Analysis

  • max time kernel
    2643s
  • max time network
    2699s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240419-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
  • submitted
    03/05/2024, 11:07

General

  • Target

    dcrat.rar

  • Size

    47.3MB

  • MD5

    01821717f0eeec608936e4db3cb2f375

  • SHA1

    4c8245e1064bdfcb3584b64d35bee26f2c30aaa5

  • SHA256

    60064a5d97f4ac6fafa5fdc364f29e22711bf1edd6b86696b4fbad4b1edb1416

  • SHA512

    d9546d11c0677ab51e7f4558f1d5278743b4dadec5124a431d5f4390efe7501141896df4f3232f59edafd41a727bd0a513fb3ff0133228b24190e7e567a18f42

  • SSDEEP

    786432:fw29TvT1KFDG8c9c6uLJVAW1knaOyYu/Rh5OJpAZXx0UHQ6MwH:fDVvT1KhEbIJVR/4exgg

Malware Config

Signatures

  • Detect ZGRat V1 1 IoCs
  • Process spawned unexpected child process 6 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • ZGRat

    ZGRat is remote access trojan written in C#.

  • Command and Scripting Interpreter: PowerShell 1 TTPs 14 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

  • Disables Task Manager via registry modification
  • Checks computer location settings 2 TTPs 3 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 15 IoCs
  • Loads dropped DLL 1 IoCs
  • Modifies file permissions 1 TTPs 1 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Drops file in Program Files directory 24 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Checks processor information in registry 2 TTPs 14 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Creates scheduled task(s) 1 TTPs 6 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Modifies registry class 5 IoCs
  • Modifies registry key 1 TTPs 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 23 IoCs
  • Suspicious use of SendNotifyMessage 20 IoCs
  • Suspicious use of SetWindowsHookEx 27 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Windows\system32\cmd.exe
    cmd /c C:\Users\Admin\AppData\Local\Temp\dcrat.rar
    1⤵
    • Modifies registry class
    PID:4308
  • C:\Windows\system32\OpenWith.exe
    C:\Windows\system32\OpenWith.exe -Embedding
    1⤵
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:5096
    • C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url "C:\Users\Admin\AppData\Local\Temp\dcrat.rar"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:4016
      • C:\Program Files\Mozilla Firefox\firefox.exe
        "C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url C:\Users\Admin\AppData\Local\Temp\dcrat.rar
        3⤵
        • Checks processor information in registry
        • Modifies registry class
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:116
        • C:\Program Files\Mozilla Firefox\firefox.exe
          "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2000 -parentBuildID 20240401114208 -prefsHandle 1916 -prefMapHandle 1908 -prefsLen 25457 -prefMapSize 244658 -appDir "C:\Program Files\Mozilla Firefox\browser" - {4394788a-3930-443e-a3bd-973cac0a9bc1} 116 "\\.\pipe\gecko-crash-server-pipe.116" gpu
          4⤵
            PID:3248
          • C:\Program Files\Mozilla Firefox\firefox.exe
            "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2432 -parentBuildID 20240401114208 -prefsHandle 2416 -prefMapHandle 2412 -prefsLen 26377 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {ac31b22a-9310-437d-bb86-bcf112cafb88} 116 "\\.\pipe\gecko-crash-server-pipe.116" socket
            4⤵
              PID:4912
            • C:\Program Files\Mozilla Firefox\firefox.exe
              "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3256 -childID 1 -isForBrowser -prefsHandle 3112 -prefMapHandle 3136 -prefsLen 26518 -prefMapSize 244658 -jsInitHandle 1012 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {7a8671db-699c-4ac9-8296-793ff131a341} 116 "\\.\pipe\gecko-crash-server-pipe.116" tab
              4⤵
                PID:2976
              • C:\Program Files\Mozilla Firefox\firefox.exe
                "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3912 -childID 2 -isForBrowser -prefsHandle 3888 -prefMapHandle 3896 -prefsLen 30867 -prefMapSize 244658 -jsInitHandle 1012 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {db22b6d8-e44d-495c-ba99-87d341f25a38} 116 "\\.\pipe\gecko-crash-server-pipe.116" tab
                4⤵
                  PID:3752
                • C:\Program Files\Mozilla Firefox\firefox.exe
                  "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5008 -parentBuildID 20240401114208 -sandboxingKind 0 -prefsHandle 4992 -prefMapHandle 5016 -prefsLen 31000 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {216ae58c-c135-4fb2-be0d-6e68c262c89c} 116 "\\.\pipe\gecko-crash-server-pipe.116" utility
                  4⤵
                  • Checks processor information in registry
                  PID:5592
                • C:\Program Files\Mozilla Firefox\firefox.exe
                  "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5368 -childID 3 -isForBrowser -prefsHandle 5384 -prefMapHandle 5312 -prefsLen 27097 -prefMapSize 244658 -jsInitHandle 1012 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {c7d054f1-48fe-4714-a311-96f835207fa5} 116 "\\.\pipe\gecko-crash-server-pipe.116" tab
                  4⤵
                    PID:6076
                  • C:\Program Files\Mozilla Firefox\firefox.exe
                    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5600 -childID 4 -isForBrowser -prefsHandle 5520 -prefMapHandle 5524 -prefsLen 27097 -prefMapSize 244658 -jsInitHandle 1012 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {b22177f7-1022-481b-a169-9a5418902714} 116 "\\.\pipe\gecko-crash-server-pipe.116" tab
                    4⤵
                      PID:6100
                    • C:\Program Files\Mozilla Firefox\firefox.exe
                      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5788 -childID 5 -isForBrowser -prefsHandle 5708 -prefMapHandle 5712 -prefsLen 27097 -prefMapSize 244658 -jsInitHandle 1012 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {324a2d4d-00a5-4a44-9f33-6c3a95d17f2c} 116 "\\.\pipe\gecko-crash-server-pipe.116" tab
                      4⤵
                        PID:6112
                • C:\Program Files\Mozilla Firefox\firefox.exe
                  "C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url "C:\Users\Admin\Downloads\dcrat.rar"
                  1⤵
                    PID:3508
                    • C:\Program Files\Mozilla Firefox\firefox.exe
                      "C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url C:\Users\Admin\Downloads\dcrat.rar
                      2⤵
                      • Checks processor information in registry
                      PID:4588
                  • C:\Program Files\7-Zip\7zFM.exe
                    "C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\Downloads\dcrat.rar"
                    1⤵
                    • Suspicious use of AdjustPrivilegeToken
                    • Suspicious use of FindShellTrayWindow
                    PID:5948
                  • C:\Windows\System32\rundll32.exe
                    C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
                    1⤵
                      PID:2692
                    • C:\Users\Admin\Desktop\dcrat\DCRat.exe
                      "C:\Users\Admin\Desktop\dcrat\DCRat.exe"
                      1⤵
                      • Executes dropped EXE
                      PID:6124
                      • C:\Program Files\Java\jre-1.8\bin\javaw.exe
                        "C:\Program Files\Java\jre-1.8\bin\javaw.exe" -Dprism.dirtyopts=false -Dfile.encoding=UTF-8 -classpath "lib\.;lib\..;lib\IIIllllIlIlllIlIIIIlllIlIlIlllllIIIlIIllllIIIlIllIIlIIllllIIllllllIIlIIIIIIlllIIIlIllllllIIllIlIllIlllIllIlIIIIIIIIllllI.jar;lib\IIIllllIlIlllIlIIIIlllIlIlIlllllIIIlIIllllIIIlIllIIlIIllllIIllllllIIlIIIIIIlllIIIlIllllllIIllIlIllIlllIllIlIIIIIIIIllllIIilIl.jar;lib\IIlIlIllIIlIIllIIllIIlIIIllIlIlIlIIIIlIlIllIIlIIllIIIIIllIIIIlIIIlIIlIIlIIlIllIIlllIIIllIIIlIIlIllllIllIIIIlIIIlIllllllI.jar;lib\IlIIlIllllIIIIIlIlllIllIlIlIIIIIlIIIlIlIlllIIllIllIIIIIIlIIlllIIIlIIIlllIIIlllllIlIlIlllllIIlIllIIlIIlIIlIIIlllllllIlIII.jar;lib\IlIlIIIIIIIlIlllllllIllIIlIIllIllllIIIlIIIlIlIIlIIlIIlIllIlllIlIlIIllIIlIIIIIIIlIIIIIIIIIlIlllIIllIlIIlIIIlIlIlllIIIIIIl.jar;lib\IlIllIIllllllllIlIIlllllIIIIllIIIlIIlllIIllIIllllIIllIlIIIlIIIIlIIIIIlllllllIllIIlIlIllIIlIlIlIIllIlIllIIIlIIIIlIllIIIIl.jar;lib\IllIIIIllIlIIIIlIlIllIIlIIllIIlIllIIlllllIlllIllIlIIlIIlllIIlIlIlIllIllIIlIIIlIIIllIIIIIllIIlllllIlIIIIIlIIIIIIIIIIIIlII.jar;lib\lIIllIIlIlllIlIlllIlIIlIIIlllllIIlIlIIllIllIlIlllIlIIlIlIlIIllIlIIIIIllIIlIIlIIlIIllIIIlIIllIlIIIIlIlIIlIIlIllIIlIIlIlIl.jar;lib\llIlIIIIlIlIlllllIlIIllllIIIlIlIllllIIllllIlllIIlllllIIlIlllIIIIIIlIIllIIIlIlIlllIlIIIlIIIIIllIlllIlllIIllIIllIlIlIIlllI.jar;lib\llIlIlIIIllllIIIllllllllllIllIlIlllIIlllIIlllIIllIIllllIlllIIIIIllllIIlllIIllIIIIlIlIlIlIIIlIIIlIlIlIlIIlllIIlllIlIlIlII.jar;lib\lllIIlIlIIlIIllllIIllllIIlIllllIIIlIllllIIllIIIlllIIIIIIlIIlllIIllIllIIlllIlIIlIlIlllIIlllIlllIlIIlIIIllIlllIIIlIIIIIlll.jar;lib\lllIlIIIIIlIllIlIlIIllIlIIIlIIllIllllIIIIIllIlllIllIIllIIllIllIllIIlIlllllIIlIllIllIIlIIlIIIllIlIlIIlIIIIIIIllIIlllIllIl.jar;lib\llllIlIIIIIllllIlIIIlIllIlIIIllllIIIllIllllIIlllIlIIIlllIIlIlIlllIIlIIIIlIIIIlllIIlIIlIlIIIIIIIIllllIllIlIIIlIllIlIlIIll.jar;lib\llllIlIIlIllllIlIlIIIlIIIlIllIlIIIIlIlIIlIlIIIIllIIlIIllIIIllllIlIllIlllllIIIIIIIIllIllIlIlllllllIllIIIllllIIllIIlIllIll.jar" org.develnext.jphp.ext.javafx.FXLauncher
                        2⤵
                        • Suspicious use of SetWindowsHookEx
                        PID:5528
                        • C:\Windows\system32\icacls.exe
                          C:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M
                          3⤵
                          • Modifies file permissions
                          PID:1612
                        • C:\Windows\System32\cmd.exe
                          C:\Windows\System32\cmd.exe /c C:\Windows\System32\wbem\wmic.exe baseboard get Manufac ��
                          3⤵
                            PID:5304
                            • C:\Windows\System32\wbem\WMIC.exe
                              C:\Windows\System32\wbem\wmic.exe baseboard get Manufac
                              4⤵
                              • Suspicious use of AdjustPrivilegeToken
                              PID:4808
                          • C:\Windows\System32\cmd.exe
                            C:\Windows\System32\cmd.exe /c USERPR ��
                            3⤵
                              PID:1436
                            • C:\Windows\System32\cmd.exe
                              C:\Windows\System32\cmd.exe /c C:\Windows\System32\wbem\wmic.exe baseboap��3���
                              3⤵
                                PID:5976
                                • C:\Windows\System32\wbem\WMIC.exe
                                  C:\Windows\System32\wbem\wmic.exe baseboap��3���
                                  4⤵
                                  • Suspicious use of AdjustPrivilegeToken
                                  PID:5196
                              • C:\Windows\System32\cmd.exe
                                C:\Windows\System32\cmd.exe /c C:\Windows\System32\wbem\wmic.exe CPU get Proc ��8�Y
                                3⤵
                                  PID:5172
                                  • C:\Windows\System32\wbem\WMIC.exe
                                    C:\Windows\System32\wbem\wmic.exe CPU get Proc
                                    4⤵
                                      PID:1852
                                  • C:\Windows\System32\cmd.exe
                                    C:\Windows\System32\cmd.exe /c C:\Windows\System32\wbem\wmic.exe diskdrive where "'Index*'L��] ��\�X[�[X�\\"
                                    3⤵
                                      PID:5700
                                      • C:\Windows\System32\wbem\WMIC.exe
                                        C:\Windows\System32\wbem\wmic.exe diskdrive where "'Index*'L��] ��\�X[�[X�\\"
                                        4⤵
                                          PID:5908
                                      • C:\Windows\System32\cmd.exe
                                        C:\Windows\System32\cmd.exe /c C:\Windows\System32\wbem\wmic.exe Path Win32_VideoConp��3�\��]�Y[����\�
                                        3⤵
                                          PID:5572
                                          • C:\Windows\System32\wbem\WMIC.exe
                                            C:\Windows\System32\wbem\wmic.exe Path Win32_VideoConp��3�\��]�Y[����\�
                                            4⤵
                                              PID:2108
                                          • C:\Windows\System32\cmd.exe
                                            C:\Windows\System32\cmd.exe /c C:\Windows\System32\wbem\wmic.exe diskdrive where "'Il*'L����] ��^"
                                            3⤵
                                              PID:1036
                                              • C:\Windows\System32\wbem\WMIC.exe
                                                C:\Windows\System32\wbem\wmic.exe diskdrive where "'Il*'L����] ��^"
                                                4⤵
                                                  PID:5924
                                          • C:\Windows\system32\cmd.exe
                                            C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Desktop\dcrat\123.bat" "
                                            1⤵
                                              PID:6108
                                              • C:\Users\Admin\Desktop\dcrat\DCRat.exe
                                                DCRat.exe
                                                2⤵
                                                • Executes dropped EXE
                                                PID:5412
                                                • C:\Program Files\Java\jre-1.8\bin\javaw.exe
                                                  "C:\Program Files\Java\jre-1.8\bin\javaw.exe" -Dprism.dirtyopts=false -Dfile.encoding=UTF-8 -classpath "lib\.;lib\..;lib\IIIllllIlIlllIlIIIIlllIlIlIlllllIIIlIIllllIIIlIllIIlIIllllIIllllllIIlIIIIIIlllIIIlIllllllIIllIlIllIlllIllIlIIIIIIIIllllI.jar;lib\IIIllllIlIlllIlIIIIlllIlIlIlllllIIIlIIllllIIIlIllIIlIIllllIIllllllIIlIIIIIIlllIIIlIllllllIIllIlIllIlllIllIlIIIIIIIIllllIIilIl.jar;lib\IIlIlIllIIlIIllIIllIIlIIIllIlIlIlIIIIlIlIllIIlIIllIIIIIllIIIIlIIIlIIlIIlIIlIllIIlllIIIllIIIlIIlIllllIllIIIIlIIIlIllllllI.jar;lib\IlIIlIllllIIIIIlIlllIllIlIlIIIIIlIIIlIlIlllIIllIllIIIIIIlIIlllIIIlIIIlllIIIlllllIlIlIlllllIIlIllIIlIIlIIlIIIlllllllIlIII.jar;lib\IlIlIIIIIIIlIlllllllIllIIlIIllIllllIIIlIIIlIlIIlIIlIIlIllIlllIlIlIIllIIlIIIIIIIlIIIIIIIIIlIlllIIllIlIIlIIIlIlIlllIIIIIIl.jar;lib\IlIllIIllllllllIlIIlllllIIIIllIIIlIIlllIIllIIllllIIllIlIIIlIIIIlIIIIIlllllllIllIIlIlIllIIlIlIlIIllIlIllIIIlIIIIlIllIIIIl.jar;lib\IllIIIIllIlIIIIlIlIllIIlIIllIIlIllIIlllllIlllIllIlIIlIIlllIIlIlIlIllIllIIlIIIlIIIllIIIIIllIIlllllIlIIIIIlIIIIIIIIIIIIlII.jar;lib\lIIllIIlIlllIlIlllIlIIlIIIlllllIIlIlIIllIllIlIlllIlIIlIlIlIIllIlIIIIIllIIlIIlIIlIIllIIIlIIllIlIIIIlIlIIlIIlIllIIlIIlIlIl.jar;lib\llIlIIIIlIlIlllllIlIIllllIIIlIlIllllIIllllIlllIIlllllIIlIlllIIIIIIlIIllIIIlIlIlllIlIIIlIIIIIllIlllIlllIIllIIllIlIlIIlllI.jar;lib\llIlIlIIIllllIIIllllllllllIllIlIlllIIlllIIlllIIllIIllllIlllIIIIIllllIIlllIIllIIIIlIlIlIlIIIlIIIlIlIlIlIIlllIIlllIlIlIlII.jar;lib\lllIIlIlIIlIIllllIIllllIIlIllllIIIlIllllIIllIIIlllIIIIIIlIIlllIIllIllIIlllIlIIlIlIlllIIlllIlllIlIIlIIIllIlllIIIlIIIIIlll.jar;lib\lllIlIIIIIlIllIlIlIIllIlIIIlIIllIllllIIIIIllIlllIllIIllIIllIllIllIIlIlllllIIlIllIllIIlIIlIIIllIlIlIIlIIIIIIIllIIlllIllIl.jar;lib\llllIlIIIIIllllIlIIIlIllIlIIIllllIIIllIllllIIlllIlIIIlllIIlIlIlllIIlIIIIlIIIIlllIIlIIlIlIIIIIIIIllllIllIlIIIlIllIlIlIIll.jar;lib\llllIlIIlIllllIlIlIIIlIIIlIllIlIIIIlIlIIlIlIIIIllIIlIIllIIIllllIlIllIlllllIIIIIIIIllIllIlIlllllllIllIIIllllIIllIIlIllIll.jar" org.develnext.jphp.ext.javafx.FXLauncher
                                                  3⤵
                                                  • Drops file in Program Files directory
                                                  • Suspicious use of SetWindowsHookEx
                                                  PID:3900
                                                  • C:\Windows\System32\cmd.exe
                                                    C:\Windows\System32\cmd.exe /c C:\Windows\System32\wbem\wmic.exe baseboard get Manufac ��
                                                    4⤵
                                                      PID:1504
                                                      • C:\Windows\System32\wbem\WMIC.exe
                                                        C:\Windows\System32\wbem\wmic.exe baseboard get Manufac
                                                        5⤵
                                                          PID:4136
                                                      • C:\Windows\System32\cmd.exe
                                                        C:\Windows\System32\cmd.exe /c USERPR ��
                                                        4⤵
                                                          PID:4276
                                                        • C:\Windows\System32\cmd.exe
                                                          C:\Windows\System32\cmd.exe /c C:\Windows\System32\wbem\wmic.exe baseboap��3���
                                                          4⤵
                                                            PID:5868
                                                            • C:\Windows\System32\wbem\WMIC.exe
                                                              C:\Windows\System32\wbem\wmic.exe baseboap��3���
                                                              5⤵
                                                                PID:4416
                                                            • C:\Windows\System32\cmd.exe
                                                              C:\Windows\System32\cmd.exe /c C:\Windows\System32\wbem\wmic.exe CPU get Proc ��8�Y
                                                              4⤵
                                                                PID:2440
                                                                • C:\Windows\System32\wbem\WMIC.exe
                                                                  C:\Windows\System32\wbem\wmic.exe CPU get Proc
                                                                  5⤵
                                                                    PID:5928
                                                                • C:\Windows\System32\cmd.exe
                                                                  C:\Windows\System32\cmd.exe /c C:\Windows\System32\wbem\wmic.exe diskdrive where "'Index*'L��] ��\�X[�[X�\\"
                                                                  4⤵
                                                                    PID:5872
                                                                    • C:\Windows\System32\wbem\WMIC.exe
                                                                      C:\Windows\System32\wbem\wmic.exe diskdrive where "'Index*'L��] ��\�X[�[X�\\"
                                                                      5⤵
                                                                        PID:6032
                                                                    • C:\Windows\System32\cmd.exe
                                                                      C:\Windows\System32\cmd.exe /c C:\Windows\System32\wbem\wmic.exe Path Win32_VideoConp��3�\��]�Y[����\�
                                                                      4⤵
                                                                        PID:3968
                                                                        • C:\Windows\System32\wbem\WMIC.exe
                                                                          C:\Windows\System32\wbem\wmic.exe Path Win32_VideoConp��3�\��]�Y[����\�
                                                                          5⤵
                                                                            PID:3376
                                                                        • C:\Windows\System32\cmd.exe
                                                                          C:\Windows\System32\cmd.exe /c C:\Windows\System32\wbem\wmic.exe diskdrive where "'Il*'L����] ��^"
                                                                          4⤵
                                                                            PID:4440
                                                                            • C:\Windows\System32\wbem\WMIC.exe
                                                                              C:\Windows\System32\wbem\wmic.exe diskdrive where "'Il*'L����] ��^"
                                                                              5⤵
                                                                                PID:2764
                                                                        • C:\Users\Admin\Desktop\dcrat\php\DCRatConnectService.exe
                                                                          php\DCRatConnectService.exe
                                                                          2⤵
                                                                          • Checks computer location settings
                                                                          • Executes dropped EXE
                                                                          • Modifies registry class
                                                                          PID:2356
                                                                          • C:\Windows\SysWOW64\WScript.exe
                                                                            "C:\Windows\System32\WScript.exe" "C:\System\lWwpVq7gHuwgO81vQqwqHneiJIBDuFSKSYTTmU6Tq3dRBEEEDwB9.vbe"
                                                                            3⤵
                                                                            • Checks computer location settings
                                                                            PID:4908
                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                              C:\Windows\system32\cmd.exe /c ""C:\System\unOUSLOLRRxkAR2qU1kiiuwS6WvSqNn.bat" "
                                                                              4⤵
                                                                                PID:5392
                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f
                                                                                  5⤵
                                                                                  • Modifies registry key
                                                                                  PID:5692
                                                                                • C:\System\mbr.exe
                                                                                  "C:\System/mbr.exe"
                                                                                  5⤵
                                                                                  • Checks computer location settings
                                                                                  • Executes dropped EXE
                                                                                  • Modifies registry class
                                                                                  • Suspicious behavior: EnumeratesProcesses
                                                                                  PID:4460
                                                                                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                    "powershell" -Command Add-MpPreference -ExclusionPath 'C:/'
                                                                                    6⤵
                                                                                    • Command and Scripting Interpreter: PowerShell
                                                                                    PID:752
                                                                                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                    "powershell" -Command Add-MpPreference -ExclusionPath 'C:/$Recycle.Bin/'
                                                                                    6⤵
                                                                                    • Command and Scripting Interpreter: PowerShell
                                                                                    PID:2028
                                                                                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                    "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Documents and Settings/'
                                                                                    6⤵
                                                                                    • Command and Scripting Interpreter: PowerShell
                                                                                    PID:2644
                                                                                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                    "powershell" -Command Add-MpPreference -ExclusionPath 'C:/PerfLogs/'
                                                                                    6⤵
                                                                                    • Command and Scripting Interpreter: PowerShell
                                                                                    PID:4932
                                                                                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                    "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files/'
                                                                                    6⤵
                                                                                    • Command and Scripting Interpreter: PowerShell
                                                                                    PID:3180
                                                                                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                    "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files (x86)/'
                                                                                    6⤵
                                                                                    • Command and Scripting Interpreter: PowerShell
                                                                                    PID:1652
                                                                                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                    "powershell" -Command Add-MpPreference -ExclusionPath 'C:/ProgramData/'
                                                                                    6⤵
                                                                                    • Command and Scripting Interpreter: PowerShell
                                                                                    PID:2580
                                                                                    • C:\Windows\System32\Conhost.exe
