en-US\upfc.exe	edb7c41437f94c8941985169d46a079c70c10f0be1f58faf8751895541414322.exe
File opened for modification	C:\Program Files\Windows NT\Accessories\RCXBCA1.tmp	edb7c41437f94c8941985169d46a079c70c10f0be1f58faf8751895541414322.exe
File opened for modification	C:\Program Files\dotnet\host\RCXCA98.tmp	edb7c41437f94c8941985169d46a079c70c10f0be1f58faf8751895541414322.exe
File opened for modification	C:\Program Files\dotnet\host\Idle.exe	edb7c41437f94c8941985169d46a079c70c10f0be1f58faf8751895541414322.exe
File created	C:\Program Files\Windows Security\BrowserCore\en-US\upfc.exe	edb7c41437f94c8941985169d46a079c70c10f0be1f58faf8751895541414322.exe
File created	C:\Program Files (x86)\Windows Mail\SearchApp.exe	edb7c41437f94c8941985169d46a079c70c10f0be1f58faf8751895541414322.exe
File created	C:\Program Files\dotnet\host\Idle.exe	edb7c41437f94c8941985169d46a079c70c10f0be1f58faf8751895541414322.exe

Drops file in Windows directory 5 IoCs

description	ioc	Process
File created	C:\Windows\Media\Cityscape\winlogon.exe	edb7c41437f94c8941985169d46a079c70c10f0be1f58faf8751895541414322.exe
File created	C:\Windows\Media\Cityscape\cc11b995f2a76d	edb7c41437f94c8941985169d46a079c70c10f0be1f58faf8751895541414322.exe
File opened for modification	C:\Windows\Media\Cityscape\RCXBA5D.tmp	edb7c41437f94c8941985169d46a079c70c10f0be1f58faf8751895541414322.exe
File opened for modification	C:\Windows\Media\Cityscape\RCXBA7D.tmp	edb7c41437f94c8941985169d46a079c70c10f0be1f58faf8751895541414322.exe
File opened for modification	C:\Windows\Media\Cityscape\winlogon.exe	edb7c41437f94c8941985169d46a079c70c10f0be1f58faf8751895541414322.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings	edb7c41437f94c8941985169d46a079c70c10f0be1f58faf8751895541414322.exe
Key created	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings	Idle.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 33 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
3888	schtasks.exe
4712	schtasks.exe
1432	schtasks.exe
4692	schtasks.exe
4848	schtasks.exe
2952	schtasks.exe
3508	schtasks.exe
1008	schtasks.exe
2440	schtasks.exe
2556	schtasks.exe
4056	schtasks.exe
5040	schtasks.exe
4672	schtasks.exe
3984	schtasks.exe
740	schtasks.exe
3484	schtasks.exe
2724	schtasks.exe
1188	schtasks.exe
1328	schtasks.exe
4956	schtasks.exe
2736	schtasks.exe
2664	schtasks.exe
2812	schtasks.exe
1168	schtasks.exe
2384	schtasks.exe
1696	schtasks.exe
4092	schtasks.exe
2640	schtasks.exe
348	schtasks.exe
432	schtasks.exe
32	schtasks.exe
2320	schtasks.exe
4644	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
5092	edb7c41437f94c8941985169d46a079c70c10f0be1f58faf8751895541414322.exe
5092	edb7c41437f94c8941985169d46a079c70c10f0be1f58faf8751895541414322.exe
5092	edb7c41437f94c8941985169d46a079c70c10f0be1f58faf8751895541414322.exe
5092	edb7c41437f94c8941985169d46a079c70c10f0be1f58faf8751895541414322.exe
5092	edb7c41437f94c8941985169d46a079c70c10f0be1f58faf8751895541414322.exe
