dcrat | fd9e479531a11076bfa97269d4562bda4571f3f03f00e049e3e125d82099e942

Resubmissions

10/01/2024, 04:58

240110-fl152aeafn10

10/01/2024, 04:00

240110-ek33kaddbl10

Analysis

max time kernel
136s
max time network
173s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
10/01/2024, 04:58

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
4f85fd9da0e6d825b520f09905b16301.exe
Size 1.1MB
Sample240110-fl152aeafn
SHA256 fd9e479531a11076bfa97269d4562bda4571f3f03f00e049e3e125d82099e942
MD5 4f85fd9da0e6d825b520f09905b16301
SHA1 11b96ca925a09cd96569c4be2930b9b2bad9dd07
SHA512 cd7d31d8cec1f0aca5597216baffa5fbdaa7b4cf8134f8b0de7f2ed0b97c24c5964cf0508dc115360d5264e093436081970d7acfa6917e0d1a14d34a4774003e
SSDEEP 24576:TGyavpdrgnar7l2odPdcsZHpa+AGO05d2GqXW+lWR++4:wlr7tcsZHpaVwulm
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

dcrat infostealer persistence rat

Malware Config

Signatures

DcRat 21 IoCs

DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

rat infostealer dcrat

description	ioc	pid	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dllhost = "\"C:\\Windows\\System32\\Windows.Media.Protection.PlayReady\\dllhost.exe\""		4f85fd9da0e6d825b520f09905b16301.exe
		1652	schtasks.exe
		4316	schtasks.exe
		1608	schtasks.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\spoolsv = "\"C:\\Windows\\System32\\hdwwiz\\spoolsv.exe\""		4f85fd9da0e6d825b520f09905b16301.exe
		3784	schtasks.exe
		3732	schtasks.exe
		5036	schtasks.exe
		2640	schtasks.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dwm = "\"C:\\Windows\\System32\\tquery\\dwm.exe\""		4f85fd9da0e6d825b520f09905b16301.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\smss = "\"C:\\Documents and Settings\\smss.exe\""		4f85fd9da0e6d825b520f09905b16301.exe
		400	schtasks.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MusNotification = "\"C:\\Windows\\System32\\cmintegrator\\MusNotification.exe\""		4f85fd9da0e6d825b520f09905b16301.exe
		2912	schtasks.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\spoolsv = "\"C:\\Windows\\System32\\dmwappushsvc\\spoolsv.exe\""		4f85fd9da0e6d825b520f09905b16301.exe
		2768	schtasks.exe
File created	C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost\StartMenuExperienceHost.exe		4f85fd9da0e6d825b520f09905b16301.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\StartMenuExperienceHost = "\"C:\\Windows\\SystemApps\\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\\StartMenuExperienceHost\\StartMenuExperienceHost.exe\""		4f85fd9da0e6d825b520f09905b16301.exe
		4540	schtasks.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sppsvc = "\"C:\\Users\\All Users\\Application Data\\sppsvc.exe\""		4f85fd9da0e6d825b520f09905b16301.exe
		788	schtasks.exe

Process spawned unexpected child process 12 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	400	3088	schtasks.exe	95
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2912	3088	schtasks.exe	95
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3732	3088	schtasks.exe	95
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2768	3088	schtasks.exe	95
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3784	3088	schtasks.exe	95
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2640	3088	schtasks.exe	95
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1652	3088	schtasks.exe	95
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4540	3088	schtasks.exe	95
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4316	3088	schtasks.exe	95
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	788	3088	schtasks.exe	95
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5036	3088	schtasks.exe	95
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1608	3088	schtasks.exe	95

DCRat payload 2 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral2/memory/4396-0-0x0000000000210000-0x0000000000332000-memory.dmp	dcrat
behavioral2/files/0x000200000001e7f2-11.dat	dcrat

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\Control Panel\International\Geo\Nation	4f85fd9da0e6d825b520f09905b16301.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\Control Panel\International\Geo\Nation	4f85fd9da0e6d825b520f09905b16301.exe

