Overview

overview

10

Static

static

10

51b284bd1d...02.exe

windows7-x64

10

51b284bd1d...02.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    87s
  • max time network
    149s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231215-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
  • submitted
    13-03-2024 19:33

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    51b284bd1d8865e9d4fe9544c81882a7790a2ce32458249a25c9698329a0ea02.exe

  • Size

    2.1MB

  • MD5

    f4a675a3b47a85daa2e7905eba314760

  • SHA1

    0e01e07ff8ed4ca94a1dcad2f2af26fd8cf431ba

  • SHA256

    51b284bd1d8865e9d4fe9544c81882a7790a2ce32458249a25c9698329a0ea02

  • SHA512

    d8a9cd69392fc775cef5d714128ca08a39a6a111e57ff248b64ba4126b89bbff4ca39bb5c117450e405619cefbec7ca01ad931c6ae7d9cb14c6d1822d478152d

  • SSDEEP

    49152:D3B3BNkmneOg9/liOjsCpfAwq1jwaCJtn:zFBNkB9NiOjsC5A91jw5

Score
10/10
dcratinfostealerpersistencerat

Malware Config

Signatures

  • DcRat 33 IoCs

    DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

    ratinfostealerdcrat
  • Modifies WinLogon for persistence 2 TTPs 11 IoCs
    persistence
  • Process spawned unexpected child process 33 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • DCRat payload 5 IoCs

    Detects payload of DCRat, commonly dropped by NSIS installers.