5092	edb7c41437f94c8941985169d46a079c70c10f0be1f58faf8751895541414322.exe
5092	edb7c41437f94c8941985169d46a079c70c10f0be1f58faf8751895541414322.exe
5092	edb7c41437f94c8941985169d46a079c70c10f0be1f58faf8751895541414322.exe
5092	edb7c41437f94c8941985169d46a079c70c10f0be1f58faf8751895541414322.exe
5092	edb7c41437f94c8941985169d46a079c70c10f0be1f58faf8751895541414322.exe
5092	edb7c41437f94c8941985169d46a079c70c10f0be1f58faf8751895541414322.exe
5092	edb7c41437f94c8941985169d46a079c70c10f0be1f58faf8751895541414322.exe
5092	edb7c41437f94c8941985169d46a079c70c10f0be1f58faf8751895541414322.exe
5092	edb7c41437f94c8941985169d46a079c70c10f0be1f58faf8751895541414322.exe
5092	edb7c41437f94c8941985169d46a079c70c10f0be1f58faf8751895541414322.exe
5092	edb7c41437f94c8941985169d46a079c70c10f0be1f58faf8751895541414322.exe
5092	edb7c41437f94c8941985169d46a079c70c10f0be1f58faf8751895541414322.exe
5092	edb7c41437f94c8941985169d46a079c70c10f0be1f58faf8751895541414322.exe
5092	edb7c41437f94c8941985169d46a079c70c10f0be1f58faf8751895541414322.exe
5092	edb7c41437f94c8941985169d46a079c70c10f0be1f58faf8751895541414322.exe
5092	edb7c41437f94c8941985169d46a079c70c10f0be1f58faf8751895541414322.exe
5092	edb7c41437f94c8941985169d46a079c70c10f0be1f58faf8751895541414322.exe
5092	edb7c41437f94c8941985169d46a079c70c10f0be1f58faf8751895541414322.exe
5092	edb7c41437f94c8941985169d46a079c70c10f0be1f58faf8751895541414322.exe
5092	edb7c41437f94c8941985169d46a079c70c10f0be1f58faf8751895541414322.exe
5092	edb7c41437f94c8941985169d46a079c70c10f0be1f58faf8751895541414322.exe
5092	edb7c41437f94c8941985169d46a079c70c10f0be1f58faf8751895541414322.exe
5092	edb7c41437f94c8941985169d46a079c70c10f0be1f58faf8751895541414322.exe
5092	edb7c41437f94c8941985169d46a079c70c10f0be1f58faf8751895541414322.exe
5092	edb7c41437f94c8941985169d46a079c70c10f0be1f58faf8751895541414322.exe
5092	edb7c41437f94c8941985169d46a079c70c10f0be1f58faf8751895541414322.exe
5092	edb7c41437f94c8941985169d46a079c70c10f0be1f58faf8751895541414322.exe
5092	edb7c41437f94c8941985169d46a079c70c10f0be1f58faf8751895541414322.exe
5092	edb7c41437f94c8941985169d46a079c70c10f0be1f58faf8751895541414322.exe
5092	edb7c41437f94c8941985169d46a079c70c10f0be1f58faf8751895541414322.exe
5092	edb7c41437f94c8941985169d46a079c70c10f0be1f58faf8751895541414322.exe
5092	edb7c41437f94c8941985169d46a079c70c10f0be1f58faf8751895541414322.exe
5092	edb7c41437f94c8941985169d46a079c70c10f0be1f58faf8751895541414322.exe
4964	powershell.exe
4964	powershell.exe
4784	powershell.exe
4784	powershell.exe
3908	powershell.exe
3908	powershell.exe
4448	powershell.exe
4448	powershell.exe
4460	powershell.exe
4460	powershell.exe
2264	powershell.exe
2264	powershell.exe
4580	powershell.exe
4580	powershell.exe
4344	powershell.exe
4344	powershell.exe
4852	powershell.exe
4852	powershell.exe
4344	powershell.exe
3380	powershell.exe
3380	powershell.exe
2264	powershell.exe
3908	powershell.exe
4964	powershell.exe
4784	powershell.exe
3380	powershell.exe

