dcrat | 09342b36eeaad27a94f1fd6817bf161cf1c9194709ce8fe869afccd4239f4db3

Analysis

max time kernel
44s
max time network
48s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
17-01-2023 14:51

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

UDS-Trojan-PSW.MSIL.Tepfer.gen-09342b36eeaad2.exe
Size

2.4MB
MD5

b8ebe55c83b79c2f0c4c15ac4ec8c3a0
SHA1

c13137e3bfb16f61e5c69f60248be578bdd70551
SHA256

09342b36eeaad27a94f1fd6817bf161cf1c9194709ce8fe869afccd4239f4db3
SHA512

93778d19151b28cfea617ca64e707d43a6bcb342bb502ea2e9723200f71a2f26cea3f1f128e7252528eb586e85eb35b47b08afd58056aaf1c84fdd29a57feb9b
SSDEEP

49152:ubA34q6DjV16+6mCoG4HWT9TV6fsmLp3nfw9heL5fE3zdbg1NG:ubRDjV1x6mCoPYofsy9wvg5fgzd0HG

Score

10^/10

dcrat infostealer rat

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat

DCRat payload 11 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

Processes:

resource	yara_rule
\Users\Admin\AppData\Roaming\protectuser.exe	dcrat
\Users\Admin\AppData\Roaming\protectuser.exe	dcrat
\Users\Admin\AppData\Roaming\protectuser.exe	dcrat
\Users\Admin\AppData\Roaming\protectuser.exe	dcrat
\Users\Admin\AppData\Roaming\protectuser.exe	dcrat
C:\Users\Admin\AppData\Roaming\protectuser.exe	dcrat
C:\Users\Admin\AppData\Roaming\protectuser.exe	dcrat
behavioral1/memory/1896-87-0x0000000001230000-0x00000000013B0000-memory.dmp	dcrat
C:\Windows\System32\wbem\scrcons\WMIADAP.exe	dcrat
C:\Windows\System32\wbem\scrcons\WMIADAP.exe	dcrat
behavioral1/memory/764-104-0x0000000000A50000-0x0000000000BD0000-memory.dmp	dcrat

Executes dropped EXE 5 IoCs

Processes:

output.exeqtOLGyaELuyA.exeprotectuser.exeSteamKeyBoost.exeWMIADAP.exe

pid process

644 output.exe
568 qtOLGyaELuyA.exe
1896 protectuser.exe
1592 SteamKeyBoost.exe
764 WMIADAP.exe

pid	process
644	output.exe
568	qtOLGyaELuyA.exe
1896	protectuser.exe
1592	SteamKeyBoost.exe
764	WMIADAP.exe

Loads dropped DLL 14 IoCs

Processes:

UDS-Trojan-PSW.MSIL.Tepfer.gen-09342b36eeaad2.exeoutput.exeqtOLGyaELuyA.exe

pid	process
2024	UDS-Trojan-PSW.MSIL.Tepfer.gen-09342b36eeaad2.exe
2024	UDS-Trojan-PSW.MSIL.Tepfer.gen-09342b36eeaad2.exe
2024	UDS-Trojan-PSW.MSIL.Tepfer.gen-09342b36eeaad2.exe
2024	UDS-Trojan-PSW.MSIL.Tepfer.gen-09342b36eeaad2.exe
644	output.exe
568	qtOLGyaELuyA.exe
568	qtOLGyaELuyA.exe
568	qtOLGyaELuyA.exe
568	qtOLGyaELuyA.exe
568	qtOLGyaELuyA.exe
568	qtOLGyaELuyA.exe
568	qtOLGyaELuyA.exe
568	qtOLGyaELuyA.exe
568	qtOLGyaELuyA.exe