    rat
  • Detects executables packed with SmartAssembly 7 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 1 IoCs
  • Adds Run key to start application 2 TTPs 22 IoCs
    persistence
  • Drops file in Program Files directory 8 IoCs
  • Drops file in Windows directory 12 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Creates scheduled task(s) 1 TTPs 33 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistence
  • Modifies registry class 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 13 IoCs
  • Suspicious use of WriteProcessMemory 30 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\51b284bd1d8865e9d4fe9544c81882a7790a2ce32458249a25c9698329a0ea02.exe
    "C:\Users\Admin\AppData\Local\Temp\51b284bd1d8865e9d4fe9544c81882a7790a2ce32458249a25c9698329a0ea02.exe"
    1⤵
    • Modifies WinLogon for persistence
    • Checks computer location settings
    • Adds Run key to start application
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1704
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\51b284bd1d8865e9d4fe9544c81882a7790a2ce32458249a25c9698329a0ea02.exe'
      2⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:3340
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\Recent\dllhost.exe'
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:4684
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\WindowsRE\dllhost.exe'
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:3224
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Adobe\Acrobat Reader DC\Setup Files\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\smss.exe'
      2⤵
        PID:1284
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\WindowsRE\sppsvc.exe'
        2⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:4400
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\Resources\Ease of Access Themes\explorer.exe'
        2⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:4476
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\WindowsRE\51b284bd1d8865e9d4fe9544c81882a7790a2ce32458249a25c9698329a0ea02.exe'
        2⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:4488
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\SchCache\Idle.exe'
        2⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:4376
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\RemotePackages\RemoteDesktops\SearchApp.exe'
        2⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:4520
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Internet Explorer\dllhost.exe'
        2⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:1416
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\odt\fontdrvhost.exe'
        2⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:744
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\Temp\MsEdgeCrashpad\reports\RuntimeBroker.exe'
        2⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:3692
      • C:\Windows\System32\cmd.exe
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\TRQhSFvIsZ.bat"
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:1612
        • C:\Windows\system32\w32tm.exe
          w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
          3⤵
            PID:4904
          • C:\Windows\RemotePackages\RemoteDesktops\SearchApp.exe
            "C:\Windows\RemotePackages\RemoteDesktops\SearchApp.exe"
            3⤵
            • Executes dropped EXE
            • Suspicious use of AdjustPrivilegeToken
            PID:1468
      • C:\Windows\system32\schtasks.exe
        schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 6 /tr "'C:\Users\Admin\Recent\dllhost.exe'" /f
        1⤵
        • DcRat
        • Process spawned unexpected child process
        • Creates scheduled task(s)
        PID:3680
      • C:\Windows\system32\schtasks.exe
        schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Users\Admin\Recent\dllhost.exe'" /rl HIGHEST /f
        1⤵
        • DcRat
        • Process spawned unexpected child process
        • Creates scheduled task(s)
        PID:4868
      • C:\Windows\system32\schtasks.exe
        schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 6 /tr "'C:\Users\Admin\Recent\dllhost.exe'" /rl HIGHEST /f
        1⤵
        • DcRat
        • Process spawned unexpected child process
        • Creates scheduled task(s)
        PID:3456
      • C:\Windows\system32\schtasks.exe
        schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 11 /tr "'C:\Recovery\WindowsRE\dllhost.exe'" /f
        1⤵
        • DcRat
        • Process spawned unexpected child process
        • Creates scheduled task(s)
        PID:4328
      • C:\Windows\system32\schtasks.exe
        schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\dllhost.exe'" /rl HIGHEST /f
        1⤵
        • DcRat
        • Process spawned unexpected child process
        • Creates scheduled task(s)
        PID:3276
      • C:\Windows\system32\schtasks.exe
        schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 9 /tr "'C:\Recovery\WindowsRE\dllhost.exe'" /rl HIGHEST /f
        1⤵
        • DcRat
        • Process spawned unexpected child process
        • Creates scheduled task(s)
        PID:4852
      • C:\Windows\system32\schtasks.exe
        schtasks.exe /create /tn "smsss" /sc MINUTE /mo 9 /tr "'C:\Program Files (x86)\Adobe\Acrobat Reader DC\Setup Files\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\smss.exe'" /f
        1⤵
        • DcRat
        • Process spawned unexpected child process
        • Creates scheduled task(s)
        PID:1500
      • C:\Windows\system32\schtasks.exe
        schtasks.exe /create /tn "smss" /sc ONLOGON /tr "'C:\Program Files (x86)\Adobe\Acrobat Reader DC\Setup Files\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\smss.exe'" /rl HIGHEST /f
        1⤵
        • DcRat
        • Process spawned unexpected child process
        • Creates scheduled task(s)
        PID:3860
      • C:\Windows\system32\schtasks.exe
        schtasks.exe /create /tn "smsss" /sc MINUTE /mo 6 /tr "'C:\Program Files (x86)\Adobe\Acrobat Reader DC\Setup Files\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\smss.exe'" /rl HIGHEST /f
        1⤵
        • DcRat
        • Process spawned unexpected child process
        • Creates scheduled task(s)
        PID:3924
      • C:\Windows\system32\schtasks.exe
        schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 11 /tr "'C:\Recovery\WindowsRE\sppsvc.exe'" /f
        1⤵
        • DcRat
        • Process spawned unexpected child process
        • Creates scheduled task(s)
        PID:2608
      • C:\Windows\system32\schtasks.exe
        schtasks.exe /create /tn "sppsvc" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\sppsvc.exe'" /rl HIGHEST /f
        1⤵
        • DcRat
        • Process spawned unexpected child process
        • Creates scheduled task(s)
        PID:2584