Suspicious use of AdjustPrivilegeToken 13 IoCs

description	pid	Process
Token: SeDebugPrivilege	5092	edb7c41437f94c8941985169d46a079c70c10f0be1f58faf8751895541414322.exe
Token: SeDebugPrivilege	4964	powershell.exe
Token: SeDebugPrivilege	4784	powershell.exe
Token: SeDebugPrivilege	3908	powershell.exe
Token: SeDebugPrivilege	4448	powershell.exe
Token: SeDebugPrivilege	4460	powershell.exe
Token: SeDebugPrivilege	2264	powershell.exe
Token: SeDebugPrivilege	4580	powershell.exe
Token: SeDebugPrivilege	4344	powershell.exe
Token: SeDebugPrivilege	4852	powershell.exe
Token: SeDebugPrivilege	3380	powershell.exe
Token: SeDebugPrivilege	3420	Idle.exe
Token: SeDebugPrivilege	3604	Idle.exe

Suspicious use of WriteProcessMemory 34 IoCs

description	pid	Process	procid_target
PID 5092 wrote to memory of 4580	5092	edb7c41437f94c8941985169d46a079c70c10f0be1f58faf8751895541414322.exe	120
PID 5092 wrote to memory of 4580	5092	edb7c41437f94c8941985169d46a079c70c10f0be1f58faf8751895541414322.exe	120
PID 5092 wrote to memory of 3380	5092	edb7c41437f94c8941985169d46a079c70c10f0be1f58faf8751895541414322.exe	121
PID 5092 wrote to memory of 3380	5092	edb7c41437f94c8941985169d46a079c70c10f0be1f58faf8751895541414322.exe	121
PID 5092 wrote to memory of 4964	5092	edb7c41437f94c8941985169d46a079c70c10f0be1f58faf8751895541414322.exe	122
PID 5092 wrote to memory of 4964	5092	edb7c41437f94c8941985169d46a079c70c10f0be1f58faf8751895541414322.exe	122
PID 5092 wrote to memory of 4784	5092	edb7c41437f94c8941985169d46a079c70c10f0be1f58faf8751895541414322.exe	123
PID 5092 wrote to memory of 4784	5092	edb7c41437f94c8941985169d46a079c70c10f0be1f58faf8751895541414322.exe	123
PID 5092 wrote to memory of 3908	5092	edb7c41437f94c8941985169d46a079c70c10f0be1f58faf8751895541414322.exe	124
PID 5092 wrote to memory of 3908	5092	edb7c41437f94c8941985169d46a079c70c10f0be1f58faf8751895541414322.exe	124
PID 5092 wrote to memory of 4852	5092	edb7c41437f94c8941985169d46a079c70c10f0be1f58faf8751895541414322.exe	125
PID 5092 wrote to memory of 4852	5092	edb7c41437f94c8941985169d46a079c70c10f0be1f58faf8751895541414322.exe	125
PID 5092 wrote to memory of 4344	5092	edb7c41437f94c8941985169d46a079c70c10f0be1f58faf8751895541414322.exe	126
PID 5092 wrote to memory of 4344	5092	edb7c41437f94c8941985169d46a079c70c10f0be1f58faf8751895541414322.exe	126
PID 5092 wrote to memory of 2264	5092	edb7c41437f94c8941985169d46a079c70c10f0be1f58faf8751895541414322.exe	127
PID 5092 wrote to memory of 2264	5092	edb7c41437f94c8941985169d46a079c70c10f0be1f58faf8751895541414322.exe	127
PID 5092 wrote to memory of 2248	5092	edb7c41437f94c8941985169d46a079c70c10f0be1f58faf8751895541414322.exe	128
PID 5092 wrote to memory of 2248	5092	edb7c41437f94c8941985169d46a079c70c10f0be1f58faf8751895541414322.exe	128
PID 5092 wrote to memory of 4460	5092	edb7c41437f94c8941985169d46a079c70c10f0be1f58faf8751895541414322.exe	129
PID 5092 wrote to memory of 4460	5092	edb7c41437f94c8941985169d46a079c70c10f0be1f58faf8751895541414322.exe	129
PID 5092 wrote to memory of 4448	5092	edb7c41437f94c8941985169d46a079c70c10f0be1f58faf8751895541414322.exe	130
PID 5092 wrote to memory of 4448	5092	edb7c41437f94c8941985169d46a079c70c10f0be1f58faf8751895541414322.exe	130
PID 5092 wrote to memory of 3500	5092	edb7c41437f94c8941985169d46a079c70c10f0be1f58faf8751895541414322.exe	141
PID 5092 wrote to memory of 3500	5092	edb7c41437f94c8941985169d46a079c70c10f0be1f58faf8751895541414322.exe	141
PID 3500 wrote to memory of 3200	3500	cmd.exe	144
PID 3500 wrote to memory of 3200	3500	cmd.exe	144
PID 3500 wrote to memory of 3420	3500	cmd.exe	146
PID 3500 wrote to memory of 3420	3500	cmd.exe	146
PID 3420 wrote to memory of 4900	3420	Idle.exe	149
PID 3420 wrote to memory of 4900	3420	Idle.exe	149
PID 3420 wrote to memory of 1852	3420	Idle.exe	150
PID 3420 wrote to memory of 1852	3420	Idle.exe	150
PID 4900 wrote to memory of 3604	4900	WScript.exe	156
PID 4900 wrote to memory of 3604	4900	WScript.exe	156

