dcrat | 6d95012691b58c36574d4b1061b07e0a8340909664908e991fad91028777fdd1

Resubmissions

12-01-2023 20:01

230112-yrh6hsae52 10

07-01-2023 04:41

230107-fa3jqagb8t 10

07-01-2023 04:21

230107-eynj2acf87 10

Analysis

max time kernel
60s
max time network
62s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
07-01-2023 04:41

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0a0a64f3c4fa7d960be983aa0a7d0ce8.exe
Size

3.8MB
MD5

0a0a64f3c4fa7d960be983aa0a7d0ce8
SHA1

b597c7397ecaff7c5c1aa27f5124fc7b8a94e643
SHA256

6d95012691b58c36574d4b1061b07e0a8340909664908e991fad91028777fdd1
SHA512

ef04e3eb8f2b10dae6845b97fa66086c3d02c5508adcd1923a93975c88f1ad0f80f984b563c36c4868276670b1dee9e11ae3c57faf7b0509118d121d920df7d4
SSDEEP

98304:F7b3a0t2TiPhx6Sp+ybfnDA4qo34n1oO:FH3Z8cp+gDZ4n1

Score

10^/10

dcrat evasion infostealer persistence rat trojan

Malware Config

Signatures

DcRat 10 IoCs

DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

rat infostealer dcrat

Processes:

schtasks.exeschtasks.exeschtasks.exeschtasks.exe0a0a64f3c4fa7d960be983aa0a7d0ce8.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exe

pid	process
540	schtasks.exe
1284	schtasks.exe
1732	schtasks.exe
968	schtasks.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	0a0a64f3c4fa7d960be983aa0a7d0ce8.exe
620	schtasks.exe
440	schtasks.exe
1536	schtasks.exe
1816	schtasks.exe
1372	schtasks.exe

Modifies WinLogon for persistence 2 TTPs 3 IoCs

persistence

Winlogon Helper DLL

T1004

Modify Registry

T1112

Processes:

0a0a64f3c4fa7d960be983aa0a7d0ce8.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Users\\All Users\\Favorites\\lsass.exe\", \"C:\\Recovery\\c0f67622-1a8a-11ed-ae9f-b21da26d38ed\\smss.exe\", \"C:\\Recovery\\c0f67622-1a8a-11ed-ae9f-b21da26d38ed\\sppsvc.exe\""	0a0a64f3c4fa7d960be983aa0a7d0ce8.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Users\\All Users\\Favorites\\lsass.exe\""	0a0a64f3c4fa7d960be983aa0a7d0ce8.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Users\\All Users\\Favorites\\lsass.exe\", \"C:\\Recovery\\c0f67622-1a8a-11ed-ae9f-b21da26d38ed\\smss.exe\""	0a0a64f3c4fa7d960be983aa0a7d0ce8.exe

Process spawned unexpected child process 9 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

Processes:

schtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exe

description	pid	pid_target	process
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	620	660	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	440	660	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1536	660	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1816	660	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	540	660	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1372	660	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	968	660	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1284	660	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1732	660	schtasks.exe

UAC bypass 3 TTPs 6 IoCs

evasion trojan

Bypass User Account Control

T1088

Disabling Security Tools

T1089

Modify Registry

T1112

Processes:

0a0a64f3c4fa7d960be983aa0a7d0ce8.exelsass.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	0a0a64f3c4fa7d960be983aa0a7d0ce8.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	0a0a64f3c4fa7d960be983aa0a7d0ce8.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	0a0a64f3c4fa7d960be983aa0a7d0ce8.exe

DCRat payload 4 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

Processes:

resource	yara_rule
behavioral2/memory/1016-54-0x0000000000050000-0x000000000041A000-memory.dmp	dcrat
C:\Users\Public\Favorites\lsass.exe	dcrat
C:\Users\All Users\Favorites\lsass.exe	dcrat
behavioral2/memory/1452-90-0x0000000000E20000-0x00000000011EA000-memory.dmp	dcrat

Executes dropped EXE 1 IoCs

Processes:

lsass.exe

pid process

1452 lsass.exe

pid	process
1452	lsass.exe

Adds Run key to start application 2 TTPs 6 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

