dcrat | 9f09328091800505339ee1a9f01b6a7646ed60d2ed21808b5e171175f1723b6b

Analysis

max time kernel
120s
max time network
154s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
07-02-2025 08:50

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

9f09328091800505339ee1a9f01b6a7646ed60d2ed218.exe
Size

1.9MB
MD5

aae1c0e394855b9138d9d540a884eb1c
SHA1

76443a092ea47adebb55e663c8299c495dd9e324
SHA256

9f09328091800505339ee1a9f01b6a7646ed60d2ed21808b5e171175f1723b6b
SHA512

a3bda818e3c84e16ae7788ecf4bce9712ab23a152ff164a5cb4e3723e8145ad912cbdc7c2902bb937812e9335733e8252b015eef92d4745b17403a632cbf7322
SSDEEP

49152:HU7L1b7b3wCVJFpcHWhW8bLoym4ZEu9eBknBe6Y:HU7hbXAagWc8fo4ZESc6

Score

10^/10

dcrat discovery execution infostealer persistence rat spyware stealer

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat
Dcrat family
dcrat

Modifies WinLogon for persistence 2 TTPs 6 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files\\Reference Assemblies\\Microsoft\\9f09328091800505339ee1a9f01b6a7646ed60d2ed218.exe\""	9f09328091800505339ee1a9f01b6a7646ed60d2ed218.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files\\Reference Assemblies\\Microsoft\\9f09328091800505339ee1a9f01b6a7646ed60d2ed218.exe\", \"C:\\Windows\\Installer\\{AC76BA86-7AD7-1033-7B44-A90000000001}\\lsass.exe\""	9f09328091800505339ee1a9f01b6a7646ed60d2ed218.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files\\Reference Assemblies\\Microsoft\\9f09328091800505339ee1a9f01b6a7646ed60d2ed218.exe\", \"C:\\Windows\\Installer\\{AC76BA86-7AD7-1033-7B44-A90000000001}\\lsass.exe\", \"C:\\Users\\All Users\\Documents\\dllhost.exe\""	9f09328091800505339ee1a9f01b6a7646ed60d2ed218.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files\\Reference Assemblies\\Microsoft\\9f09328091800505339ee1a9f01b6a7646ed60d2ed218.exe\", \"C:\\Windows\\Installer\\{AC76BA86-7AD7-1033-7B44-A90000000001}\\lsass.exe\", \"C:\\Users\\All Users\\Documents\\dllhost.exe\", \"C:\\MSOCache\\All Users\\{90140000-001A-0409-0000-0000000FF1CE}-C\\audiodg.exe\""	9f09328091800505339ee1a9f01b6a7646ed60d2ed218.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files\\Reference Assemblies\\Microsoft\\9f09328091800505339ee1a9f01b6a7646ed60d2ed218.exe\", \"C:\\Windows\\Installer\\{AC76BA86-7AD7-1033-7B44-A90000000001}\\lsass.exe\", \"C:\\Users\\All Users\\Documents\\dllhost.exe\", \"C:\\MSOCache\\All Users\\{90140000-001A-0409-0000-0000000FF1CE}-C\\audiodg.exe\", \"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\plug_ins\\AcroForm\\spoolsv.exe\""	9f09328091800505339ee1a9f01b6a7646ed60d2ed218.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files\\Reference Assemblies\\Microsoft\\9f09328091800505339ee1a9f01b6a7646ed60d2ed218.exe\", \"C:\\Windows\\Installer\\{AC76BA86-7AD7-1033-7B44-A90000000001}\\lsass.exe\", \"C:\\Users\\All Users\\Documents\\dllhost.exe\", \"C:\\MSOCache\\All Users\\{90140000-001A-0409-0000-0000000FF1CE}-C\\audiodg.exe\", \"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\plug_ins\\AcroForm\\spoolsv.exe\", \"C:\\Users\\Admin\\AppData\\Local\\Temp\\9f09328091800505339ee1a9f01b6a7646ed60d2ed218.exe\""	9f09328091800505339ee1a9f01b6a7646ed60d2ed218.exe