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\edb7c41437f94c8941985169d46a079c70c10f0be1f58faf8751895541414322.exe
"C:\Users\Admin\AppData\Local\Temp\edb7c41437f94c8941985169d46a079c70c10f0be1f58faf8751895541414322.exe"
1⤵
- Drops file in Drivers directory
- Checks computer location settings
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5092
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4580
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/$Recycle.Bin/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3380
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Documents and Settings/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4964
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/PerfLogs/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4784
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3908
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files (x86)/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4852
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/ProgramData/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4344
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Recovery/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2264
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/System Volume Information/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:2248
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Users/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4460
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Windows/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4448
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\ZulfStaN0H.bat"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3500
- - C:\Windows\system32\w32tm.exe
    w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
    3⤵
    PID:3200
- - C:\Program Files\dotnet\host\Idle.exe
    "C:\Program Files\dotnet\host\Idle.exe"
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Modifies registry class
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:3420
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\42886f58-f1d6-4fff-a425-20d616651db3.vbs"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:4900
    - - C:\Program Files\dotnet\host\Idle.exe
        
        "C:\Program Files\dotnet\host\Idle.exe"
        5⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:3604
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\8090d2d2-789f-4b71-a6b0-d29f2d38b156.vbs"
      4⤵
      PID:1852

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 6 /tr "'C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\SaslPrep\explorer.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2440

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorer" /sc ONLOGON /tr "'C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\SaslPrep\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2640

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 8 /tr "'C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\SaslPrep\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1188

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "upfcu" /sc MINUTE /mo 5 /tr "'C:\Program Files\Windows Security\BrowserCore\en-US\upfc.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:348

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "upfc" /sc ONLOGON /tr "'C:\Program Files\Windows Security\BrowserCore\en-US\upfc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5040

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "upfcu" /sc MINUTE /mo 6 /tr "'C:\Program Files\Windows Security\BrowserCore\en-US\upfc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4672

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 7 /tr "'C:\Windows\Media\Cityscape\winlogon.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:432

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogon" /sc ONLOGON /tr "'C:\Windows\Media\Cityscape\winlogon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:32

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 8 /tr "'C:\Windows\Media\Cityscape\winlogon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1168

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 14 /tr "'C:\Program Files\Windows NT\Accessories\dllhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2320