      • C:\Windows\system32\schtasks.exe
        schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 9 /tr "'C:\Recovery\WindowsRE\sppsvc.exe'" /rl HIGHEST /f
        1⤵
        • DcRat
        • Process spawned unexpected child process
        • Creates scheduled task(s)
        PID:4492
      • C:\Windows\system32\schtasks.exe
        schtasks.exe /create /tn "explorere" /sc MINUTE /mo 13 /tr "'C:\Windows\Resources\Ease of Access Themes\explorer.exe'" /f
        1⤵
        • DcRat
        • Process spawned unexpected child process
        • Creates scheduled task(s)
        PID:4384
      • C:\Windows\system32\schtasks.exe
        schtasks.exe /create /tn "explorer" /sc ONLOGON /tr "'C:\Windows\Resources\Ease of Access Themes\explorer.exe'" /rl HIGHEST /f
        1⤵
        • DcRat
        • Process spawned unexpected child process
        • Creates scheduled task(s)
        PID:3120
      • C:\Windows\system32\schtasks.exe
        schtasks.exe /create /tn "explorere" /sc MINUTE /mo 7 /tr "'C:\Windows\Resources\Ease of Access Themes\explorer.exe'" /rl HIGHEST /f
        1⤵
        • DcRat
        • Process spawned unexpected child process
        • Creates scheduled task(s)
        PID:5048
      • C:\Windows\system32\schtasks.exe
        schtasks.exe /create /tn "51b284bd1d8865e9d4fe9544c81882a7790a2ce32458249a25c9698329a0ea025" /sc MINUTE /mo 10 /tr "'C:\Recovery\WindowsRE\51b284bd1d8865e9d4fe9544c81882a7790a2ce32458249a25c9698329a0ea02.exe'" /f
        1⤵
        • DcRat
        • Process spawned unexpected child process
        • Creates scheduled task(s)
        PID:956
      • C:\Windows\system32\schtasks.exe
        schtasks.exe /create /tn "51b284bd1d8865e9d4fe9544c81882a7790a2ce32458249a25c9698329a0ea02" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\51b284bd1d8865e9d4fe9544c81882a7790a2ce32458249a25c9698329a0ea02.exe'" /rl HIGHEST /f
        1⤵
        • DcRat
        • Process spawned unexpected child process
        • Creates scheduled task(s)
        PID:880
      • C:\Windows\system32\schtasks.exe
        schtasks.exe /create /tn "51b284bd1d8865e9d4fe9544c81882a7790a2ce32458249a25c9698329a0ea025" /sc MINUTE /mo 10 /tr "'C:\Recovery\WindowsRE\51b284bd1d8865e9d4fe9544c81882a7790a2ce32458249a25c9698329a0ea02.exe'" /rl HIGHEST /f
        1⤵
        • DcRat
        • Process spawned unexpected child process
        • Creates scheduled task(s)
        PID:3268
      • C:\Windows\system32\schtasks.exe
        schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 12 /tr "'C:\Windows\SchCache\Idle.exe'" /f
        1⤵
        • DcRat
        • Process spawned unexpected child process
        • Creates scheduled task(s)
        PID:3252
      • C:\Windows\system32\schtasks.exe
        schtasks.exe /create /tn "Idle" /sc ONLOGON /tr "'C:\Windows\SchCache\Idle.exe'" /rl HIGHEST /f
        1⤵
        • DcRat
        • Process spawned unexpected child process
        • Creates scheduled task(s)
        PID:4900
      • C:\Windows\system32\schtasks.exe
        schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 9 /tr "'C:\Windows\SchCache\Idle.exe'" /rl HIGHEST /f
        1⤵
        • DcRat
        • Process spawned unexpected child process
        • Creates scheduled task(s)
        PID:988
      • C:\Windows\system32\schtasks.exe
        schtasks.exe /create /tn "SearchAppS" /sc MINUTE /mo 13 /tr "'C:\Windows\RemotePackages\RemoteDesktops\SearchApp.exe'" /f
        1⤵
        • DcRat
        • Process spawned unexpected child process
        • Creates scheduled task(s)
        PID:3368
      • C:\Windows\system32\schtasks.exe
        schtasks.exe /create /tn "SearchApp" /sc ONLOGON /tr "'C:\Windows\RemotePackages\RemoteDesktops\SearchApp.exe'" /rl HIGHEST /f
        1⤵
        • DcRat
        • Process spawned unexpected child process
        • Creates scheduled task(s)
        PID:4552
      • C:\Windows\system32\schtasks.exe
        schtasks.exe /create /tn "SearchAppS" /sc MINUTE /mo 10 /tr "'C:\Windows\RemotePackages\RemoteDesktops\SearchApp.exe'" /rl HIGHEST /f
        1⤵
        • DcRat
        • Process spawned unexpected child process
        • Creates scheduled task(s)
        PID:4836
      • C:\Windows\system32\schtasks.exe
        schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 8 /tr "'C:\Program Files (x86)\Internet Explorer\dllhost.exe'" /f
        1⤵
        • DcRat
        • Process spawned unexpected child process
        • Creates scheduled task(s)
        PID:1908
      • C:\Windows\system32\schtasks.exe
        schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Program Files (x86)\Internet Explorer\dllhost.exe'" /rl HIGHEST /f
        1⤵
        • DcRat
        • Process spawned unexpected child process
        • Creates scheduled task(s)
        PID:4772
      • C:\Windows\system32\schtasks.exe
        schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 13 /tr "'C:\Program Files (x86)\Internet Explorer\dllhost.exe'" /rl HIGHEST /f
        1⤵
        • DcRat
        • Process spawned unexpected child process
        • Creates scheduled task(s)
        PID:4252
      • C:\Windows\system32\schtasks.exe
        schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 10 /tr "'C:\odt\fontdrvhost.exe'" /f
        1⤵
        • DcRat
        • Process spawned unexpected child process
        • Creates scheduled task(s)
        PID:2304
      • C:\Windows\system32\schtasks.exe
        schtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\odt\fontdrvhost.exe'" /rl HIGHEST /f
        1⤵
        • DcRat
        • Process spawned unexpected child process
        • Creates scheduled task(s)
        PID:4760
      • C:\Windows\system32\schtasks.exe
        schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 12 /tr "'C:\odt\fontdrvhost.exe'" /rl HIGHEST /f
        1⤵
        • DcRat
        • Process spawned unexpected child process
        • Creates scheduled task(s)
        PID:4764
      • C:\Windows\system32\schtasks.exe
        schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 5 /tr "'C:\Windows\Temp\MsEdgeCrashpad\reports\RuntimeBroker.exe'" /f
        1⤵
        • DcRat
        • Process spawned unexpected child process
        • Creates scheduled task(s)
        PID:3028
      • C:\Windows\system32\schtasks.exe
        schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Windows\Temp\MsEdgeCrashpad\reports\RuntimeBroker.exe'" /rl HIGHEST /f
        1⤵
        • DcRat
        • Process spawned unexpected child process
        • Creates scheduled task(s)
        PID:3444
      • C:\Windows\system32\schtasks.exe
        schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 13 /tr "'C:\Windows\Temp\MsEdgeCrashpad\reports\RuntimeBroker.exe'" /rl HIGHEST /f
        1⤵
        • DcRat
        • Process spawned unexpected child process
        • Creates scheduled task(s)
        PID:4860

