darktrack | e5184d8982254662e152b0f61fccf90d1230a6f173118a59bc53bc883992de26

Analysis

max time kernel
152s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20220414-en
submitted
12/05/2022, 11:55

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
e5184d8982254662e152b0f61fccf90d1230a6f173118a59bc53bc883992de26.exe
Size 822KB
Sample220512-n3mmzagcar
SHA256 e5184d8982254662e152b0f61fccf90d1230a6f173118a59bc53bc883992de26
MD5 4e7cf999557893b08c6623c31c45b28d
SHA1 9f8a085de74277fe2fcd79d77037a0627b79ebc1
SHA512 44711a040f3b5329d71b6f0fec1dd21adf16626ffacde92b28603b8358f81f9b8e76f68610629be9a62051273f14396ba7cd24eb87f89a60bca5260f8e337ef8
MD5 SHA1 SHA512

Score

10^/10

darktrack evasion persistence rat stealer trojan

Malware Config

Signatures

DarkTrack
DarkTrack is a remote administration tool written in delphi.
rat stealer darktrack

DarkTrack Payload 4 IoCs

resource	yara_rule
behavioral2/memory/1500-147-0x0000000000400000-0x00000000004A8000-memory.dmp	family_darktrack
behavioral2/memory/1500-148-0x0000000000400000-0x00000000004A8000-memory.dmp	family_darktrack
behavioral2/memory/1500-149-0x0000000000400000-0x00000000004A8000-memory.dmp	family_darktrack
behavioral2/memory/1500-151-0x0000000000400000-0x00000000004A8000-memory.dmp	family_darktrack

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "explorer.exe,\"C:\\Users\\Admin\\AppData\\Local\\Temp\\e5184d8982254662e152b0f61fccf90d1230a6f173118a59bc53bc883992de26.exe\""	e5184d8982254662e152b0f61fccf90d1230a6f173118a59bc53bc883992de26.exe

Modifies Windows Defender Real-time Protection settings 3 TTPs
evasion trojan

Modify Registry
T1112

Modify Existing Service
T1031

Disabling Security Tools
T1089
Turns off Windows Defender SpyNet reporting 2 TTPs
evasion

Disabling Security Tools
T1089

Modify Registry
T1112
Windows security bypass 2 TTPs
evasion trojan

Disabling Security Tools
T1089

Modify Registry
T1112

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Control Panel\International\Geo\Nation	e5184d8982254662e152b0f61fccf90d1230a6f173118a59bc53bc883992de26.exe

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\e5184d8982254662e152b0f61fccf90d1230a6f173118a59bc53bc883992de26.exe	e5184d8982254662e152b0f61fccf90d1230a6f173118a59bc53bc883992de26.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\e5184d8982254662e152b0f61fccf90d1230a6f173118a59bc53bc883992de26.exe	e5184d8982254662e152b0f61fccf90d1230a6f173118a59bc53bc883992de26.exe

Windows security modification 2 TTPs 11 IoCs

evasion trojan

Disabling Security Tools

T1089

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Spynet	e5184d8982254662e152b0f61fccf90d1230a6f173118a59bc53bc883992de26.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Spynet\SubmitSamplesConsent = "0"	e5184d8982254662e152b0f61fccf90d1230a6f173118a59bc53bc883992de26.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features	e5184d8982254662e152b0f61fccf90d1230a6f173118a59bc53bc883992de26.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0"	e5184d8982254662e152b0f61fccf90d1230a6f173118a59bc53bc883992de26.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths	e5184d8982254662e152b0f61fccf90d1230a6f173118a59bc53bc883992de26.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	e5184d8982254662e152b0f61fccf90d1230a6f173118a59bc53bc883992de26.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Temp\e5184d8982254662e152b0f61fccf90d1230a6f173118a59bc53bc883992de26.exe = "0"	e5184d8982254662e152b0f61fccf90d1230a6f173118a59bc53bc883992de26.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Real-Time Protection	e5184d8982254662e152b0f61fccf90d1230a6f173118a59bc53bc883992de26.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Spynet\SpyNetReporting = "0"	e5184d8982254662e152b0f61fccf90d1230a6f173118a59bc53bc883992de26.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions	e5184d8982254662e152b0f61fccf90d1230a6f173118a59bc53bc883992de26.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\e5184d8982254662e152b0f61fccf90d1230a6f173118a59bc53bc883992de26.exe = "0"	e5184d8982254662e152b0f61fccf90d1230a6f173118a59bc53bc883992de26.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\e5184d8982254662e152b0f61fccf90d1230a6f173118a59bc53bc883992de26.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\e5184d8982254662e152b0f61fccf90d1230a6f173118a59bc53bc883992de26.exe"	e5184d8982254662e152b0f61fccf90d1230a6f173118a59bc53bc883992de26.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\<Unknown> = "C:\\Users\\Admin\\AppData\\Local\\Temp\\e5184d8982254662e152b0f61fccf90d1230a6f173118a59bc53bc883992de26.exe"	e5184d8982254662e152b0f61fccf90d1230a6f173118a59bc53bc883992de26.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