Drops file in System32 directory 11 IoCs

Processes:

protectuser.exe

description	ioc	process
File created	C:\Windows\System32\C_437\spoolsv.exe	protectuser.exe
File created	C:\Windows\System32\C_437\f3b6ecef712a24f33798f5d2fb3790c3d9b894c4	protectuser.exe
File created	C:\Windows\System32\wbem\scrcons\WMIADAP.exe	protectuser.exe
File created	C:\Windows\System32\wbem\scrcons\75a57c1bdf437c0c81ad56e81f43c7323ed35745	protectuser.exe
File created	C:\Windows\System32\wow64\winlogon.exe	protectuser.exe
File created	C:\Windows\System32\vbisurf\sppsvc.exe	protectuser.exe
File opened for modification	C:\Windows\System32\C_437\spoolsv.exe	protectuser.exe
File created	C:\Windows\System32\wow64\cc11b995f2a76da408ea6a601e682e64743153ad	protectuser.exe
File created	C:\Windows\System32\vbisurf\0a1fd5f707cd16ea89afd3d6db52b2da58214a6c	protectuser.exe
File created	C:\Windows\System32\C_28599\spoolsv.exe	protectuser.exe
File created	C:\Windows\System32\C_28599\f3b6ecef712a24f33798f5d2fb3790c3d9b894c4	protectuser.exe

Drops file in Program Files directory 4 IoCs

Processes:

protectuser.exe

description	ioc	process
File created	C:\Program Files\VideoLAN\VLC\hrtfs\protectuser.exe	protectuser.exe
File created	C:\Program Files\VideoLAN\VLC\hrtfs\ffa18abe14e4ab4742891363173df3747d0e251a	protectuser.exe
File created	C:\Program Files\Java\jre7\lib\deploy\dwm.exe	protectuser.exe
File created	C:\Program Files\Java\jre7\lib\deploy\6cb0b6c459d5d3455a3da700e713f2e2529862ff	protectuser.exe

Drops file in Windows directory 2 IoCs

Processes:

protectuser.exe

description	ioc	process
File created	C:\Windows\Setup\State\f3b6ecef712a24f33798f5d2fb3790c3d9b894c4	protectuser.exe
File created	C:\Windows\Setup\State\spoolsv.exe	protectuser.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 9 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

Processes:

schtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exe

pid	process
1460	schtasks.exe
464	schtasks.exe
1384	schtasks.exe
1936	schtasks.exe
1832	schtasks.exe
1072	schtasks.exe
988	schtasks.exe
1732	schtasks.exe
268	schtasks.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery
T1018

Processes:

PING.EXE

pid process

1672 PING.EXE
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

protectuser.exeWMIADAP.exe

pid process

1896 protectuser.exe
764 WMIADAP.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

protectuser.exeWMIADAP.exe

description pid process

Token: SeDebugPrivilege 1896 protectuser.exe
Token: SeDebugPrivilege 764 WMIADAP.exe

pid	process
1672	PING.EXE

pid	process
1896	protectuser.exe
764	WMIADAP.exe

description	pid	process
Token: SeDebugPrivilege	1896	protectuser.exe
Token: SeDebugPrivilege	764	WMIADAP.exe

Suspicious use of WriteProcessMemory 55 IoCs

Processes:

UDS-Trojan-PSW.MSIL.Tepfer.gen-09342b36eeaad2.exeoutput.exeqtOLGyaELuyA.exeprotectuser.execmd.exe

