dcrat | 7ddbec7fac00ec5624f45da5879ebfa97d95b21c7842cbaa1058daa46a47bd41

Analysis

max time kernel
117s
max time network
120s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
22/03/2025, 06:16

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c45000d07293154a655ba52ffb7bab99.exe
Size

849KB
MD5

c45000d07293154a655ba52ffb7bab99
SHA1

4b4fbc2c00cf6c6c6fcea58074213c4f0606b80a
SHA256

f639fc426671cba387b08b8c14743bccfd9d13866982573a1ed2e150967c17ac
SHA512

2805351e0080a62061efb9bc7e3d953221df1180edfcf1142b59302a0afbcf3332a8855deaa9f147ebb11789a3cdbadf6073306000d03698537813bf579df674
SSDEEP

12288:I6NE5ig5Fttrh5PxjUm5SvDdLILaBFkjKuAMx6A5gtbGk84Ca04jtiPBgGKYTx:I6N297PxbsKtC5AHgk

Score

10^/10

dcrat infostealer rat

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat
Dcrat family
dcrat

Process spawned unexpected child process 27 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2764	2788	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2720	2788	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2612	2788	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2820	2788	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2140	2788	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	272	2788	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2904	2788	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1744	2788	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	352	2788	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2976	2788	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1640	2788	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1096	2788	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	820	2788	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1484	2788	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2692	2788	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2036	2788	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1648	2788	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1884	2788	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	900	2788	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1804	2788	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2156	2788	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2668	2788	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2620	2788	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2740	2788	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2960	2788	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2732	2788	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2712	2788	schtasks.exe	30

DCRat payload 7 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral9/memory/2532-1-0x00000000003B0000-0x000000000048A000-memory.dmp	dcrat
behavioral9/files/0x0005000000019c54-40.dat	dcrat
behavioral9/files/0x000500000001926a-17.dat	dcrat
behavioral9/files/0x00060000000192a9-109.dat	dcrat
behavioral9/files/0x00070000000193a4-120.dat	dcrat
behavioral9/files/0x0006000000019467-130.dat	dcrat
behavioral9/memory/2360-140-0x0000000000230000-0x000000000030A000-memory.dmp	dcrat

Executes dropped EXE 1 IoCs

pid	Process
2360	sppsvc.exe

Drops file in Program Files directory 10 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\c45000d07293154a655ba52ffb7bab99.exe	c45000d07293154a655ba52ffb7bab99.exe
File created	C:\Program Files (x86)\Microsoft Synchronization Services\ADO.NET\v1.0\wininit.exe	c45000d07293154a655ba52ffb7bab99.exe
File opened for modification	C:\Program Files (x86)\Microsoft Synchronization Services\ADO.NET\v1.0\wininit.exe	c45000d07293154a655ba52ffb7bab99.exe
File created	C:\Program Files (x86)\Microsoft Synchronization Services\ADO.NET\v1.0\56085415360792	c45000d07293154a655ba52ffb7bab99.exe
File created	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\c45000d07293154a655ba52ffb7bab99.exe	c45000d07293154a655ba52ffb7bab99.exe
File created	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\e77d3f30b5f080	c45000d07293154a655ba52ffb7bab99.exe
File opened for modification	C:\Program Files (x86)\Microsoft Synchronization Services\ADO.NET\v1.0\RCXB4B2.tmp	c45000d07293154a655ba52ffb7bab99.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\RCXBF36.tmp	c45000d07293154a655ba52ffb7bab99.exe
File opened for modification	C:\Program Files (x86)\Microsoft Synchronization Services\ADO.NET\v1.0\RCXB444.tmp	c45000d07293154a655ba52ffb7bab99.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\RCXBF37.tmp	c45000d07293154a655ba52ffb7bab99.exe