      Network

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
        Filesize

        2KB

        MD5

        d85ba6ff808d9e5444a4b369f5bc2730

        SHA1

        31aa9d96590fff6981b315e0b391b575e4c0804a

        SHA256

        84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

        SHA512

        8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

        Download Submit

      • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
        Filesize

        944B

        MD5

        0a2208fa0a4f50a8a854149081d56a62

        SHA1

        544300faad0490810910a418d57dea555ebacd49

        SHA256

        608d28181f5a9a851defcfc14015d697d0fbfc08b4f47232e1c3673366b781b7

        SHA512

        fab39f47a508c6dcaca0ea272a9f6ee443bb9f0e4ecdc4aa1239c48ed1afaec83499ab54851873ccc15030d8ef156e69b20420454e90985bde67b66292723299

        Download Submit

      • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
        Filesize

        944B

        MD5

        d28a889fd956d5cb3accfbaf1143eb6f

        SHA1

        157ba54b365341f8ff06707d996b3635da8446f7

        SHA256

        21e5d7ccf80a293e6ba30ed728846ca19c929c52b96e2c8d34e27cd2234f1d45

        SHA512

        0b6d88deb9be85722e6a78d5886d49f2caf407a59e128d2b4ed74c1356f9928c40048a62731959f2460e9ff9d9feee311043d2a37abe3bb92c2b76a44281478c

        Download Submit

      • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
        Filesize

        944B

        MD5

        bd5940f08d0be56e65e5f2aaf47c538e

        SHA1

        d7e31b87866e5e383ab5499da64aba50f03e8443

        SHA256

        2d2f364c75bd2897504249f42cdf1d19374f5230aad68fa9154ea3d03e3031a6

        SHA512

        c34d10c7e07da44a180fae9889b61f08903aa84e8ddfa80c31c272b1ef9d491b8cec6b8a4c836c3cb1583fe8f4955c6a8db872515de3a9e10eae09610c959406

        Download Submit

      • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
        Filesize

        944B

        MD5

        3a6bad9528f8e23fb5c77fbd81fa28e8

        SHA1

        f127317c3bc6407f536c0f0600dcbcf1aabfba36

        SHA256

        986366767de5873f1b170a63f2a33ce05132d1afd90c8f5017afbca8ef1beb05

        SHA512

        846002154a0ece6f3e9feda6f115d3161dc21b3789525dd62ae1d9188495171293efdbe7be4710666dd8a15e66b557315b5a02918a741ed1d5f3ff0c515b98e2

        Download Submit

      • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
        Filesize

        944B

        MD5

        2e907f77659a6601fcc408274894da2e

        SHA1

        9f5b72abef1cd7145bf37547cdb1b9254b4efe9d

        SHA256

        385da35673330e21ac02545220552fe301fe54dedefbdafc097ac4342a295233

        SHA512

        34fa0fff24f6550f55f828541aaefe5d75c86f8f0842d54b50065e9746f9662bb7209c74c9a9571540b9855bb3851f01db613190024e89b198d485bb5dc07721

