dcrat | 5250a7d14874c55bebe18f783f9534fae7a79174fdd93efa5a96e079dcaefe83

Analysis

max time kernel
12s
max time network
157s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
31/03/2023, 09:56

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
a0a6e25c9983c73293aa7c9aabb893d5.exe
Size 3.3MB
Sample230331-lycabshc29
SHA256 5250a7d14874c55bebe18f783f9534fae7a79174fdd93efa5a96e079dcaefe83
MD5 a0a6e25c9983c73293aa7c9aabb893d5
SHA1 ccc867837aeafdf57c3d122664a756adb9a324a3
SHA512 8ebee2ab924e3171f19ca3a91a330f1826d0f4128512b3131edef9e68aeedd5cd95e831902e5b0a736380b96e12acae37eff1559fde2c83c0eb05a36e1c5db4a
SSDEEP 98304:GEho/Wo7jzmfOMb1XTOsiVD5xu2tfLuxN3KutYI:vo1PypbdgtPu2hk3n
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

dcrat evasion infostealer rat trojan

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat

Process spawned unexpected child process 30 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1052	2148	schtasks.exe	68
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1372	2148	schtasks.exe	68
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1424	2148	schtasks.exe	68
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2328	2148	schtasks.exe	68
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3360	2148	schtasks.exe	68
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4712	2148	schtasks.exe	68
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4032	2148	schtasks.exe	68
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5052	2148	schtasks.exe	68
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2244	2148	schtasks.exe	68
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3700	2148	schtasks.exe	68
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4772	2148	schtasks.exe	68
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	396	2148	schtasks.exe	68
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2480	2148	schtasks.exe	68
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	664	2148	schtasks.exe	68
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1664	2148	schtasks.exe	68
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3076	2148	schtasks.exe	68
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2712	2148	schtasks.exe	68
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	976	2148	schtasks.exe	68
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3492	2148	schtasks.exe	68
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2324	2148	schtasks.exe	68
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3956	2148	schtasks.exe	68
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4488	2148	schtasks.exe	68
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5080	2148	schtasks.exe	68
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1432	2148	schtasks.exe	68
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4976	2148	schtasks.exe	68
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	792	2148	schtasks.exe	68
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5100	2148	schtasks.exe	68
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4728	2148	schtasks.exe	68
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2484	2148	schtasks.exe	68
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2748	2148	schtasks.exe	68

UAC bypass 3 TTPs 3 IoCs

evasion trojan

Bypass User Account Control

T1088

Disabling Security Tools

T1089

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	a0a6e25c9983c73293aa7c9aabb893d5.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	a0a6e25c9983c73293aa7c9aabb893d5.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	a0a6e25c9983c73293aa7c9aabb893d5.exe

DCRat payload 4 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral2/memory/4480-134-0x0000000000270000-0x0000000000856000-memory.dmp	dcrat
behavioral2/memory/4480-169-0x0000000000270000-0x0000000000856000-memory.dmp	dcrat
behavioral2/memory/4476-174-0x00000000008D0000-0x0000000000EB6000-memory.dmp	dcrat
behavioral2/memory/4476-175-0x00000000008D0000-0x0000000000EB6000-memory.dmp	dcrat

Checks whether UAC is enabled 1 TTPs 2 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	a0a6e25c9983c73293aa7c9aabb893d5.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	a0a6e25c9983c73293aa7c9aabb893d5.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
4480	a0a6e25c9983c73293aa7c9aabb893d5.exe
4480	a0a6e25c9983c73293aa7c9aabb893d5.exe

Drops file in Program Files directory 4 IoCs

description	ioc	Process
File created	C:\Program Files\Microsoft Office 15\ClientX64\RuntimeBroker.exe	a0a6e25c9983c73293aa7c9aabb893d5.exe
File created	C:\Program Files\Microsoft Office 15\ClientX64\9e8d7a4ca61bd9	a0a6e25c9983c73293aa7c9aabb893d5.exe
File created	C:\Program Files\Windows Multimedia Platform\explorer.exe	a0a6e25c9983c73293aa7c9aabb893d5.exe
File created	C:\Program Files\Windows Multimedia Platform\7a0fd90576e088	a0a6e25c9983c73293aa7c9aabb893d5.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\Cursors\StartMenuExperienceHost.exe	a0a6e25c9983c73293aa7c9aabb893d5.exe
File created	C:\Windows\Cursors\55b276f4edf653	a0a6e25c9983c73293aa7c9aabb893d5.exe

