dcrat | a3f1615bd60b684da869e6b08295b273bd7698f63aa24ffb86d2ce24e03496bf

Analysis

max time kernel
133s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20220414-en
submitted
05/05/2022, 10:47

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
a958bca004dcc7edf8310150ef02512b.exe
Size 2.1MB
Sample220505-mvhtdaaefm
SHA256 a3f1615bd60b684da869e6b08295b273bd7698f63aa24ffb86d2ce24e03496bf
MD5 a958bca004dcc7edf8310150ef02512b
SHA1 6f853ea253498f97e1ade601e0abd831d404d7b1
SHA512 c172e97c690f32b1e82afb7dd48c0932bde062a2391b8ce180fe87ecea0d78a35a74acbe696d7ebe38b38fa939e2feab0d5e7cb7291e9ea38088c8ed284d6278
MD5 SHA1 SHA512

Score

10^/10

dcrat evasion infostealer rat spyware stealer suricata

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat

Process spawned unexpected child process 21 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4924	364	schtasks.exe	59
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1196	364	schtasks.exe	59
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4120	364	schtasks.exe	59
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4928	364	schtasks.exe	59
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2792	364	schtasks.exe	59
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4908	364	schtasks.exe	59
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1664	364	schtasks.exe	59
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4948	364	schtasks.exe	59
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2376	364	schtasks.exe	59
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3964	364	schtasks.exe	59
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4016	364	schtasks.exe	59
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	956	364	schtasks.exe	59
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4048	364	schtasks.exe	59
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3620	364	schtasks.exe	59
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2900	364	schtasks.exe	59
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2280	364	schtasks.exe	59
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4288	364	schtasks.exe	59
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2496	364	schtasks.exe	59
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4984	364	schtasks.exe	59
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5084	364	schtasks.exe	59
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1556	364	schtasks.exe	59

suricata: ET MALWARE DCRAT Activity (GET)
suricata: ET MALWARE DCRAT Activity (GET)
suricata
Disables Task Manager via registry modification
evasion

Executes dropped EXE 3 IoCs

pid	Process
4456	msportBrowser.exe
2020	msportBrowser.exe
2200	WmiPrvSE.exe

Checks computer location settings 2 TTPs 4 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1081944012-3634099177-1681222835-1000\Control Panel\International\Geo\Nation	a958bca004dcc7edf8310150ef02512b.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1081944012-3634099177-1681222835-1000\Control Panel\International\Geo\Nation	WScript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1081944012-3634099177-1681222835-1000\Control Panel\International\Geo\Nation	msportBrowser.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1081944012-3634099177-1681222835-1000\Control Panel\International\Geo\Nation	msportBrowser.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Drops file in Program Files directory 3 IoCs

description	ioc	Process
File created	C:\Program Files\Windows Portable Devices\RuntimeBroker.exe	msportBrowser.exe
File opened for modification	C:\Program Files\Windows Portable Devices\RuntimeBroker.exe	msportBrowser.exe
File created	C:\Program Files\Windows Portable Devices\9e8d7a4ca61bd9	msportBrowser.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File created	C:\Windows\tracing\sppsvc.exe	msportBrowser.exe
File created	C:\Windows\tracing\0a1fd5f707cd16	msportBrowser.exe
File created	C:\Windows\Boot\fontdrvhost.exe	msportBrowser.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 21 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
1664	schtasks.exe
3964	schtasks.exe
956	schtasks.exe
4120	schtasks.exe
4928	schtasks.exe
4908	schtasks.exe
2376	schtasks.exe
3620	schtasks.exe
2900	schtasks.exe
1196	schtasks.exe
2792	schtasks.exe
2280	schtasks.exe
4288	schtasks.exe
2496	schtasks.exe
4948	schtasks.exe
4048	schtasks.exe
4984	schtasks.exe
5084	schtasks.exe
1556	schtasks.exe
4924	schtasks.exe
4016	schtasks.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1081944012-3634099177-1681222835-1000_Classes\Local Settings	a958bca004dcc7edf8310150ef02512b.exe
Key created	\REGISTRY\USER\S-1-5-21-1081944012-3634099177-1681222835-1000_Classes\Local Settings	msportBrowser.exe