Process spawned unexpected child process 18 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2800	2932	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2768	2932	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2884	2932	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1540	2932	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2984	2932	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	264	2932	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2856	2932	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2512	2932	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2580	2932	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2428	2932	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2276	2932	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1924	2932	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1688	2932	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1644	2932	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	944	2932	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	808	2932	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2304	2932	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2336	2932	schtasks.exe	30

Command and Scripting Interpreter: PowerShell 1 TTPs 6 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
1256	powershell.exe
2080	powershell.exe
1956	powershell.exe
1840	powershell.exe
876	powershell.exe
1940	powershell.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 12 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\audiodg = "\"C:\\MSOCache\\All Users\\{90140000-001A-0409-0000-0000000FF1CE}-C\\audiodg.exe\""	9f09328091800505339ee1a9f01b6a7646ed60d2ed218.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\spoolsv = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\plug_ins\\AcroForm\\spoolsv.exe\""	9f09328091800505339ee1a9f01b6a7646ed60d2ed218.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\lsass = "\"C:\\Windows\\Installer\\{AC76BA86-7AD7-1033-7B44-A90000000001}\\lsass.exe\""	9f09328091800505339ee1a9f01b6a7646ed60d2ed218.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dllhost = "\"C:\\Users\\All Users\\Documents\\dllhost.exe\""	9f09328091800505339ee1a9f01b6a7646ed60d2ed218.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Windows\CurrentVersion\Run\audiodg = "\"C:\\MSOCache\\All Users\\{90140000-001A-0409-0000-0000000FF1CE}-C\\audiodg.exe\""	9f09328091800505339ee1a9f01b6a7646ed60d2ed218.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Windows\CurrentVersion\Run\dllhost = "\"C:\\Users\\All Users\\Documents\\dllhost.exe\""	9f09328091800505339ee1a9f01b6a7646ed60d2ed218.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Windows\CurrentVersion\Run\spoolsv = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\plug_ins\\AcroForm\\spoolsv.exe\""	9f09328091800505339ee1a9f01b6a7646ed60d2ed218.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Windows\CurrentVersion\Run\9f09328091800505339ee1a9f01b6a7646ed60d2ed218 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\9f09328091800505339ee1a9f01b6a7646ed60d2ed218.exe\""	9f09328091800505339ee1a9f01b6a7646ed60d2ed218.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\9f09328091800505339ee1a9f01b6a7646ed60d2ed218 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\9f09328091800505339ee1a9f01b6a7646ed60d2ed218.exe\""	9f09328091800505339ee1a9f01b6a7646ed60d2ed218.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Windows\CurrentVersion\Run\9f09328091800505339ee1a9f01b6a7646ed60d2ed218 = "\"C:\\Program Files\\Reference Assemblies\\Microsoft\\9f09328091800505339ee1a9f01b6a7646ed60d2ed218.exe\""	9f09328091800505339ee1a9f01b6a7646ed60d2ed218.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\9f09328091800505339ee1a9f01b6a7646ed60d2ed218 = "\"C:\\Program Files\\Reference Assemblies\\Microsoft\\9f09328091800505339ee1a9f01b6a7646ed60d2ed218.exe\""	9f09328091800505339ee1a9f01b6a7646ed60d2ed218.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Windows\CurrentVersion\Run\lsass = "\"C:\\Windows\\Installer\\{AC76BA86-7AD7-1033-7B44-A90000000001}\\lsass.exe\""	9f09328091800505339ee1a9f01b6a7646ed60d2ed218.exe

Looks up external IP address via web service 4 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
4	ipinfo.io
5	ipinfo.io
12	ipinfo.io
13	ipinfo.io

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	\??\c:\Windows\System32\CSCEDD39DE794E7468D9738BE595F697CD8.TMP	csc.exe
File created	\??\c:\Windows\System32\hi5-9c.exe	csc.exe