Suspicious use of NtSetInformationThreadHideFromDebugger 16 IoCs

pid	Process
4564	e5184d8982254662e152b0f61fccf90d1230a6f173118a59bc53bc883992de26.exe
4564	e5184d8982254662e152b0f61fccf90d1230a6f173118a59bc53bc883992de26.exe
4564	e5184d8982254662e152b0f61fccf90d1230a6f173118a59bc53bc883992de26.exe
4564	e5184d8982254662e152b0f61fccf90d1230a6f173118a59bc53bc883992de26.exe
4564	e5184d8982254662e152b0f61fccf90d1230a6f173118a59bc53bc883992de26.exe
4564	e5184d8982254662e152b0f61fccf90d1230a6f173118a59bc53bc883992de26.exe
4564	e5184d8982254662e152b0f61fccf90d1230a6f173118a59bc53bc883992de26.exe
4564	e5184d8982254662e152b0f61fccf90d1230a6f173118a59bc53bc883992de26.exe
4564	e5184d8982254662e152b0f61fccf90d1230a6f173118a59bc53bc883992de26.exe
4564	e5184d8982254662e152b0f61fccf90d1230a6f173118a59bc53bc883992de26.exe
4564	e5184d8982254662e152b0f61fccf90d1230a6f173118a59bc53bc883992de26.exe
4564	e5184d8982254662e152b0f61fccf90d1230a6f173118a59bc53bc883992de26.exe
4564	e5184d8982254662e152b0f61fccf90d1230a6f173118a59bc53bc883992de26.exe
4564	e5184d8982254662e152b0f61fccf90d1230a6f173118a59bc53bc883992de26.exe
4564	e5184d8982254662e152b0f61fccf90d1230a6f173118a59bc53bc883992de26.exe
4564	e5184d8982254662e152b0f61fccf90d1230a6f173118a59bc53bc883992de26.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4564 set thread context of 1500	4564	e5184d8982254662e152b0f61fccf90d1230a6f173118a59bc53bc883992de26.exe	96

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3192	4564	WerFault.exe	15

Delays execution with timeout.exe 1 IoCs

evasion

pid	Process
2012	timeout.exe

Suspicious behavior: EnumeratesProcesses 15 IoCs

pid	Process
4792	powershell.exe
3188	powershell.exe
3692	powershell.exe
308	powershell.exe
4792	powershell.exe
3692	powershell.exe
3188	powershell.exe
308	powershell.exe
4564	e5184d8982254662e152b0f61fccf90d1230a6f173118a59bc53bc883992de26.exe
4564	e5184d8982254662e152b0f61fccf90d1230a6f173118a59bc53bc883992de26.exe
4564	e5184d8982254662e152b0f61fccf90d1230a6f173118a59bc53bc883992de26.exe
4564	e5184d8982254662e152b0f61fccf90d1230a6f173118a59bc53bc883992de26.exe
4564	e5184d8982254662e152b0f61fccf90d1230a6f173118a59bc53bc883992de26.exe
4564	e5184d8982254662e152b0f61fccf90d1230a6f173118a59bc53bc883992de26.exe
4564	e5184d8982254662e152b0f61fccf90d1230a6f173118a59bc53bc883992de26.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1500	aspnet_state.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeDebugPrivilege	4564	e5184d8982254662e152b0f61fccf90d1230a6f173118a59bc53bc883992de26.exe
Token: SeDebugPrivilege	3188	powershell.exe
Token: SeDebugPrivilege	308	powershell.exe
Token: SeDebugPrivilege	4792	powershell.exe
Token: SeDebugPrivilege	3692	powershell.exe