                                                                                      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                      7⤵
                                                                                        PID:2764
                                                                                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                      "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Recovery/'
                                                                                      6⤵
                                                                                      • Command and Scripting Interpreter: PowerShell
                                                                                      PID:1392
                                                                                      • C:\Windows\System32\Conhost.exe
                                                                                        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                        7⤵
                                                                                          PID:3376
                                                                                      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                        "powershell" -Command Add-MpPreference -ExclusionPath 'C:/System/'
                                                                                        6⤵
                                                                                        • Command and Scripting Interpreter: PowerShell
                                                                                        PID:5228
                                                                                        • C:\Windows\System32\Conhost.exe
                                                                                          \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                          7⤵
                                                                                            PID:5928
                                                                                        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                          "powershell" -Command Add-MpPreference -ExclusionPath 'C:/System Volume Information/'
                                                                                          6⤵
                                                                                          • Command and Scripting Interpreter: PowerShell
                                                                                          PID:5248
                                                                                          • C:\Windows\System32\Conhost.exe
                                                                                            \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                            7⤵
                                                                                              PID:6032
                                                                                          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                            "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Users/'
                                                                                            6⤵
                                                                                            • Command and Scripting Interpreter: PowerShell
                                                                                            PID:5272
                                                                                          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                            "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Windows/'
                                                                                            6⤵
                                                                                            • Command and Scripting Interpreter: PowerShell
                                                                                            PID:3720
                                                                                          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\{hck3dbitch}\hck3d\mbr.exe\OfficeClickToRun.exe'
                                                                                            6⤵
                                                                                            • Command and Scripting Interpreter: PowerShell
                                                                                            PID:5800
                                                                                          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\System\mbr.exe'
                                                                                            6⤵
                                                                                            • Command and Scripting Interpreter: PowerShell
                                                                                            PID:5196
                                                                                          • C:\Windows\System32\cmd.exe
                                                                                            "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\QT3Ue8RpoK.bat"
                                                                                            6⤵
                                                                                              PID:4672
                                                                                              • C:\Windows\system32\chcp.com
                                                                                                chcp 65001
                                                                                                7⤵
                                                                                                  PID:7100
                                                                                                • C:\Windows\system32\w32tm.exe
                                                                                                  w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                                                                                                  7⤵
                                                                                                    PID:6408
                                                                                                  • C:\System\mbr.exe
                                                                                                    "C:\System\mbr.exe"
                                                                                                    7⤵
                                                                                                    • Executes dropped EXE
                                                                                                    • Suspicious behavior: GetForegroundWindowSpam
                                                                                                    PID:6940
                                                                                        • C:\Users\Admin\Desktop\dcrat\php\php.exe
                                                                                          php -S 127.0.0.1:8000 -t ..\server
                                                                                          2⤵
                                                                                          • Executes dropped EXE
                                                                                          • Loads dropped DLL
                                                                                          PID:668
                                                                                      • C:\Windows\system32\schtasks.exe
                                                                                        schtasks.exe /create /tn "OfficeClickToRunO" /sc MINUTE /mo 13 /tr "'C:\Users\{hck3dbitch}\hck3d\mbr.exe\OfficeClickToRun.exe'" /f
                                                                                        1⤵
                                                                                        • Process spawned unexpected child process
                                                                                        • Creates scheduled task(s)
                                                                                        PID:2852
                                                                                      • C:\Windows\system32\schtasks.exe
                                                                                        schtasks.exe /create /tn "OfficeClickToRun" /sc ONLOGON /tr "'C:\Users\{hck3dbitch}\hck3d\mbr.exe\OfficeClickToRun.exe'" /rl HIGHEST /f
                                                                                        1⤵
                                                                                        • Process spawned unexpected child process
                                                                                        • Creates scheduled task(s)
                                                                                        PID:1452
                                                                                      • C:\Windows\system32\schtasks.exe
                                                                                        schtasks.exe /create /tn "OfficeClickToRunO" /sc MINUTE /mo 11 /tr "'C:\Users\{hck3dbitch}\hck3d\mbr.exe\OfficeClickToRun.exe'" /rl HIGHEST /f
                                                                                        1⤵
                                                                                        • Process spawned unexpected child process
                                                                                        • Creates scheduled task(s)
                                                                                        PID:5724
                                                                                      • C:\Windows\system32\schtasks.exe
                                                                                        schtasks.exe /create /tn "mbrm" /sc MINUTE /mo 13 /tr "'C:\System\mbr.exe'" /f
                                                                                        1⤵
                                                                                        • Process spawned unexpected child process
                                                                                        • Creates scheduled task(s)
                                                                                        PID:5832
                                                                                      • C:\Windows\system32\schtasks.exe
                                                                                        schtasks.exe /create /tn "mbr" /sc ONLOGON /tr "'C:\System\mbr.exe'" /rl HIGHEST /f
                                                                                        1⤵
                                                                                        • Process spawned unexpected child process
                                                                                        • Creates scheduled task(s)
                                                                                        PID:5932
                                                                                      • C:\Windows\system32\schtasks.exe
                                                                                        schtasks.exe /create /tn "mbrm" /sc MINUTE /mo 8 /tr "'C:\System\mbr.exe'" /rl HIGHEST /f
                                                                                        1⤵
                                                                                        • Process spawned unexpected child process
                                                                                        • Creates scheduled task(s)
                                                                                        PID:3836
                                                                                      • C:\Users\Admin\Desktop\dcrat\DCRat.exe
                                                                                        "C:\Users\Admin\Desktop\dcrat\DCRat.exe"
                                                                                        1⤵
                                                                                        • Executes dropped EXE
                                                                                        PID:6376
                                                                                        • C:\Program Files\Java\jre-1.8\bin\javaw.exe
                                                                                          "C:\Program Files\Java\jre-1.8\bin\javaw.exe" -Dprism.dirtyopts=false -Dfile.encoding=UTF-8 -classpath "lib\.;lib\..;lib\IIIllllIlIlllIlIIIIlllIlIlIlllllIIIlIIllllIIIlIllIIlIIllllIIllllllIIlIIIIIIlllIIIlIllllllIIllIlIllIlllIllIlIIIIIIIIllllI.jar;lib\IIIllllIlIlllIlIIIIlllIlIlIlllllIIIlIIllllIIIlIllIIlIIllllIIllllllIIlIIIIIIlllIIIlIllllllIIllIlIllIlllIllIlIIIIIIIIllllIIilIl.jar;lib\IIlIlIllIIlIIllIIllIIlIIIllIlIlIlIIIIlIlIllIIlIIllIIIIIllIIIIlIIIlIIlIIlIIlIllIIlllIIIllIIIlIIlIllllIllIIIIlIIIlIllllllI.jar;lib\IlIIlIllllIIIIIlIlllIllIlIlIIIIIlIIIlIlIlllIIllIllIIIIIIlIIlllIIIlIIIlllIIIlllllIlIlIlllllIIlIllIIlIIlIIlIIIlllllllIlIII.jar;lib\IlIlIIIIIIIlIlllllllIllIIlIIllIllllIIIlIIIlIlIIlIIlIIlIllIlllIlIlIIllIIlIIIIIIIlIIIIIIIIIlIlllIIllIlIIlIIIlIlIlllIIIIIIl.jar;lib\IlIllIIllllllllIlIIlllllIIIIllIIIlIIlllIIllIIllllIIllIlIIIlIIIIlIIIIIlllllllIllIIlIlIllIIlIlIlIIllIlIllIIIlIIIIlIllIIIIl.jar;lib\IllIIIIllIlIIIIlIlIllIIlIIllIIlIllIIlllllIlllIllIlIIlIIlllIIlIlIlIllIllIIlIIIlIIIllIIIIIllIIlllllIlIIIIIlIIIIIIIIIIIIlII.jar;lib\lIIllIIlIlllIlIlllIlIIlIIIlllllIIlIlIIllIllIlIlllIlIIlIlIlIIllIlIIIIIllIIlIIlIIlIIllIIIlIIllIlIIIIlIlIIlIIlIllIIlIIlIlIl.jar;lib\llIlIIIIlIlIlllllIlIIllllIIIlIlIllllIIllllIlllIIlllllIIlIlllIIIIIIlIIllIIIlIlIlllIlIIIlIIIIIllIlllIlllIIllIIllIlIlIIlllI.jar;lib\llIlIlIIIllllIIIllllllllllIllIlIlllIIlllIIlllIIllIIllllIlllIIIIIllllIIlllIIllIIIIlIlIlIlIIIlIIIlIlIlIlIIlllIIlllIlIlIlII.jar;lib\lllIIlIlIIlIIllllIIllllIIlIllllIIIlIllllIIllIIIlllIIIIIIlIIlllIIllIllIIlllIlIIlIlIlllIIlllIlllIlIIlIIIllIlllIIIlIIIIIlll.jar;lib\lllIlIIIIIlIllIlIlIIllIlIIIlIIllIllllIIIIIllIlllIllIIllIIllIllIllIIlIlllllIIlIllIllIIlIIlIIIllIlIlIIlIIIIIIIllIIlllIllIl.jar;lib\llllIlIIIIIllllIlIIIlIllIlIIIllllIIIllIllllIIlllIlIIIlllIIlIlIlllIIlIIIIlIIIIlllIIlIIlIlIIIIIIIIllllIllIlIIIlIllIlIlIIll.jar;lib\llllIlIIlIllllIlIlIIIlIIIlIllIlIIIIlIlIIlIlIIIIllIIlIIllIIIllllIlIllIlllllIIIIIIIIllIllIlIlllllllIllIIIllllIIllIIlIllIll.jar" org.develnext.jphp.ext.javafx.FXLauncher
                                                                                          2⤵
                                                                                          • Suspicious use of SetWindowsHookEx
                                                                                          PID:2848
                                                                                          • C:\Windows\System32\cmd.exe
                                                                                            C:\Windows\System32\cmd.exe /c C:\Windows\System32\wbem\wmic.exe baseboard get Manufac ��
                                                                                            3⤵
                                                                                              PID:2652
                                                                                              • C:\Windows\System32\wbem\WMIC.exe
                                                                                                C:\Windows\System32\wbem\wmic.exe baseboard get Manufac
                                                                                                4⤵
                                                                                                  PID:736
                                                                                              • C:\Windows\System32\cmd.exe
                                                                                                C:\Windows\System32\cmd.exe /c USERPR ��
                                                                                                3⤵
                                                                                                  PID:4312
                                                                                                • C:\Windows\System32\cmd.exe
                                                                                                  C:\Windows\System32\cmd.exe /c C:\Windows\System32\wbem\wmic.exe baseboap��3���
                                                                                                  3⤵
                                                                                                    PID:752
                                                                                                    • C:\Windows\System32\wbem\WMIC.exe
                                                                                                      C:\Windows\System32\wbem\wmic.exe baseboap��3���
                                                                                                      4⤵
                                                                                                        PID:5700
                                                                                                    • C:\Windows\System32\cmd.exe
                                                                                                      C:\Windows\System32\cmd.exe /c C:\Windows\System32\wbem\wmic.exe CPU get Proc ��8�Y
                                                                                                      3⤵
                                                                                                        PID:6388
                                                                                                        • C:\Windows\System32\wbem\WMIC.exe
                                                                                                          C:\Windows\System32\wbem\wmic.exe CPU get Proc
                                                                                                          4⤵
                                                                                                            PID:5136
                                                                                                        • C:\Windows\System32\cmd.exe
                                                                                                          C:\Windows\System32\cmd.exe /c C:\Windows\System32\wbem\wmic.exe diskdrive where "'Index*'L��] ��\�X[�[X�\\"
                                                                                                          3⤵
                                                                                                            PID:6632
                                                                                                            • C:\Windows\System32\wbem\WMIC.exe
                                                                                                              C:\Windows\System32\wbem\wmic.exe diskdrive where "'Index*'L��] ��\�X[�[X�\\"
                                                                                                              4⤵
                                                                                                                PID:6564
                                                                                                            • C:\Windows\System32\cmd.exe
                                                                                                              C:\Windows\System32\cmd.exe /c C:\Windows\System32\wbem\wmic.exe Path Win32_VideoConp��3�\��]�Y[����\�
                                                                                                              3⤵
                                                                                                                PID:6600
                                                                                                                • C:\Windows\System32\wbem\WMIC.exe
                                                                                                                  C:\Windows\System32\wbem\wmic.exe Path Win32_VideoConp��3�\��]�Y[����\�
                                                                                                                  4⤵
                                                                                                                    PID:6776
                                                                                                                • C:\Windows\System32\cmd.exe
                                                                                                                  C:\Windows\System32\cmd.exe /c C:\Windows\System32\wbem\wmic.exe diskdrive where "'Il*'L����] ��^"
                                                                                                                  3⤵
                                                                                                                    PID:4108
                                                                                                                    • C:\Windows\System32\wbem\WMIC.exe
                                                                                                                      C:\Windows\System32\wbem\wmic.exe diskdrive where "'Il*'L����] ��^"
                                                                                                                      4⤵
                                                                                                                        PID:6880
                                                                                                                • C:\System\mbr.exe
                                                                                                                  C:\System\mbr.exe
                                                                                                                  1⤵
                                                                                                                  • Executes dropped EXE
                                                                                                                  PID:6400
                                                                                                                • C:\Users\{hck3dbitch}\hck3d\mbr.exe\OfficeClickToRun.exe
                                                                                                                  C:\Users\{hck3dbitch}\hck3d\mbr.exe\OfficeClickToRun.exe
                                                                                                                  1⤵
                                                                                                                  • Executes dropped EXE
                                                                                                                  PID:4808
                                                                                                                • C:\System\mbr.exe
                                                                                                                  C:\System\mbr.exe
                                                                                                                  1⤵
                                                                                                                  • Executes dropped EXE
                                                                                                                  PID:4624
                                                                                                                • C:\Users\{hck3dbitch}\hck3d\mbr.exe\OfficeClickToRun.exe
                                                                                                                  C:\Users\{hck3dbitch}\hck3d\mbr.exe\OfficeClickToRun.exe
                                                                                                                  1⤵
                                                                                                                  • Executes dropped EXE
                                                                                                                  PID:5640
                                                                                                                • C:\System\mbr.exe
                                                                                                                  C:\System\mbr.exe
                                                                                                                  1⤵
                                                                                                                  • Executes dropped EXE
                                                                                                                  PID:5464
                                                                                                                • C:\System\mbr.exe
                                                                                                                  C:\System\mbr.exe
                                                                                                                  1⤵
                                                                                                                  • Executes dropped EXE
                                                                                                                  PID:6032
                                                                                                                • C:\Users\{hck3dbitch}\hck3d\mbr.exe\OfficeClickToRun.exe
                                                                                                                  C:\Users\{hck3dbitch}\hck3d\mbr.exe\OfficeClickToRun.exe
                                                                                                                  1⤵
                                                                                                                  • Executes dropped EXE
                                                                                                                  PID:3552
                                                                                                                • C:\System\mbr.exe
                                                                                                                  C:\System\mbr.exe
                                                                                                                  1⤵
                                                                                                                  • Executes dropped EXE
                                                                                                                  PID:2500