0a0a64f3c4fa7d960be983aa0a7d0ce8.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\lsass = "\"C:\\Users\\All Users\\Favorites\\lsass.exe\""	0a0a64f3c4fa7d960be983aa0a7d0ce8.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\lsass = "\"C:\\Users\\All Users\\Favorites\\lsass.exe\""	0a0a64f3c4fa7d960be983aa0a7d0ce8.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\smss = "\"C:\\Recovery\\c0f67622-1a8a-11ed-ae9f-b21da26d38ed\\smss.exe\""	0a0a64f3c4fa7d960be983aa0a7d0ce8.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\smss = "\"C:\\Recovery\\c0f67622-1a8a-11ed-ae9f-b21da26d38ed\\smss.exe\""	0a0a64f3c4fa7d960be983aa0a7d0ce8.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\sppsvc = "\"C:\\Recovery\\c0f67622-1a8a-11ed-ae9f-b21da26d38ed\\sppsvc.exe\""	0a0a64f3c4fa7d960be983aa0a7d0ce8.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sppsvc = "\"C:\\Recovery\\c0f67622-1a8a-11ed-ae9f-b21da26d38ed\\sppsvc.exe\""	0a0a64f3c4fa7d960be983aa0a7d0ce8.exe

Checks whether UAC is enabled 1 TTPs 4 IoCs

evasion trojan

System Information Discovery

T1082

Processes:

0a0a64f3c4fa7d960be983aa0a7d0ce8.exelsass.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	0a0a64f3c4fa7d960be983aa0a7d0ce8.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	lsass.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	0a0a64f3c4fa7d960be983aa0a7d0ce8.exe

Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

8 ipinfo.io
7 ipinfo.io
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

flow	ioc
8	ipinfo.io
7	ipinfo.io

Creates scheduled task(s) 1 TTPs 9 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

Processes:

schtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exe

pid	process
1816	schtasks.exe
968	schtasks.exe
1284	schtasks.exe
620	schtasks.exe
440	schtasks.exe
1372	schtasks.exe
1732	schtasks.exe
1536	schtasks.exe
540	schtasks.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

Processes:

0a0a64f3c4fa7d960be983aa0a7d0ce8.exelsass.exepowershell.exepowershell.exepowershell.exe

pid	process
1016	0a0a64f3c4fa7d960be983aa0a7d0ce8.exe
1452	lsass.exe
1608	powershell.exe
2000	powershell.exe
904	powershell.exe
1452	lsass.exe
1452	lsass.exe
1452	lsass.exe
1452	lsass.exe
1452	lsass.exe
1452	lsass.exe
1452	lsass.exe
1452	lsass.exe

Suspicious use of AdjustPrivilegeToken 8 IoCs

Processes:

0a0a64f3c4fa7d960be983aa0a7d0ce8.exelsass.exepowershell.exepowershell.exepowershell.exevssvc.exe

description	pid	process
Token: SeDebugPrivilege	1016	0a0a64f3c4fa7d960be983aa0a7d0ce8.exe
Token: SeDebugPrivilege	1452	lsass.exe
Token: SeDebugPrivilege	1608	powershell.exe
Token: SeDebugPrivilege	2000	powershell.exe
Token: SeDebugPrivilege	904	powershell.exe
Token: SeBackupPrivilege	1036	vssvc.exe
Token: SeRestorePrivilege	1036	vssvc.exe
Token: SeAuditPrivilege	1036	vssvc.exe

Suspicious use of WriteProcessMemory 21 IoCs

Processes:

0a0a64f3c4fa7d960be983aa0a7d0ce8.exelsass.exe

description	pid	process	target process
PID 1016 wrote to memory of 2000	1016	0a0a64f3c4fa7d960be983aa0a7d0ce8.exe	powershell.exe
PID 1016 wrote to memory of 2000	1016	0a0a64f3c4fa7d960be983aa0a7d0ce8.exe	powershell.exe
PID 1016 wrote to memory of 2000	1016	0a0a64f3c4fa7d960be983aa0a7d0ce8.exe	powershell.exe
PID 1016 wrote to memory of 788	1016	0a0a64f3c4fa7d960be983aa0a7d0ce8.exe	powershell.exe
PID 1016 wrote to memory of 788	1016	0a0a64f3c4fa7d960be983aa0a7d0ce8.exe	powershell.exe
PID 1016 wrote to memory of 788	1016	0a0a64f3c4fa7d960be983aa0a7d0ce8.exe	powershell.exe
PID 1016 wrote to memory of 1608	1016	0a0a64f3c4fa7d960be983aa0a7d0ce8.exe	powershell.exe
PID 1016 wrote to memory of 1608	1016	0a0a64f3c4fa7d960be983aa0a7d0ce8.exe	powershell.exe
PID 1016 wrote to memory of 1608	1016	0a0a64f3c4fa7d960be983aa0a7d0ce8.exe	powershell.exe
PID 1016 wrote to memory of 904	1016	0a0a64f3c4fa7d960be983aa0a7d0ce8.exe	powershell.exe
PID 1016 wrote to memory of 904	1016	0a0a64f3c4fa7d960be983aa0a7d0ce8.exe	powershell.exe
PID 1016 wrote to memory of 904	1016	0a0a64f3c4fa7d960be983aa0a7d0ce8.exe	powershell.exe
PID 1016 wrote to memory of 1452	1016	0a0a64f3c4fa7d960be983aa0a7d0ce8.exe	lsass.exe
PID 1016 wrote to memory of 1452	1016	0a0a64f3c4fa7d960be983aa0a7d0ce8.exe	lsass.exe
PID 1016 wrote to memory of 1452	1016	0a0a64f3c4fa7d960be983aa0a7d0ce8.exe	lsass.exe
PID 1452 wrote to memory of 1700	1452	lsass.exe	WScript.exe
PID 1452 wrote to memory of 1700	1452	lsass.exe	WScript.exe
PID 1452 wrote to memory of 1700	1452	lsass.exe	WScript.exe
PID 1452 wrote to memory of 1104	1452	lsass.exe	WScript.exe
PID 1452 wrote to memory of 1104	1452	lsass.exe	WScript.exe
PID 1452 wrote to memory of 1104	1452	lsass.exe	WScript.exe

System policy modification 1 TTPs 6 IoCs

evasion

Modify Registry

T1112

Processes:

0a0a64f3c4fa7d960be983aa0a7d0ce8.exelsass.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	0a0a64f3c4fa7d960be983aa0a7d0ce8.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	0a0a64f3c4fa7d960be983aa0a7d0ce8.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	0a0a64f3c4fa7d960be983aa0a7d0ce8.exe

C:\Users\Admin\AppData\Local\Temp\0a0a64f3c4fa7d960be983aa0a7d0ce8.exe
"C:\Users\Admin\AppData\Local\Temp\0a0a64f3c4fa7d960be983aa0a7d0ce8.exe"
1⤵
- DcRat
- Modifies WinLogon for persistence
- UAC bypass
- Adds Run key to start application
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1016

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\0a0a64f3c4fa7d960be983aa0a7d0ce8.exe'
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2000

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\All Users\Favorites\lsass.exe'
2⤵
PID:788

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\c0f67622-1a8a-11ed-ae9f-b21da26d38ed\smss.exe'
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1608

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\c0f67622-1a8a-11ed-ae9f-b21da26d38ed\sppsvc.exe'
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:904

C:\Users\All Users\Favorites\lsass.exe
"C:\Users\All Users\Favorites\lsass.exe"
2⤵
- UAC bypass
- Executes dropped EXE
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1452

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\8779be4c-4877-451e-a356-2867dba7e75a.vbs"
3⤵
PID:1700

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\4771eca1-baeb-4f85-bc5a-bfcaadb7b9e2.vbs"
3⤵
PID:1104

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 8 /tr "'C:\Users\All Users\Favorites\lsass.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:620

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsass" /sc ONLOGON /tr "'C:\Users\All Users\Favorites\lsass.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:440

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 7 /tr "'C:\Users\All Users\Favorites\lsass.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1536

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 13 /tr "'C:\Recovery\c0f67622-1a8a-11ed-ae9f-b21da26d38ed\smss.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1816

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smss" /sc ONLOGON /tr "'C:\Recovery\c0f67622-1a8a-11ed-ae9f-b21da26d38ed\smss.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:540

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 9 /tr "'C:\Recovery\c0f67622-1a8a-11ed-ae9f-b21da26d38ed\smss.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1372

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 6 /tr "'C:\Recovery\c0f67622-1a8a-11ed-ae9f-b21da26d38ed\sppsvc.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:968

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvc" /sc ONLOGON /tr "'C:\Recovery\c0f67622-1a8a-11ed-ae9f-b21da26d38ed\sppsvc.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1284

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 11 /tr "'C:\Recovery\c0f67622-1a8a-11ed-ae9f-b21da26d38ed\sppsvc.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1732

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1036

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Registry Run Keys / Startup Folder

T1060

Scheduled Task

T1053

Winlogon Helper DLL

T1004

Privilege Escalation

Bypass User Account Control

T1088

Scheduled Task

T1053

Defense Evasion

Bypass User Account Control

T1088

Disabling Security Tools

T1089

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\4771eca1-baeb-4f85-bc5a-bfcaadb7b9e2.vbs