Executes dropped EXE 1 IoCs

pid	Process
5000	SppExtComObj.exe

Adds Run key to start application 2 TTPs 12 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\StartMenuExperienceHost = "\"C:\\Windows\\SystemApps\\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\\StartMenuExperienceHost\\StartMenuExperienceHost.exe\""	4f85fd9da0e6d825b520f09905b16301.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dllhost = "\"C:\\Windows\\System32\\Windows.Media.Protection.PlayReady\\dllhost.exe\""	4f85fd9da0e6d825b520f09905b16301.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\spoolsv = "\"C:\\Windows\\System32\\dmwappushsvc\\spoolsv.exe\""	4f85fd9da0e6d825b520f09905b16301.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\smss = "\"C:\\Documents and Settings\\smss.exe\""	4f85fd9da0e6d825b520f09905b16301.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sppsvc = "\"C:\\Users\\All Users\\Application Data\\sppsvc.exe\""	4f85fd9da0e6d825b520f09905b16301.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SppExtComObj = "\"C:\\Windows\\Resources\\Ease of Access Themes\\SppExtComObj.exe\""	4f85fd9da0e6d825b520f09905b16301.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\lsass = "\"C:\\Windows\\System32\\microsoft-windows-battery-events\\lsass.exe\""	4f85fd9da0e6d825b520f09905b16301.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\spoolsv = "\"C:\\Windows\\System32\\hdwwiz\\spoolsv.exe\""	4f85fd9da0e6d825b520f09905b16301.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dwm = "\"C:\\Windows\\System32\\tquery\\dwm.exe\""	4f85fd9da0e6d825b520f09905b16301.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MusNotification = "\"C:\\Windows\\System32\\cmintegrator\\MusNotification.exe\""	4f85fd9da0e6d825b520f09905b16301.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dllhost = "\"C:\\Program Files (x86)\\Windows Sidebar\\Shared Gadgets\\dllhost.exe\""	4f85fd9da0e6d825b520f09905b16301.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\explorer = "\"C:\\Windows\\sysmon\\explorer.exe\""	4f85fd9da0e6d825b520f09905b16301.exe

Drops file in System32 directory 12 IoCs

description	ioc	Process
File created	C:\Windows\System32\cmintegrator\aa97147c4c782d4a77c6b7822ef5383b917e6cfb	4f85fd9da0e6d825b520f09905b16301.exe
File created	C:\Windows\System32\Windows.Media.Protection.PlayReady\dllhost.exe	4f85fd9da0e6d825b520f09905b16301.exe
File created	C:\Windows\System32\dmwappushsvc\f3b6ecef712a24f33798f5d2fb3790c3d9b894c4	4f85fd9da0e6d825b520f09905b16301.exe
File created	C:\Windows\System32\tquery\dwm.exe	4f85fd9da0e6d825b520f09905b16301.exe
File created	C:\Windows\System32\tquery\6cb0b6c459d5d3455a3da700e713f2e2529862ff	4f85fd9da0e6d825b520f09905b16301.exe
File created	C:\Windows\System32\cmintegrator\MusNotification.exe	4f85fd9da0e6d825b520f09905b16301.exe
File created	C:\Windows\System32\microsoft-windows-battery-events\lsass.exe	4f85fd9da0e6d825b520f09905b16301.exe
File created	C:\Windows\System32\microsoft-windows-battery-events\6203df4a6bafc7c328ee7f6f8ca0a8a838a8a1b9	4f85fd9da0e6d825b520f09905b16301.exe
File created	C:\Windows\System32\hdwwiz\spoolsv.exe	4f85fd9da0e6d825b520f09905b16301.exe
File created	C:\Windows\System32\hdwwiz\f3b6ecef712a24f33798f5d2fb3790c3d9b894c4	4f85fd9da0e6d825b520f09905b16301.exe
File created	C:\Windows\System32\Windows.Media.Protection.PlayReady\5940a34987c99120d96dace90a3f93f329dcad63	4f85fd9da0e6d825b520f09905b16301.exe
File created	C:\Windows\System32\dmwappushsvc\spoolsv.exe	4f85fd9da0e6d825b520f09905b16301.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Windows Sidebar\Shared Gadgets\dllhost.exe	4f85fd9da0e6d825b520f09905b16301.exe
File created	C:\Program Files (x86)\Windows Sidebar\Shared Gadgets\5940a34987c99120d96dace90a3f93f329dcad63	4f85fd9da0e6d825b520f09905b16301.exe