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Program Files\Windows NT\Accessories\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3888

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 14 /tr "'C:\Program Files\Windows NT\Accessories\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4712

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SearchAppS" /sc MINUTE /mo 10 /tr "'C:\Recovery\WindowsRE\SearchApp.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1432

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SearchApp" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\SearchApp.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3984

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SearchAppS" /sc MINUTE /mo 5 /tr "'C:\Recovery\WindowsRE\SearchApp.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2384

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 10 /tr "'C:\Users\Admin\Contacts\smss.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4644

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smss" /sc ONLOGON /tr "'C:\Users\Admin\Contacts\smss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1328

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 14 /tr "'C:\Users\Admin\Contacts\smss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2952

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 10 /tr "'C:\Recovery\WindowsRE\Idle.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2556

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Idle" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\Idle.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2664

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 5 /tr "'C:\Recovery\WindowsRE\Idle.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4056

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SearchAppS" /sc MINUTE /mo 8 /tr "'C:\Program Files (x86)\Windows Mail\SearchApp.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:740

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SearchApp" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Mail\SearchApp.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2812

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SearchAppS" /sc MINUTE /mo 9 /tr "'C:\Program Files (x86)\Windows Mail\SearchApp.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3484

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 11 /tr "'C:\Users\Default User\System.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1696

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "System" /sc ONLOGON /tr "'C:\Users\Default User\System.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2724

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 8 /tr "'C:\Users\Default User\System.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4692

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 5 /tr "'C:\Program Files\dotnet\host\Idle.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4956

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Idle" /sc ONLOGON /tr "'C:\Program Files\dotnet\host\Idle.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3508

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 7 /tr "'C:\Program Files\dotnet\host\Idle.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2736

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 11 /tr "'C:\Recovery\WindowsRE\explorer.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4848

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorer" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4092

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 5 /tr "'C:\Recovery\WindowsRE\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1008

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\dotnet\host\Idle.exe

Filesize
1.7MB

MD5
251bc53b2e5b51a8605bbc3cc214d220

SHA1
ea2c82feaebf9a3ee294094be2c8ce4190e6592b

SHA256
4abd3fdc568bb1f27720659825994c87f22381b8611c94761472145196dd369a

SHA512
0209113fa0a0418213da29ecf564cfb9a9ea27c17cb6582affdcab72be58635753f1d2b895395815672e432b330e974a0ac2cf77b01afcd368d2c8451c37a97e

Download Submit
C:\Recovery\WindowsRE\SearchApp.exe

Filesize
1.7MB

MD5
70cce5da5f92bbe6d8cb1d38b7071a61

SHA1
3aa3958772bec55307a2181982f063415278e761

SHA256
edb7c41437f94c8941985169d46a079c70c10f0be1f58faf8751895541414322

SHA512
959b63af4e19cafa2be83a63eda2bf8192c779a70772372b42e1954786d292b2991278e3221f29e25dd9ea4f88801d177e81a79340d8ed548453b51888cafaba

Download Submit
C:\Recovery\WindowsRE\SearchApp.exe

Filesize
1.7MB

MD5
19feef3f1c85148e765f3dbaea9553d6

SHA1
2ab97588e53ba32313773b6d72fbc3e3be4aab33

SHA256
e224a1f1eadab0d7098de5ec5e14516d28ab877ab2865f152be014305a123b9d

SHA512
73e3f9f319218ba56efb24977ddeccfe767de73fa44945cb82f3339638e40809621185e32bd1169d0606c5b9cffd036c00d22c39f364ed613c1249811c7f2138

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\Idle.exe.log

Filesize
1KB

MD5
3ad9a5252966a3ab5b1b3222424717be

SHA1
5397522c86c74ddbfb2585b9613c794f4b4c3410

SHA256
27525f5fc7871c6828ab5173315e95b5c7e918d2ee532781c562c378584b5249

SHA512
b1a745f7a0f33b777ffc34f74f42752144d9f2d06b8bc613e703570494762b3af87e153212c3274b18af14f17b8619e2f350b7c3cc11228f7d4208d4251e90e6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
a43e653ffb5ab07940f4bdd9cc8fade4