        Download Submit

      • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
        Filesize

        944B

        MD5

        3a5e1f1efff867a822c6a57ee928dd66

        SHA1

        b017854d8a1deb05f1447e9dd6002902fb66bf6b

        SHA256

        8222fe869b025493591ca2ffbabe089c2e682449e77b754fc864ba62d64ee957

        SHA512

        25fc0fd6a71595c44efe34d281c4bc4924ac82f76b9f697497d0019fa2c8e0cadf58f92ae4272f00b1ef1e97dfd93bd740a9e7f7d9dc93cb1cadbde5f93d1782

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\TRQhSFvIsZ.bat
        Filesize

        219B

        MD5

        bdc09336c101369368496635c6463d45

        SHA1

        8c47e9a86e9eeb50973837ccd39250ea6eb09256

        SHA256

        e81398d8a30ac6c48a50f6de696bd7c3e71302279fe9228f04cbd533497eaed8

        SHA512

        0a3ee82679c8abcfe38eb7441e4fac724aae9b864c0147c152bb3223be9a28413e2ad08c2d86865368a1a3509f53bc6d551ece6acb513cbc0b0b4606996c7984

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_lumif5np.ebv.ps1
        Filesize

        60B

        MD5

        d17fe0a3f47be24a6453e9ef58c94641

        SHA1

        6ab83620379fc69f80c0242105ddffd7d98d5d9d

        SHA256

        96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

        SHA512

        5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

        Download Submit

      • C:\Windows\RemotePackages\RemoteDesktops\SearchApp.exe
        Filesize

        670KB

        MD5

        3b5ade9251fb80480f559a9ced2e1c27

        SHA1

        b08a0ca54096c73aa41422c842ac6712757df349

        SHA256

        d637753d9c54f47cdb909039dc27a3abb5f85892cbd0e9094074f81a9852133d

        SHA512

        7232968032c7e061473d7ae9fe3fc8132a554aad803c445872ef19ff28b1c54a378a6a606055a15a3d8d3a6fde86496adc6012d4cff3167cd47c2e6553f4e49a

        Download Submit

      • C:\Windows\RemotePackages\RemoteDesktops\SearchApp.exe
        Filesize

        1.6MB

        MD5

        dcd6342ca7200ca25c2efd1e3d3edcd3

        SHA1

        f04839064f2f3c0d5aad9a32f9578c6d5dd859f6

        SHA256

        0b26d449b550c85a1c557e42026ec4e7f6a30ecaa48ec426deba02b72b517501

        SHA512

        dbbfcaccd64195b675d09e2d2fd6100f42b5641113635ac87ed9adb69913bc65d7d1f8843a2d42265989787ccd5b76fed66d544d26eb7b8c786e106dcd6b61d0

        Download Submit

      • C:\Windows\Resources\Ease of Access Themes\explorer.exe
        Filesize

        2.1MB

        MD5

        f4a675a3b47a85daa2e7905eba314760

        SHA1

        0e01e07ff8ed4ca94a1dcad2f2af26fd8cf431ba

        SHA256

        51b284bd1d8865e9d4fe9544c81882a7790a2ce32458249a25c9698329a0ea02

        SHA512

        d8a9cd69392fc775cef5d714128ca08a39a6a111e57ff248b64ba4126b89bbff4ca39bb5c117450e405619cefbec7ca01ad931c6ae7d9cb14c6d1822d478152d

        Download Submit

      • C:\Windows\Temp\MsEdgeCrashpad\reports\RuntimeBroker.exe
        Filesize

        2.1MB

        MD5

        cb3337d502d22aaebc85f011f9dab476

        SHA1

        d22cbb7232f0d71682c04b2dae9893b55c33f943

        SHA256

        dafa7cea4798c021c0cf1c385a9376dc8273d4e8eb4302e75c47f0614e0c8188

        SHA512

        7445585156f205e1af8589a622652611e04d4c70874a4a362695cff6eb0ac2ba8c423288616b37c65bf1a3b3640bb2d2ba06ece0518a79f12ac8acd6f96bf6e4