Drops file in Windows directory 10 IoCs

description	ioc	Process
File created	C:\Windows\BitLockerDiscoveryVolumeContents\sppsvc.exe	c45000d07293154a655ba52ffb7bab99.exe
File created	C:\Windows\BitLockerDiscoveryVolumeContents\0a1fd5f707cd16	c45000d07293154a655ba52ffb7bab99.exe
File opened for modification	C:\Windows\BitLockerDiscoveryVolumeContents\RCXBB2D.tmp	c45000d07293154a655ba52ffb7bab99.exe
File opened for modification	C:\Windows\LiveKernelReports\RCXBD31.tmp	c45000d07293154a655ba52ffb7bab99.exe
File created	C:\Windows\LiveKernelReports\dwm.exe	c45000d07293154a655ba52ffb7bab99.exe
File created	C:\Windows\LiveKernelReports\6cb0b6c459d5d3	c45000d07293154a655ba52ffb7bab99.exe
File opened for modification	C:\Windows\BitLockerDiscoveryVolumeContents\RCXBB2E.tmp	c45000d07293154a655ba52ffb7bab99.exe
File opened for modification	C:\Windows\BitLockerDiscoveryVolumeContents\sppsvc.exe	c45000d07293154a655ba52ffb7bab99.exe
File opened for modification	C:\Windows\LiveKernelReports\RCXBD32.tmp	c45000d07293154a655ba52ffb7bab99.exe
File opened for modification	C:\Windows\LiveKernelReports\dwm.exe	c45000d07293154a655ba52ffb7bab99.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Scheduled Task/Job: Scheduled Task 1 TTPs 27 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2620	schtasks.exe
2960	schtasks.exe
2764	schtasks.exe
2720	schtasks.exe
352	schtasks.exe
2976	schtasks.exe
1648	schtasks.exe
900	schtasks.exe
2740	schtasks.exe
2732	schtasks.exe
2904	schtasks.exe
1744	schtasks.exe
1640	schtasks.exe
1096	schtasks.exe
1884	schtasks.exe
2712	schtasks.exe
2140	schtasks.exe
2036	schtasks.exe
1804	schtasks.exe
2156	schtasks.exe
2668	schtasks.exe
2612	schtasks.exe
2820	schtasks.exe
272	schtasks.exe
820	schtasks.exe
1484	schtasks.exe
2692	schtasks.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
2532	c45000d07293154a655ba52ffb7bab99.exe
2532	c45000d07293154a655ba52ffb7bab99.exe
2532	c45000d07293154a655ba52ffb7bab99.exe
2360	sppsvc.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2532	c45000d07293154a655ba52ffb7bab99.exe
Token: SeDebugPrivilege	2360	sppsvc.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 2532 wrote to memory of 2360	2532	c45000d07293154a655ba52ffb7bab99.exe	58
PID 2532 wrote to memory of 2360	2532	c45000d07293154a655ba52ffb7bab99.exe	58
PID 2532 wrote to memory of 2360	2532	c45000d07293154a655ba52ffb7bab99.exe	58
PID 2532 wrote to memory of 2360	2532	c45000d07293154a655ba52ffb7bab99.exe	58
PID 2532 wrote to memory of 2360	2532	c45000d07293154a655ba52ffb7bab99.exe	58

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\c45000d07293154a655ba52ffb7bab99.exe
"C:\Users\Admin\AppData\Local\Temp\c45000d07293154a655ba52ffb7bab99.exe"
1⤵
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2532
- C:\Windows\BitLockerDiscoveryVolumeContents\sppsvc.exe
  "C:\Windows\BitLockerDiscoveryVolumeContents\sppsvc.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2360

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 7 /tr "'C:\Program Files (x86)\Microsoft Synchronization Services\ADO.NET\v1.0\wininit.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2712

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininit" /sc ONLOGON /tr "'C:\Program Files (x86)\Microsoft Synchronization Services\ADO.NET\v1.0\wininit.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2732

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 12 /tr "'C:\Program Files (x86)\Microsoft Synchronization Services\ADO.NET\v1.0\wininit.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2820

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostt" /sc MINUTE /mo 12 /tr "'C:\MSOCache\All Users\{90140000-00BA-0409-0000-0000000FF1CE}-C\taskhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2764

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhost" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-00BA-0409-0000-0000000FF1CE}-C\taskhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2612

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostt" /sc MINUTE /mo 9 /tr "'C:\MSOCache\All Users\{90140000-00BA-0409-0000-0000000FF1CE}-C\taskhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2720

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 7 /tr "'C:\Recovery\18fc4542-69f6-11ef-a46c-62cb582c238c\lsass.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2960

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsass" /sc ONLOGON /tr "'C:\Recovery\18fc4542-69f6-11ef-a46c-62cb582c238c\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2740

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 6 /tr "'C:\Recovery\18fc4542-69f6-11ef-a46c-62cb582c238c\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2140

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 9 /tr "'C:\Windows\BitLockerDiscoveryVolumeContents\sppsvc.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2620

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvc" /sc ONLOGON /tr "'C:\Windows\BitLockerDiscoveryVolumeContents\sppsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2668

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 6 /tr "'C:\Windows\BitLockerDiscoveryVolumeContents\sppsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2156

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 10 /tr "'C:\Windows\LiveKernelReports\dwm.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1804

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwm" /sc ONLOGON /tr "'C:\Windows\LiveKernelReports\dwm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:272

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 6 /tr "'C:\Windows\LiveKernelReports\dwm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:900

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "c45000d07293154a655ba52ffb7bab99c" /sc MINUTE /mo 6 /tr "'C:\Program Files (x86)\Adobe\Reader 9.0\Reader\c45000d07293154a655ba52ffb7bab99.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1884

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "c45000d07293154a655ba52ffb7bab99" /sc ONLOGON /tr "'C:\Program Files (x86)\Adobe\Reader 9.0\Reader\c45000d07293154a655ba52ffb7bab99.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2904

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "c45000d07293154a655ba52ffb7bab99c" /sc MINUTE /mo 5 /tr "'C:\Program Files (x86)\Adobe\Reader 9.0\Reader\c45000d07293154a655ba52ffb7bab99.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1744

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 9 /tr "'C:\Users\All Users\Start Menu\winlogon.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1648

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogon" /sc ONLOGON /tr "'C:\Users\All Users\Start Menu\winlogon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2036