description	pid	process	target process
PID 2024 wrote to memory of 644	2024	UDS-Trojan-PSW.MSIL.Tepfer.gen-09342b36eeaad2.exe	output.exe
PID 2024 wrote to memory of 644	2024	UDS-Trojan-PSW.MSIL.Tepfer.gen-09342b36eeaad2.exe	output.exe
PID 2024 wrote to memory of 644	2024	UDS-Trojan-PSW.MSIL.Tepfer.gen-09342b36eeaad2.exe	output.exe
PID 2024 wrote to memory of 644	2024	UDS-Trojan-PSW.MSIL.Tepfer.gen-09342b36eeaad2.exe	output.exe
PID 644 wrote to memory of 568	644	output.exe	qtOLGyaELuyA.exe
PID 644 wrote to memory of 568	644	output.exe	qtOLGyaELuyA.exe
PID 644 wrote to memory of 568	644	output.exe	qtOLGyaELuyA.exe
PID 644 wrote to memory of 568	644	output.exe	qtOLGyaELuyA.exe
PID 568 wrote to memory of 1896	568	qtOLGyaELuyA.exe	protectuser.exe
PID 568 wrote to memory of 1896	568	qtOLGyaELuyA.exe	protectuser.exe
PID 568 wrote to memory of 1896	568	qtOLGyaELuyA.exe	protectuser.exe
PID 568 wrote to memory of 1896	568	qtOLGyaELuyA.exe	protectuser.exe
PID 568 wrote to memory of 1592	568	qtOLGyaELuyA.exe	SteamKeyBoost.exe
PID 568 wrote to memory of 1592	568	qtOLGyaELuyA.exe	SteamKeyBoost.exe
PID 568 wrote to memory of 1592	568	qtOLGyaELuyA.exe	SteamKeyBoost.exe
PID 568 wrote to memory of 1592	568	qtOLGyaELuyA.exe	SteamKeyBoost.exe
PID 1896 wrote to memory of 1936	1896	protectuser.exe	schtasks.exe
PID 1896 wrote to memory of 1936	1896	protectuser.exe	schtasks.exe
PID 1896 wrote to memory of 1936	1896	protectuser.exe	schtasks.exe
PID 1896 wrote to memory of 1460	1896	protectuser.exe	schtasks.exe
PID 1896 wrote to memory of 1460	1896	protectuser.exe	schtasks.exe
PID 1896 wrote to memory of 1460	1896	protectuser.exe	schtasks.exe
PID 1896 wrote to memory of 464	1896	protectuser.exe	schtasks.exe
PID 1896 wrote to memory of 464	1896	protectuser.exe	schtasks.exe
PID 1896 wrote to memory of 464	1896	protectuser.exe	schtasks.exe
PID 1896 wrote to memory of 268	1896	protectuser.exe	schtasks.exe
PID 1896 wrote to memory of 268	1896	protectuser.exe	schtasks.exe
PID 1896 wrote to memory of 268	1896	protectuser.exe	schtasks.exe
PID 1896 wrote to memory of 1384	1896	protectuser.exe	schtasks.exe
PID 1896 wrote to memory of 1384	1896	protectuser.exe	schtasks.exe
PID 1896 wrote to memory of 1384	1896	protectuser.exe	schtasks.exe
PID 1896 wrote to memory of 1832	1896	protectuser.exe	schtasks.exe
PID 1896 wrote to memory of 1832	1896	protectuser.exe	schtasks.exe
PID 1896 wrote to memory of 1832	1896	protectuser.exe	schtasks.exe
PID 1896 wrote to memory of 1072	1896	protectuser.exe	schtasks.exe
PID 1896 wrote to memory of 1072	1896	protectuser.exe	schtasks.exe
PID 1896 wrote to memory of 1072	1896	protectuser.exe	schtasks.exe
PID 1896 wrote to memory of 988	1896	protectuser.exe	schtasks.exe
PID 1896 wrote to memory of 988	1896	protectuser.exe	schtasks.exe
PID 1896 wrote to memory of 988	1896	protectuser.exe	schtasks.exe
PID 1896 wrote to memory of 1732	1896	protectuser.exe	schtasks.exe
PID 1896 wrote to memory of 1732	1896	protectuser.exe	schtasks.exe
PID 1896 wrote to memory of 1732	1896	protectuser.exe	schtasks.exe
PID 1896 wrote to memory of 1572	1896	protectuser.exe	cmd.exe
PID 1896 wrote to memory of 1572	1896	protectuser.exe	cmd.exe
PID 1896 wrote to memory of 1572	1896	protectuser.exe	cmd.exe
PID 1572 wrote to memory of 1660	1572	cmd.exe	chcp.com
PID 1572 wrote to memory of 1660	1572	cmd.exe	chcp.com
PID 1572 wrote to memory of 1660	1572	cmd.exe	chcp.com
PID 1572 wrote to memory of 1672	1572	cmd.exe	PING.EXE
PID 1572 wrote to memory of 1672	1572	cmd.exe	PING.EXE
PID 1572 wrote to memory of 1672	1572	cmd.exe	PING.EXE
PID 1572 wrote to memory of 764	1572	cmd.exe	WMIADAP.exe
PID 1572 wrote to memory of 764	1572	cmd.exe	WMIADAP.exe
PID 1572 wrote to memory of 764	1572	cmd.exe	WMIADAP.exe