Modifies registry key 1 TTPs 1 IoCs

Modify Registry

T1112

pid	Process
4292	reg.exe

Suspicious behavior: EnumeratesProcesses 18 IoCs

pid	Process
4456	msportBrowser.exe
2020	msportBrowser.exe
2020	msportBrowser.exe
2020	msportBrowser.exe
2020	msportBrowser.exe
2020	msportBrowser.exe
2200	WmiPrvSE.exe
2200	WmiPrvSE.exe
2200	WmiPrvSE.exe
2200	WmiPrvSE.exe
2200	WmiPrvSE.exe
2200	WmiPrvSE.exe
2200	WmiPrvSE.exe
2200	WmiPrvSE.exe
2200	WmiPrvSE.exe
2200	WmiPrvSE.exe
2200	WmiPrvSE.exe
2200	WmiPrvSE.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2200	WmiPrvSE.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	4456	msportBrowser.exe
Token: SeDebugPrivilege	2020	msportBrowser.exe
Token: SeDebugPrivilege	2200	WmiPrvSE.exe

Suspicious use of WriteProcessMemory 19 IoCs

description	pid	Process	procid_target
PID 1176 wrote to memory of 2136	1176	a958bca004dcc7edf8310150ef02512b.exe	83
PID 1176 wrote to memory of 2136	1176	a958bca004dcc7edf8310150ef02512b.exe	83
PID 1176 wrote to memory of 2136	1176	a958bca004dcc7edf8310150ef02512b.exe	83
PID 2136 wrote to memory of 1992	2136	WScript.exe	84
PID 2136 wrote to memory of 1992	2136	WScript.exe	84
PID 2136 wrote to memory of 1992	2136	WScript.exe	84
PID 1992 wrote to memory of 4456	1992	cmd.exe	86
PID 1992 wrote to memory of 4456	1992	cmd.exe	86
PID 4456 wrote to memory of 2020	4456	msportBrowser.exe	102
PID 4456 wrote to memory of 2020	4456	msportBrowser.exe	102
PID 1992 wrote to memory of 4292	1992	cmd.exe	103
PID 1992 wrote to memory of 4292	1992	cmd.exe	103
PID 1992 wrote to memory of 4292	1992	cmd.exe	103
PID 2020 wrote to memory of 3908	2020	msportBrowser.exe	113
PID 2020 wrote to memory of 3908	2020	msportBrowser.exe	113
PID 3908 wrote to memory of 1020	3908	cmd.exe	115
PID 3908 wrote to memory of 1020	3908	cmd.exe	115
PID 3908 wrote to memory of 2200	3908	cmd.exe	124
PID 3908 wrote to memory of 2200	3908	cmd.exe	124

C:\Users\Admin\AppData\Local\Temp\a958bca004dcc7edf8310150ef02512b.exe
"C:\Users\Admin\AppData\Local\Temp\a958bca004dcc7edf8310150ef02512b.exe"
1⤵
- Checks computer location settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1176
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\SessionruntimebrokerCommon\zhIp2XW1emn5KJ.vbe"
  2⤵
  - Checks computer location settings
  - Suspicious use of WriteProcessMemory
  PID:2136
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\SessionruntimebrokerCommon\cEwrYP.bat" "
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1992
  - - C:\SessionruntimebrokerCommon\msportBrowser.exe
      "C:\SessionruntimebrokerCommon\msportBrowser.exe"
      4⤵
      Executes dropped EXE
      Checks computer location settings
      Drops file in Program Files directory
      Drops file in Windows directory
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:4456
    - - C:\SessionruntimebrokerCommon\msportBrowser.exe
        
        "C:\SessionruntimebrokerCommon\msportBrowser.exe"
        5⤵
        Executes dropped EXE
        Checks computer location settings
        Drops file in Windows directory
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2020
      - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\AM1acbGJr2.bat"
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:3908
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        7⤵
        
        PID:1020
        
        C:\SessionruntimebrokerCommon\WmiPrvSE.exe
        
        "C:\SessionruntimebrokerCommon\WmiPrvSE.exe"
        7⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious behavior: GetForegroundWindowSpam
        Suspicious use of AdjustPrivilegeToken
        
        PID:2200
  - - C:\Windows\SysWOW64\reg.exe
      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f
      4⤵
      Modifies registry key
      PID:4292

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 14 /tr "'C:\Program Files\Windows Portable Devices\RuntimeBroker.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4924

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Program Files\Windows Portable Devices\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1196

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 7 /tr "'C:\Program Files\Windows Portable Devices\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4120

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 12 /tr "'C:\odt\services.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4928

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "services" /sc ONLOGON /tr "'C:\odt\services.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2792

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 8 /tr "'C:\odt\services.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4908

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sihosts" /sc MINUTE /mo 9 /tr "'C:\odt\sihost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1664

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sihost" /sc ONLOGON /tr "'C:\odt\sihost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4948

