Overview
overview
10Static
static
101.exe
windows7_x64
61.exe
windows10-2004_x64
610.exe
windows7_x64
1010.exe
windows10-2004_x64
102.doc
windows7_x64
102.doc
windows10-2004_x64
13.xlsx
windows7_x64
103.xlsx
windows10-2004_x64
14.exe
windows7_x64
104.exe
windows10-2004_x64
15.exe
windows7_x64
105.exe
windows10-2004_x64
16.exe
windows7_x64
106.exe
windows10-2004_x64
107.exe
windows7_x64
107.exe
windows10-2004_x64
18.exe
windows7_x64
108.exe
windows10-2004_x64
109.docm
windows7_x64
109.docm
windows10-2004_x64
10rip.bat
windows7_x64
10rip.bat
windows10-2004_x64
10Analysis
-
max time kernel
130s -
max time network
156s -
platform
windows10-2004_x64 -
resource
win10v2004-en-20220113 -
submitted
23-03-2022 21:00
Static task
static1
Behavioral task
behavioral1
Sample
1.exe
Resource
win7-20220310-en
Behavioral task
behavioral2
Sample
1.exe
Resource
win10v2004-en-20220113
Behavioral task
behavioral3
Sample
10.exe
Resource
win7-20220310-en
Behavioral task
behavioral4
Sample
10.exe
Resource
win10v2004-en-20220113
Behavioral task
behavioral5
Sample
2.doc
Resource
win7-20220311-en
Behavioral task
behavioral6
Sample
2.doc
Resource
win10v2004-20220310-en
Behavioral task
behavioral7
Sample
3.xlsx
Resource
win7-20220311-en
Behavioral task
behavioral8
Sample
3.xlsx
Resource
win10v2004-20220310-en
Behavioral task
behavioral9
Sample
4.exe
Resource
win7-20220311-en
Behavioral task
behavioral10
Sample
4.exe
Resource
win10v2004-en-20220113
Behavioral task
behavioral11
Sample
5.exe
Resource
win7-20220310-en
Behavioral task
behavioral12
Sample
5.exe
Resource
win10v2004-en-20220113
Behavioral task
behavioral13
Sample
6.exe
Resource
win7-20220310-en
Behavioral task
behavioral14
Sample
6.exe
Resource
win10v2004-en-20220113
Behavioral task
behavioral15
Sample
7.exe
Resource
win7-20220311-en
Behavioral task
behavioral16
Sample
7.exe
Resource
win10v2004-20220310-en
Behavioral task
behavioral17
Sample
8.exe
Resource
win7-20220311-en
Behavioral task
behavioral18
Sample
8.exe
Resource
win10v2004-20220310-en
Behavioral task
behavioral19
Sample
9.docm
Resource
win7-20220311-en
Behavioral task
behavioral20
Sample
9.docm
Resource
win10v2004-en-20220113
Behavioral task
behavioral21
Sample
rip.bat
Resource
win7-20220310-en
Behavioral task
behavioral22
Sample
rip.bat
Resource
win10v2004-en-20220113
General
-
Target
6.exe
Malware Config
Signatures
-
DcRat 21 IoCs
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
Processes:
schtasks.exeschtasks.exeschtasks.exe6.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exepid process 5080 schtasks.exe 5000 schtasks.exe 3672 schtasks.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sihost = "\"C:\\Windows\\System32\\GenValObj\\sihost.exe\"" 6.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\taskhostw = "\"C:\\Windows\\System32\\drvstore\\taskhostw.exe\"" 6.exe 3904 schtasks.exe 436 schtasks.exe 4476 schtasks.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\StartMenuExperienceHost = "\"C:\\Windows\\SystemApps\\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\\AppxBlockMap\\StartMenuExperienceHost.exe\"" 6.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\taskhostw = "\"C:\\Windows\\System32\\srm\\taskhostw.exe\"" 6.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dwm = "\"C:\\Windows\\System32\\ImplatSetup\\dwm.exe\"" 6.exe 1688 schtasks.exe 2920 schtasks.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA 6.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dwm = "\"C:\\Windows\\System32\\gdi32full\\dwm.exe\"" 6.exe 1440 schtasks.exe 1516 schtasks.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\fontdrvhost = "\"C:\\Windows\\System32\\WorkfoldersControl\\fontdrvhost.exe\"" 6.exe 4468 schtasks.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dwm = "\"C:\\Windows\\System32\\mfc120chs\\dwm.exe\"" 6.exe 2184 schtasks.exe -
Process spawned unexpected child process 12 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