Drops file in Windows directory 8 IoCs

description	ioc	Process
File created	C:\Windows\Resources\Ease of Access Themes\SppExtComObj.exe	4f85fd9da0e6d825b520f09905b16301.exe
File opened for modification	C:\Windows\Resources\Ease of Access Themes\SppExtComObj.exe	4f85fd9da0e6d825b520f09905b16301.exe
File created	C:\Windows\Resources\Ease of Access Themes\e1ef82546f0b02b7e974f28047f3788b1128cce1	4f85fd9da0e6d825b520f09905b16301.exe
File created	C:\Windows\sysmon\explorer.exe	4f85fd9da0e6d825b520f09905b16301.exe
File created	C:\Windows\sysmon\7a0fd90576e08807bde2cc57bcf9854bbce05fe3	4f85fd9da0e6d825b520f09905b16301.exe
File created	C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost\StartMenuExperienceHost.exe	4f85fd9da0e6d825b520f09905b16301.exe
File opened for modification	C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost\StartMenuExperienceHost.exe	4f85fd9da0e6d825b520f09905b16301.exe
File created	C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost\55b276f4edf653fe07efe8f1ecc32d3d195abd16	4f85fd9da0e6d825b520f09905b16301.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 12 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
2912	schtasks.exe
3784	schtasks.exe
1652	schtasks.exe
788	schtasks.exe
1608	schtasks.exe
400	schtasks.exe
3732	schtasks.exe
2768	schtasks.exe
2640	schtasks.exe
4540	schtasks.exe
4316	schtasks.exe
5036	schtasks.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000_Classes\Local Settings	4f85fd9da0e6d825b520f09905b16301.exe

Suspicious behavior: EnumeratesProcesses 11 IoCs

pid	Process
4396	4f85fd9da0e6d825b520f09905b16301.exe
4396	4f85fd9da0e6d825b520f09905b16301.exe
4396	4f85fd9da0e6d825b520f09905b16301.exe
4396	4f85fd9da0e6d825b520f09905b16301.exe
4396	4f85fd9da0e6d825b520f09905b16301.exe
4396	4f85fd9da0e6d825b520f09905b16301.exe
4396	4f85fd9da0e6d825b520f09905b16301.exe
4396	4f85fd9da0e6d825b520f09905b16301.exe
4396	4f85fd9da0e6d825b520f09905b16301.exe
752	4f85fd9da0e6d825b520f09905b16301.exe
5000	SppExtComObj.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	4396	4f85fd9da0e6d825b520f09905b16301.exe
Token: SeDebugPrivilege	752	4f85fd9da0e6d825b520f09905b16301.exe
Token: SeDebugPrivilege	5000	SppExtComObj.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 4396 wrote to memory of 840	4396	4f85fd9da0e6d825b520f09905b16301.exe	104
PID 4396 wrote to memory of 840	4396	4f85fd9da0e6d825b520f09905b16301.exe	104
PID 840 wrote to memory of 864	840	cmd.exe	106
PID 840 wrote to memory of 864	840	cmd.exe	106
PID 840 wrote to memory of 4964	840	cmd.exe	107
PID 840 wrote to memory of 4964	840	cmd.exe	107
PID 840 wrote to memory of 752	840	cmd.exe	108
PID 840 wrote to memory of 752	840	cmd.exe	108
PID 752 wrote to memory of 5000	752	4f85fd9da0e6d825b520f09905b16301.exe	113
PID 752 wrote to memory of 5000	752	4f85fd9da0e6d825b520f09905b16301.exe	113

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\4f85fd9da0e6d825b520f09905b16301.exe
"C:\Users\Admin\AppData\Local\Temp\4f85fd9da0e6d825b520f09905b16301.exe"
1⤵
- DcRat
- Checks computer location settings
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4396
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\FypuoSWXd6.bat"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:840
- - C:\Windows\system32\chcp.com
    chcp 65001
    3⤵
    PID:864
- - C:\Windows\system32\w32tm.exe
    w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
    3⤵
    PID:4964
- - C:\Users\Admin\AppData\Local\Temp\4f85fd9da0e6d825b520f09905b16301.exe
    "C:\Users\Admin\AppData\Local\Temp\4f85fd9da0e6d825b520f09905b16301.exe"
    3⤵
    - Checks computer location settings
    - Adds Run key to start application
    - Drops file in System32 directory
    - Drops file in Program Files directory
    - Drops file in Windows directory
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:752
  - - C:\Windows\Resources\Ease of Access Themes\SppExtComObj.exe
      "C:\Windows\Resources\Ease of Access Themes\SppExtComObj.exe"
      4⤵
      Executes dropped EXE
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:5000

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "StartMenuExperienceHost" /sc ONLOGON /tr "'C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost\StartMenuExperienceHost.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:400