Suspicious use of WriteProcessMemory 55 IoCs

description	pid	Process	procid_target
PID 4564 wrote to memory of 2012	4564	e5184d8982254662e152b0f61fccf90d1230a6f173118a59bc53bc883992de26.exe	84
PID 4564 wrote to memory of 2012	4564	e5184d8982254662e152b0f61fccf90d1230a6f173118a59bc53bc883992de26.exe	84
PID 4564 wrote to memory of 2012	4564	e5184d8982254662e152b0f61fccf90d1230a6f173118a59bc53bc883992de26.exe	84
PID 4564 wrote to memory of 308	4564	e5184d8982254662e152b0f61fccf90d1230a6f173118a59bc53bc883992de26.exe	89
PID 4564 wrote to memory of 308	4564	e5184d8982254662e152b0f61fccf90d1230a6f173118a59bc53bc883992de26.exe	89
PID 4564 wrote to memory of 308	4564	e5184d8982254662e152b0f61fccf90d1230a6f173118a59bc53bc883992de26.exe	89
PID 4564 wrote to memory of 4792	4564	e5184d8982254662e152b0f61fccf90d1230a6f173118a59bc53bc883992de26.exe	86
PID 4564 wrote to memory of 4792	4564	e5184d8982254662e152b0f61fccf90d1230a6f173118a59bc53bc883992de26.exe	86
PID 4564 wrote to memory of 4792	4564	e5184d8982254662e152b0f61fccf90d1230a6f173118a59bc53bc883992de26.exe	86
PID 4564 wrote to memory of 3188	4564	e5184d8982254662e152b0f61fccf90d1230a6f173118a59bc53bc883992de26.exe	90
PID 4564 wrote to memory of 3188	4564	e5184d8982254662e152b0f61fccf90d1230a6f173118a59bc53bc883992de26.exe	90
PID 4564 wrote to memory of 3188	4564	e5184d8982254662e152b0f61fccf90d1230a6f173118a59bc53bc883992de26.exe	90
PID 4564 wrote to memory of 3692	4564	e5184d8982254662e152b0f61fccf90d1230a6f173118a59bc53bc883992de26.exe	92
PID 4564 wrote to memory of 3692	4564	e5184d8982254662e152b0f61fccf90d1230a6f173118a59bc53bc883992de26.exe	92
PID 4564 wrote to memory of 3692	4564	e5184d8982254662e152b0f61fccf90d1230a6f173118a59bc53bc883992de26.exe	92
PID 4564 wrote to memory of 4796	4564	e5184d8982254662e152b0f61fccf90d1230a6f173118a59bc53bc883992de26.exe	94
PID 4564 wrote to memory of 4796	4564	e5184d8982254662e152b0f61fccf90d1230a6f173118a59bc53bc883992de26.exe	94
PID 4564 wrote to memory of 4796	4564	e5184d8982254662e152b0f61fccf90d1230a6f173118a59bc53bc883992de26.exe	94
PID 4564 wrote to memory of 1984	4564	e5184d8982254662e152b0f61fccf90d1230a6f173118a59bc53bc883992de26.exe	95
PID 4564 wrote to memory of 1984	4564	e5184d8982254662e152b0f61fccf90d1230a6f173118a59bc53bc883992de26.exe	95
PID 4564 wrote to memory of 1984	4564	e5184d8982254662e152b0f61fccf90d1230a6f173118a59bc53bc883992de26.exe	95
PID 4564 wrote to memory of 1500	4564	e5184d8982254662e152b0f61fccf90d1230a6f173118a59bc53bc883992de26.exe	96
PID 4564 wrote to memory of 1500	4564	e5184d8982254662e152b0f61fccf90d1230a6f173118a59bc53bc883992de26.exe	96
PID 4564 wrote to memory of 1500	4564	e5184d8982254662e152b0f61fccf90d1230a6f173118a59bc53bc883992de26.exe	96
PID 4564 wrote to memory of 1500	4564	e5184d8982254662e152b0f61fccf90d1230a6f173118a59bc53bc883992de26.exe	96
PID 4564 wrote to memory of 1500	4564	e5184d8982254662e152b0f61fccf90d1230a6f173118a59bc53bc883992de26.exe	96
PID 4564 wrote to memory of 1500	4564	e5184d8982254662e152b0f61fccf90d1230a6f173118a59bc53bc883992de26.exe	96
PID 4564 wrote to memory of 1500	4564	e5184d8982254662e152b0f61fccf90d1230a6f173118a59bc53bc883992de26.exe	96
PID 4564 wrote to memory of 1500	4564	e5184d8982254662e152b0f61fccf90d1230a6f173118a59bc53bc883992de26.exe	96
PID 4564 wrote to memory of 1500	4564	e5184d8982254662e152b0f61fccf90d1230a6f173118a59bc53bc883992de26.exe	96
PID 4564 wrote to memory of 1500	4564	e5184d8982254662e152b0f61fccf90d1230a6f173118a59bc53bc883992de26.exe	96
PID 4564 wrote to memory of 1500	4564	e5184d8982254662e152b0f61fccf90d1230a6f173118a59bc53bc883992de26.exe	96
PID 4564 wrote to memory of 1500	4564	e5184d8982254662e152b0f61fccf90d1230a6f173118a59bc53bc883992de26.exe	96
PID 1500 wrote to memory of 2580	1500	aspnet_state.exe	98
PID 1500 wrote to memory of 2580	1500	aspnet_state.exe	98
PID 1500 wrote to memory of 2580	1500	aspnet_state.exe	98
PID 1500 wrote to memory of 2580	1500	aspnet_state.exe	98
PID 1500 wrote to memory of 2580	1500	aspnet_state.exe	98
PID 1500 wrote to memory of 2580	1500	aspnet_state.exe	98
PID 1500 wrote to memory of 2580	1500	aspnet_state.exe	98
PID 1500 wrote to memory of 2580	1500	aspnet_state.exe	98
PID 1500 wrote to memory of 2580	1500	aspnet_state.exe	98
PID 1500 wrote to memory of 2580	1500	aspnet_state.exe	98
PID 1500 wrote to memory of 2580	1500	aspnet_state.exe	98
PID 1500 wrote to memory of 2580	1500	aspnet_state.exe	98
PID 1500 wrote to memory of 2580	1500	aspnet_state.exe	98
PID 1500 wrote to memory of 2580	1500	aspnet_state.exe	98
PID 1500 wrote to memory of 2580	1500	aspnet_state.exe	98
PID 1500 wrote to memory of 2580	1500	aspnet_state.exe	98
PID 1500 wrote to memory of 2580	1500	aspnet_state.exe	98
PID 1500 wrote to memory of 2580	1500	aspnet_state.exe	98
PID 1500 wrote to memory of 2580	1500	aspnet_state.exe	98
PID 1500 wrote to memory of 2580	1500	aspnet_state.exe	98
PID 1500 wrote to memory of 2580	1500	aspnet_state.exe	98
PID 1500 wrote to memory of 2580	1500	aspnet_state.exe	98