C:\Users\Admin\AppData\Local\Temp\UDS-Trojan-PSW.MSIL.Tepfer.gen-09342b36eeaad2.exe
"C:\Users\Admin\AppData\Local\Temp\UDS-Trojan-PSW.MSIL.Tepfer.gen-09342b36eeaad2.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2024

C:\Users\Admin\AppData\Roaming\output.exe
"C:\Users\Admin\AppData\Roaming\output.exe"
2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:644

C:\Users\Admin\AppData\Local\Temp\qtOLGyaELuyA.exe
"C:\Users\Admin\AppData\Local\Temp\qtOLGyaELuyA.exe"
3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:568

C:\Users\Admin\AppData\Roaming\protectuser.exe
"C:\Users\Admin\AppData\Roaming\protectuser.exe"
4⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1896

C:\Windows\system32\schtasks.exe
"schtasks" /create /tn "spoolsv" /sc ONLOGON /tr "'C:\Windows\System32\C_437\spoolsv.exe'" /rl HIGHEST /f
5⤵
- Creates scheduled task(s)
PID:1936

C:\Windows\system32\schtasks.exe
"schtasks" /create /tn "lsm" /sc ONLOGON /tr "'C:\Recovery\31001cc2-2a3d-11ed-9244-9c23e66b04e4\lsm.exe'" /rl HIGHEST /f
5⤵
- Creates scheduled task(s)
PID:1460

C:\Windows\system32\schtasks.exe
"schtasks" /create /tn "WMIADAP" /sc ONLOGON /tr "'C:\Windows\System32\wbem\scrcons\WMIADAP.exe'" /rl HIGHEST /f
5⤵
- Creates scheduled task(s)
PID:464

C:\Windows\system32\schtasks.exe
"schtasks" /create /tn "dwm" /sc ONLOGON /tr "'C:\Program Files\Java\jre7\lib\deploy\dwm.exe'" /rl HIGHEST /f
5⤵
- Creates scheduled task(s)
PID:268

C:\Windows\system32\schtasks.exe
"schtasks" /create /tn "protectuser" /sc ONLOGON /tr "'C:\Program Files\VideoLAN\VLC\hrtfs\protectuser.exe'" /rl HIGHEST /f
5⤵
- Creates scheduled task(s)
PID:1384

C:\Windows\system32\schtasks.exe
"schtasks" /create /tn "winlogon" /sc ONLOGON /tr "'C:\Windows\System32\wow64\winlogon.exe'" /rl HIGHEST /f
5⤵
- Creates scheduled task(s)
PID:1832

C:\Windows\system32\schtasks.exe
"schtasks" /create /tn "spoolsv" /sc ONLOGON /tr "'C:\Windows\Setup\State\spoolsv.exe'" /rl HIGHEST /f
5⤵
- Creates scheduled task(s)
PID:1072

C:\Windows\system32\schtasks.exe
"schtasks" /create /tn "sppsvc" /sc ONLOGON /tr "'C:\Windows\System32\vbisurf\sppsvc.exe'" /rl HIGHEST /f
5⤵
- Creates scheduled task(s)
PID:988

C:\Windows\system32\schtasks.exe
"schtasks" /create /tn "spoolsv" /sc ONLOGON /tr "'C:\Windows\System32\C_28599\spoolsv.exe'" /rl HIGHEST /f
5⤵
- Creates scheduled task(s)
PID:1732

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\5lrxVqtzZs.bat"
5⤵
- Suspicious use of WriteProcessMemory
PID:1572

C:\Windows\system32\chcp.com
chcp 65001
6⤵
PID:1660

C:\Windows\system32\PING.EXE
ping -n 5 localhost
6⤵
- Runs ping.exe
PID:1672

C:\Windows\System32\wbem\scrcons\WMIADAP.exe
"C:\Windows\System32\wbem\scrcons\WMIADAP.exe"
6⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:764

C:\Users\Admin\AppData\Roaming\SteamKeyBoost.exe
"C:\Users\Admin\AppData\Roaming\SteamKeyBoost.exe"
4⤵
- Executes dropped EXE
PID:1592