Creates scheduled task(s) 1 TTPs 30 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
4712	schtasks.exe
5052	schtasks.exe
2328	schtasks.exe
4032	schtasks.exe
5080	schtasks.exe
3492	schtasks.exe
3956	schtasks.exe
4976	schtasks.exe
3360	schtasks.exe
1664	schtasks.exe
5100	schtasks.exe
2484	schtasks.exe
1432	schtasks.exe
4728	schtasks.exe
2748	schtasks.exe
4772	schtasks.exe
396	schtasks.exe
2712	schtasks.exe
976	schtasks.exe
664	schtasks.exe
3076	schtasks.exe
2324	schtasks.exe
792	schtasks.exe
1052	schtasks.exe
1424	schtasks.exe
2244	schtasks.exe
2480	schtasks.exe
1372	schtasks.exe
3700	schtasks.exe
4488	schtasks.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
4480	a0a6e25c9983c73293aa7c9aabb893d5.exe
4480	a0a6e25c9983c73293aa7c9aabb893d5.exe
4480	a0a6e25c9983c73293aa7c9aabb893d5.exe
4480	a0a6e25c9983c73293aa7c9aabb893d5.exe
4480	a0a6e25c9983c73293aa7c9aabb893d5.exe
4480	a0a6e25c9983c73293aa7c9aabb893d5.exe
4480	a0a6e25c9983c73293aa7c9aabb893d5.exe
4480	a0a6e25c9983c73293aa7c9aabb893d5.exe
4480	a0a6e25c9983c73293aa7c9aabb893d5.exe
4480	a0a6e25c9983c73293aa7c9aabb893d5.exe
4480	a0a6e25c9983c73293aa7c9aabb893d5.exe
4480	a0a6e25c9983c73293aa7c9aabb893d5.exe
4480	a0a6e25c9983c73293aa7c9aabb893d5.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4480	a0a6e25c9983c73293aa7c9aabb893d5.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4480	a0a6e25c9983c73293aa7c9aabb893d5.exe

System policy modification 1 TTPs 3 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	a0a6e25c9983c73293aa7c9aabb893d5.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	a0a6e25c9983c73293aa7c9aabb893d5.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	a0a6e25c9983c73293aa7c9aabb893d5.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\a0a6e25c9983c73293aa7c9aabb893d5.exe
"C:\Users\Admin\AppData\Local\Temp\a0a6e25c9983c73293aa7c9aabb893d5.exe"
1⤵
- UAC bypass
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:4480
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\PcwjyylHJ0.bat"
  2⤵
  PID:3356
- - C:\Windows\SysWOW64\w32tm.exe
    w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
    3⤵
    PID:3376
  - - C:\Windows\system32\w32tm.exe
      w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
      4⤵
      PID:2868
- - C:\Program Files\Windows Multimedia Platform\explorer.exe
    "C:\Program Files\Windows Multimedia Platform\explorer.exe"
    3⤵
    PID:4476

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 10 /tr "'C:\odt\System.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1052

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "System" /sc ONLOGON /tr "'C:\odt\System.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1372

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 7 /tr "'C:\odt\System.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1424

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OfficeClickToRunO" /sc MINUTE /mo 8 /tr "'C:\odt\OfficeClickToRun.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2328

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OfficeClickToRun" /sc ONLOGON /tr "'C:\odt\OfficeClickToRun.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3360

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OfficeClickToRunO" /sc MINUTE /mo 6 /tr "'C:\odt\OfficeClickToRun.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4712

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 5 /tr "'C:\Recovery\WindowsRE\explorer.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4032

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorer" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:5052

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 7 /tr "'C:\Recovery\WindowsRE\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2244

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 7 /tr "'C:\Users\Default User\csrss.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3700

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Users\Default User\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4772

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 7 /tr "'C:\Users\Default User\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:396

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 6 /tr "'C:\Program Files\Microsoft Office 15\ClientX64\RuntimeBroker.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2480

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Program Files\Microsoft Office 15\ClientX64\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:664

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 11 /tr "'C:\Program Files\Microsoft Office 15\ClientX64\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1664

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 8 /tr "'C:\Program Files\Windows Multimedia Platform\explorer.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3076

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorer" /sc ONLOGON /tr "'C:\Program Files\Windows Multimedia Platform\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2712

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 8 /tr "'C:\Program Files\Windows Multimedia Platform\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:976

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSE" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\WmiPrvSE.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3492

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 11 /tr "'C:\Recovery\WindowsRE\WmiPrvSE.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2324

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 8 /tr "'C:\Recovery\WindowsRE\WmiPrvSE.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3956

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "StartMenuExperienceHostS" /sc MINUTE /mo 5 /tr "'C:\Windows\Cursors\StartMenuExperienceHost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4488

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "StartMenuExperienceHost" /sc ONLOGON /tr "'C:\Windows\Cursors\StartMenuExperienceHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:5080

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "StartMenuExperienceHostS" /sc MINUTE /mo 13 /tr "'C:\Windows\Cursors\StartMenuExperienceHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1432

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "backgroundTaskHostb" /sc MINUTE /mo 10 /tr "'C:\odt\backgroundTaskHost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4976

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "backgroundTaskHost" /sc ONLOGON /tr "'C:\odt\backgroundTaskHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:792

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "backgroundTaskHostb" /sc MINUTE /mo 9 /tr "'C:\odt\backgroundTaskHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:5100

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 14 /tr "'C:\Users\All Users\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\RuntimeBroker.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4728