Drops file in Program Files directory 5 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\AcroForm\spoolsv.exe	9f09328091800505339ee1a9f01b6a7646ed60d2ed218.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\AcroForm\spoolsv.exe	9f09328091800505339ee1a9f01b6a7646ed60d2ed218.exe
File created	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\AcroForm\f3b6ecef712a24	9f09328091800505339ee1a9f01b6a7646ed60d2ed218.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\9f09328091800505339ee1a9f01b6a7646ed60d2ed218.exe	9f09328091800505339ee1a9f01b6a7646ed60d2ed218.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\6086d3d60ddf03	9f09328091800505339ee1a9f01b6a7646ed60d2ed218.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\Installer\{AC76BA86-7AD7-1033-7B44-A90000000001}\lsass.exe	9f09328091800505339ee1a9f01b6a7646ed60d2ed218.exe
File created	C:\Windows\Installer\{AC76BA86-7AD7-1033-7B44-A90000000001}\6203df4a6bafc7	9f09328091800505339ee1a9f01b6a7646ed60d2ed218.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
1944	PING.EXE

Modifies system certificate store 2 TTPs 2 IoCs

defense_evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 0400000001000000100000000cd2f9e0da1773e9ed864da5e370e74e14000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e80f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f631900000001000000100000002fe1f70bb05d7c92335bc5e05b984da620000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827	9f09328091800505339ee1a9f01b6a7646ed60d2ed218.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8	9f09328091800505339ee1a9f01b6a7646ed60d2ed218.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
1944	PING.EXE