                                                                                                                Network

                                                                                                                      MITRE ATT&CK Enterprise v15

                                                                                                                      Replay Monitor

                                                                                                                      Loading Replay Monitor...

                                                                                                                      Downloads

                                                                                                                      • C:\ProgramData\Oracle\Java\.oracle_jre_usage\3903daac9bc4a3b7.timestamp

                                                                                                                        Filesize

                                                                                                                        46B

                                                                                                                        MD5

                                                                                                                        4da00f3d9824127a833dc7b003977922

                                                                                                                        SHA1

                                                                                                                        1e6e4e321dd12aa1d868b1a2c12413e6940f89f2

                                                                                                                        SHA256

                                                                                                                        e00dfb30bfa7c5875301e18fe38a2c4ab4071f396250c22d20d1f25c7c969eb7

                                                                                                                        SHA512

                                                                                                                        ade0f0e5523b427042ce4a198713c6608954c3a4cf4a01b6c49004b6f219c3a002e622825283327e5e0d10f356d472898458148c5b25b31f93b0b38c2943a615

                                                                                                                      • C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\l594d31n.default-release\activity-stream.discovery_stream.json

                                                                                                                        Filesize

                                                                                                                        19KB

                                                                                                                        MD5

                                                                                                                        fbdf14d0d74432d54c4617fb2330be49

                                                                                                                        SHA1

                                                                                                                        7757c33745c2e7c3b3972dca31a5ed919343fa07

                                                                                                                        SHA256

                                                                                                                        b4a6881757c5345d0f4103c53d3c4dc1a45c8af71598befb9df987905badc97e

                                                                                                                        SHA512

                                                                                                                        bba7fbbe512a08ceea234a29f5c47b1f2d5240dc4e440d49c90f07e7c0ece956e34b2863982eb96872739bb04a76f4ed36379def8ff045cd101e1fc137a5c8ce

                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\7zEC37A3248\dcrat\plugins\chat_native\fav.png

                                                                                                                        Filesize

                                                                                                                        2KB

                                                                                                                        MD5

                                                                                                                        a8e72c0e27750ce36da3110126c38afe

                                                                                                                        SHA1

                                                                                                                        e96bc3555f8ed8e715af94d492965b4e6597563c

                                                                                                                        SHA256

                                                                                                                        a4f7e5adde35c1979fbf2cc44b37e2907ec963468443e34262b207dd3dab81b8

                                                                                                                        SHA512

                                                                                                                        e43e2c6abb6006c783331cb8b0e290560bb65f7cfd0e113bbddb31a6978aee31fb39a2b22b38ef83f27d512152329d066bc270e640e8900b2746a2a4e0b4dd48

                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_zu4hg1cz.zi2.ps1

                                                                                                                        Filesize

                                                                                                                        60B

                                                                                                                        MD5

                                                                                                                        d17fe0a3f47be24a6453e9ef58c94641

                                                                                                                        SHA1

                                                                                                                        6ab83620379fc69f80c0242105ddffd7d98d5d9d

                                                                                                                        SHA256

                                                                                                                        96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

                                                                                                                        SHA512

                                                                                                                        5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\tmpaddon

                                                                                                                        Filesize

                                                                                                                        479KB

                                                                                                                        MD5

                                                                                                                        09372174e83dbbf696ee732fd2e875bb

                                                                                                                        SHA1

                                                                                                                        ba360186ba650a769f9303f48b7200fb5eaccee1

                                                                                                                        SHA256

                                                                                                                        c32efac42faf4b9878fb8917c5e71d89ff40de580c4f52f62e11c6cfab55167f

                                                                                                                        SHA512

                                                                                                                        b667086ed49579592d435df2b486fe30ba1b62ddd169f19e700cd079239747dd3e20058c285fa9c10a533e34f22b5198ed9b1f92ae560a3067f3e3feacc724f1

                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\tmpaddon-1

                                                                                                                        Filesize

                                                                                                                        13.8MB

                                                                                                                        MD5

                                                                                                                        0a8747a2ac9ac08ae9508f36c6d75692

                                                                                                                        SHA1

                                                                                                                        b287a96fd6cc12433adb42193dfe06111c38eaf0

                                                                                                                        SHA256

                                                                                                                        32d544baf2facc893057a1d97db33207e642f0dacf235d8500a0b5eff934ce03

                                                                                                                        SHA512

                                                                                                                        59521f8c61236641b3299ab460c58c8f5f26fa67e828de853c2cf372f9614d58b9f541aae325b1600ec4f3a47953caacb8122b0dfce7481acfec81045735947d

                                                                                                                      • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\TIZGX89WH6VEW3OZ64PI.temp

                                                                                                                        Filesize

                                                                                                                        7KB

                                                                                                                        MD5

                                                                                                                        a603088d1233c05b5f007c0f8ff9a08c

                                                                                                                        SHA1

                                                                                                                        7af084d75f6ba8cd2913725fd09a7c2b62aa780e

                                                                                                                        SHA256

                                                                                                                        cd9a962235c0c85e67d95e10aa956f91b8091e1559685d1237b20b5ab0f3ef13

                                                                                                                        SHA512

                                                                                                                        24f0adeddb4d8b4b575bc851bf3f5c67bc3b869940f5f294a3af534547fdba989bb776b12ac9b57318e4c59158fa233fd6933b995465ec6b6f80fe0823dff2a4

                                                                                                                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\l594d31n.default-release\AlternateServices.bin