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Credential Access

Discovery

Remote System Discovery

T1018

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\5lrxVqtzZs.bat

Filesize
210B

MD5
19d8deaf34654cd4e5367c2493100664

SHA1
2b7fe5dda6391fbd87f7c9bb57a3b2e5370bc931

SHA256
c98fa07c442225e2617e017373a0d66c4836401017794ca991db8616a2dbff5a

SHA512
9339b32b844ffdbc019ea767a4517f7cbc5363413b2f71bff84ce974353b58f263f7a08551b1272c872a80d6484d901dbe2168beda2ff9418fe760487fc15a01

Download Submit
C:\Users\Admin\AppData\Local\Temp\qtOLGyaELuyA.exe

Filesize
2.0MB

MD5
624ba3439ab7210c7eb0b2326e4fbd9a

SHA1
6815d815dde9ff0dcd17e56505a08566026bd7b7

SHA256
8fe8f3efc119e54d0946abefd2e439d6b9a729213cd7991743631823730a77cc

SHA512
7d2cd2a7011eac0f99f16bfe80f35c18f094fb6fd08438680bee343ee378ce3486a8b4763687acc123d4d26bf97562643576577d9eaa269ec23aca8eab866992

Download Submit
C:\Users\Admin\AppData\Local\Temp\qtOLGyaELuyA.exe

Filesize
2.0MB

MD5
624ba3439ab7210c7eb0b2326e4fbd9a

SHA1
6815d815dde9ff0dcd17e56505a08566026bd7b7

SHA256
8fe8f3efc119e54d0946abefd2e439d6b9a729213cd7991743631823730a77cc

SHA512
7d2cd2a7011eac0f99f16bfe80f35c18f094fb6fd08438680bee343ee378ce3486a8b4763687acc123d4d26bf97562643576577d9eaa269ec23aca8eab866992

Download Submit
C:\Users\Admin\AppData\Roaming\SteamKeyBoost.exe

Filesize
2.3MB

MD5
7c3cab1d97259537f098637a470200c3

SHA1
87c760496eda6bc4a9ac3e6d76f20843e52d4de1

SHA256
fa44ed8e4fe3acf3033daf19db1b05b47fb8e2d9bc8a473d07756b0dba35177c

SHA512
7355bafbf5a483df81f26074868749eba153610e81b2594f2c4fb9136502c3c487cad2812beca258c193bca0d498afa5bae85335dd248ed53af63341887f3b4f

Download Submit
C:\Users\Admin\AppData\Roaming\SteamKeyBoost.exe

Filesize
2.3MB

MD5
7c3cab1d97259537f098637a470200c3

SHA1
87c760496eda6bc4a9ac3e6d76f20843e52d4de1

SHA256
fa44ed8e4fe3acf3033daf19db1b05b47fb8e2d9bc8a473d07756b0dba35177c

SHA512
7355bafbf5a483df81f26074868749eba153610e81b2594f2c4fb9136502c3c487cad2812beca258c193bca0d498afa5bae85335dd248ed53af63341887f3b4f

Download Submit
C:\Users\Admin\AppData\Roaming\output.exe

Filesize
2.6MB

MD5
e7eb08585396e571d260dd55956e0a65

SHA1
bdf532d6ebe2b0de0d4fff8ba5f580101920335d

SHA256
55e95bfde07d8e6ab7824dd0a0b9a4e67e622793233729541ef258bf3610d434

SHA512
d2ddfbea5863566d8168c13eb7c311fec027af56db7cd2277f25ec800a6a63483f3e8cc89a519c57dc0bf20b51d0e0a64a603635519627c33decd00dcf70e49d

Download Submit
C:\Users\Admin\AppData\Roaming\output.exe

Filesize
2.6MB

MD5
e7eb08585396e571d260dd55956e0a65

SHA1
bdf532d6ebe2b0de0d4fff8ba5f580101920335d

SHA256
55e95bfde07d8e6ab7824dd0a0b9a4e67e622793233729541ef258bf3610d434

SHA512
d2ddfbea5863566d8168c13eb7c311fec027af56db7cd2277f25ec800a6a63483f3e8cc89a519c57dc0bf20b51d0e0a64a603635519627c33decd00dcf70e49d