C:\Users\Admin\AppData\Local\Temp\e5184d8982254662e152b0f61fccf90d1230a6f173118a59bc53bc883992de26.exe
"C:\Users\Admin\AppData\Local\Temp\e5184d8982254662e152b0f61fccf90d1230a6f173118a59bc53bc883992de26.exe"
1⤵
- Modifies WinLogon for persistence
- Checks computer location settings
- Drops startup file
- Windows security modification
- Adds Run key to start application
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4564
- C:\Windows\SysWOW64\timeout.exe
  timeout 4
  2⤵
  - Delays execution with timeout.exe
  PID:2012
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\e5184d8982254662e152b0f61fccf90d1230a6f173118a59bc53bc883992de26.exe" -Force
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4792
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\e5184d8982254662e152b0f61fccf90d1230a6f173118a59bc53bc883992de26.exe" -Force
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:308
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\e5184d8982254662e152b0f61fccf90d1230a6f173118a59bc53bc883992de26.exe" -Force
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3188
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\e5184d8982254662e152b0f61fccf90d1230a6f173118a59bc53bc883992de26.exe" -Force
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3692
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_state.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_state.exe"
  2⤵
  PID:4796
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_state.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_state.exe"
  2⤵
  PID:1984
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_state.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_state.exe"
  2⤵
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of WriteProcessMemory
  PID:1500
- - C:\Windows\SysWOW64\notepad.exe
    notepad
    3⤵
    PID:2580
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4564 -s 1120
  2⤵
  - Program crash
  PID:3192