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sihosts" /sc MINUTE /mo 13 /tr "'C:\odt\sihost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2376

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 8 /tr "'C:\Windows\tracing\sppsvc.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3964

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvc" /sc ONLOGON /tr "'C:\Windows\tracing\sppsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4016

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 7 /tr "'C:\Windows\tracing\sppsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:956

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RegistryR" /sc MINUTE /mo 14 /tr "'C:\Recovery\WindowsRE\Registry.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4048

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Registry" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\Registry.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3620

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RegistryR" /sc MINUTE /mo 14 /tr "'C:\Recovery\WindowsRE\Registry.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2900

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 5 /tr "'C:\SessionruntimebrokerCommon\WmiPrvSE.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2280

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSE" /sc ONLOGON /tr "'C:\SessionruntimebrokerCommon\WmiPrvSE.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4288

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 11 /tr "'C:\SessionruntimebrokerCommon\WmiPrvSE.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2496

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OfficeClickToRunO" /sc MINUTE /mo 6 /tr "'C:\SessionruntimebrokerCommon\OfficeClickToRun.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4984

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OfficeClickToRun" /sc ONLOGON /tr "'C:\SessionruntimebrokerCommon\OfficeClickToRun.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:5084

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OfficeClickToRunO" /sc MINUTE /mo 11 /tr "'C:\SessionruntimebrokerCommon\OfficeClickToRun.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1556

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

WmiPrvSE.exe

Path C:\SessionruntimebrokerCommon\WmiPrvSE.exe
Size 1.7MB
SHA256 9da1c8ead1bf1e76bc8ea2267eae81f44c3ce33e6d1e2b8201fbf1af187a17cc
MD5 29ff712e7414fe05cc9719083a436ecc
SHA1 03884e07bd6cf4cd8fc53bbc803e246b15a6c896
SHA512 3fbe4d108410da037c47cd17a2861bc49733425be6f3c05fb8e7b2e60c67dd9d60cf79f176ab62c356e4943f78d1ad6e99205ee06683ae9c2d4fc9e0a758af91
SSDEEP 24576:mNGspS3fJXZmdFm3/0x/OmPgyhwlYIHKaYmosq:wGsusU1ykvhrq
MD5 SHA1 SHA512 SSDEEP

Submit Download

WmiPrvSE.exe

Path C:\SessionruntimebrokerCommon\WmiPrvSE.exe
Size 1.7MB
SHA256 9da1c8ead1bf1e76bc8ea2267eae81f44c3ce33e6d1e2b8201fbf1af187a17cc
MD5 29ff712e7414fe05cc9719083a436ecc
SHA1 03884e07bd6cf4cd8fc53bbc803e246b15a6c896
SHA512 3fbe4d108410da037c47cd17a2861bc49733425be6f3c05fb8e7b2e60c67dd9d60cf79f176ab62c356e4943f78d1ad6e99205ee06683ae9c2d4fc9e0a758af91
SSDEEP 24576:mNGspS3fJXZmdFm3/0x/OmPgyhwlYIHKaYmosq:wGsusU1ykvhrq
MD5 SHA1 SHA512 SSDEEP

Submit Download

cEwrYP.bat

Path C:\SessionruntimebrokerCommon\cEwrYP.bat
Size 161B
SHA256 6c081456763b96a26b21443ea6987ea1b143bb47b17f3a2b6bec9ca27f3931a6
MD5 186e7d6a1d23ca6cdd5b39630c5334ba
SHA1 cfbd196bfb8b8b3a8d5f01e84b9c9894ff547af9
SHA512 11c5a40d387c78c71b0499f651f8a148c7e5fda7f335dc2bef8860986d47982de81f080299c34bcb68983b7d94afdb83801d122c1beb383e29aafbc1507f0ba6
MD5 SHA1 SHA512

Submit Download

msportBrowser.exe

Path C:\SessionruntimebrokerCommon\msportBrowser.exe
Size 1.7MB
SHA256 9da1c8ead1bf1e76bc8ea2267eae81f44c3ce33e6d1e2b8201fbf1af187a17cc
MD5 29ff712e7414fe05cc9719083a436ecc
SHA1 03884e07bd6cf4cd8fc53bbc803e246b15a6c896
SHA512 3fbe4d108410da037c47cd17a2861bc49733425be6f3c05fb8e7b2e60c67dd9d60cf79f176ab62c356e4943f78d1ad6e99205ee06683ae9c2d4fc9e0a758af91
SSDEEP 24576:mNGspS3fJXZmdFm3/0x/OmPgyhwlYIHKaYmosq:wGsusU1ykvhrq
MD5 SHA1 SHA512 SSDEEP