                                                                                                                        Filesize

                                                                                                                        7KB

                                                                                                                        MD5

                                                                                                                        fc45aa1ba06243c000a33092aae2fc31

                                                                                                                        SHA1

                                                                                                                        ee29ea7d990e48bb644637754e38f3384ee168d1

                                                                                                                        SHA256

                                                                                                                        cb5df1960e7bb94132242cd198fe44c54857ef88dde61e3becfe72884eb3c97f

                                                                                                                        SHA512

                                                                                                                        261dd376340132150a9f601d7e0918d99de98ad8ed46cd389548bce1cdf165fce70bec2d6644d1325e3344ba2ca0f0f0855d45e91990378d5d79e1d022f78c0d

                                                                                                                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\l594d31n.default-release\bookmarkbackups\bookmarks-2024-05-03_11_lGGEHwAiKjDnYqTsLYT0rw==.jsonlz4

                                                                                                                        Filesize

                                                                                                                        1009B

                                                                                                                        MD5

                                                                                                                        8715856e279b11f43e931810aab4d627

                                                                                                                        SHA1

                                                                                                                        e2878f32348e68d91c1aa4c4775c33b4e5833bef

                                                                                                                        SHA256

                                                                                                                        50e5c4006d73a8668d105ebc128d7a847488f0d5bafeab7fbacbceae66e06290

                                                                                                                        SHA512

                                                                                                                        e4b3802f2480ae44e0672b72866f0f1466e9f88090288168288ba5f965a4e7433b5d8b13be35b2a73c08106582236e4807ede2fb2f5f4c5a6781219651958793

                                                                                                                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\l594d31n.default-release\datareporting\glean\db\data.safe.tmp

                                                                                                                        Filesize

                                                                                                                        6KB

                                                                                                                        MD5

                                                                                                                        24b61b7f8015f3fabeeea5e554765ecf

                                                                                                                        SHA1

                                                                                                                        6e580e0b548ea7e648029bbe7caee2637a45f5c4

                                                                                                                        SHA256

                                                                                                                        948da935c33cdeeb818f05e875b38fba1abf8df4c7aa870f191164a0ab3003a1

                                                                                                                        SHA512

                                                                                                                        0eee1dd293637b3d9d83e35bdbf6231ff33dd5e609ec7c36123d0f17860b8b0594ce6c74cb14dd1ae798e1f5a6daaba50de228d82bfc8545b15c2be8cbe87508

                                                                                                                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\l594d31n.default-release\datareporting\glean\db\data.safe.tmp

                                                                                                                        Filesize

                                                                                                                        5KB

                                                                                                                        MD5

                                                                                                                        a59d404358706abe71fd37d6e0768316

                                                                                                                        SHA1

                                                                                                                        788e6f77908cdc0c4eefd07d2e7c5fc71bc8e11e

                                                                                                                        SHA256

                                                                                                                        80b35136051059c0aeffaa5103f7e3739b2d24afc828abf4930eb37009489e0e

                                                                                                                        SHA512

                                                                                                                        544e478d6105fc3ce31b4381e1f0bda4c22ef8306d94b8d91505c5638ef8bb1722a896b77a22f9cb0856ca97305f25a1f256f804277b4de2a882cba43a8a66bd

                                                                                                                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\l594d31n.default-release\datareporting\glean\db\data.safe.tmp

                                                                                                                        Filesize

                                                                                                                        26KB

                                                                                                                        MD5

                                                                                                                        4918c50c5616f735169dc342908cf3b4

                                                                                                                        SHA1

                                                                                                                        6586dfe91cc32ff27bbe5344e08008949914706c

                                                                                                                        SHA256

                                                                                                                        de8d38fc26dae5043f4600fe9a8bcf84d9a1d950dce9d4272e782063ca8f359e

                                                                                                                        SHA512

                                                                                                                        0ec110ce8b30a32761aecbaf418570330b667c700e4680d518004c5f69d19673f41824f5e395d8c4aaa7a0462655e3647695b0e512ce3bc0acb2d2822c1c8ff9

                                                                                                                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\l594d31n.default-release\datareporting\glean\db\data.safe.tmp

                                                                                                                        Filesize

                                                                                                                        28KB

                                                                                                                        MD5

                                                                                                                        c266c368b57def68f4d48dc3282f03a1

                                                                                                                        SHA1

                                                                                                                        40957de21af5f5b0cf5f2405f6d1687858774792

                                                                                                                        SHA256

                                                                                                                        cb9af2055fed9e9c55eabf6518fb59f8a2e3fcb0506698c0f747e920ddfd5bfe

                                                                                                                        SHA512

                                                                                                                        5fac7baa391c81da5d630e7a5a5a95b45a6684bbbba3f1b9b3220d8d9e157080333c0a59c194e85b80d4dc8fcbdc1cb62356cf0ababa6fa2fc5eed31259147e6

                                                                                                                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\l594d31n.default-release\datareporting\glean\db\data.safe.tmp

                                                                                                                        Filesize

                                                                                                                        6KB

                                                                                                                        MD5

                                                                                                                        4b9501a43a3ac3e4a2deb4ba3772849a

                                                                                                                        SHA1

                                                                                                                        cbd68d37a18480fa5ad9fb782369326ee4e87e06

                                                                                                                        SHA256

                                                                                                                        8d3bee5bbe89b83a9a0bf164ba983f8f902620f7bd0f539b50fb681cff717588

                                                                                                                        SHA512

                                                                                                                        e336dd5013713db6b5ffba09b4a0a4183e35a26a6ace31f1074007a3964c48faa96a2912f40f70bde251cf72373ff56d4f5710cf9071af1e6a5fd3cf16dc6b3b

                                                                                                                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\l594d31n.default-release\datareporting\glean\pending_pings\0cc3921a-93ed-4b38-9ec1-54a9a11405f9

                                                                                                                        Filesize

                                                                                                                        671B

                                                                                                                        MD5

                                                                                                                        0a6f4bb7c94ffeb0e619d986a4f750e3

                                                                                                                        SHA1

                                                                                                                        4992e35735852d8c37153d614538588cad73ea55

                                                                                                                        SHA256

                                                                                                                        2130d812187c77849b3deb2df6237d8c004d6e8324fccf2357725783383e2342

                                                                                                                        SHA512

                                                                                                                        b8c09fe7fd76bca67d3256a412c41b6494cd8f33311c997b8465963f7ff0f911c4c55d1783b7b4bf7cad0287e5a3ad4b8e15ffd07491568729107f2f79784fd1

                                                                                                                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\l594d31n.default-release\datareporting\glean\pending_pings\6ab1546d-b981-4ef5-ac64-39e51765d413

                                                                                                                        Filesize

                                                                                                                        982B

                                                                                                                        MD5

                                                                                                                        f2b35ff7bb186a227c9da41a7429dccc

                                                                                                                        SHA1

                                                                                                                        cd76bcabaf3489e8f87206cf73f94402a546cfc2

                                                                                                                        SHA256

                                                                                                                        7978050b4251e079a639d4e227e563c3350f3aaae8098b6e08304996c1dd911f

                                                                                                                        SHA512

                                                                                                                        d8a32ee467db6feb441c4632e665a412114bbf50c5d789ceca61c87ec55f78c5828ddac063e7202d93a54637a36c29d6f0f565c681f434b2f445ca013937f02b

                                                                                                                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\l594d31n.default-release\datareporting\glean\pending_pings\eccedc9e-4f81-46dc-9f10-c5abbe5bc48d

                                                                                                                        Filesize

                                                                                                                        28KB

                                                                                                                        MD5

                                                                                                                        5dec9b9c4d812893e233a6c0051da388

                                                                                                                        SHA1

                                                                                                                        662ac04b8a8da20d7bddb995bc4f75b8c87a1324

                                                                                                                        SHA256

                                                                                                                        d3d6f61f5232c4f5b11ce82bc47bf3da084c9974ea3dd4cefa819f3c79d51458

                                                                                                                        SHA512

                                                                                                                        0aa4f1ac076b738b54ac28ef2c6730a1199a87e44639fc887c99938e94d1cdf74af107bd6e3e20755dc8a8a5f564077c71ac03f804105f34b00edcd3815fc9c8

                                                                                                                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\l594d31n.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.dll

                                                                                                                        Filesize

                                                                                                                        1.1MB

                                                                                                                        MD5

                                                                                                                        842039753bf41fa5e11b3a1383061a87

                                                                                                                        SHA1

                                                                                                                        3e8fe1d7b3ad866b06dca6c7ef1e3c50c406e153

                                                                                                                        SHA256

                                                                                                                        d88dd3bfc4a558bb943f3caa2e376da3942e48a7948763bf9a38f707c2cd0c1c

                                                                                                                        SHA512

                                                                                                                        d3320f7ac46327b7b974e74320c4d853e569061cb89ca849cd5d1706330aca629abeb4a16435c541900d839f46ff72dfde04128c450f3e1ee63c025470c19157

                                                                                                                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\l594d31n.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.info

                                                                                                                        Filesize

                                                                                                                        116B

                                                                                                                        MD5

                                                                                                                        2a461e9eb87fd1955cea740a3444ee7a

                                                                                                                        SHA1

                                                                                                                        b10755914c713f5a4677494dbe8a686ed458c3c5

                                                                                                                        SHA256

                                                                                                                        4107f76ba1d9424555f4e8ea0acef69357dfff89dfa5f0ec72aa4f2d489b17bc

                                                                                                                        SHA512

                                                                                                                        34f73f7bf69d7674907f190f257516e3956f825e35a2f03d58201a5a630310b45df393f2b39669f9369d1ac990505a4b6849a0d34e8c136e1402143b6cedf2d3

                                                                                                                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\l594d31n.default-release\gmp-widevinecdm\4.10.2710.0\manifest.json

                                                                                                                        Filesize

                                                                                                                        372B

                                                                                                                        MD5

                                                                                                                        bf957ad58b55f64219ab3f793e374316

                                                                                                                        SHA1

                                                                                                                        a11adc9d7f2c28e04d9b35e23b7616d0527118a1

                                                                                                                        SHA256

                                                                                                                        bbab6ca07edbed72a966835c7907b3e60c7aa3d48ddea847e5076bd05f4b1eda

                                                                                                                        SHA512

                                                                                                                        79c179b56e4893fb729b225818ab4b95a50b69666ac41d17aad0b37ab0ca8cd9f0848cbc3c5d9e69e4640a8b261d7ced592eae9bcb0e0b63c05a56e7c477f44e

                                                                                                                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\l594d31n.default-release\gmp-widevinecdm\4.10.2710.0\widevinecdm.dll

                                                                                                                        Filesize

                                                                                                                        17.8MB

                                                                                                                        MD5

                                                                                                                        daf7ef3acccab478aaa7d6dc1c60f865

                                                                                                                        SHA1

                                                                                                                        f8246162b97ce4a945feced27b6ea114366ff2ad

                                                                                                                        SHA256

                                                                                                                        bc40c7821dcd3fea9923c6912ab1183a942c11b7690cfd79ed148ded0228777e

                                                                                                                        SHA512

                                                                                                                        5840a45cfdb12c005e117608b1e5d946e1b2e76443ed39ba940d7f56de4babeab09bee7e64b903eb82bb37624c0a0ef19e9b59fbe2ce2f0e0b1c7a6015a63f75

                                                                                                                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\l594d31n.default-release\prefs-1.js

                                                                                                                        Filesize

                                                                                                                        9KB

                                                                                                                        MD5

                                                                                                                        b7b0fdfbe838cda0bf3d3bdf17fa67ab

                                                                                                                        SHA1

                                                                                                                        c6fdc2f59dca31a2c89dd6aa4af0dc19d30ddaa7

                                                                                                                        SHA256

                                                                                                                        1e07ccf2333e7eadb3883ec6cb736b604283d8cb0e1520ba4165adf829d85fad

                                                                                                                        SHA512

                                                                                                                        867f17f8a043979513eee81fae7ebece107e0da854a325eae97e9e58c54cdfb9a543a48f2dd382b66aa2f71429c73544a9cfa43a1d0c2f247ff1221935bd63ef

                                                                                                                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\l594d31n.default-release\prefs-1.js

                                                                                                                        Filesize

                                                                                                                        9KB

                                                                                                                        MD5

                                                                                                                        99c4d17be879f948f1ea7965d8b298ad

                                                                                                                        SHA1

                                                                                                                        7fc70f8b0a03a6309526fc35ddd9684792c7c1e5

                                                                                                                        SHA256

                                                                                                                        78a0f19a96c2f3c30e0d3f874d48324be04bc501a37641e3e03c99712b308a2c

                                                                                                                        SHA512

                                                                                                                        44cb61af51536024b0570d918a81a468f8665b7f2f8283c18f1faece8cd485dd4361e17cfd6c07cb5149ef292a38dd68139fbe61839e63fb146f22e175f82d8c

                                                                                                                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\l594d31n.default-release\prefs-1.js

                                                                                                                        Filesize

                                                                                                                        8KB

                                                                                                                        MD5

                                                                                                                        e19accd982cea331fb67c2a1f969df38

                                                                                                                        SHA1

                                                                                                                        6ffe69d733fdba283b0d8d7dcc8650063ebf0f0f

                                                                                                                        SHA256

                                                                                                                        c647f536b60ef59554652c504d00be26b476036fcbde3b533d4ec6d36c91ec87

                                                                                                                        SHA512

                                                                                                                        2e2dfcfa942e217027c8cf1aec9d7f0cb5486bbed7baf2e8eb8bb10930f035e910b19787348bd314657438be3afe1350f2333c97a5929a57bbc9fbddf02c36a6

                                                                                                                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\l594d31n.default-release\prefs.js

                                                                                                                        Filesize

                                                                                                                        8KB

                                                                                                                        MD5

                                                                                                                        287822372bea6fa0b251b5fe99ff2858

                                                                                                                        SHA1

                                                                                                                        8cef02cd3f0e5a1f7edd3a3f8b6a19041b3f7ef1

                                                                                                                        SHA256

                                                                                                                        05f5f169840053e0bd83b37cc1839c55442ebf75316525918440dcb10486a3fe

                                                                                                                        SHA512

                                                                                                                        1105a8f64ad212bb299be8178f861151fd165321b660d3ccf31b5a0c079173aa7619fc433cf4667f81a43af2e8c6fb3211bc5840c093ddfa31359a9a660d0e7d

                                                                                                                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\l594d31n.default-release\sessionstore-backups\recovery.baklz4

                                                                                                                        Filesize

                                                                                                                        1KB

                                                                                                                        MD5

                                                                                                                        22cc6cb62d995ec7b1076fd9fabb4000

                                                                                                                        SHA1

                                                                                                                        5e50f7dc0c6b3e4ac4a88b6cafb0ccbd9c27fa6f

                                                                                                                        SHA256

                                                                                                                        fceabf3816cef37c2dd6eab11897693cd4fba38e0bf18e946a46160c4b83e217

                                                                                                                        SHA512

                                                                                                                        10dcd014e91d807fccde8394bde204db62d86df8d44096c6b167fff982097a73760ab78ac5e6330e7b7585583b741b857173654cd31a911e7760be6b2b996b13