Scheduled Task/Job: Scheduled Task 1 TTPs 18 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2768	schtasks.exe
1540	schtasks.exe
2984	schtasks.exe
2304	schtasks.exe
2884	schtasks.exe
2856	schtasks.exe
2428	schtasks.exe
1924	schtasks.exe
808	schtasks.exe
2800	schtasks.exe
264	schtasks.exe
2276	schtasks.exe
1688	schtasks.exe
1644	schtasks.exe
944	schtasks.exe
2336	schtasks.exe
2512	schtasks.exe
2580	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2200	9f09328091800505339ee1a9f01b6a7646ed60d2ed218.exe
2200	9f09328091800505339ee1a9f01b6a7646ed60d2ed218.exe
2200	9f09328091800505339ee1a9f01b6a7646ed60d2ed218.exe
2200	9f09328091800505339ee1a9f01b6a7646ed60d2ed218.exe
2200	9f09328091800505339ee1a9f01b6a7646ed60d2ed218.exe
2200	9f09328091800505339ee1a9f01b6a7646ed60d2ed218.exe
2200	9f09328091800505339ee1a9f01b6a7646ed60d2ed218.exe
2200	9f09328091800505339ee1a9f01b6a7646ed60d2ed218.exe
2200	9f09328091800505339ee1a9f01b6a7646ed60d2ed218.exe
2200	9f09328091800505339ee1a9f01b6a7646ed60d2ed218.exe
2200	9f09328091800505339ee1a9f01b6a7646ed60d2ed218.exe
2200	9f09328091800505339ee1a9f01b6a7646ed60d2ed218.exe
2200	9f09328091800505339ee1a9f01b6a7646ed60d2ed218.exe
2200	9f09328091800505339ee1a9f01b6a7646ed60d2ed218.exe
2200	9f09328091800505339ee1a9f01b6a7646ed60d2ed218.exe
2200	9f09328091800505339ee1a9f01b6a7646ed60d2ed218.exe
2200	9f09328091800505339ee1a9f01b6a7646ed60d2ed218.exe
2200	9f09328091800505339ee1a9f01b6a7646ed60d2ed218.exe
2200	9f09328091800505339ee1a9f01b6a7646ed60d2ed218.exe
2200	9f09328091800505339ee1a9f01b6a7646ed60d2ed218.exe
2200	9f09328091800505339ee1a9f01b6a7646ed60d2ed218.exe
2200	9f09328091800505339ee1a9f01b6a7646ed60d2ed218.exe
2200	9f09328091800505339ee1a9f01b6a7646ed60d2ed218.exe
2200	9f09328091800505339ee1a9f01b6a7646ed60d2ed218.exe
2200	9f09328091800505339ee1a9f01b6a7646ed60d2ed218.exe
2200	9f09328091800505339ee1a9f01b6a7646ed60d2ed218.exe
2200	9f09328091800505339ee1a9f01b6a7646ed60d2ed218.exe
2200	9f09328091800505339ee1a9f01b6a7646ed60d2ed218.exe
2200	9f09328091800505339ee1a9f01b6a7646ed60d2ed218.exe
2200	9f09328091800505339ee1a9f01b6a7646ed60d2ed218.exe
2200	9f09328091800505339ee1a9f01b6a7646ed60d2ed218.exe
2200	9f09328091800505339ee1a9f01b6a7646ed60d2ed218.exe
2200	9f09328091800505339ee1a9f01b6a7646ed60d2ed218.exe
2200	9f09328091800505339ee1a9f01b6a7646ed60d2ed218.exe
2200	9f09328091800505339ee1a9f01b6a7646ed60d2ed218.exe
2200	9f09328091800505339ee1a9f01b6a7646ed60d2ed218.exe
2200	9f09328091800505339ee1a9f01b6a7646ed60d2ed218.exe
2200	9f09328091800505339ee1a9f01b6a7646ed60d2ed218.exe
2200	9f09328091800505339ee1a9f01b6a7646ed60d2ed218.exe
2200	9f09328091800505339ee1a9f01b6a7646ed60d2ed218.exe
2200	9f09328091800505339ee1a9f01b6a7646ed60d2ed218.exe
2200	9f09328091800505339ee1a9f01b6a7646ed60d2ed218.exe
2200	9f09328091800505339ee1a9f01b6a7646ed60d2ed218.exe
2200	9f09328091800505339ee1a9f01b6a7646ed60d2ed218.exe
2200	9f09328091800505339ee1a9f01b6a7646ed60d2ed218.exe
2200	9f09328091800505339ee1a9f01b6a7646ed60d2ed218.exe
2200	9f09328091800505339ee1a9f01b6a7646ed60d2ed218.exe
2200	9f09328091800505339ee1a9f01b6a7646ed60d2ed218.exe
2200	9f09328091800505339ee1a9f01b6a7646ed60d2ed218.exe
2200	9f09328091800505339ee1a9f01b6a7646ed60d2ed218.exe
2200	9f09328091800505339ee1a9f01b6a7646ed60d2ed218.exe
2200	9f09328091800505339ee1a9f01b6a7646ed60d2ed218.exe
2200	9f09328091800505339ee1a9f01b6a7646ed60d2ed218.exe
2200	9f09328091800505339ee1a9f01b6a7646ed60d2ed218.exe
2200	9f09328091800505339ee1a9f01b6a7646ed60d2ed218.exe
2200	9f09328091800505339ee1a9f01b6a7646ed60d2ed218.exe
2200	9f09328091800505339ee1a9f01b6a7646ed60d2ed218.exe
2200	9f09328091800505339ee1a9f01b6a7646ed60d2ed218.exe
2200	9f09328091800505339ee1a9f01b6a7646ed60d2ed218.exe
2200	9f09328091800505339ee1a9f01b6a7646ed60d2ed218.exe
2200	9f09328091800505339ee1a9f01b6a7646ed60d2ed218.exe
2200	9f09328091800505339ee1a9f01b6a7646ed60d2ed218.exe
2200	9f09328091800505339ee1a9f01b6a7646ed60d2ed218.exe
2200	9f09328091800505339ee1a9f01b6a7646ed60d2ed218.exe

Suspicious use of AdjustPrivilegeToken 8 IoCs

description	pid	Process
Token: SeDebugPrivilege	2200	9f09328091800505339ee1a9f01b6a7646ed60d2ed218.exe
Token: SeDebugPrivilege	1956	powershell.exe
Token: SeDebugPrivilege	1256	powershell.exe
Token: SeDebugPrivilege	876	powershell.exe
Token: SeDebugPrivilege	1940	powershell.exe
Token: SeDebugPrivilege	1840	powershell.exe
Token: SeDebugPrivilege	2080	powershell.exe
Token: SeDebugPrivilege	2536	9f09328091800505339ee1a9f01b6a7646ed60d2ed218.exe