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 11 /tr "'C:\Users\All Users\Start Menu\winlogon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:352

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "audiodga" /sc MINUTE /mo 14 /tr "'C:\MSOCache\All Users\{90140000-0117-0409-0000-0000000FF1CE}-C\audiodg.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2692

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "audiodg" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-0117-0409-0000-0000000FF1CE}-C\audiodg.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1484

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "audiodga" /sc MINUTE /mo 14 /tr "'C:\MSOCache\All Users\{90140000-0117-0409-0000-0000000FF1CE}-C\audiodg.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:820

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 12 /tr "'C:\Users\Default\services.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1096

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "services" /sc ONLOGON /tr "'C:\Users\Default\services.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1640

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 8 /tr "'C:\Users\Default\services.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2976

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\MSOCache\All Users\{90140000-0117-0409-0000-0000000FF1CE}-C\audiodg.exe

Filesize
849KB

MD5
cec5e51385141347a4f154b623f0700b

SHA1
021bfe75786cc03e790499c9dbb615bb835e0497

SHA256
850f6cd9c570df9ec1befe8bd6dcc988f93b79b99b597be0c457f00075bf8267

SHA512
e31469bbd8618a049b290e92da40e3ae12d812f4b70b7fecb493156ec930277f9b902883aef881c60bb662223f788a955899d2d89473f6237ef6dfb857c74560

Download Submit
C:\Program Files (x86)\Microsoft Synchronization Services\ADO.NET\v1.0\wininit.exe

Filesize
849KB

MD5
045db68f4f8859fbdd8abb3c1f3cff3d

SHA1
0f6189dbc1088120d0970ac69cede19e9d95aff4

SHA256
015dce219e96dee7a7abf161a98b4e85c4d3f1a14c9eac80d934220eff358ce3

SHA512
c08ccda074101da129dfb1dd9c6a35be0a6b7436ab82a29cbdc322c4184a3e5fc5fd9f97e2c0cd28b095329e3552afeaa5e213e593cfb940616cef9de49aeb84

Download Submit
C:\ProgramData\Microsoft\Windows\Start Menu\winlogon.exe

Filesize
849KB

MD5
66a36912b8f116a56e43c44395008f49

SHA1
9e1bf8817675868a813d6d4a4a968789d066236d

SHA256
d77b7c086995f9c8617f40602fdd2bedc9b72e08dd226415d532e846297dc82b

SHA512
9e06fc7cfdfdeb8d5fbd7bc597d25b478d629cc7d01e2e745f128a0685a1c89a916bed0f1aabbe6f3e9b6c920c52e2768f2712805df9a584a75ba007ed0cd84e

Download Submit
C:\Users\Default\RCXC6FA.tmp

Filesize
849KB

MD5
804112e31f13907f3011626e221a0b91

SHA1
0e8806cf65a6253f1470966b4ce6ef48d6afcc2b

SHA256
f957b6f92f03cfecc6d64a75ae3a2252f25ccebb5db7756672edd1cc9104124e

SHA512
11b3a6c395fb5b5f690c0419655a1fad7e309e48a66cd62d4ff023adeeebec8e29a76c803f194defd47520e4ada356547c4259dfce68dc027e86887a4a767705

Download Submit
C:\Windows\LiveKernelReports\dwm.exe

Filesize
849KB

MD5
c45000d07293154a655ba52ffb7bab99

SHA1
4b4fbc2c00cf6c6c6fcea58074213c4f0606b80a

SHA256
f639fc426671cba387b08b8c14743bccfd9d13866982573a1ed2e150967c17ac

SHA512
2805351e0080a62061efb9bc7e3d953221df1180edfcf1142b59302a0afbcf3332a8855deaa9f147ebb11789a3cdbadf6073306000d03698537813bf579df674

Download Submit
memory/2360-140-0x0000000000230000-0x000000000030A000-memory.dmp

Filesize
872KB

Download
memory/2532-7-0x0000000000700000-0x0000000000710000-memory.dmp

Filesize
64KB

Download
memory/2532-2-0x000007FEF5310000-0x000007FEF5CFC000-memory.dmp

Filesize
9.9MB

Download
memory/2532-6-0x00000000003A0000-0x00000000003A8000-memory.dmp

Filesize
32KB

Download
memory/2532-5-0x0000000000380000-0x0000000000396000-memory.dmp

Filesize
88KB

Download
memory/2532-3-0x0000000000350000-0x000000000036C000-memory.dmp

Filesize
112KB

Download
memory/2532-0-0x000007FEF5313000-0x000007FEF5314000-memory.dmp

Filesize
4KB

Download
memory/2532-1-0x00000000003B0000-0x000000000048A000-memory.dmp

Filesize
872KB

Download
memory/2532-8-0x0000000000920000-0x000000000092C000-memory.dmp

Filesize
48KB

Download
memory/2532-4-0x0000000000370000-0x0000000000380000-memory.dmp

Filesize
64KB

Download
memory/2532-141-0x000007FEF5310000-0x000007FEF5CFC000-memory.dmp

Filesize
9.9MB

Download