                                                                                                                      • C:\Users\Admin\Desktop\dcrat\DCRat.exe

                                                                                                                        Filesize

                                                                                                                        72KB

                                                                                                                        MD5

                                                                                                                        2c7d37e90dd8ab57d06dad5bc7956885

                                                                                                                        SHA1

                                                                                                                        da789c107c4c68b8250b6589e45e5a3cf7a9a143

                                                                                                                        SHA256

                                                                                                                        5ede5d774ab65f25357cf5a1fa5e354f6f2a9868651a0fa717485802b21b1939

                                                                                                                        SHA512

                                                                                                                        e74ae891771bfd9c6fcdfbe8e4f33f0d5f7c3457cd84b257500cdaf8fa8b16fe458a18db9b3a60591465982fc2871f4c3f2e7541c765f00a0516f805e7e9ca0f

                                                                                                                      • C:\Users\Admin\Desktop\dcrat\back.o

                                                                                                                        Filesize

                                                                                                                        664KB

                                                                                                                        MD5

                                                                                                                        aef4b8423ae335762bbae012e2fc49d6

                                                                                                                        SHA1

                                                                                                                        87e31aa55052205cba347c62c595cd054b5a1585

                                                                                                                        SHA256

                                                                                                                        1dad158eebe2b6437b0ed6089495158be9e6ed7e31725894536888ab3f1a8b5f

                                                                                                                        SHA512

                                                                                                                        2aff6a5254e65d7b3d8d102cf5d28949d0de735f88a0e17d5a57c78cb3f54955622ff0e0dcf9389305bba31fa835fb706bd4c84a6400a84511f394582bdf8c3a

                                                                                                                      • C:\Users\Admin\Desktop\dcrat\lib\IIIllllIlIlllIlIIIIlllIlIlIlllllIIIlIIllllIIIlIllIIlIIllllIIllllllIIlIIIIIIlllIIIlIllllllIIllIlIllIlllIllIlIIIIIIIIllllI.jar

                                                                                                                        Filesize

                                                                                                                        2.3MB

                                                                                                                        MD5

                                                                                                                        6316f84bc78d40b138dab1adc978ca5d

                                                                                                                        SHA1

                                                                                                                        b12ea05331ad89a9b09937367ebc20421f17b9ff

                                                                                                                        SHA256

                                                                                                                        d637e3326f87a173abd5f51ac98906a3237b9e511d07d31d6aafcf43f33dac17

                                                                                                                        SHA512

                                                                                                                        1cdca01ed9c2bc607207c8c51f4b532f4153e94b3846308332eccae25f9c5fddf8279e3063f44a75dd43d696eab0f9f340f9bf2f3ec805ab0f2f1de5135a426c

                                                                                                                      • C:\Users\Admin\Desktop\dcrat\lib\IIIllllIlIlllIlIIIIlllIlIlIlllllIIIlIIllllIIIlIllIIlIIllllIIllllllIIlIIIIIIlllIIIlIllllllIIllIlIllIlllIllIlIIIIIIIIllllIIilIl.jar

                                                                                                                        Filesize

                                                                                                                        5.5MB

                                                                                                                        MD5

                                                                                                                        f323bd3b1e342a856bf3036453cd01b2

                                                                                                                        SHA1

                                                                                                                        a8c48a731c350d1514ddcc6a99738cb93277fe14

                                                                                                                        SHA256

                                                                                                                        64bc153889ab341d4ec8e693fafe117651d3b627d1a608dad951f5b030aab26f

                                                                                                                        SHA512

                                                                                                                        764e1643f2f0b2a5c64e2fd52b2ed8cb3597469ec7ea2c28c2009c0d0b1f5e1dbbcc12b6cf36e94ae7db53bb9d118cd3d33ad92de0c3e256b751c5085e3489a4

                                                                                                                      • C:\Users\Admin\Desktop\dcrat\lib\IIlIlIllIIlIIllIIllIIlIIIllIlIlIlIIIIlIlIllIIlIIllIIIIIllIIIIlIIIlIIlIIlIIlIllIIlllIIIllIIIlIIlIllllIllIIIIlIIIlIllllllI.jar

                                                                                                                        Filesize

                                                                                                                        464KB

                                                                                                                        MD5

                                                                                                                        7e5e3d6d352025bd7f093c2d7f9b21ab

                                                                                                                        SHA1

                                                                                                                        ad9bfc2c3d70c574d34a752c5d0ebcc43a046c57

                                                                                                                        SHA256

                                                                                                                        5b37e8ff2850a4cbb02f9f02391e9f07285b4e0667f7e4b2d4515b78e699735a

                                                                                                                        SHA512

                                                                                                                        c19c29f8ad8b6beb3eed40ab7dc343468a4ca75d49f1d0d4ea0b4a5cee33f745893fba764d35c8bd157f7842268e0716b1eb4b8b26dcf888fb3b3f4314844aad

                                                                                                                      • C:\Users\Admin\Desktop\dcrat\lib\IlIIlIllllIIIIIlIlllIllIlIlIIIIIlIIIlIlIlllIIllIllIIIIIIlIIlllIIIlIIIlllIIIlllllIlIlIlllllIIlIllIIlIIlIIlIIIlllllllIlIII.jar

                                                                                                                        Filesize

                                                                                                                        19KB

                                                                                                                        MD5

                                                                                                                        0a79304556a1289aa9e6213f574f3b08

                                                                                                                        SHA1

                                                                                                                        7ee3bde3b1777bf65d4f62ce33295556223a26cd

                                                                                                                        SHA256

                                                                                                                        434e57fffc7df0b725c1d95cabafdcdb83858ccb3e5e728a74d3cf33a0ca9c79

                                                                                                                        SHA512

                                                                                                                        1560703d0c162d73c99cef9e8ddc050362e45209cc8dea6a34a49e2b6f99aae462eae27ba026bdb29433952b6696896bb96998a0f6ac0a3c1dbbb2f6ebc26a7e

                                                                                                                      • C:\Users\Admin\Desktop\dcrat\lib\IlIlIIIIIIIlIlllllllIllIIlIIllIllllIIIlIIIlIlIIlIIlIIlIllIlllIlIlIIllIIlIIIIIIIlIIIIIIIIIlIlllIIllIlIIlIIIlIlIlllIIIIIIl.jar

                                                                                                                        Filesize

                                                                                                                        250KB

                                                                                                                        MD5

                                                                                                                        fe734f7ab030363362fe3d3ba5e8f913

                                                                                                                        SHA1

                                                                                                                        2e9d54e3b410557c51c3ea101d66efbb5266b80a

                                                                                                                        SHA256

                                                                                                                        03ead999502aefbf1380bd2e9c4a407acb7a92a7b2fe61f6995aba3fca85efd4

                                                                                                                        SHA512

                                                                                                                        303ecea5f3f1130f473cde0d78270090290b6f13311bf7459282257ac3097b2b6086db461183f2d8c97a9101372155bf59bbfa12a74925136d0a2a615b648b2a

                                                                                                                      • C:\Users\Admin\Desktop\dcrat\lib\IlIllIIllllllllIlIIlllllIIIIllIIIlIIlllIIllIIllllIIllIlIIIlIIIIlIIIIIlllllllIllIIlIlIllIIlIlIlIIllIlIllIIIlIIIIlIllIIIIl.jar

                                                                                                                        Filesize

                                                                                                                        688KB

                                                                                                                        MD5

                                                                                                                        6696368a09c7f8fed4ea92c4e5238cee

                                                                                                                        SHA1

                                                                                                                        f89c282e557d1207afd7158b82721c3d425736a7

                                                                                                                        SHA256

                                                                                                                        c25d7a7b8f0715729bccb817e345f0fdd668dd4799c8dab1a4db3d6a37e7e3e4

                                                                                                                        SHA512

                                                                                                                        0ab24f07f956e3cdcd9d09c3aa4677ff60b70d7a48e7179a02e4ff9c0d2c7a1fc51624c3c8a5d892644e9f36f84f7aaf4aa6d2c9e1c291c88b3cff7568d54f76

                                                                                                                      • C:\Users\Admin\Desktop\dcrat\lib\IllIIIIllIlIIIIlIlIllIIlIIllIIlIllIIlllllIlllIllIlIIlIIlllIIlIlIlIllIllIIlIIIlIIIllIIIIIllIIlllllIlIIIIIlIIIIIIIIIIIIlII.jar

                                                                                                                        Filesize

                                                                                                                        226KB

                                                                                                                        MD5

                                                                                                                        5134a2350f58890ffb9db0b40047195d

                                                                                                                        SHA1

                                                                                                                        751f548c85fa49f330cecbb1875893f971b33c4e

                                                                                                                        SHA256

                                                                                                                        2d43eb5ea9e133d2ee2405cc14f5ee08951b8361302fdd93494a3a997b508d32

                                                                                                                        SHA512

                                                                                                                        c3cdaf66a99e6336abc80ff23374f6b62ac95ab2ae874c9075805e91d849b18e3f620cc202b4978fc92b73d98de96089c8714b1dd096b2ae1958cfa085715f7a

                                                                                                                      • C:\Users\Admin\Desktop\dcrat\lib\lIIllIIlIlllIlIlllIlIIlIIIlllllIIlIlIIllIllIlIlllIlIIlIlIlIIllIlIIIIIllIIlIIlIIlIIllIIIlIIllIlIIIIlIlIIlIIlIllIIlIIlIlIl.jar

                                                                                                                        Filesize

                                                                                                                        50KB

                                                                                                                        MD5

                                                                                                                        d093f94c050d5900795de8149cb84817

                                                                                                                        SHA1

                                                                                                                        54058dda5c9e66a22074590072c8a48559bba1fb

                                                                                                                        SHA256

                                                                                                                        4bec0794a0d69debe2f955bf495ea7c0858ad84cb0d2d549cacb82e70c060cba

                                                                                                                        SHA512

                                                                                                                        3faaa415fba5745298981014d0042e8e01850fccaac22f92469765fd8c56b920da877ff3138a629242d9c52e270e7e2ce89e7c69f6902859f48ea0359842e2fb

                                                                                                                      • C:\Users\Admin\Desktop\dcrat\lib\llIlIIIIlIlIlllllIlIIllllIIIlIlIllllIIllllIlllIIlllllIIlIlllIIIIIIlIIllIIIlIlIlllIlIIIlIIIIIllIlllIlllIIllIIllIlIlIIlllI.jar

                                                                                                                        Filesize

                                                                                                                        16KB

                                                                                                                        MD5

                                                                                                                        fde38932b12fc063451af6613d4470cc

                                                                                                                        SHA1

                                                                                                                        bc08c114681a3afc05fb8c0470776c3eae2eefeb

                                                                                                                        SHA256

                                                                                                                        9967ea3c3d1aee8db5a723f714fba38d2fc26d8553435ab0e1d4e123cd211830

                                                                                                                        SHA512

                                                                                                                        0f211f81101ced5fff466f2aab0e6c807bb18b23bc4928fe664c60653c99fa81b34edf5835fcc3affb34b0df1fa61c73a621df41355e4d82131f94fcc0b0e839

                                                                                                                      • C:\Users\Admin\Desktop\dcrat\lib\llIlIlIIIllllIIIllllllllllIllIlIlllIIlllIIlllIIllIIllllIlllIIIIIllllIIlllIIllIIIIlIlIlIlIIIlIIIlIlIlIlIIlllIIlllIlIlIlII.jar

                                                                                                                        Filesize

                                                                                                                        103KB

                                                                                                                        MD5

                                                                                                                        0c8768cdeb3e894798f80465e0219c05

                                                                                                                        SHA1

                                                                                                                        c4da07ac93e4e547748ecc26b633d3db5b81ce47

                                                                                                                        SHA256

                                                                                                                        15f36830124fc7389e312cf228b952024a8ce8601bf5c4df806bc395d47db669

                                                                                                                        SHA512

                                                                                                                        35db507a3918093b529547e991ab6c1643a96258fc95ba1ea7665ff762b0b8abb1ef732b3854663a947effe505be667bd2609ffcccb6409a66df605f971da106

                                                                                                                      • C:\Users\Admin\Desktop\dcrat\lib\lllIIlIlIIlIIllllIIllllIIlIllllIIIlIllllIIllIIIlllIIIIIIlIIlllIIllIllIIlllIlIIlIlIlllIIlllIlllIlIIlIIIllIlllIIIlIIIIIlll.jar

                                                                                                                        Filesize

                                                                                                                        12KB

                                                                                                                        MD5

                                                                                                                        3e5e8cccff7ff343cbfe22588e569256

                                                                                                                        SHA1

                                                                                                                        66756daa182672bff27e453eed585325d8cc2a7a

                                                                                                                        SHA256

                                                                                                                        0f26584763ef1c5ec07d1f310f0b6504bc17732f04e37f4eb101338803be0dc4

                                                                                                                        SHA512

                                                                                                                        8ea5f31e25c3c48ee21c51abe9146ee2a270d603788ec47176c16acac15dad608eef4fa8ca0f34a1bbc6475c29e348bd62b0328e73d2e1071aaa745818867522

                                                                                                                      • C:\Users\Admin\Desktop\dcrat\lib\lllIlIIIIIlIllIlIlIIllIlIIIlIIllIllllIIIIIllIlllIllIIllIIllIllIllIIlIlllllIIlIllIllIIlIIlIIIllIlIlIIlIIIIIIIllIIlllIllIl.jar

                                                                                                                        Filesize

                                                                                                                        1.1MB

                                                                                                                        MD5

                                                                                                                        d5ef47c915bef65a63d364f5cf7cd467

                                                                                                                        SHA1

                                                                                                                        f711f3846e144dddbfb31597c0c165ba8adf8d6b

                                                                                                                        SHA256

                                                                                                                        9c287472408857301594f8f7bda108457f6fdae6e25c87ec88dbf3012e5a98b6

                                                                                                                        SHA512

                                                                                                                        04aeb956bfcd3bd23b540f9ad2d4110bb2ffd25fe899152c4b2e782daa23a676df9507078ecf1bfc409ddfbe2858ab4c4c324f431e45d8234e13905eb192bae8

                                                                                                                      • C:\Users\Admin\Desktop\dcrat\lib\llllIlIIIIIllllIlIIIlIllIlIIIllllIIIllIllllIIlllIlIIIlllIIlIlIlllIIlIIIIlIIIIlllIIlIIlIlIIIIIIIIllllIllIlIIIlIllIlIlIIll.jar

                                                                                                                        Filesize

                                                                                                                        16KB

                                                                                                                        MD5

                                                                                                                        b50e2c75f5f0e1094e997de8a2a2d0ca

                                                                                                                        SHA1

                                                                                                                        d789eb689c091536ea6a01764bada387841264cb

                                                                                                                        SHA256

                                                                                                                        cf4068ebb5ecd47adec92afba943aea4eb2fee40871330d064b69770cccb9e23

                                                                                                                        SHA512

                                                                                                                        57d8ac613805edada6aeba7b55417fd7d41c93913c56c4c2c1a8e8a28bbb7a05aade6e02b70a798a078dc3c747967da242c6922b342209874f3caf7312670cb0