Suspicious use of WriteProcessMemory 36 IoCs

description	pid	Process	procid_target
PID 2200 wrote to memory of 804	2200	9f09328091800505339ee1a9f01b6a7646ed60d2ed218.exe	34
PID 2200 wrote to memory of 804	2200	9f09328091800505339ee1a9f01b6a7646ed60d2ed218.exe	34
PID 2200 wrote to memory of 804	2200	9f09328091800505339ee1a9f01b6a7646ed60d2ed218.exe	34
PID 804 wrote to memory of 1516	804	csc.exe	36
PID 804 wrote to memory of 1516	804	csc.exe	36
PID 804 wrote to memory of 1516	804	csc.exe	36
PID 2200 wrote to memory of 2080	2200	9f09328091800505339ee1a9f01b6a7646ed60d2ed218.exe	52
PID 2200 wrote to memory of 2080	2200	9f09328091800505339ee1a9f01b6a7646ed60d2ed218.exe	52
PID 2200 wrote to memory of 2080	2200	9f09328091800505339ee1a9f01b6a7646ed60d2ed218.exe	52
PID 2200 wrote to memory of 1256	2200	9f09328091800505339ee1a9f01b6a7646ed60d2ed218.exe	53
PID 2200 wrote to memory of 1256	2200	9f09328091800505339ee1a9f01b6a7646ed60d2ed218.exe	53
PID 2200 wrote to memory of 1256	2200	9f09328091800505339ee1a9f01b6a7646ed60d2ed218.exe	53
PID 2200 wrote to memory of 1956	2200	9f09328091800505339ee1a9f01b6a7646ed60d2ed218.exe	55
PID 2200 wrote to memory of 1956	2200	9f09328091800505339ee1a9f01b6a7646ed60d2ed218.exe	55
PID 2200 wrote to memory of 1956	2200	9f09328091800505339ee1a9f01b6a7646ed60d2ed218.exe	55
PID 2200 wrote to memory of 1840	2200	9f09328091800505339ee1a9f01b6a7646ed60d2ed218.exe	56
PID 2200 wrote to memory of 1840	2200	9f09328091800505339ee1a9f01b6a7646ed60d2ed218.exe	56
PID 2200 wrote to memory of 1840	2200	9f09328091800505339ee1a9f01b6a7646ed60d2ed218.exe	56
PID 2200 wrote to memory of 876	2200	9f09328091800505339ee1a9f01b6a7646ed60d2ed218.exe	57
PID 2200 wrote to memory of 876	2200	9f09328091800505339ee1a9f01b6a7646ed60d2ed218.exe	57
PID 2200 wrote to memory of 876	2200	9f09328091800505339ee1a9f01b6a7646ed60d2ed218.exe	57
PID 2200 wrote to memory of 1940	2200	9f09328091800505339ee1a9f01b6a7646ed60d2ed218.exe	59
PID 2200 wrote to memory of 1940	2200	9f09328091800505339ee1a9f01b6a7646ed60d2ed218.exe	59
PID 2200 wrote to memory of 1940	2200	9f09328091800505339ee1a9f01b6a7646ed60d2ed218.exe	59
PID 2200 wrote to memory of 2324	2200	9f09328091800505339ee1a9f01b6a7646ed60d2ed218.exe	64
PID 2200 wrote to memory of 2324	2200	9f09328091800505339ee1a9f01b6a7646ed60d2ed218.exe	64
PID 2200 wrote to memory of 2324	2200	9f09328091800505339ee1a9f01b6a7646ed60d2ed218.exe	64
PID 2324 wrote to memory of 1112	2324	cmd.exe	66
PID 2324 wrote to memory of 1112	2324	cmd.exe	66
PID 2324 wrote to memory of 1112	2324	cmd.exe	66
PID 2324 wrote to memory of 1944	2324	cmd.exe	67
PID 2324 wrote to memory of 1944	2324	cmd.exe	67
PID 2324 wrote to memory of 1944	2324	cmd.exe	67
PID 2324 wrote to memory of 2536	2324	cmd.exe	68
PID 2324 wrote to memory of 2536	2324	cmd.exe	68
PID 2324 wrote to memory of 2536	2324	cmd.exe	68