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 356 -p 4564 -ip 4564
1⤵
PID:3852

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Modify Existing Service

T1031

Registry Run Keys / Startup Folder

T1060

Winlogon Helper DLL

T1004

Privilege Escalation

Defense Evasion

Disabling Security Tools

T1089

Modify Registry

T1112

Web Service

T1102

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

ModuleAnalysisCache

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache
Size 55KB
SHA256 5704f05742c564fc9a5cb35e9ac7761433b23a5089b2799f9dd526d1b9a87cf9
MD5 d8874959db424819879be4c2fa214824
SHA1 3aede102b10ae80ed60d6560d7e04cf1878b2a47
SHA512 815d51c460f527ca7e57dae35d10d5b404e90ba3cf0876e80c0a7d77b6347e9ea3b235fa934ebcbefbc0b2eded8c7674125128329e6583a52bc427994306b0e4
SSDEEP 1536:J5C+jH04tAHkdSMrxyNhftflJd+YoQV3CNBQkj20ZUstzyhNOwUpUbNvv+EGa5bp:HC+jH04tAHkQMrxyNhftflJd+YoQV3CW
MD5 SHA1 SHA512 SSDEEP

Submit Download

ModuleAnalysisCache

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache
Size 56KB
SHA256 f589708eecb84d2fe0145bdf2eebbc370a7094ad3b10d402030c7987ebd826ef
MD5 4d179314c7095c44f4425e91901282cb
SHA1 ed39e5484a8c4abffecfb4f211c684998d0bef08
SHA512 009821ac79b5e1da2745c19737822a0dc4eb57094a0c462c7f69df828eb95e4fcef8b146253ba6b64b5b234d2197597edafb63c6fc2f0a6a985eddb4bae1e493
SSDEEP 1536:k5C+jH04tAHkdqOdBGNhftflJd+YooV3CNBQkj20UqdvzyhgOwUpUbNpMoEua5ba:wC+jH04tAHk4OdBGNhftflJd+YooV3Cx
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/308-139-0x0000000005630000-0x0000000005C58000-memory.dmp

Download

memory/308-161-0x00000000053E0000-0x00000000053FA000-memory.dmp

Download

memory/308-160-0x0000000007CB0000-0x000000000832A000-memory.dmp

Download

memory/308-153-0x000000006FD60000-0x000000006FDAC000-memory.dmp

Download

memory/308-156-0x00000000068E0000-0x00000000068FE000-memory.dmp

Download

memory/1500-148-0x0000000000400000-0x00000000004A8000-memory.dmp

Download

memory/1500-151-0x0000000000400000-0x00000000004A8000-memory.dmp

Download

memory/1500-147-0x0000000000400000-0x00000000004A8000-memory.dmp

Download

memory/1500-149-0x0000000000400000-0x00000000004A8000-memory.dmp

Download

memory/3188-140-0x00000000054E0000-0x0000000005502000-memory.dmp

Download

memory/3188-155-0x000000006FD60000-0x000000006FDAC000-memory.dmp

Download

memory/3188-138-0x0000000002BA0000-0x0000000002BD6000-memory.dmp

Download

memory/3692-142-0x0000000005D60000-0x0000000005DC6000-memory.dmp

Download

memory/3692-164-0x00000000079B0000-0x0000000007A46000-memory.dmp

Download

memory/3692-157-0x000000006FD60000-0x000000006FDAC000-memory.dmp

Download

memory/4564-130-0x0000000000050000-0x0000000000122000-memory.dmp

Download

memory/4564-133-0x0000000005430000-0x00000000059D4000-memory.dmp

Download

memory/4564-131-0x0000000004A80000-0x0000000004B1C000-memory.dmp

Download

memory/4792-154-0x000000006FD60000-0x000000006FDAC000-memory.dmp

Download

memory/4792-152-0x0000000006140000-0x0000000006172000-memory.dmp

Download

memory/4792-143-0x0000000005B30000-0x0000000005B4E000-memory.dmp

Download

memory/4792-162-0x0000000006F30000-0x0000000006F3A000-memory.dmp

Download

memory/4792-141-0x0000000004B80000-0x0000000004BE6000-memory.dmp

Download