                                                                                                                      • C:\Users\Admin\Desktop\dcrat\lib\llllIlIIlIllllIlIlIIIlIIIlIllIlIIIIlIlIIlIlIIIIllIIlIIllIIIllllIlIllIlllllIIIIIIIIllIllIlIlllllllIllIIIllllIIllIIlIllIll.jar

                                                                                                                        Filesize

                                                                                                                        95KB

                                                                                                                        MD5

                                                                                                                        4bc2aea7281e27bc91566377d0ed1897

                                                                                                                        SHA1

                                                                                                                        d02d897e8a8aca58e3635c009a16d595a5649d44

                                                                                                                        SHA256

                                                                                                                        4aef566bbf3f0b56769a0c45275ebbf7894e9ddb54430c9db2874124b7cea288

                                                                                                                        SHA512

                                                                                                                        da35bb2f67bca7527dc94e5a99a162180b2701ddca2c688d9e0be69876aca7c48f192d0f03d431ccd2d8eec55e0e681322b4f15eba4db29ef5557316e8e51e10

                                                                                                                      • C:\Users\Admin\Desktop\dcrat\plugins\ActiveWindowNotifier.plg

                                                                                                                        Filesize

                                                                                                                        233B

                                                                                                                        MD5

                                                                                                                        9d79462a38f05c98f8af9ce194086de3

                                                                                                                        SHA1

                                                                                                                        2a1fbacc08c1b6f69bf285a2efa181ce0e14bb89

                                                                                                                        SHA256

                                                                                                                        759adec692b3fc93e3a13c817536f70b80ca77f1c47f0998bab55d258dfd2173

                                                                                                                        SHA512

                                                                                                                        b54509ef21eb1e0df66f52d44dde3026c18b35d67c73dc8d2a15d434dbf297377a906c8d92e47ba2a5c85aa09227432c8643e21e61354009856970a1ff185e66

                                                                                                                      • C:\Users\Admin\Desktop\dcrat\plugins\ActiveWindowNotifier\configuration.json

                                                                                                                        Filesize

                                                                                                                        112B

                                                                                                                        MD5

                                                                                                                        7274b40806ddc9b05aaf679efd9ed503

                                                                                                                        SHA1

                                                                                                                        06a0ed8394004318859859c50dcb412153e65453

                                                                                                                        SHA256

                                                                                                                        720b6c93d9bed8c9bf8a745762883256c9d9fc4bd3c1d282dced559742165163

                                                                                                                        SHA512

                                                                                                                        e2eeca868aef81e67d09af46525e98fcc6af3d17fdef321a5a97d5a85c8bbd34206f19f4fdaef9481985075f15d0acb1efb6e80671317d6080cc06bcc85e8dfd

                                                                                                                      • C:\Users\Admin\Desktop\dcrat\plugins\AntiAnalysisPlugin.plg

                                                                                                                        Filesize

                                                                                                                        222B

                                                                                                                        MD5

                                                                                                                        745952c4ce75067e520be681d9c2112b

                                                                                                                        SHA1

                                                                                                                        a442210c6b9c519faf04d38889ec6c459934bced

                                                                                                                        SHA256

                                                                                                                        07b57c642aad49c6cee7c9707906c65f2d76bca587427709261190a8a6c2887f

                                                                                                                        SHA512

                                                                                                                        ce42290e5a0c558af5d72604447e18bc8cfeaa703809d7b7cd49af339dc067563b9f418266b53c1f126f16cfedb8f5aa1ec747b88a9f5e5566a7c111e713a3b2

                                                                                                                      • C:\Users\Admin\Desktop\dcrat\plugins\AntiAnalysisPlugin\configuration.json

                                                                                                                        Filesize

                                                                                                                        96B

                                                                                                                        MD5

                                                                                                                        3575f0e3dd5316c2122c8723b80a53f3

                                                                                                                        SHA1

                                                                                                                        feb80619c8ea7f43322e02ab99cb69135d83cd29

                                                                                                                        SHA256

                                                                                                                        524cca97e3d0be041b4c52a20f83ccb5555c8e2abc23a69c434433cc8ce66113

                                                                                                                        SHA512

                                                                                                                        78bd14afe21e7a0516dd4880ec76a1b22d5ba8f9b3323eca0f867f2315566c46008147f9652d9a7aeba11ed11f98c80a1622ca6380c18f130ec8670fda647c4e

                                                                                                                      • C:\Users\Admin\Desktop\dcrat\plugins\Audio_native.plg

                                                                                                                        Filesize

                                                                                                                        168B

                                                                                                                        MD5

                                                                                                                        630f22251fedbe30e968432d68ae8543

                                                                                                                        SHA1

                                                                                                                        6d25f9813b0995a3d032482abb7844cf4646b66f

                                                                                                                        SHA256

                                                                                                                        822869646486a798dc943c015e1bca6ac19b440652f8c93ddec4373c76846bef

                                                                                                                        SHA512

                                                                                                                        acc1b2ca19c4d30202423ecfd94c32420ea11171d72ac309d6849a31b67ca9832903987cffd807cfaf36a6760dcc60d45fdd9aafffb25669f40d864c4fdf545d

                                                                                                                      • C:\Users\Admin\Desktop\dcrat\plugins\Audio_native\configuration.json

                                                                                                                        Filesize

                                                                                                                        102B

                                                                                                                        MD5

                                                                                                                        4829fde8c25c2763214293eb37e50500

                                                                                                                        SHA1

                                                                                                                        1949db855ffdde8c96a7ff370e08abbaab459fbf

                                                                                                                        SHA256

                                                                                                                        96184ab6b632d6715d7b9f22de206319c44e3b268db4ac7b85acf4cfd17f6902

                                                                                                                        SHA512

                                                                                                                        b4dcfb999ae54d111e80fc4e2f0f4241699e15e4c3045648f9c2470414e88eee21d6ae8f2921fbc937e13caf00fb677c655cd08d541c549b84e7d6719432cb4e

                                                                                                                      • C:\Users\Admin\Desktop\dcrat\plugins\BSoDProtection.plg

                                                                                                                        Filesize

                                                                                                                        285B

                                                                                                                        MD5

                                                                                                                        88584f350c58c51eb2ae11a96dc62391

                                                                                                                        SHA1

                                                                                                                        b56aba2558e2386b1803f34fefa62029d5c94417

                                                                                                                        SHA256

                                                                                                                        dd760670b178a06aab1a1a0dbe78a9f6d36cc82cb538705e50bb13dbdacd8e42

                                                                                                                        SHA512

                                                                                                                        2290ebfad38de62f6fd61ded0becca29e9498bd0ddc29f27fc76b6f842955d012dc1c8d5b956c339ff857bfedce39308c326094389c4cf3112b7c0a402524966

                                                                                                                      • C:\Users\Admin\Desktop\dcrat\plugins\BSoDProtection\configuration.json

                                                                                                                        Filesize

                                                                                                                        104B

                                                                                                                        MD5

                                                                                                                        192d9ad2141908acde6d3e67d469274e

                                                                                                                        SHA1

                                                                                                                        2c23154ff73e202167b58593b1306311fd39e59c

                                                                                                                        SHA256

                                                                                                                        954c72fefc76cadb975b81e4ffa8a651e91229f98179e945da0a248b22fe2d54

                                                                                                                        SHA512

                                                                                                                        820e0875fbbc5a098c36c35d82fcb6dc739b2175c82fdc00c15fe7bc0a03a76ee7f3b2cb3867dcaf38b3084a399cd66ee70238bd10cac45801c31d3a6d92d9fa

                                                                                                                      • C:\Users\Admin\Desktop\dcrat\plugins\BlockInputPlugin.plg

                                                                                                                        Filesize

                                                                                                                        229B

                                                                                                                        MD5

                                                                                                                        b6d792cf92aaab098bd20c610a32dc7d

                                                                                                                        SHA1

                                                                                                                        938bd54611ec0769fd6c868280d0e1a27f517bce

                                                                                                                        SHA256

                                                                                                                        ad04867256b8adec506febb62980c0a516c05fbad7a4aaafaf86d72c42d9d5c0

                                                                                                                        SHA512

                                                                                                                        f9919c05330f98c566f9fff9012bbae5fb54923a1f96110df5ad7505edc9530beb988c0ea58aaf9dcbf69dd57856f77a80f5cd49358be15065fcc9eca1afa5d4

                                                                                                                      • C:\Users\Admin\Desktop\dcrat\plugins\BlockInputPlugin\configuration.json

                                                                                                                        Filesize

                                                                                                                        106B

                                                                                                                        MD5

                                                                                                                        afb18e21483320c671fbf3fc0e8852bf

                                                                                                                        SHA1

                                                                                                                        492d35550208e62ac013822b92379850fc76e877

                                                                                                                        SHA256

                                                                                                                        53e5c864b7b35564c6c7b5d263b6f625c755127dab893ed6db3fba767fa1a180

                                                                                                                        SHA512

                                                                                                                        5bffc0b2cf7479f231993c4aace989bafeed798855a18c5f14f97a54065861eceffe3ef44cd24c77d9ee872188f34311f4b0544db20b809808108516fd9ae535

                                                                                                                      • C:\Users\Admin\Desktop\dcrat\plugins\BrowsersStealer_native.plg

                                                                                                                        Filesize

                                                                                                                        200B

                                                                                                                        MD5

                                                                                                                        6f572698625a63133bb2084d9bb71d94

                                                                                                                        SHA1

                                                                                                                        c8a328c8d7377ddf189410be32a2e10f1fd74f50

                                                                                                                        SHA256

                                                                                                                        d02d6b6f1e2e7291e41d0d076d45322f9d34ba23c9b35be843cf43afffbc06b8

                                                                                                                        SHA512

                                                                                                                        898c17d4001aef45eb8585b0601c18899010717f2d867c7d3a5a947b4fdd57ffe5cec900732267eee798e559c452156dd94b826e76239020eb1b9ea9e6f7e05e

                                                                                                                      • C:\Users\Admin\Desktop\dcrat\plugins\BrowsersStealer_native\configuration.json

                                                                                                                        Filesize

                                                                                                                        112B

                                                                                                                        MD5

                                                                                                                        7fee909db2d84b923b5b1a557d980def

                                                                                                                        SHA1

                                                                                                                        487cabe13d30e4d9841ddabc4a2c5aab8971316d

                                                                                                                        SHA256

                                                                                                                        d5b69f3ce285b018f0cd1c4b93f4eacdbd02853f7c17c4c26e65f9665e59de84

                                                                                                                        SHA512

                                                                                                                        b8bf4e9c24555d6421dd54b3c138813da8c6ec5f8e0c34f03e64ec686f6c8ca984a34eff361e6ff4e5a2476b47c36b534252b85c2fc0dfa7983dea51825c5cca

                                                                                                                      • C:\Users\Admin\Desktop\dcrat\plugins\BuildInstallationTweaksPlugin.plg

                                                                                                                        Filesize

                                                                                                                        302B

                                                                                                                        MD5

                                                                                                                        d2296986b47083fdc965d3bcccc8cce8

                                                                                                                        SHA1

                                                                                                                        6bedc82418395705201c17a86a80619815833fd5

                                                                                                                        SHA256

                                                                                                                        2d66eb6ac35a4cebe4df0dd9efff13e662ff4e3d71a47f4314eac7ae167d1f67

                                                                                                                        SHA512

                                                                                                                        01bc9f996c2ec55a90179365d4d6ad6a4d70901f2f8532ac5b723fd48f1950f6d0a2ce4ed101ec8a22e0bfb25aeec37c64facc46dcb6128e0afe32b57fc518fa

                                                                                                                      • C:\Users\Admin\Desktop\dcrat\plugins\BuildInstallationTweaksPlugin\configuration.json

                                                                                                                        Filesize

                                                                                                                        124B

                                                                                                                        MD5

                                                                                                                        8de11d5b207e7c70c515a192dd2661ef

                                                                                                                        SHA1

                                                                                                                        9f3a1da6e0ec83c599c4f0f542de04789afecfe0

                                                                                                                        SHA256

                                                                                                                        5ff8575dd71be41c39869c1a6f451ba30190b6fa6546da39b0644bb98f27d19d

                                                                                                                        SHA512

                                                                                                                        6440d1561add2e02f3bd6608c9611b75fe26656ad1fe27ab12231baca2d8752c4f62fbe138398457f41b8bb7ec3152809175e4a0663c712249925ab074561f72

                                                                                                                      • C:\Users\Admin\Desktop\dcrat\plugins\ClientsStealer_native.plg

                                                                                                                        Filesize

                                                                                                                        197B

                                                                                                                        MD5

                                                                                                                        77090d6218e6a2f0f6f846f26545ed14

                                                                                                                        SHA1

                                                                                                                        ff0ce654d3d5383e3684de07a882178a5483a92f

                                                                                                                        SHA256

                                                                                                                        0d93e907d03a8a161deaf26d83221d8159e03768e47c67fac3aedf85d7733210

                                                                                                                        SHA512

                                                                                                                        e7953f96233d1d47540b9acc288ae85acc724777998e991d8129a7fd842a5dcf64083f7dc57a220f26826f3fe09fd47df6cb08434a21e519f748d06a6187084d

                                                                                                                      • C:\Users\Admin\Desktop\dcrat\plugins\ClientsStealer_native\configuration.json

                                                                                                                        Filesize

                                                                                                                        111B

                                                                                                                        MD5

                                                                                                                        a447c276d835363fb44ed5c27e716b02

                                                                                                                        SHA1

                                                                                                                        de1c9b06cb257bad1aeb97718e3837bcee36e993

                                                                                                                        SHA256

                                                                                                                        9bd962e5d852e0a0c8fb72606bfb0a21ec35e07a0fe34a6ddb22ac7be07fe401

                                                                                                                        SHA512

                                                                                                                        f26f169300f142c58bfa0ec27329bc8690141e960280e001e51a248cf86ad75af6029513aa8651e2f640cd2736982662be3742c597467fe199b5fb5e8cb1779e

                                                                                                                      • C:\Users\Admin\Desktop\dcrat\plugins\ClipboardLogger.plg

                                                                                                                        Filesize

                                                                                                                        238B

                                                                                                                        MD5

                                                                                                                        2aea94cd3a00ade5aeb6daf5ecee4ddb

                                                                                                                        SHA1

                                                                                                                        d4c6ad77d134f5951fbd9aabe7705b78b20c2207

                                                                                                                        SHA256

                                                                                                                        1026aa2bf76235de24e90ba49e661a6170364de8b675b650cd67b28e9c64be1b

                                                                                                                        SHA512

                                                                                                                        a042b99aa6e3f5bd3e58df3ccb7b251d93c7ed87f1dbd5cf2d508a0fc9267877c80bffa69bd533fb79ef062077e2c640e9a909862618b157d7a75bde3f13f987