Download Submit
C:\Users\Admin\AppData\Roaming\protectuser.exe

Filesize
1.5MB

MD5
4d4416d03c666f90cdffed05443b2ad1

SHA1
51dcca8d0e1b4d15f48497e42a421f5e4427bfd7

SHA256
09f8d2c21b615748a3789084587025142032537945301db93fc828adc836c7b6

SHA512
2556ed2aa689867285882543eebed0a6aa1a5af387fe15a2a5ef2138904fbd55c48b3ae81dac0ef783f55616e6eeeda4f6b5cb7a7751e10a9ac316899d0c21d3

Download Submit
C:\Users\Admin\AppData\Roaming\protectuser.exe

Filesize
1.5MB

MD5
4d4416d03c666f90cdffed05443b2ad1

SHA1
51dcca8d0e1b4d15f48497e42a421f5e4427bfd7

SHA256
09f8d2c21b615748a3789084587025142032537945301db93fc828adc836c7b6

SHA512
2556ed2aa689867285882543eebed0a6aa1a5af387fe15a2a5ef2138904fbd55c48b3ae81dac0ef783f55616e6eeeda4f6b5cb7a7751e10a9ac316899d0c21d3

Download Submit
C:\Windows\System32\wbem\scrcons\WMIADAP.exe

Filesize
1.5MB

MD5
4d4416d03c666f90cdffed05443b2ad1

SHA1
51dcca8d0e1b4d15f48497e42a421f5e4427bfd7

SHA256
09f8d2c21b615748a3789084587025142032537945301db93fc828adc836c7b6

SHA512
2556ed2aa689867285882543eebed0a6aa1a5af387fe15a2a5ef2138904fbd55c48b3ae81dac0ef783f55616e6eeeda4f6b5cb7a7751e10a9ac316899d0c21d3

Download Submit
C:\Windows\System32\wbem\scrcons\WMIADAP.exe

Filesize
1.5MB

MD5
4d4416d03c666f90cdffed05443b2ad1

SHA1
51dcca8d0e1b4d15f48497e42a421f5e4427bfd7

SHA256
09f8d2c21b615748a3789084587025142032537945301db93fc828adc836c7b6

SHA512
2556ed2aa689867285882543eebed0a6aa1a5af387fe15a2a5ef2138904fbd55c48b3ae81dac0ef783f55616e6eeeda4f6b5cb7a7751e10a9ac316899d0c21d3

Download Submit
\Users\Admin\AppData\Local\Temp\qtOLGyaELuyA.exe

Filesize
2.0MB

MD5
624ba3439ab7210c7eb0b2326e4fbd9a

SHA1
6815d815dde9ff0dcd17e56505a08566026bd7b7

SHA256
8fe8f3efc119e54d0946abefd2e439d6b9a729213cd7991743631823730a77cc

SHA512
7d2cd2a7011eac0f99f16bfe80f35c18f094fb6fd08438680bee343ee378ce3486a8b4763687acc123d4d26bf97562643576577d9eaa269ec23aca8eab866992

Download Submit
\Users\Admin\AppData\Roaming\SteamKeyBoost.exe

Filesize
2.3MB

MD5
7c3cab1d97259537f098637a470200c3

SHA1
87c760496eda6bc4a9ac3e6d76f20843e52d4de1

SHA256
fa44ed8e4fe3acf3033daf19db1b05b47fb8e2d9bc8a473d07756b0dba35177c

SHA512
7355bafbf5a483df81f26074868749eba153610e81b2594f2c4fb9136502c3c487cad2812beca258c193bca0d498afa5bae85335dd248ed53af63341887f3b4f

Download Submit
\Users\Admin\AppData\Roaming\SteamKeyBoost.exe

Filesize
2.3MB

MD5
7c3cab1d97259537f098637a470200c3

SHA1
87c760496eda6bc4a9ac3e6d76f20843e52d4de1

SHA256
fa44ed8e4fe3acf3033daf19db1b05b47fb8e2d9bc8a473d07756b0dba35177c

SHA512
7355bafbf5a483df81f26074868749eba153610e81b2594f2c4fb9136502c3c487cad2812beca258c193bca0d498afa5bae85335dd248ed53af63341887f3b4f