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\9f09328091800505339ee1a9f01b6a7646ed60d2ed218.exe
"C:\Users\Admin\AppData\Local\Temp\9f09328091800505339ee1a9f01b6a7646ed60d2ed218.exe"
1⤵
- Modifies WinLogon for persistence
- Adds Run key to start application
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2200
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\yrvd4bhs\yrvd4bhs.cmdline"
  2⤵
  - Drops file in System32 directory
  - Suspicious use of WriteProcessMemory
  PID:804
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESB635.tmp" "c:\Windows\System32\CSCEDD39DE794E7468D9738BE595F697CD8.TMP"
    3⤵
    PID:1516
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Reference Assemblies\Microsoft\9f09328091800505339ee1a9f01b6a7646ed60d2ed218.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of AdjustPrivilegeToken
  PID:2080
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\Installer\{AC76BA86-7AD7-1033-7B44-A90000000001}\lsass.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of AdjustPrivilegeToken
  PID:1256
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\All Users\Documents\dllhost.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of AdjustPrivilegeToken
  PID:1956
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\MSOCache\All Users\{90140000-001A-0409-0000-0000000FF1CE}-C\audiodg.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of AdjustPrivilegeToken
  PID:1840
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\AcroForm\spoolsv.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of AdjustPrivilegeToken
  PID:876
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\9f09328091800505339ee1a9f01b6a7646ed60d2ed218.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of AdjustPrivilegeToken
  PID:1940
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\cvPwbLiLgp.bat"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2324
- - C:\Windows\system32\chcp.com
    chcp 65001
    3⤵
    PID:1112
- - C:\Windows\system32\PING.EXE
    ping -n 10 localhost
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:1944
- - C:\Users\Admin\AppData\Local\Temp\9f09328091800505339ee1a9f01b6a7646ed60d2ed218.exe
    "C:\Users\Admin\AppData\Local\Temp\9f09328091800505339ee1a9f01b6a7646ed60d2ed218.exe"
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2536

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "9f09328091800505339ee1a9f01b6a7646ed60d2ed2189" /sc MINUTE /mo 9 /tr "'C:\Program Files\Reference Assemblies\Microsoft\9f09328091800505339ee1a9f01b6a7646ed60d2ed218.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2768

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "9f09328091800505339ee1a9f01b6a7646ed60d2ed218" /sc ONLOGON /tr "'C:\Program Files\Reference Assemblies\Microsoft\9f09328091800505339ee1a9f01b6a7646ed60d2ed218.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2800

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "9f09328091800505339ee1a9f01b6a7646ed60d2ed2189" /sc MINUTE /mo 12 /tr "'C:\Program Files\Reference Assemblies\Microsoft\9f09328091800505339ee1a9f01b6a7646ed60d2ed218.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2884

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 7 /tr "'C:\Windows\Installer\{AC76BA86-7AD7-1033-7B44-A90000000001}\lsass.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1540

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsass" /sc ONLOGON /tr "'C:\Windows\Installer\{AC76BA86-7AD7-1033-7B44-A90000000001}\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2984

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 10 /tr "'C:\Windows\Installer\{AC76BA86-7AD7-1033-7B44-A90000000001}\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:264

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 8 /tr "'C:\Users\All Users\Documents\dllhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2856

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Users\All Users\Documents\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2512

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 6 /tr "'C:\Users\All Users\Documents\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2580

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "audiodga" /sc MINUTE /mo 10 /tr "'C:\MSOCache\All Users\{90140000-001A-0409-0000-0000000FF1CE}-C\audiodg.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2428

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "audiodg" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-001A-0409-0000-0000000FF1CE}-C\audiodg.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2276

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "audiodga" /sc MINUTE /mo 12 /tr "'C:\MSOCache\All Users\{90140000-001A-0409-0000-0000000FF1CE}-C\audiodg.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1924

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 10 /tr "'C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\AcroForm\spoolsv.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1688

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsv" /sc ONLOGON /tr "'C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\AcroForm\spoolsv.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1644