        Download Submit

      • memory/744-248-0x00007FFFAAD70000-0x00007FFFAB831000-memory.dmp

        Filesize

        10.8MB

        Download

      • memory/744-266-0x00007FFFAAD70000-0x00007FFFAB831000-memory.dmp

        Filesize

        10.8MB

        Download

      • memory/1416-276-0x00007FFFAAD70000-0x00007FFFAB831000-memory.dmp

        Filesize

        10.8MB

        Download

      • memory/1416-153-0x000002A4CF880000-0x000002A4CF8A2000-memory.dmp

        Filesize

        136KB

        Download

      • memory/1416-251-0x00007FFFAAD70000-0x00007FFFAB831000-memory.dmp

        Filesize

        10.8MB

        Download

      • memory/1416-132-0x000002A4B71D0000-0x000002A4B71E0000-memory.dmp

        Filesize

        64KB

        Download

      • memory/1416-131-0x000002A4B71D0000-0x000002A4B71E0000-memory.dmp

        Filesize

        64KB

        Download

      • memory/1704-24-0x000000001B9A0000-0x000000001B9AC000-memory.dmp

        Filesize

        48KB

        Download

      • memory/1704-12-0x000000001B660000-0x000000001B672000-memory.dmp

        Filesize

        72KB

        Download

      • memory/1704-26-0x000000001B9C0000-0x000000001B9CC000-memory.dmp

        Filesize

        48KB

        Download

      • memory/1704-25-0x000000001B9B0000-0x000000001B9BA000-memory.dmp

        Filesize

        40KB

        Download

      • memory/1704-19-0x000000001AF40000-0x000000001AF50000-memory.dmp

        Filesize

        64KB

        Download

      • memory/1704-22-0x000000001B980000-0x000000001B988000-memory.dmp

        Filesize

        32KB

        Download

      • memory/1704-21-0x000000001AF40000-0x000000001AF50000-memory.dmp

        Filesize

        64KB

        Download

      • memory/1704-20-0x000000001B960000-0x000000001B96E000-memory.dmp

        Filesize

        56KB

        Download

      • memory/1704-43-0x000000001AF40000-0x000000001AF50000-memory.dmp

        Filesize

        64KB

        Download

      • memory/1704-18-0x000000001B910000-0x000000001B91C000-memory.dmp

        Filesize

        48KB

        Download

      • memory/1704-17-0x000000001B970000-0x000000001B978000-memory.dmp

        Filesize

        32KB

        Download

      • memory/1704-16-0x000000001B700000-0x000000001B70C000-memory.dmp

        Filesize

        48KB

        Download

      • memory/1704-15-0x000000001B6F0000-0x000000001B6FC000-memory.dmp

        Filesize

        48KB

        Download

      • memory/1704-14-0x000000001B690000-0x000000001B69C000-memory.dmp

        Filesize

        48KB

        Download

      • memory/1704-13-0x000000001BC20000-0x000000001C148000-memory.dmp

        Filesize

        5.2MB

        Download

      • memory/1704-23-0x000000001B990000-0x000000001B99E000-memory.dmp

        Filesize

        56KB

        Download

      • memory/1704-135-0x00007FFFAAD70000-0x00007FFFAB831000-memory.dmp

        Filesize

        10.8MB

        Download

      • memory/1704-0-0x0000000000190000-0x00000000003A6000-memory.dmp

        Filesize

        2.1MB

        Download

      • memory/1704-11-0x000000001B650000-0x000000001B65C000-memory.dmp

        Filesize

        48KB

        Download

      • memory/1704-10-0x000000001AF30000-0x000000001AF40000-memory.dmp

        Filesize

        64KB

        Download

      • memory/1704-9-0x000000001AF10000-0x000000001AF26000-memory.dmp

        Filesize

        88KB

        Download

      • memory/1704-8-0x000000001AF00000-0x000000001AF10000-memory.dmp

        Filesize

        64KB

        Download

      • memory/1704-7-0x000000001B6A0000-0x000000001B6F0000-memory.dmp

        Filesize

        320KB

        Download

      • memory/1704-6-0x000000001AEE0000-0x000000001AEFC000-memory.dmp

        Filesize

        112KB

        Download

      • memory/1704-5-0x000000001AED0000-0x000000001AED8000-memory.dmp

        Filesize

        32KB

        Download