Processes:
schtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exedescription pid pid_target process target process Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 5000 3216 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4468 3216 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4476 3216 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3904 3216 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 436 3216 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3672 3216 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 5080 3216 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1440 3216 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1516 3216 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2184 3216 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1688 3216 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2920 3216 schtasks.exe -
suricata: ET MALWARE DCRAT Activity (GET)
suricata: ET MALWARE DCRAT Activity (GET)
-
Executes dropped EXE 1 IoCs
Processes:
winlogon.exepid process 2988 winlogon.exe -
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
6.exe6.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Control Panel\International\Geo\Nation 6.exe Key value queried \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Control Panel\International\Geo\Nation 6.exe -
Adds Run key to start application 2 TTPs 12 IoCs
Processes:
6.exe6.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RuntimeBroker = "\"C:\\ProgramData\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\packages\\vcRuntimeAdditional_x86\\RuntimeBroker.exe\"" 6.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\winlogon = "\"C:\\Documents and Settings\\winlogon.exe\"" 6.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\explorer = "\"C:\\Windows\\bootstat\\explorer.exe\"" 6.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\explorer = "\"C:\\Program Files (x86)\\Google\\Policies\\explorer.exe\"" 6.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sihost = "\"C:\\Windows\\System32\\GenValObj\\sihost.exe\"" 6.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\StartMenuExperienceHost = "\"C:\\Windows\\SystemApps\\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\\AppxBlockMap\\StartMenuExperienceHost.exe\"" 6.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\taskhostw = "\"C:\\Windows\\System32\\drvstore\\taskhostw.exe\"" 6.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dwm = "\"C:\\Windows\\System32\\mfc120chs\\dwm.exe\"" 6.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\fontdrvhost = "\"C:\\Windows\\System32\\WorkfoldersControl\\fontdrvhost.exe\"" 6.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\taskhostw = "\"C:\\Windows\\System32\\srm\\taskhostw.exe\"" 6.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dwm = "\"C:\\Windows\\System32\\gdi32full\\dwm.exe\"" 6.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dwm = "\"C:\\Windows\\System32\\ImplatSetup\\dwm.exe\"" 6.exe -
Processes:
6.exewinlogon.exe6.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA 6.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 6.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA winlogon.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" winlogon.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA 6.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 6.exe -
Drops file in System32 directory 15 IoCs
Processes:
6.exedescription ioc process File created C:\Windows\System32\GenValObj\sihost.exe 6.exe File created C:\Windows\System32\drvstore\ea9f0e6c9e2dcd4dfacdaf29ba21541fb815a988 6.exe File created C:\Windows\System32\srm\taskhostw.exe 6.exe File created C:\Windows\System32\srm\ea9f0e6c9e2dcd4dfacdaf29ba21541fb815a988 6.exe File created C:\Windows\System32\gdi32full\dwm.exe 6.exe File opened for modification C:\Windows\System32\gdi32full\dwm.exe 6.exe File created C:\Windows\System32\mfc120chs\dwm.exe 6.exe File created C:\Windows\System32\gdi32full\6cb0b6c459d5d3455a3da700e713f2e2529862ff 6.exe File created C:\Windows\System32\ImplatSetup\dwm.exe 6.exe File created C:\Windows\System32\ImplatSetup\6cb0b6c459d5d3455a3da700e713f2e2529862ff 6.exe File created C:\Windows\System32\mfc120chs\6cb0b6c459d5d3455a3da700e713f2e2529862ff 6.exe File created C:\Windows\System32\GenValObj\66fc9ff0ee96c2b21f0cfded48750ae9e3032bf3 6.exe File created C:\Windows\System32\drvstore\taskhostw.exe 6.exe File created C:\Windows\System32\WorkfoldersControl\fontdrvhost.exe 6.exe File created C:\Windows\System32\WorkfoldersControl\5b884080fd4f94e2695da25c503f9e33b9605b83 6.exe -
Drops file in Program Files directory 2 IoCs
Processes:
6.exedescription ioc process File created C:\Program Files (x86)\Google\Policies\7a0fd90576e08807bde2cc57bcf9854bbce05fe3 6.exe File created C:\Program Files (x86)\Google\Policies\explorer.exe 6.exe -
Drops file in Windows directory 4 IoCs
Processes:
6.exe6.exedescription ioc process File created C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\AppxBlockMap\StartMenuExperienceHost.exe 6.exe File created C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\AppxBlockMap\55b276f4edf653fe07efe8f1ecc32d3d195abd16 6.exe File created C:\Windows\bootstat\explorer.exe 6.exe File created C:\Windows\bootstat\7a0fd90576e08807bde2cc57bcf9854bbce05fe3 6.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 12 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes:
schtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exepid process 2184 schtasks.exe 4468 schtasks.exe 3904 schtasks.exe 436 schtasks.exe 1440 schtasks.exe 1516 schtasks.exe 1688 schtasks.exe 2920 schtasks.exe 5000 schtasks.exe 4476 schtasks.exe 3672 schtasks.exe 5080 schtasks.exe -
Modifies registry class 1 IoCs
Processes:
6.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000_Classes\Local Settings 6.exe -
Suspicious behavior: EnumeratesProcesses 9 IoCs
Processes:
6.exe6.exewinlogon.exepid process 1160 6.exe 1160 6.exe 1160 6.exe 1160 6.exe 1160 6.exe 1160 6.exe 1160 6.exe 4352 6.exe 2988 winlogon.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
6.exe6.exewinlogon.exedescription pid process Token: SeDebugPrivilege 1160 6.exe Token: SeDebugPrivilege 4352 6.exe Token: SeDebugPrivilege 2988 winlogon.exe -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
6.execmd.exe6.exedescription pid process target process PID 1160 wrote to memory of 4808 1160 6.exe cmd.exe PID 1160 wrote to memory of 4808 1160 6.exe cmd.exe PID 4808 wrote to memory of 3736 4808 cmd.exe w32tm.exe PID 4808 wrote to memory of 3736 4808 cmd.exe w32tm.exe PID 4808 wrote to memory of 4352 4808 cmd.exe 6.exe PID 4808 wrote to memory of 4352 4808 cmd.exe 6.exe PID 4352 wrote to memory of 2988 4352 6.exe winlogon.exe PID 4352 wrote to memory of 2988 4352 6.exe winlogon.exe -
System policy modification 1 TTPs 9 IoCs
Processes:
6.exe6.exewinlogon.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" 6.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" 6.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" 6.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" winlogon.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" winlogon.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" winlogon.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 6.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" 6.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 6.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\6.exe"C:\Users\Admin\AppData\Local\Temp\6.exe"1⤵
- DcRat
- Checks computer location settings
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\YhJtA5Z5n3.bat"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:23⤵
-
C:\Users\Admin\AppData\Local\Temp\6.exe"C:\Users\Admin\AppData\Local\Temp\6.exe"3⤵
- Checks computer location settings