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 12 /tr "'C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\AcroForm\spoolsv.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:944

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "9f09328091800505339ee1a9f01b6a7646ed60d2ed2189" /sc MINUTE /mo 13 /tr "'C:\Users\Admin\AppData\Local\Temp\9f09328091800505339ee1a9f01b6a7646ed60d2ed218.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:808

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "9f09328091800505339ee1a9f01b6a7646ed60d2ed218" /sc ONLOGON /tr "'C:\Users\Admin\AppData\Local\Temp\9f09328091800505339ee1a9f01b6a7646ed60d2ed218.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2304

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "9f09328091800505339ee1a9f01b6a7646ed60d2ed2189" /sc MINUTE /mo 9 /tr "'C:\Users\Admin\AppData\Local\Temp\9f09328091800505339ee1a9f01b6a7646ed60d2ed218.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2336

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\Reference Assemblies\Microsoft\9f09328091800505339ee1a9f01b6a7646ed60d2ed218.exe

Filesize
1.9MB

MD5
aae1c0e394855b9138d9d540a884eb1c

SHA1
76443a092ea47adebb55e663c8299c495dd9e324

SHA256
9f09328091800505339ee1a9f01b6a7646ed60d2ed21808b5e171175f1723b6b

SHA512
a3bda818e3c84e16ae7788ecf4bce9712ab23a152ff164a5cb4e3723e8145ad912cbdc7c2902bb937812e9335733e8252b015eef92d4745b17403a632cbf7322

Download Submit
C:\Users\Admin\AppData\Local\Temp\RESB635.tmp

Filesize
1KB

MD5
766a9c12ca9bda6cfac28238d65d7477

SHA1
d45cbaaa33d7f9e8689cb3ea80f3144393e3c470

SHA256
58791e7d41d93bf63a4e6b6bb4f70a845b8b0d22b9af0511d6d5b8b549443c7d

SHA512
368d838ee503bf0a678fbea7171a19ffbd071fd98ccaa25f69884bc4c825d579f323401ae69dac184f95323b61515d0850a69926f5f0fd43c60982d7d14c0cb5

Download Submit
C:\Users\Admin\AppData\Local\Temp\cvPwbLiLgp.bat

Filesize
211B

MD5
eff2500287063ca9773eae4f51d5ac3e

SHA1
d29244840e8bd5111b3bb0e9fbf3ebed301aa5b5

SHA256
34b2b6ba3ca147bcfac3b1ea980d7ed178af9c1ec488d462f9ad74392afde7a8

SHA512
34b4249f6327130dd4b8ad45e6de3ad95b0e8f57027d94a1f2988b0a4ca93b26c794c7ed34f2ef48166f774481d3199a89f730666b04e11fe79488114f6be7c6

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
7KB

MD5
6e2268682f37a3fd4e525de727b538b4

SHA1
83f018ea30fa0ce7b2d1db54b7b415e486f28b32

SHA256
225e6acd45abff3f9e421c9f4652cae6a8426934f160b4689ce4d875787b740b

SHA512
0ea9070cf1bd9cbfbf3752b63b1e6a6412fe19d20b6246806e071dfd209f990335927965c9f504144bb85d27bc48c8644b27ee22ff2a5b26850666c276aa1ae3

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\yrvd4bhs\yrvd4bhs.0.cs

Filesize
429B

MD5
cc7150b7afa563738af137603a97d819

SHA1
28d5c48c38c6581ad0b4e4ee84b1abb61bd0c6dd

SHA256
a6da53887275834e899d9a46c819ed7ce700d965b5ed94241e88fa6673b8e826

SHA512
294a8f11b1392cf4edf406005062afff325112b90a67f81ccbfd83d3644a978b65f87370e5f32dfb081f918a4f04f3121f2082f9d19109ad42ffaf6222c1b39e

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\yrvd4bhs\yrvd4bhs.cmdline

Filesize
235B

MD5
9bba6711f642c04fcf30d314f81d1fed

SHA1
4923111fc9f38ddbd899e8df6a558baec208d32b

SHA256
35830803f3ac356f70d3852f32622b21343c333f5533ef474b0d37a5e55ddb3a

SHA512
8e2d84b1043282c303b57e8afc664aafeac2ed2b8b5b3744800019086f0ae7c0d8504dc286720e5e26651fb1e6a9c2df57c408512d756cf66c8dadf6f89c3fe1