      • memory/1704-4-0x000000001AEC0000-0x000000001AECE000-memory.dmp

        Filesize

        56KB

        Download

      • memory/1704-3-0x00000000024D0000-0x00000000024DE000-memory.dmp

        Filesize

        56KB

        Download

      • memory/1704-2-0x000000001AF40000-0x000000001AF50000-memory.dmp

        Filesize

        64KB

        Download

      • memory/1704-1-0x00007FFFAAD70000-0x00007FFFAB831000-memory.dmp

        Filesize

        10.8MB

        Download

      • memory/3224-136-0x000002B2B4950000-0x000002B2B4960000-memory.dmp

        Filesize

        64KB

        Download

      • memory/3224-134-0x00007FFFAAD70000-0x00007FFFAB831000-memory.dmp

        Filesize

        10.8MB

        Download

      • memory/3224-272-0x00007FFFAAD70000-0x00007FFFAB831000-memory.dmp

        Filesize

        10.8MB

        Download

      • memory/3340-255-0x00007FFFAAD70000-0x00007FFFAB831000-memory.dmp

        Filesize

        10.8MB

        Download

      • memory/3340-256-0x00000271B3430000-0x00000271B3440000-memory.dmp

        Filesize

        64KB

        Download

      • memory/3692-253-0x000001AAF99B0000-0x000001AAF99C0000-memory.dmp

        Filesize

        64KB

        Download

      • memory/3692-215-0x00007FFFAAD70000-0x00007FFFAB831000-memory.dmp

        Filesize

        10.8MB

        Download

      • memory/4376-257-0x000001F129D30000-0x000001F129D40000-memory.dmp

        Filesize

        64KB

        Download

      • memory/4376-245-0x000001F129D30000-0x000001F129D40000-memory.dmp

        Filesize

        64KB

        Download

      • memory/4376-240-0x00007FFFAAD70000-0x00007FFFAB831000-memory.dmp

        Filesize

        10.8MB

        Download

      • memory/4376-246-0x000001F129D30000-0x000001F129D40000-memory.dmp

        Filesize

        64KB

        Download

      • memory/4400-194-0x000002DDD82C0000-0x000002DDD82D0000-memory.dmp

        Filesize

        64KB

        Download

      • memory/4400-283-0x00007FFFAAD70000-0x00007FFFAB831000-memory.dmp

        Filesize

        10.8MB

        Download

      • memory/4400-192-0x00007FFFAAD70000-0x00007FFFAB831000-memory.dmp

        Filesize

        10.8MB

        Download

      • memory/4476-260-0x00007FFFAAD70000-0x00007FFFAB831000-memory.dmp

        Filesize

        10.8MB

        Download

      • memory/4476-146-0x00007FFFAAD70000-0x00007FFFAB831000-memory.dmp

        Filesize

        10.8MB

        Download

      • memory/4476-158-0x00000252A64D0000-0x00000252A64E0000-memory.dmp

        Filesize

        64KB

        Download

      • memory/4476-147-0x00000252A64D0000-0x00000252A64E0000-memory.dmp

        Filesize

        64KB

        Download

      • memory/4488-252-0x00007FFFAAD70000-0x00007FFFAB831000-memory.dmp

        Filesize

        10.8MB

        Download

      • memory/4488-177-0x000002A1ED9D0000-0x000002A1ED9E0000-memory.dmp

        Filesize

        64KB

        Download

      • memory/4488-275-0x00007FFFAAD70000-0x00007FFFAB831000-memory.dmp

        Filesize

        10.8MB

        Download

      • memory/4520-250-0x0000028CE9110000-0x0000028CE9120000-memory.dmp

        Filesize

        64KB

        Download

      • memory/4520-249-0x00007FFFAAD70000-0x00007FFFAB831000-memory.dmp

        Filesize

        10.8MB

        Download

      • memory/4520-254-0x0000028CE9110000-0x0000028CE9120000-memory.dmp

        Filesize

        64KB

        Download

      • memory/4684-271-0x00007FFFAAD70000-0x00007FFFAB831000-memory.dmp

        Filesize

        10.8MB

        Download

      • memory/4684-130-0x00000221E2010000-0x00000221E2020000-memory.dmp

        Filesize

        64KB

        Download

      • memory/4684-129-0x00000221E2010000-0x00000221E2020000-memory.dmp

        Filesize

        64KB

        Download

      • memory/4684-128-0x00007FFFAAD70000-0x00007FFFAB831000-memory.dmp

        Filesize

        10.8MB

        Download