Filesize
490B

MD5
62126b74368d64907088d3c59c553ecd

SHA1
7ea3fc1026e7895346dd2990a0bcaf01c1288a14

SHA256
cf3f1b69bbdc009a07d8cc8ee67c1d39dcd290e3c94f0374bef06136144ce9ae

SHA512
1dc2be5861124b209009563d82da57deb101134bab096d03ccc96110eca8b50d1d29ed01b4704ee2056ea6ea118505d9e8f0fadabbbd72dc3dfab46886f08970

Download Submit
C:\Users\Admin\AppData\Local\Temp\8779be4c-4877-451e-a356-2867dba7e75a.vbs

Filesize
714B

MD5
800eb65e6b423837c8daac9179563732

SHA1
9cf0f92001a1d67d6906bcb9560605b4ac53db4e

SHA256
6c17f5b0396264945baf0e12102c04081635ff0ec7afa84991ece7a2e96120a2

SHA512
67761ea0957f1f518e91881895e259f2efe8026345f652cc93e93036da9706d76ae8d1788801900e9cdbdf5107edf2029afe68a0242c539678e540bf0d29303c

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
7KB

MD5
7b1040cf108c247dfc90dd966bb7c0b7

SHA1
d488d99f2b8cc0349f8ec6b64cd37a320fbbb054

SHA256
c44e58bf9c3af6f9d761a89a91356caecd0d1f2ff892d7006445bd30802e02c2

SHA512
e547984f63619c0c40623f33a04361cee900ffa762a1a608cbd3f58880c4f3c1f4aaa2fb2a73b2b631a60ab50ae9461850f161b658c6562a6ae69f34eab471ab

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
7KB

MD5
7b1040cf108c247dfc90dd966bb7c0b7

SHA1
d488d99f2b8cc0349f8ec6b64cd37a320fbbb054

SHA256
c44e58bf9c3af6f9d761a89a91356caecd0d1f2ff892d7006445bd30802e02c2

SHA512
e547984f63619c0c40623f33a04361cee900ffa762a1a608cbd3f58880c4f3c1f4aaa2fb2a73b2b631a60ab50ae9461850f161b658c6562a6ae69f34eab471ab

Download Submit
C:\Users\All Users\Favorites\lsass.exe

Filesize
3.8MB

MD5
71436e482e0d0bd7648ee96cb6936613

SHA1
71b954f5971ef7e1549a2abd7391ec841f092ac4

SHA256
ed9806b6ca433fa7207636e5eb27bfacf475514765712ce37b41dff6890187e9

SHA512
5889958d772e10f42ae6667f01b2c9a5b29e6918f21d4bdce1bd7f2a256c0cf9ddc4aed430d30f7df0c9fab1713f0d981bd74220306e0769936fcb86ab537e1b

Download Submit
C:\Users\Public\Favorites\lsass.exe

Filesize
3.8MB

MD5
71436e482e0d0bd7648ee96cb6936613

SHA1
71b954f5971ef7e1549a2abd7391ec841f092ac4

SHA256
ed9806b6ca433fa7207636e5eb27bfacf475514765712ce37b41dff6890187e9

SHA512
5889958d772e10f42ae6667f01b2c9a5b29e6918f21d4bdce1bd7f2a256c0cf9ddc4aed430d30f7df0c9fab1713f0d981bd74220306e0769936fcb86ab537e1b