Download Submit
\Users\Admin\AppData\Roaming\SteamKeyBoost.exe

Filesize
2.3MB

MD5
7c3cab1d97259537f098637a470200c3

SHA1
87c760496eda6bc4a9ac3e6d76f20843e52d4de1

SHA256
fa44ed8e4fe3acf3033daf19db1b05b47fb8e2d9bc8a473d07756b0dba35177c

SHA512
7355bafbf5a483df81f26074868749eba153610e81b2594f2c4fb9136502c3c487cad2812beca258c193bca0d498afa5bae85335dd248ed53af63341887f3b4f

Download Submit
\Users\Admin\AppData\Roaming\SteamKeyBoost.exe

Filesize
2.3MB

MD5
7c3cab1d97259537f098637a470200c3

SHA1
87c760496eda6bc4a9ac3e6d76f20843e52d4de1

SHA256
fa44ed8e4fe3acf3033daf19db1b05b47fb8e2d9bc8a473d07756b0dba35177c

SHA512
7355bafbf5a483df81f26074868749eba153610e81b2594f2c4fb9136502c3c487cad2812beca258c193bca0d498afa5bae85335dd248ed53af63341887f3b4f

Download Submit
\Users\Admin\AppData\Roaming\output.exe

Filesize
2.6MB

MD5
e7eb08585396e571d260dd55956e0a65

SHA1
bdf532d6ebe2b0de0d4fff8ba5f580101920335d

SHA256
55e95bfde07d8e6ab7824dd0a0b9a4e67e622793233729541ef258bf3610d434

SHA512
d2ddfbea5863566d8168c13eb7c311fec027af56db7cd2277f25ec800a6a63483f3e8cc89a519c57dc0bf20b51d0e0a64a603635519627c33decd00dcf70e49d

Download Submit
\Users\Admin\AppData\Roaming\output.exe

Filesize
2.6MB

MD5
e7eb08585396e571d260dd55956e0a65

SHA1
bdf532d6ebe2b0de0d4fff8ba5f580101920335d

SHA256
55e95bfde07d8e6ab7824dd0a0b9a4e67e622793233729541ef258bf3610d434

SHA512
d2ddfbea5863566d8168c13eb7c311fec027af56db7cd2277f25ec800a6a63483f3e8cc89a519c57dc0bf20b51d0e0a64a603635519627c33decd00dcf70e49d

Download Submit
\Users\Admin\AppData\Roaming\output.exe

Filesize
2.6MB

MD5
e7eb08585396e571d260dd55956e0a65

SHA1
bdf532d6ebe2b0de0d4fff8ba5f580101920335d

SHA256
55e95bfde07d8e6ab7824dd0a0b9a4e67e622793233729541ef258bf3610d434

SHA512
d2ddfbea5863566d8168c13eb7c311fec027af56db7cd2277f25ec800a6a63483f3e8cc89a519c57dc0bf20b51d0e0a64a603635519627c33decd00dcf70e49d

Download Submit
\Users\Admin\AppData\Roaming\output.exe

Filesize
2.6MB

MD5
e7eb08585396e571d260dd55956e0a65

SHA1
bdf532d6ebe2b0de0d4fff8ba5f580101920335d

SHA256
55e95bfde07d8e6ab7824dd0a0b9a4e67e622793233729541ef258bf3610d434

SHA512
d2ddfbea5863566d8168c13eb7c311fec027af56db7cd2277f25ec800a6a63483f3e8cc89a519c57dc0bf20b51d0e0a64a603635519627c33decd00dcf70e49d

Download Submit
\Users\Admin\AppData\Roaming\protectuser.exe

Filesize
1.5MB

MD5
4d4416d03c666f90cdffed05443b2ad1

SHA1
51dcca8d0e1b4d15f48497e42a421f5e4427bfd7

SHA256
09f8d2c21b615748a3789084587025142032537945301db93fc828adc836c7b6

SHA512
2556ed2aa689867285882543eebed0a6aa1a5af387fe15a2a5ef2138904fbd55c48b3ae81dac0ef783f55616e6eeeda4f6b5cb7a7751e10a9ac316899d0c21d3