                                                                                                                      • C:\Users\Admin\Desktop\dcrat\plugins\ClipboardLogger\configuration.json

                                                                                                                        Filesize

                                                                                                                        105B

                                                                                                                        MD5

                                                                                                                        9c4f8ac6df6dacc347e2671c8f6b4a62

                                                                                                                        SHA1

                                                                                                                        4436b88aa68303cd8a48402667d11802aa39937b

                                                                                                                        SHA256

                                                                                                                        143bbc799092c79f0230b2b990e8f2485836bd9cc682d2ac8f92262ccce0c58e

                                                                                                                        SHA512

                                                                                                                        3b53a7c9ccae040171033c66a98009c017c4df54baba008af76ef5b92e098c954c4dfb9ae971112d3536a1dbd9435830171fa748274ac43eb04a70f3c2a27d24

                                                                                                                      • C:\Users\Admin\Desktop\dcrat\plugins\Clipper.plg

                                                                                                                        Filesize

                                                                                                                        192B

                                                                                                                        MD5

                                                                                                                        f8b2b7f806e58527549377fa6154d993

                                                                                                                        SHA1

                                                                                                                        c75a9895a5ec2fc4670d1a5a13b7264e4707db4d

                                                                                                                        SHA256

                                                                                                                        d99a640efb37a5da0c89f270cadb7cfe2a7f8d9d22c63a0ed2b463bdcd202ec3

                                                                                                                        SHA512

                                                                                                                        fc5c349c995dc1c3d6e46d40b65a3d111c72ec71b064ec4297b41f3176097311d0bf10f7b4d07e3cfccfca46f2407974d6e01db8d601892b1977c6fcb66d3da1

                                                                                                                      • C:\Users\Admin\Desktop\dcrat\plugins\Clipper\configuration.json

                                                                                                                        Filesize

                                                                                                                        86B

                                                                                                                        MD5

                                                                                                                        e4c48f85060b023b74d50199870e526c

                                                                                                                        SHA1

                                                                                                                        0dbe75f1ea0e354fc98f56d4e4fa66cb57765298

                                                                                                                        SHA256

                                                                                                                        aa8f6257110045d5df7e79224bf32a0a3f6eb59743553871f2a7c1480beb7bea

                                                                                                                        SHA512

                                                                                                                        ee6b913023473aad5347b4a7f2e8325c1443d1591c79a4cb7ad6d845cd7ee3b08dcfd902d75538253504eb23fa71cb3e082cbfe7ce7719fa38b1db98804bac7e

                                                                                                                      • C:\Users\Admin\Desktop\dcrat\plugins\CountryBlackList.plg

                                                                                                                        Filesize

                                                                                                                        214B

                                                                                                                        MD5

                                                                                                                        c0494389ad56345479427327f3a105ab

                                                                                                                        SHA1

                                                                                                                        dae7cfe32343c0eca4f4045324bb5ba898e87bee

                                                                                                                        SHA256

                                                                                                                        d5bb7934e66b18abaa7bf5c385923142721a515919c17a855e69bf89f7cc511a

                                                                                                                        SHA512

                                                                                                                        ab1e1d4f4f6a6de5cb70a617caf9146f34a7d854a637a41887c452ceab0e3f20464f22d0fae936dc2db049aacbf09e9102e46075089b1aa7d7b69b851b0bb2dc

                                                                                                                      • C:\Users\Admin\Desktop\dcrat\plugins\CountryBlackList\configuration.json

                                                                                                                        Filesize

                                                                                                                        104B

                                                                                                                        MD5

                                                                                                                        8b9be085529d1d126811f78aa34656ae

                                                                                                                        SHA1

                                                                                                                        796a5a39e8cc496a3a7ea2066a4831c614c4a325

                                                                                                                        SHA256

                                                                                                                        8fc9fb90aa56ee75b6d021f178baa9dba961905e772c5cd16da36221cea61d12

                                                                                                                        SHA512

                                                                                                                        daf243f71d256c377956957314e035ab193e37875c388ee664113ec7ba8a381402b9ceecfab838b5d0edc5431065e78f79b7e39b010fcd2b4b75711d3a6109d3

                                                                                                                      • C:\Users\Admin\Desktop\dcrat\plugins\CrashLogger.plg

                                                                                                                        Filesize

                                                                                                                        181B

                                                                                                                        MD5

                                                                                                                        bb1bb69674cc872f932498e7e4713dfd

                                                                                                                        SHA1

                                                                                                                        e877f196c43f8ebbef1e37375dccc34ceb5742b0

                                                                                                                        SHA256

                                                                                                                        67312c6ca5890d398663b8c0fc704128f9cedb03cbca6750b646edc8107abed2

                                                                                                                        SHA512

                                                                                                                        b1219b0bf6692fcf86fb3091fedca2606466b04ebe15a3ee7916262ec17cdee724c0f0541e80c9c37fbee66a095edbd0c646994d728ddd5a4173c1433aab8042

                                                                                                                      • C:\Users\Admin\Desktop\dcrat\plugins\CrashLogger\configuration.json

                                                                                                                        Filesize

                                                                                                                        101B

                                                                                                                        MD5

                                                                                                                        0a127fa54f700f8684c050a55a808cd0

                                                                                                                        SHA1

                                                                                                                        91099fe6e3effcb4a4698c5a285ed71cf4fb288b

                                                                                                                        SHA256

                                                                                                                        23c26b3316cb33cbaf01d46e02063203f3b5f57a9a20cdd9c85fc9873ea6a828

                                                                                                                        SHA512

                                                                                                                        41eb2ca6d669cb1784a3a7a49235ce3060c6c64a6b09aaf8efbd9ddc7081c192ede27ae6ad8cd96bdf8bd28d9243989fc40abb2e1cfa6895daec1620fe632535

                                                                                                                      • C:\Users\Admin\Desktop\dcrat\plugins\CryptoStealer.plg

                                                                                                                        Filesize

                                                                                                                        365B

                                                                                                                        MD5

                                                                                                                        7d0e8191fcb1475a4b5fb85c29345363

                                                                                                                        SHA1

                                                                                                                        a590571d720d6d6a468f6fd0a250a55a12399f24

                                                                                                                        SHA256

                                                                                                                        0221a13049e8f79f3499939eb75c6ceaf0be835418e92578ba3a7abd649f7310

                                                                                                                        SHA512

                                                                                                                        8584e3072e75b75675f557e69c17f60c981606e6ea006e630e5551f647c604cba5ee35f6fb3c620705ea87787c8485853ca729069de5b2e5ca74dd6720717a6a

                                                                                                                      • C:\Users\Admin\Desktop\dcrat\plugins\CryptoStealer\configuration.json

                                                                                                                        Filesize

                                                                                                                        98B

                                                                                                                        MD5

                                                                                                                        5e2149e2a884141db7aeb1486516126c

                                                                                                                        SHA1

                                                                                                                        b992417484ad0f38150de4f3d02d1771037454ef

                                                                                                                        SHA256

                                                                                                                        4d51e75e2d7ebda91ba80e14462bb0482d4fd950f755c9255da86c5da7774632

                                                                                                                        SHA512

                                                                                                                        3b453bf7ff5d6b7debdb174516b303a67f3232c284bef4206c49f8d7751818df86a6bf2de88cfe7bf5650ce97195553ed90852fd783950131ddb5f3f1950f43f

                                                                                                                      • C:\Users\Admin\Desktop\dcrat\plugins\DisableUAC.plg

                                                                                                                        Filesize

                                                                                                                        207B

                                                                                                                        MD5

                                                                                                                        6e676e43b744fd7d4e52d1ba98675514

                                                                                                                        SHA1

                                                                                                                        e32f3e1317d3be97b36a2ce82da912081a37fe51

                                                                                                                        SHA256

                                                                                                                        ad6955b9032ab30f648c3c9de6b13b944ea9e11735d6e5e569f94e25c5a69f6d

                                                                                                                        SHA512

                                                                                                                        2755225499cb506890e56b38efe4e0de9f00b41684db40595a0f26101b6a6b54dabb2c8f9c4b5539173865e654f4d69fcdb7f9927cc3d084b878a22ea891d110

                                                                                                                      • C:\Users\Admin\Desktop\dcrat\plugins\DisableUAC\configuration.json

                                                                                                                        Filesize

                                                                                                                        100B

                                                                                                                        MD5

                                                                                                                        2b2a2dbd6ae8af2a46fcb420ca4eebc6

                                                                                                                        SHA1

                                                                                                                        4ece6dfd41a3a3a374982b77096fa756413f0403

                                                                                                                        SHA256

                                                                                                                        ba65b7b97a8d118c10c1fb839646d0512af0501e20aa00cc7f27b25fd564b9f3

                                                                                                                        SHA512

                                                                                                                        85ec63ff01c45eda1efaa591c1fb53e3e12d000f441c26fc13bb46b380e0f2efe472f9f9944b15ad67b126f85ea7aad2db637184b91d3213bfedef68d7e79107

                                                                                                                      • C:\Users\Admin\Desktop\dcrat\plugins\FakeSteamWindows.plg

                                                                                                                        Filesize

                                                                                                                        210B

                                                                                                                        MD5

                                                                                                                        da61683b55b7e89cf5ae23960320980a

                                                                                                                        SHA1

                                                                                                                        caff3d5419b6486ae4e89bb800c681aa303f39d0

                                                                                                                        SHA256

                                                                                                                        2b0d91b02e0249e0f2a19b0ec154c849d08611aa6e8c731317ef6155108ce7ec

                                                                                                                        SHA512

                                                                                                                        f00437c80e8658a4b0ff3c8a2a8014eeeb4d38cc4785d83595e712d61160700a6edc05667c3467b871ab640ee3d80f35cfd24ae2eee17e4d6b48191c4e76d9d5

                                                                                                                      • C:\Users\Admin\Desktop\dcrat\plugins\FakeSteamWindows\configuration.json

                                                                                                                        Filesize

                                                                                                                        106B

                                                                                                                        MD5

                                                                                                                        5d9116cbd984428cccfa8c6e20d6f0f1

                                                                                                                        SHA1

                                                                                                                        3cced48d366ff4088a4299c4bc18925090a4ed38

                                                                                                                        SHA256

                                                                                                                        b4bc6ab3ba0db5f3984278fd8d651396636812adf0125a501079d0e2b9b2317e

                                                                                                                        SHA512

                                                                                                                        66beb3ac519219ce469ea7e115c687940913214fd37ba4b9f4197a069d10fe0a07c9e7cc33d6702aa5adf8d865919f269925fe2e6813cdf9d71c077e9b99f3a7

                                                                                                                      • C:\Users\Admin\Desktop\dcrat\plugins\FileGrabberPlugin.plg

                                                                                                                        Filesize

                                                                                                                        231B

                                                                                                                        MD5

                                                                                                                        216ebf1bdbc0de1f212832987f8bbe47

                                                                                                                        SHA1

                                                                                                                        9787abc1f775be1a971ac670150e3229b5961e0b

                                                                                                                        SHA256

                                                                                                                        f6944fc54b9611c9dd7050235a928aebce4158eebec2f9184d445c4435495c21

                                                                                                                        SHA512

                                                                                                                        0bc7c96f0ab833da5efcfe8e61db9434e8f00aea14965739853ee871689678e262d4a79010ee581767ba42260250ea146e4717e346ce07b823e969b49ff8124d

                                                                                                                      • C:\Users\Admin\Desktop\dcrat\plugins\FileGrabberPlugin\configuration.json

                                                                                                                        Filesize

                                                                                                                        94B

                                                                                                                        MD5

                                                                                                                        4d2c47275bfa55c305257974b3b02cbb

                                                                                                                        SHA1

                                                                                                                        7d02d9784a080fe804175dedf51cbd6c7bfa345d

                                                                                                                        SHA256

                                                                                                                        de8696cb1d37c484482993b4af3264ca5d427d0ade923237e4040752cc73c051

                                                                                                                        SHA512

                                                                                                                        fcb04a7efa58f8228738aa244f7e6438c7d059b09f1439afd6f2bc86e69ea6d0d20e3136c537a3574f2ec5d1312fcde5279cc85892ce4436114a2add7d9b69cd

                                                                                                                      • C:\Users\Admin\Desktop\dcrat\plugins\FileSearcher.plg

                                                                                                                        Filesize

                                                                                                                        268B

                                                                                                                        MD5

                                                                                                                        76f8b470737338310491265025e0c71c

                                                                                                                        SHA1

                                                                                                                        d500ec75aec69dbeef62d79273696f7eb2543b8b

                                                                                                                        SHA256

                                                                                                                        4ce3a1379cb93cb25fbefb15994af4b064e582578a101186b38d7b403a638847

                                                                                                                        SHA512

                                                                                                                        d84a1d49f7d50317449ce96a39102d3e39525098f5195d55e48e49cf3ec154e0119e4218e27f1dd36832abeae4889886247cb2e47b3a9b2ab0e427da301823b8

                                                                                                                      • C:\Users\Admin\Desktop\dcrat\plugins\FileSearcher\configuration.json

                                                                                                                        Filesize

                                                                                                                        102B

                                                                                                                        MD5

                                                                                                                        4b13366c8bc0890db6cf99cea80423ec

                                                                                                                        SHA1

                                                                                                                        7820a2c397fcf7eb9979da57ed4dea864836eb38

                                                                                                                        SHA256

                                                                                                                        b2e8c48fe7f87445fff8370e02803b71c06dfb7c3674ad83592c0186ba583f8c

                                                                                                                        SHA512

                                                                                                                        a76204eaaa0114a4112a3ccebf4b469f4eddd26951ba4337a49f5fcb695e41c01e9cbea34912e92821265f920fc31f7b6a06c41675fe3255f19ca5bfe7a0301d

                                                                                                                      • C:\Users\Admin\Desktop\dcrat\plugins\ForceAdmin.plg

                                                                                                                        Filesize

                                                                                                                        238B

                                                                                                                        MD5

                                                                                                                        9d34cdbe36c7c1d9635255000995efad

                                                                                                                        SHA1

                                                                                                                        87f3cc2914cd04e20246e3cc8296c347c85d91d1

                                                                                                                        SHA256

                                                                                                                        4d45530a98ab32ff2bc6a3fd1d91fea4b5f6d7ce7aca17553b50fca9d78d2d13

                                                                                                                        SHA512

                                                                                                                        3fcd3d659b72cf9f5baa00c1108bb3e6ef26cb7fd700d77e217ddb5b1134564a70730075d263e330558bc628ed5fca34454eeb830f44e0403a02377fec40e75d