Download Submit
memory/788-76-0x0000000000000000-mapping.dmp

Download
memory/904-98-0x000007FEEDDA0000-0x000007FEEE8FD000-memory.dmp

Filesize
11.4MB

Download
memory/904-78-0x0000000000000000-mapping.dmp

Download
memory/904-106-0x000000000289B000-0x00000000028BA000-memory.dmp

Filesize
124KB

Download
memory/904-104-0x0000000002894000-0x0000000002897000-memory.dmp

Filesize
12KB

Download
memory/904-102-0x000000001B770000-0x000000001BA6F000-memory.dmp

Filesize
3.0MB

Download
memory/904-97-0x0000000002894000-0x0000000002897000-memory.dmp

Filesize
12KB

Download
memory/904-86-0x000007FEEB840000-0x000007FEEC263000-memory.dmp

Filesize
10.1MB

Download
memory/1016-57-0x0000000000870000-0x0000000000880000-memory.dmp

Filesize
64KB

Download
memory/1016-59-0x00000000009B0000-0x00000000009BA000-memory.dmp

Filesize
40KB

Download
memory/1016-70-0x0000000002440000-0x000000000244E000-memory.dmp

Filesize
56KB

Download
memory/1016-71-0x0000000002450000-0x0000000002458000-memory.dmp

Filesize
32KB

Download
memory/1016-72-0x0000000002460000-0x000000000246C000-memory.dmp

Filesize
48KB

Download
memory/1016-73-0x0000000002480000-0x000000000248A000-memory.dmp

Filesize
40KB

Download
memory/1016-74-0x0000000002490000-0x000000000249C000-memory.dmp

Filesize
48KB

Download
memory/1016-55-0x0000000000840000-0x000000000085C000-memory.dmp

Filesize
112KB

Download
memory/1016-61-0x0000000000A10000-0x0000000000A1C000-memory.dmp

Filesize
48KB

Download
memory/1016-56-0x0000000000860000-0x0000000000868000-memory.dmp

Filesize
32KB

Download
memory/1016-68-0x0000000002250000-0x000000000225E000-memory.dmp

Filesize
56KB

Download
memory/1016-69-0x0000000002430000-0x0000000002438000-memory.dmp

Filesize
32KB

Download
memory/1016-60-0x00000000009C0000-0x0000000000A16000-memory.dmp

Filesize
344KB

Download
memory/1016-54-0x0000000000050000-0x000000000041A000-memory.dmp

Filesize
3.8MB

Download
memory/1016-66-0x0000000002230000-0x0000000002238000-memory.dmp

Filesize
32KB

Download
memory/1016-58-0x0000000000990000-0x00000000009A6000-memory.dmp

Filesize
88KB

Download
memory/1016-62-0x0000000000C30000-0x0000000000C42000-memory.dmp

Filesize
72KB

Download
memory/1016-65-0x0000000002220000-0x0000000002228000-memory.dmp

Filesize
32KB

Download
memory/1016-67-0x0000000002240000-0x000000000224A000-memory.dmp

Filesize
40KB

Download
memory/1016-63-0x0000000000C60000-0x0000000000C68000-memory.dmp

Filesize
32KB

Download
memory/1016-64-0x0000000000C70000-0x0000000000C7C000-memory.dmp

Filesize
48KB

Download
memory/1104-109-0x0000000000000000-mapping.dmp

Download
memory/1452-95-0x00000000005F0000-0x0000000000646000-memory.dmp

Filesize
344KB

Download
memory/1452-90-0x0000000000E20000-0x00000000011EA000-memory.dmp

Filesize
3.8MB

Download
memory/1452-87-0x0000000000000000-mapping.dmp

Download
memory/1608-77-0x0000000000000000-mapping.dmp

Download
memory/1608-107-0x000000000235B000-0x000000000237A000-memory.dmp

Filesize
124KB

Download
memory/1608-91-0x000007FEEB840000-0x000007FEEC263000-memory.dmp

Filesize
10.1MB

Download
memory/1608-93-0x000007FEEDDA0000-0x000007FEEE8FD000-memory.dmp

Filesize
11.4MB

Download
memory/1608-103-0x0000000002354000-0x0000000002357000-memory.dmp

Filesize
12KB

Download
memory/1608-99-0x000000001B700000-0x000000001B9FF000-memory.dmp

Filesize
3.0MB

Download
memory/1608-105-0x0000000002354000-0x0000000002357000-memory.dmp

Filesize
12KB

Download
memory/1608-92-0x0000000002354000-0x0000000002357000-memory.dmp

Filesize
12KB

Download
memory/1700-108-0x0000000000000000-mapping.dmp

Download
memory/2000-101-0x000000000249B000-0x00000000024BA000-memory.dmp

Filesize
124KB

Download
memory/2000-84-0x000007FEEB840000-0x000007FEEC263000-memory.dmp

Filesize
10.1MB

Download
memory/2000-96-0x0000000002494000-0x0000000002497000-memory.dmp

Filesize
12KB

Download
memory/2000-100-0x0000000002494000-0x0000000002497000-memory.dmp

Filesize
12KB

Download
memory/2000-94-0x000007FEEDDA0000-0x000007FEEE8FD000-memory.dmp

Filesize
11.4MB

Download
memory/2000-79-0x000007FEFC2C1000-0x000007FEFC2C3000-memory.dmp

Filesize
8KB

Download
memory/2000-75-0x0000000000000000-mapping.dmp

Download