SHA1
af43d04e3427f111b22dc891c5c7ee8a10ac4123

SHA256
c4c53abb13e99475aebfbe9fec7a8fead81c14c80d9dcc2b81375304f3a683fe

SHA512
62a97e95e1f19a8d4302847110dae44f469877eed6aa8ea22345c6eb25ee220e7d310fa0b7ec5df42356815421c0af7c46a0f1fee8933cc446641800eda6cd1b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
d28a889fd956d5cb3accfbaf1143eb6f

SHA1
157ba54b365341f8ff06707d996b3635da8446f7

SHA256
21e5d7ccf80a293e6ba30ed728846ca19c929c52b96e2c8d34e27cd2234f1d45

SHA512
0b6d88deb9be85722e6a78d5886d49f2caf407a59e128d2b4ed74c1356f9928c40048a62731959f2460e9ff9d9feee311043d2a37abe3bb92c2b76a44281478c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
62623d22bd9e037191765d5083ce16a3

SHA1
4a07da6872672f715a4780513d95ed8ddeefd259

SHA256
95d79fd575bbd21540e378fcbc1cd00d16f51af62ce15bae7080bb72c24e2010

SHA512
9a448b7a0d867466c2ea04ab84d2a9485d5fd20ab53b2b854f491831ee3f1d781b94d2635f7b0b35cb9f2d373cd52c67570879a56a42ed66bc9db06962ed4992

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
a8e8360d573a4ff072dcc6f09d992c88

SHA1
3446774433ceaf0b400073914facab11b98b6807

SHA256
bf5e284e8f95122bf75ead61c7e2b40f55c96742b05330b5b1cb7915991df13b

SHA512
4ee5167643d82082f57c42616007ef9be57f43f9731921bdf7bca611a914724ad94072d3c8f5b130fa54129e5328ccdebf37ba74339c37deb53e79df5cdf0dbe

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
59d97011e091004eaffb9816aa0b9abd

SHA1
1602a56b01dd4b7c577ca27d3117e4bcc1aa657b

SHA256
18f381e0db020a763b8c515c346ef58679ab9c403267eacfef5359e272f7e71d

SHA512
d9ca49c1a17580981e2c1a50d73c0eecaa7a62f8514741512172e395af2a3d80aeb0f71c58bc7f52c18246d57ba67af09b6bff4776877d6cc6f0245c30e092d6

Download Submit
C:\Users\Admin\AppData\Local\Temp\42886f58-f1d6-4fff-a425-20d616651db3.vbs

Filesize
713B

MD5
9b3e0c6dfe633d70d9a5df5712fca779

SHA1
9b6bdb54f75abe4267118ee91cefa95ff32a4750

SHA256
28932764ef92f8bdc54e5dd11f680e81098667cd2eafb1ce4a5d2093a716b42c

SHA512
6fd2bf558e53b078550ed5c87ed2bd92956b5449e5df178c1e00fd9e554c406953eeeefa473a86503d98886decd6f12c6eb5a6a1da1db4103900581be8fc344a

Download Submit
C:\Users\Admin\AppData\Local\Temp\8090d2d2-789f-4b71-a6b0-d29f2d38b156.vbs

Filesize
489B

MD5
28388329d599a6f8ce8a1d82c3d96f2b

SHA1
e8a3fab5d1ba3b6816337d7bc8dc7cb0fd631640

SHA256
023094bfa5c7d0925d088d0b0f2e8d5def2df1a9af064d05200052647e2c1a7e

SHA512
5c8c49cb1000053aeea33e2ed07fb8374b0ed2247147fed355b190bb798c2d268dde4f794545122be8713be6f4de6514d2af15394a0a6fcc670752c524c15216