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Users\All Users\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2484

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 5 /tr "'C:\Users\All Users\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2748

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Scheduled Task

T1053

Privilege Escalation

Bypass User Account Control

T1088

Scheduled Task

T1053

Defense Evasion

Bypass User Account Control

T1088

Disabling Security Tools

T1089

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

RuntimeBroker.exe

Path C:\Program Files\Microsoft Office 15\ClientX64\RuntimeBroker.exe
Size 3.3MB
SHA256 5250a7d14874c55bebe18f783f9534fae7a79174fdd93efa5a96e079dcaefe83
MD5 a0a6e25c9983c73293aa7c9aabb893d5
SHA1 ccc867837aeafdf57c3d122664a756adb9a324a3
SHA512 8ebee2ab924e3171f19ca3a91a330f1826d0f4128512b3131edef9e68aeedd5cd95e831902e5b0a736380b96e12acae37eff1559fde2c83c0eb05a36e1c5db4a
SSDEEP 98304:GEho/Wo7jzmfOMb1XTOsiVD5xu2tfLuxN3KutYI:vo1PypbdgtPu2hk3n
MD5 SHA1 SHA512 SSDEEP

Submit Download

explorer.exe

Path C:\Program Files\Windows Multimedia Platform\explorer.exe
Size 3.3MB
SHA256 5250a7d14874c55bebe18f783f9534fae7a79174fdd93efa5a96e079dcaefe83
MD5 a0a6e25c9983c73293aa7c9aabb893d5
SHA1 ccc867837aeafdf57c3d122664a756adb9a324a3
SHA512 8ebee2ab924e3171f19ca3a91a330f1826d0f4128512b3131edef9e68aeedd5cd95e831902e5b0a736380b96e12acae37eff1559fde2c83c0eb05a36e1c5db4a
SSDEEP 98304:GEho/Wo7jzmfOMb1XTOsiVD5xu2tfLuxN3KutYI:vo1PypbdgtPu2hk3n
MD5 SHA1 SHA512 SSDEEP

Submit Download

explorer.exe

Path C:\Program Files\Windows Multimedia Platform\explorer.exe
Size 3.3MB
SHA256 5250a7d14874c55bebe18f783f9534fae7a79174fdd93efa5a96e079dcaefe83
MD5 a0a6e25c9983c73293aa7c9aabb893d5
SHA1 ccc867837aeafdf57c3d122664a756adb9a324a3
SHA512 8ebee2ab924e3171f19ca3a91a330f1826d0f4128512b3131edef9e68aeedd5cd95e831902e5b0a736380b96e12acae37eff1559fde2c83c0eb05a36e1c5db4a
SSDEEP 98304:GEho/Wo7jzmfOMb1XTOsiVD5xu2tfLuxN3KutYI:vo1PypbdgtPu2hk3n
MD5 SHA1 SHA512 SSDEEP

Submit Download

PcwjyylHJ0.bat

Path C:\Users\Admin\AppData\Local\Temp\PcwjyylHJ0.bat
Size 222B
SHA256 785ae15420233020d96a4ac314507150597a7cba59d9e85395493e597231d1b9
MD5 b9cc2a3403863a4612476d9cb89dcfbd
SHA1 69fba6ba6349333934edcc7d2d82ff4bcc80fd0a
SHA512 f77dda0674bd9574a221dccf3d2f14f2b6d1fa7e3ca70d01987f3e39c82651b11171c111bdfac97afaca8cdb715cb16f2bc6ae0ec6f95bdc58e5ac6643187eba
MD5 SHA1 SHA512

Submit Download

memory/4476-174-0x00000000008D0000-0x0000000000EB6000-memory.dmp

Download

memory/4476-175-0x00000000008D0000-0x0000000000EB6000-memory.dmp

Download

memory/4476-179-0x00000000038A0000-0x00000000038B0000-memory.dmp

Download

memory/4476-178-0x00000000008D0000-0x0000000000EB6000-memory.dmp

Download

memory/4476-176-0x00000000038A0000-0x00000000038B0000-memory.dmp

Download

memory/4480-169-0x0000000000270000-0x0000000000856000-memory.dmp

Download

memory/4480-137-0x00000000063A0000-0x00000000063F0000-memory.dmp

Download

memory/4480-138-0x0000000006BD0000-0x0000000006C62000-memory.dmp

Download

memory/4480-133-0x0000000000270000-0x0000000000856000-memory.dmp

Download

memory/4480-136-0x0000000003610000-0x0000000003620000-memory.dmp

Download

memory/4480-165-0x0000000000270000-0x0000000000856000-memory.dmp

Download

memory/4480-135-0x0000000006540000-0x0000000006AE4000-memory.dmp

Download

memory/4480-134-0x0000000000270000-0x0000000000856000-memory.dmp

Download

memory/4480-142-0x0000000007FE0000-0x0000000008046000-memory.dmp

Download

memory/4480-139-0x00000000084A0000-0x00000000089CC000-memory.dmp

Download