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsv" /sc ONLOGON /tr "'C:\Windows\System32\hdwwiz\spoolsv.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2912

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Windows\System32\Windows.Media.Protection.PlayReady\dllhost.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3732

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsv" /sc ONLOGON /tr "'C:\Windows\System32\dmwappushsvc\spoolsv.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2768

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smss" /sc ONLOGON /tr "'C:\Documents and Settings\smss.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3784

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvc" /sc ONLOGON /tr "'C:\Users\All Users\Application Data\sppsvc.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2640

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwm" /sc ONLOGON /tr "'C:\Windows\System32\tquery\dwm.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1652

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "MusNotification" /sc ONLOGON /tr "'C:\Windows\System32\cmintegrator\MusNotification.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4540

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SppExtComObj" /sc ONLOGON /tr "'C:\Windows\Resources\Ease of Access Themes\SppExtComObj.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4316

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsass" /sc ONLOGON /tr "'C:\Windows\System32\microsoft-windows-battery-events\lsass.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:788

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Sidebar\Shared Gadgets\dllhost.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:5036

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorer" /sc ONLOGON /tr "'C:\Windows\sysmon\explorer.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1608

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

4f85fd9da0e6d825b520f09905b16301.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\4f85fd9da0e6d825b520f09905b16301.exe.log
Size 1KB
SHA256 46386a61f3aaf1b1c2e6efc9fc7e9e9ff16cd13ae58b8d856835771fedb6d457
MD5 b7c0c43fc7804baaa7dc87152cdc9554
SHA1 1bab62bd56af745678d4e967d91e1ccfdeed4038
SHA512 9fda3dd00a3406137e0113f13f78e77b20a76512b35820d38df696842cbbf2e2ebabfb99a3846c9637ecb54af858ec1551521187e379872973006426a253f769
MD5 SHA1 SHA512

Submit Download

FypuoSWXd6.bat

Path C:\Users\Admin\AppData\Local\Temp\FypuoSWXd6.bat
Size 286B
SHA256 9195ca93ff828fdaf754801f0ede43eae5c3f8802bb37e06f2c3130a7b94cc1d
MD5 36c384eb524716daf9d0f8e692fda4bd
SHA1 692cb548b321e466b26dac0856f47cd3f63b6198
SHA512 730b8ef9c27b8e27f68898e1d7f04be068f212dbb7947e3c36aab77c89fedf51e3b98d9559ea6830bc2de9b5772480066ee70eeb60242880758a3694176e1b69
MD5 SHA1 SHA512

Submit Download

smss.exe

Path C:\Users\smss.exe
Size 1.1MB
SHA256 fd9e479531a11076bfa97269d4562bda4571f3f03f00e049e3e125d82099e942
MD5 4f85fd9da0e6d825b520f09905b16301
SHA1 11b96ca925a09cd96569c4be2930b9b2bad9dd07
SHA512 cd7d31d8cec1f0aca5597216baffa5fbdaa7b4cf8134f8b0de7f2ed0b97c24c5964cf0508dc115360d5264e093436081970d7acfa6917e0d1a14d34a4774003e
SSDEEP 24576:TGyavpdrgnar7l2odPdcsZHpa+AGO05d2GqXW+lWR++4:wlr7tcsZHpaVwulm
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/752-28-0x00007FF997490000-0x00007FF997F51000-memory.dmp

Download

memory/752-29-0x000000001B120000-0x000000001B130000-memory.dmp

Download

memory/752-49-0x00007FF997490000-0x00007FF997F51000-memory.dmp

Download

memory/4396-0-0x0000000000210000-0x0000000000332000-memory.dmp

Download

memory/4396-23-0x00007FF997400000-0x00007FF997EC1000-memory.dmp

Download

memory/4396-25-0x00007FF997400000-0x00007FF997EC1000-memory.dmp

Download

memory/4396-2-0x0000000002400000-0x0000000002410000-memory.dmp

Download

memory/4396-1-0x00007FF997400000-0x00007FF997EC1000-memory.dmp

Download

memory/5000-48-0x00007FF997490000-0x00007FF997F51000-memory.dmp

Download

memory/5000-50-0x000000001B3A0000-0x000000001B3B0000-memory.dmp

Download

memory/5000-51-0x00007FF997490000-0x00007FF997F51000-memory.dmp

Download

memory/5000-53-0x00007FF997490000-0x00007FF997F51000-memory.dmp

Download