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Documents and Settings\winlogon.exe"C:\Documents and Settings\winlogon.exe"4⤵
- Executes dropped EXE
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- System policy modification
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "dwm" /sc ONLOGON /tr "'C:\Windows\System32\gdi32full\dwm.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "sihost" /sc ONLOGON /tr "'C:\Windows\System32\GenValObj\sihost.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "dwm" /sc ONLOGON /tr "'C:\Windows\System32\ImplatSetup\dwm.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "taskhostw" /sc ONLOGON /tr "'C:\Windows\System32\drvstore\taskhostw.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "dwm" /sc ONLOGON /tr "'C:\Windows\System32\mfc120chs\dwm.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\Windows\System32\WorkfoldersControl\fontdrvhost.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "StartMenuExperienceHost" /sc ONLOGON /tr "'C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\AppxBlockMap\StartMenuExperienceHost.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "taskhostw" /sc ONLOGON /tr "'C:\Windows\System32\srm\taskhostw.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\ProgramData\Package Cache\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\packages\vcRuntimeAdditional_x86\RuntimeBroker.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "winlogon" /sc ONLOGON /tr "'C:\Documents and Settings\winlogon.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "explorer" /sc ONLOGON /tr "'C:\Windows\bootstat\explorer.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "explorer" /sc ONLOGON /tr "'C:\Program Files (x86)\Google\Policies\explorer.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Documents and Settings\winlogon.exeFilesize
564KB
MD5748a4bea8c0624a4c7a69f67263e0839
SHA16955b7d516df38992ac6bff9d0b0f5df150df859
SHA256220d8f8ff82d413c81bd02dfa001e1c478e8fbea44bad24f21b3a5284e15632e
SHA5125fcdfddce3cc2e636001ed08c5f2f7590aadaa37c091f7ba94e519d298e284362721f1859c6ffbf064ae23e05d4e0e9754b515396812fbe9f9028497396799fd
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\6.exe.logFilesize
1KB
MD5b7c0c43fc7804baaa7dc87152cdc9554
SHA11bab62bd56af745678d4e967d91e1ccfdeed4038
SHA25646386a61f3aaf1b1c2e6efc9fc7e9e9ff16cd13ae58b8d856835771fedb6d457
SHA5129fda3dd00a3406137e0113f13f78e77b20a76512b35820d38df696842cbbf2e2ebabfb99a3846c9637ecb54af858ec1551521187e379872973006426a253f769
-
C:\Users\Admin\AppData\Local\Temp\YhJtA5Z5n3.batFilesize
203B
MD51d1523baa7f95f99f056551c38538d8b
SHA1a02089b0cd2fb7f6308eddb35437c117b4194e07
SHA256cb5094fe8d71624397c5fae8831bc3103e468c5b17c383245fa5d16226b5776c
SHA512ea33e3ae876ae4cb6447d485aea54c90bf81f01e619e35805a58548532ced360f88793d1cb5b40cefea39498dab29a4c60c6a4a802d10aa2018639af3a321527
-
C:\Users\winlogon.exeFilesize
564KB
MD5748a4bea8c0624a4c7a69f67263e0839
SHA16955b7d516df38992ac6bff9d0b0f5df150df859
SHA256220d8f8ff82d413c81bd02dfa001e1c478e8fbea44bad24f21b3a5284e15632e
SHA5125fcdfddce3cc2e636001ed08c5f2f7590aadaa37c091f7ba94e519d298e284362721f1859c6ffbf064ae23e05d4e0e9754b515396812fbe9f9028497396799fd
-
memory/1160-131-0x00007FFE67680000-0x00007FFE68141000-memory.dmpFilesize
10.8MB
-
memory/1160-132-0x0000000002C90000-0x0000000002C92000-memory.dmpFilesize
8KB
-
memory/1160-130-0x0000000000B40000-0x0000000000BD4000-memory.dmpFilesize
592KB
-
memory/2988-144-0x000000001BBB0000-0x000000001BBB2000-memory.dmpFilesize
8KB
-
memory/2988-143-0x00007FFE67330000-0x00007FFE67DF1000-memory.dmpFilesize
10.8MB
-
memory/2988-140-0x0000000000000000-mapping.dmp
-
memory/3736-135-0x0000000000000000-mapping.dmp
-
memory/4352-138-0x00007FFE67330000-0x00007FFE67DF1000-memory.dmpFilesize
10.8MB
-
memory/4352-139-0x000000001B220000-0x000000001B222000-memory.dmpFilesize
8KB
-
memory/4352-136-0x0000000000000000-mapping.dmp
-
memory/4808-133-0x0000000000000000-mapping.dmp