Download Submit
C:\Users\Admin\AppData\Local\Temp\ZulfStaN0H.bat

Filesize
202B

MD5
47e7dd819e1008b6b48c2f7542858a7d

SHA1
5e84f24ca5838ab801c2cd671bbf88e549a89239

SHA256
0ff7336dc948a14282581af384264b384bfa528edc92b44c1f72eeab311136cf

SHA512
40a6ec0896c15b11acca5bdf33209560e1f36b7e2c94be8cd191a40260c65d64e29e068b0c14bf9629c6fe46951a04c96f1686de506b9324a95df3c6e1f4482a

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_gorl2bvs.ikz.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
memory/3420-312-0x000000001C230000-0x000000001C332000-memory.dmp

Filesize
1.0MB

Download
memory/3420-301-0x0000000002CE0000-0x0000000002CF2000-memory.dmp

Filesize
72KB

Download
memory/3604-315-0x0000000000C40000-0x0000000000C52000-memory.dmp

Filesize
72KB

Download
memory/4784-194-0x000001CF5E3D0000-0x000001CF5E3F2000-memory.dmp

Filesize
136KB

Download
memory/5092-15-0x000000001BA00000-0x000000001BA0A000-memory.dmp

Filesize
40KB

Download
memory/5092-9-0x000000001B980000-0x000000001B990000-memory.dmp

Filesize
64KB

Download
memory/5092-14-0x000000001B9F0000-0x000000001B9FC000-memory.dmp

Filesize
48KB

Download
memory/5092-6-0x000000001B910000-0x000000001B920000-memory.dmp

Filesize
64KB

Download
memory/5092-7-0x000000001B940000-0x000000001B956000-memory.dmp

Filesize
88KB

Download
memory/5092-142-0x00007FF976223000-0x00007FF976225000-memory.dmp

Filesize
8KB

Download
memory/5092-165-0x00007FF976220000-0x00007FF976CE1000-memory.dmp

Filesize
10.8MB

Download
memory/5092-5-0x000000001B900000-0x000000001B908000-memory.dmp

Filesize
32KB

Download
memory/5092-18-0x000000001C440000-0x000000001C44C000-memory.dmp

Filesize
48KB

Download
memory/5092-4-0x000000001B990000-0x000000001B9E0000-memory.dmp

Filesize
320KB

Download
memory/5092-22-0x00007FF976220000-0x00007FF976CE1000-memory.dmp

Filesize
10.8MB

Download
memory/5092-21-0x00007FF976220000-0x00007FF976CE1000-memory.dmp

Filesize
10.8MB

Download
memory/5092-208-0x00007FF976220000-0x00007FF976CE1000-memory.dmp

Filesize
10.8MB

Download
memory/5092-0-0x00007FF976223000-0x00007FF976225000-memory.dmp

Filesize
8KB

Download
memory/5092-3-0x0000000002F70000-0x0000000002F8C000-memory.dmp

Filesize
112KB

Download
memory/5092-16-0x000000001C420000-0x000000001C428000-memory.dmp

Filesize
32KB

Download
memory/5092-2-0x00007FF976220000-0x00007FF976CE1000-memory.dmp

Filesize
10.8MB

Download
memory/5092-17-0x000000001C430000-0x000000001C43C000-memory.dmp

Filesize
48KB

Download
memory/5092-13-0x000000001B9E0000-0x000000001B9EC000-memory.dmp

Filesize
48KB

Download
memory/5092-11-0x000000001B970000-0x000000001B978000-memory.dmp

Filesize
32KB

Download
memory/5092-10-0x000000001B960000-0x000000001B96C000-memory.dmp

Filesize
48KB

Download
memory/5092-1-0x0000000000C30000-0x0000000000DE6000-memory.dmp

Filesize
1.7MB

Download
memory/5092-8-0x000000001B920000-0x000000001B932000-memory.dmp

Filesize
72KB

Download