Submit Download

msportBrowser.exe

Path C:\SessionruntimebrokerCommon\msportBrowser.exe
Size 1.7MB
SHA256 9da1c8ead1bf1e76bc8ea2267eae81f44c3ce33e6d1e2b8201fbf1af187a17cc
MD5 29ff712e7414fe05cc9719083a436ecc
SHA1 03884e07bd6cf4cd8fc53bbc803e246b15a6c896
SHA512 3fbe4d108410da037c47cd17a2861bc49733425be6f3c05fb8e7b2e60c67dd9d60cf79f176ab62c356e4943f78d1ad6e99205ee06683ae9c2d4fc9e0a758af91
SSDEEP 24576:mNGspS3fJXZmdFm3/0x/OmPgyhwlYIHKaYmosq:wGsusU1ykvhrq
MD5 SHA1 SHA512 SSDEEP

Submit Download

msportBrowser.exe

Path C:\SessionruntimebrokerCommon\msportBrowser.exe
Size 1.7MB
SHA256 9da1c8ead1bf1e76bc8ea2267eae81f44c3ce33e6d1e2b8201fbf1af187a17cc
MD5 29ff712e7414fe05cc9719083a436ecc
SHA1 03884e07bd6cf4cd8fc53bbc803e246b15a6c896
SHA512 3fbe4d108410da037c47cd17a2861bc49733425be6f3c05fb8e7b2e60c67dd9d60cf79f176ab62c356e4943f78d1ad6e99205ee06683ae9c2d4fc9e0a758af91
SSDEEP 24576:mNGspS3fJXZmdFm3/0x/OmPgyhwlYIHKaYmosq:wGsusU1ykvhrq
MD5 SHA1 SHA512 SSDEEP

Submit Download

zhIp2XW1emn5KJ.vbe

Path C:\SessionruntimebrokerCommon\zhIp2XW1emn5KJ.vbe
Size 206B
SHA256 7c02f23c879d3b2073f68ea42946d7a604ffeabd4cf71b7d7f66c8b71aa99663
MD5 a4d66228ab855d3e0ab9d847045f7021
SHA1 4345ca7a9a2d92dfb618d773d2303b05799d07ff
SHA512 eedb0b88bc4ae550eec6a6f99646260ddac6eafa3b7503a8ce049d98f5d0a15d8fffa8edbb537def363ed0600f78605c48a1edd621e756c52f9785126835db02
MD5 SHA1 SHA512

Submit Download

msportBrowser.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\msportBrowser.exe.log
Size 1KB
SHA256 eb70c64ae99d14ac2588b7a84854fbf3c420532d7fe4dfd49c7b5a70c869943a
MD5 bbb951a34b516b66451218a3ec3b0ae1
SHA1 7393835a2476ae655916e0a9687eeaba3ee876e9
SHA512 63bcbfcf8e7421c66855c487c31b2991a989bdea0c1edd4c40066b52fa3eb3d9d37db1cd21b8eb4f33dd5870cc20532c8f485eab9c0b4f6b0793a35c077f2d6f
MD5 SHA1 SHA512

Submit Download

AM1acbGJr2.bat

Path C:\Users\Admin\AppData\Local\Temp\AM1acbGJr2.bat
Size 207B
SHA256 11b58be1d2e5b4ec8c51a1d5a0a353ed0df2098052f0154764a7ac006e7b2eb0
MD5 3008f9a22a198065b96e794ef11edf33
SHA1 0d4c235f674647fb11bff9ef4a9be830a7f1ce6c
SHA512 743841dc99f98d2ce53a2c1c0ef3709d2a29416919b38e36b70f40cc193f8b69fe03e2b5f195bb4c0088e0551cff789e74006f20677a16ff24173235d3202ec5
MD5 SHA1 SHA512

Submit Download

memory/2020-145-0x00007FF8643B0000-0x00007FF864E71000-memory.dmp

Download

memory/2200-152-0x00007FF864290000-0x00007FF864D51000-memory.dmp

Download

memory/4456-140-0x000000001DD00000-0x000000001E228000-memory.dmp

Download

memory/4456-139-0x00000000012C0000-0x0000000001310000-memory.dmp

Download

memory/4456-138-0x00007FF8643B0000-0x00007FF864E71000-memory.dmp

Download

memory/4456-137-0x0000000000880000-0x0000000000A42000-memory.dmp

Download