                                                                                                                      • C:\Users\Admin\Desktop\dcrat\plugins\ForceAdmin\configuration.json

                                                                                                                        Filesize

                                                                                                                        100B

                                                                                                                        MD5

                                                                                                                        e82af5243b5f44e846974c4c01fa09db

                                                                                                                        SHA1

                                                                                                                        663a2afd36867792809214b9eb3c1a2f40844c2b

                                                                                                                        SHA256

                                                                                                                        1eaab47bcfdb68424c5ed6710acf6f2902eafc266b3da121bd514cff933a96dd

                                                                                                                        SHA512

                                                                                                                        9cf1cd16bf8eb1b1dfbd730ae2cb861431e8e0049b2c88ec240f4d85f0c5ac8e2d9ccc829bea9e9002e90926ee0e920f072302a48f71d00c6b19c0f747612460

                                                                                                                      • C:\Users\Admin\Desktop\dcrat\plugins\Fun_native.plg

                                                                                                                        Filesize

                                                                                                                        162B

                                                                                                                        MD5

                                                                                                                        dbb324f7c7399f28cdd5a82a08882ef3

                                                                                                                        SHA1

                                                                                                                        58558c379c06a58f5e70e509073baef5d8a56aa6

                                                                                                                        SHA256

                                                                                                                        a8c4f392de4e778a1f3106988d603f42c54aa00bccedf7a93d468fcd53d1aca0

                                                                                                                        SHA512

                                                                                                                        b72b8e597403b014b7254406665383a4960d095fb3067d7f3d7756eb403815e62effd143b647886ee3a51efc54da25012e73bb53772feac191a5f1b69340f981

                                                                                                                      • C:\Users\Admin\Desktop\dcrat\plugins\Fun_native\configuration.json

                                                                                                                        Filesize

                                                                                                                        100B

                                                                                                                        MD5

                                                                                                                        2f3433224600a3cdc3f9b9115599a530

                                                                                                                        SHA1

                                                                                                                        20d13bfe5499ba8cad0aa3026ab907da80091c5c

                                                                                                                        SHA256

                                                                                                                        842fb8642e278e442e15bdd5531cac79dd37cff3496f0614982af7bae5f93e0b

                                                                                                                        SHA512

                                                                                                                        f0b1879befc9c0d7de04ad18ea8ae88290f735d260b181b92571618fe4c8887d08728e81e4f089ec763ef7ac5f5ecb3a37d8552ac86c705e2c3263ece420f368

                                                                                                                      • C:\Users\Admin\Desktop\dcrat\plugins\HiddenRemoteDesktop_native.plg

                                                                                                                        Filesize

                                                                                                                        209B

                                                                                                                        MD5

                                                                                                                        b46f4f8e1f4371590e7fefa16ab0d243

                                                                                                                        SHA1

                                                                                                                        d135c0268e112e6f5afbc4eb8df9ea5e5f29cbdf

                                                                                                                        SHA256

                                                                                                                        7164d4f82c5d759d5fda1dbaa380faac4fd8f83fcda2ee068bcb6c324e1b6dc3

                                                                                                                        SHA512

                                                                                                                        8438ab6734c07d43d4f46fef8f68aa3ce830434f8690f781f8b6e25069d6fa09451c22aad50d93d6d252b6b5bca57b1f4c1f37bb4f571f16044d79bcb5079c22

                                                                                                                      • C:\Users\Admin\Desktop\dcrat\plugins\HiddenRemoteDesktop_native\configuration.json

                                                                                                                        Filesize

                                                                                                                        116B

                                                                                                                        MD5

                                                                                                                        40fe420aad7deebae11d6b6509daabd0

                                                                                                                        SHA1

                                                                                                                        4db41dadc85894c5476290594e821d2ce44488a2

                                                                                                                        SHA256

                                                                                                                        517358ce35d73f02ba6b9bd13d77eb895512e9118f530f4380891011ed336246

                                                                                                                        SHA512

                                                                                                                        2ac9e9ed93e1f7596a2688fb39a2fafd0afdacc8f6ce277830a2eec8aa5225b7cc95e04ee1334e63ecaaa9eff6f6932f16331afbeaaf0d9cb312a2f100c97986

                                                                                                                      • C:\Users\Admin\Desktop\dcrat\plugins\HostsEditor.plg

                                                                                                                        Filesize

                                                                                                                        225B

                                                                                                                        MD5

                                                                                                                        731d2ed472cfe27dc5a9fba3cd7cbf4d

                                                                                                                        SHA1

                                                                                                                        3c62a0e3a26d98f37ff526b7ff6624a1a89a0b11

                                                                                                                        SHA256

                                                                                                                        51b6d2d569d24b8cab87925089c33904920b4b6739e0c285f4edda4c0f3740c1

                                                                                                                        SHA512

                                                                                                                        7f8458ea3d1807411ea9e0f469544412761e2977de80c3b774f4ad20111e6cba5a4d1aa4cc56ef7bc13f5d0d9fdb416daa38f6520fe696b1ee810966f8ea18a5

                                                                                                                      • C:\Users\Admin\Desktop\dcrat\plugins\HostsEditor\configuration.json

                                                                                                                        Filesize

                                                                                                                        94B

                                                                                                                        MD5

                                                                                                                        8c00555026bf5da18dc07d101db6cdae

                                                                                                                        SHA1

                                                                                                                        43ad16de3d9ac1c03c52b96cfdea51948ee6720e

                                                                                                                        SHA256

                                                                                                                        43a5e423804b6380f8b79d81f2a5b774831a530355c1b241e50880240dca6513

                                                                                                                        SHA512

                                                                                                                        4d61df12093a6338f57d79b5becb00ea1916a8dd3c4bdd88b43924584572545aee56f4ed31d8c8cdb178acc694c1cdbfc68e59421f10ccefb1b9733f577fb5aa

                                                                                                                      • C:\Users\Admin\Desktop\dcrat\plugins\Keylogger_native.plg

                                                                                                                        Filesize

                                                                                                                        179B

                                                                                                                        MD5

                                                                                                                        f00a5e16cfab8d3d16a6faa558a98cba

                                                                                                                        SHA1

                                                                                                                        755610d639a93ccc220e5c8f9bc7d9c35f315e8f

                                                                                                                        SHA256

                                                                                                                        db96f9e2c164b733e883ae0a9e7921468248e98b063776df65ecb947f2cda52a

                                                                                                                        SHA512

                                                                                                                        e5515bc93d8812a7dac6be8a02a77f72e62a3385ff50391c42e82f6266f04980ffba03214104d9d8dd0365178a9b33d488ef71fb2cfd859e444df220e9540303

                                                                                                                      • C:\Users\Admin\Desktop\dcrat\plugins\chat_native.plg

                                                                                                                        Filesize

                                                                                                                        164B

                                                                                                                        MD5

                                                                                                                        7293ef71d2371dd20997ff0d99a1edd3

                                                                                                                        SHA1

                                                                                                                        f380ec631fa6b6ed4f13ed497988bc638eef850b

                                                                                                                        SHA256

                                                                                                                        6e6ad73d10b50a48e2b314bd665e87c0c7f15c84f561be55bc44445021c6f103

                                                                                                                        SHA512

                                                                                                                        8a35244016543dc1a835a069ca287b97678cbc426108a964024775dcd0934edadd3f22c731707e8624d2d1c59ae6b68d1f42eee3a87d1647d5806d0129c3c438

                                                                                                                      • C:\Users\Admin\Desktop\dcrat\plugins\chat_native\configuration.json

                                                                                                                        Filesize

                                                                                                                        101B

                                                                                                                        MD5

                                                                                                                        5d4b4f6d829676eace149f4c50003829

                                                                                                                        SHA1

                                                                                                                        18379611c88af3c7e0ebf3ccf1ec4edbd04ce83e

                                                                                                                        SHA256

                                                                                                                        5905a40b34bfbca66378e60dac23ef06bdf8392f1126f72509368e3f683cb100

                                                                                                                        SHA512

                                                                                                                        a36774efa7f9352ff517935f12b97e5b19494563ac38e5623c24a4f7753378337165608be24848767b5fa954652cbe0bbb6c5c443d5caf4b2bb61a0051a55b5e

                                                                                                                      • C:\Users\Admin\Downloads\rgAaMAj3.rar.part

                                                                                                                        Filesize

                                                                                                                        47.3MB

                                                                                                                        MD5

                                                                                                                        01821717f0eeec608936e4db3cb2f375

                                                                                                                        SHA1

                                                                                                                        4c8245e1064bdfcb3584b64d35bee26f2c30aaa5

                                                                                                                        SHA256

                                                                                                                        60064a5d97f4ac6fafa5fdc364f29e22711bf1edd6b86696b4fbad4b1edb1416

                                                                                                                        SHA512

                                                                                                                        d9546d11c0677ab51e7f4558f1d5278743b4dadec5124a431d5f4390efe7501141896df4f3232f59edafd41a727bd0a513fb3ff0133228b24190e7e567a18f42

                                                                                                                      • memory/4460-1776-0x00000000015A0000-0x00000000015B0000-memory.dmp

                                                                                                                        Filesize

                                                                                                                        64KB

                                                                                                                      • memory/4460-1835-0x000000001B820000-0x000000001B830000-memory.dmp

                                                                                                                        Filesize

                                                                                                                        64KB

                                                                                                                      • memory/4460-1741-0x00000000008A0000-0x0000000000C2E000-memory.dmp

                                                                                                                        Filesize

                                                                                                                        3.6MB

                                                                                                                      • memory/4460-1873-0x000000001BF50000-0x000000001BF9E000-memory.dmp

                                                                                                                        Filesize

                                                                                                                        312KB

                                                                                                                      • memory/4460-1767-0x00000000015F0000-0x000000000160C000-memory.dmp

                                                                                                                        Filesize

                                                                                                                        112KB

                                                                                                                      • memory/4460-1768-0x000000001BDF0000-0x000000001BE40000-memory.dmp

                                                                                                                        Filesize

                                                                                                                        320KB

                                                                                                                      • memory/4460-1770-0x0000000001590000-0x00000000015A0000-memory.dmp

                                                                                                                        Filesize

                                                                                                                        64KB

                                                                                                                      • memory/4460-1773-0x0000000001610000-0x0000000001628000-memory.dmp

                                                                                                                        Filesize

                                                                                                                        96KB

                                                                                                                      • memory/4460-1761-0x00000000015C0000-0x00000000015E6000-memory.dmp

                                                                                                                        Filesize

                                                                                                                        152KB

                                                                                                                      • memory/4460-1780-0x00000000015B0000-0x00000000015C0000-memory.dmp

                                                                                                                        Filesize

                                                                                                                        64KB

                                                                                                                      • memory/4460-1789-0x0000000002EE0000-0x0000000002EEE000-memory.dmp

                                                                                                                        Filesize

                                                                                                                        56KB

                                                                                                                      • memory/4460-1794-0x0000000002F20000-0x0000000002F32000-memory.dmp

                                                                                                                        Filesize

                                                                                                                        72KB

                                                                                                                      • memory/4460-1801-0x0000000002EF0000-0x0000000002F00000-memory.dmp

                                                                                                                        Filesize

                                                                                                                        64KB

                                                                                                                      • memory/4460-1805-0x000000001B840000-0x000000001B856000-memory.dmp

                                                                                                                        Filesize

                                                                                                                        88KB

                                                                                                                      • memory/4460-1809-0x000000001B860000-0x000000001B872000-memory.dmp

                                                                                                                        Filesize

                                                                                                                        72KB

                                                                                                                      • memory/4460-1828-0x000000001C370000-0x000000001C898000-memory.dmp

                                                                                                                        Filesize

                                                                                                                        5.2MB

                                                                                                                      • memory/4460-1830-0x0000000002F00000-0x0000000002F0E000-memory.dmp

                                                                                                                        Filesize

                                                                                                                        56KB

                                                                                                                      • memory/4460-1765-0x0000000001330000-0x000000000133E000-memory.dmp

                                                                                                                        Filesize

                                                                                                                        56KB

                                                                                                                      • memory/4460-1852-0x000000001BEA0000-0x000000001BEFA000-memory.dmp

                                                                                                                        Filesize

                                                                                                                        360KB

                                                                                                                      • memory/4460-1847-0x000000001B830000-0x000000001B840000-memory.dmp

                                                                                                                        Filesize

                                                                                                                        64KB

                                                                                                                      • memory/4460-1858-0x000000001B880000-0x000000001B88E000-memory.dmp

                                                                                                                        Filesize

                                                                                                                        56KB

                                                                                                                      • memory/4460-1863-0x000000001B890000-0x000000001B8A0000-memory.dmp

                                                                                                                        Filesize

                                                                                                                        64KB

                                                                                                                      • memory/4460-1866-0x000000001B9B0000-0x000000001B9BE000-memory.dmp

                                                                                                                        Filesize

                                                                                                                        56KB

                                                                                                                      • memory/4460-1868-0x000000001BE40000-0x000000001BE58000-memory.dmp

                                                                                                                        Filesize

                                                                                                                        96KB

                                                                                                                      • memory/4460-1871-0x000000001B9C0000-0x000000001B9CC000-memory.dmp

                                                                                                                        Filesize

                                                                                                                        48KB

                                                                                                                      • memory/4932-2002-0x000001F15F0B0000-0x000001F15F0D2000-memory.dmp

                                                                                                                        Filesize

                                                                                                                        136KB

                                                                                                                      • memory/5528-1380-0x00000232F4730000-0x00000232F4731000-memory.dmp

                                                                                                                        Filesize

                                                                                                                        4KB

                                                                                                                      • memory/5528-1363-0x00000232F4730000-0x00000232F4731000-memory.dmp

                                                                                                                        Filesize

                                                                                                                        4KB

                                                                                                                      • memory/5528-1230-0x00000232F4730000-0x00000232F4731000-memory.dmp

                                                                                                                        Filesize

                                                                                                                        4KB

                                                                                                                      • memory/5528-1221-0x00000232F4730000-0x00000232F4731000-memory.dmp

                                                                                                                        Filesize

                                                                                                                        4KB

                                                                                                                      • memory/5528-1199-0x00000232F4730000-0x00000232F4731000-memory.dmp

                                                                                                                        Filesize

                                                                                                                        4KB

                                                                                                                      • memory/5528-1147-0x00000232F4730000-0x00000232F4731000-memory.dmp

                                                                                                                        Filesize

                                                                                                                        4KB

                                                                                                                      • memory/5528-1126-0x00000232F4730000-0x00000232F4731000-memory.dmp

                                                                                                                        Filesize

                                                                                                                        4KB

                                                                                                                      • memory/5528-1076-0x00000232F4730000-0x00000232F4731000-memory.dmp

                                                                                                                        Filesize

                                                                                                                        4KB

                                                                                                                      • memory/5528-1376-0x00000232F4730000-0x00000232F4731000-memory.dmp

                                                                                                                        Filesize

                                                                                                                        4KB

                                                                                                                      • memory/6124-1052-0x0000000000400000-0x000000000041F000-memory.dmp

                                                                                                                        Filesize

                                                                                                                        124KB