Download Submit
\??\c:\Windows\System32\CSCEDD39DE794E7468D9738BE595F697CD8.TMP

Filesize
1KB

MD5
60a1ebb8f840aad127346a607d80fc19

SHA1
c8b7e9ad601ac19ab90b3e36f811960e8badf354

SHA256
9d6a9d38b7a86cc88e551a0c1172a3fb387b1a5f928ac13993ec3387d39cc243

SHA512
44830cefb264bac520174b4b884312dd0393be33a193d4f0fee3cc3c14deb86ca39e43ef281232f9169fd204d19b22e8a7aad72fa448ca52d5cbc3ee1dbb18a4

Download Submit
memory/1256-86-0x0000000001FD0000-0x0000000001FD8000-memory.dmp

Filesize
32KB

Download
memory/1940-85-0x000000001B1C0000-0x000000001B4A2000-memory.dmp

Filesize
2.9MB

Download
memory/2200-29-0x000007FEF6400000-0x000007FEF6DEC000-memory.dmp

Filesize
9.9MB

Download
memory/2200-8-0x0000000000420000-0x000000000043C000-memory.dmp

Filesize
112KB

Download
memory/2200-16-0x000007FEF6400000-0x000007FEF6DEC000-memory.dmp

Filesize
9.9MB

Download
memory/2200-18-0x0000000000480000-0x000000000048C000-memory.dmp

Filesize
48KB

Download
memory/2200-19-0x000007FEF6400000-0x000007FEF6DEC000-memory.dmp

Filesize
9.9MB

Download
memory/2200-25-0x000007FEF6400000-0x000007FEF6DEC000-memory.dmp

Filesize
9.9MB

Download
memory/2200-26-0x000007FEF6400000-0x000007FEF6DEC000-memory.dmp

Filesize
9.9MB

Download
memory/2200-0-0x000007FEF6403000-0x000007FEF6404000-memory.dmp

Filesize
4KB

Download
memory/2200-13-0x0000000000410000-0x000000000041C000-memory.dmp

Filesize
48KB

Download
memory/2200-11-0x000007FEF6400000-0x000007FEF6DEC000-memory.dmp

Filesize
9.9MB

Download
memory/2200-10-0x0000000000440000-0x0000000000458000-memory.dmp

Filesize
96KB

Download
memory/2200-15-0x0000000000460000-0x0000000000468000-memory.dmp

Filesize
32KB

Download
memory/2200-6-0x00000000003F0000-0x00000000003FE000-memory.dmp

Filesize
56KB

Download
memory/2200-46-0x000007FEF6403000-0x000007FEF6404000-memory.dmp

Filesize
4KB

Download
memory/2200-47-0x000007FEF6400000-0x000007FEF6DEC000-memory.dmp

Filesize
9.9MB

Download
memory/2200-48-0x000007FEF6400000-0x000007FEF6DEC000-memory.dmp

Filesize
9.9MB

Download
memory/2200-52-0x000007FEF6400000-0x000007FEF6DEC000-memory.dmp

Filesize
9.9MB

Download
memory/2200-4-0x000007FEF6400000-0x000007FEF6DEC000-memory.dmp

Filesize
9.9MB

Download
memory/2200-3-0x000007FEF6400000-0x000007FEF6DEC000-memory.dmp

Filesize
9.9MB

Download
memory/2200-2-0x000007FEF6400000-0x000007FEF6DEC000-memory.dmp

Filesize
9.9MB

Download
memory/2200-84-0x000007FEF6400000-0x000007FEF6DEC000-memory.dmp

Filesize
9.9MB

Download
memory/2200-1-0x0000000000B20000-0x0000000000D04000-memory.dmp

Filesize
1.9MB

Download
memory/2536-87-0x0000000000CB0000-0x0000000000E94000-memory.dmp

Filesize
1.9MB

Download