Download Submit
\Users\Admin\AppData\Roaming\protectuser.exe

Filesize
1.5MB

MD5
4d4416d03c666f90cdffed05443b2ad1

SHA1
51dcca8d0e1b4d15f48497e42a421f5e4427bfd7

SHA256
09f8d2c21b615748a3789084587025142032537945301db93fc828adc836c7b6

SHA512
2556ed2aa689867285882543eebed0a6aa1a5af387fe15a2a5ef2138904fbd55c48b3ae81dac0ef783f55616e6eeeda4f6b5cb7a7751e10a9ac316899d0c21d3

Download Submit
\Users\Admin\AppData\Roaming\protectuser.exe

Filesize
1.5MB

MD5
4d4416d03c666f90cdffed05443b2ad1

SHA1
51dcca8d0e1b4d15f48497e42a421f5e4427bfd7

SHA256
09f8d2c21b615748a3789084587025142032537945301db93fc828adc836c7b6

SHA512
2556ed2aa689867285882543eebed0a6aa1a5af387fe15a2a5ef2138904fbd55c48b3ae81dac0ef783f55616e6eeeda4f6b5cb7a7751e10a9ac316899d0c21d3

Download Submit
\Users\Admin\AppData\Roaming\protectuser.exe

Filesize
1.5MB

MD5
4d4416d03c666f90cdffed05443b2ad1

SHA1
51dcca8d0e1b4d15f48497e42a421f5e4427bfd7

SHA256
09f8d2c21b615748a3789084587025142032537945301db93fc828adc836c7b6

SHA512
2556ed2aa689867285882543eebed0a6aa1a5af387fe15a2a5ef2138904fbd55c48b3ae81dac0ef783f55616e6eeeda4f6b5cb7a7751e10a9ac316899d0c21d3

Download Submit
\Users\Admin\AppData\Roaming\protectuser.exe

Filesize
1.5MB

MD5
4d4416d03c666f90cdffed05443b2ad1

SHA1
51dcca8d0e1b4d15f48497e42a421f5e4427bfd7

SHA256
09f8d2c21b615748a3789084587025142032537945301db93fc828adc836c7b6

SHA512
2556ed2aa689867285882543eebed0a6aa1a5af387fe15a2a5ef2138904fbd55c48b3ae81dac0ef783f55616e6eeeda4f6b5cb7a7751e10a9ac316899d0c21d3

Download Submit
memory/268-91-0x0000000000000000-mapping.dmp

Download
memory/464-90-0x0000000000000000-mapping.dmp

Download
memory/568-67-0x0000000000000000-mapping.dmp

Download
memory/644-62-0x0000000000A60000-0x0000000000CF6000-memory.dmp

Filesize
2.6MB

Download
memory/644-64-0x0000000000390000-0x0000000000396000-memory.dmp

Filesize
24KB

Download
memory/644-59-0x0000000000000000-mapping.dmp

Download
memory/644-63-0x0000000000300000-0x0000000000306000-memory.dmp

Filesize
24KB

Download
memory/764-102-0x0000000000000000-mapping.dmp

Download
memory/764-104-0x0000000000A50000-0x0000000000BD0000-memory.dmp

Filesize
1.5MB

Download
memory/988-95-0x0000000000000000-mapping.dmp

Download
memory/1072-94-0x0000000000000000-mapping.dmp

Download
memory/1384-92-0x0000000000000000-mapping.dmp

Download
memory/1460-89-0x0000000000000000-mapping.dmp

Download
memory/1572-97-0x0000000000000000-mapping.dmp

Download
memory/1592-83-0x0000000000000000-mapping.dmp

Download
memory/1660-99-0x0000000000000000-mapping.dmp

Download
memory/1672-100-0x0000000000000000-mapping.dmp

Download
memory/1732-96-0x0000000000000000-mapping.dmp

Download
memory/1832-93-0x0000000000000000-mapping.dmp

Download
memory/1896-87-0x0000000001230000-0x00000000013B0000-memory.dmp

Filesize
1.5MB

Download
memory/1896-76-0x0000000000000000-mapping.dmp

Download
memory/1936-88-0x0000000000000000-mapping.dmp

Download
memory/2024-54-0x00000000766D1000-0x00000000766D3000-memory.dmp

Filesize
8KB

Download