dcrat | cca041e34546ca2022b7abbd6958921809b717c0c399832f1a162412d3be07b9

Analysis

max time kernel
149s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
18-05-2024 22:08

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Total order confirmation April 10 2017.exe
Size

1.5MB
MD5

d31daa3adb9285b7024438799d3a7fc8
SHA1

3a4a3684c7a475bae5b47aad1ad750996add764b
SHA256

ebdb910c35ce8b21168a4bda0dae16b3a64f66670763be89a81e322d8ddab431
SHA512

9d3febe2e0603e0f6d040dff42b194fa2be309260724f9bfc879fd72990718145a239a6817b8fbcf1fd1c2e3209896c94282fc88e9bc61d064b393f0b271d8dc
SSDEEP

49152:41wV28FzbXmsC/C2d4A7k5r3HN2i54kZW:VVvFzisC/r4UkJ3HN2i54mW

Score

10^/10

dcrat luminosity pony collection discovery infostealer persistence rat spyware stealer upx

Malware Config

Extracted

Family

pony

http://tcoolonline.mobi/wp-includes/css/Panel/gate.php

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat

Luminosity 2 IoCs

Luminosity is a RAT family that was on sale, while claiming to be a system administration utility.

rat luminosity

Processes:

Total order confirmation April 10 2017.exeschtasks.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Software\Microsoft\SystemCertificates\CA	Total order confirmation April 10 2017.exe
2840	schtasks.exe

Pony,Fareit
Pony is a Remote Access Trojan application that steals information.
rat spyware stealer pony

Checks computer location settings 2 TTPs 3 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

Total order confirmation April 10 2017.exesvchost.exesvchost.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Control Panel\International\Geo\Nation	Total order confirmation April 10 2017.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Control Panel\International\Geo\Nation	svchost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Control Panel\International\Geo\Nation	svchost.exe

Executes dropped EXE 7 IoCs

Processes:

datalog.exesvchost.exedatalog.exesvchost.exesvchost.execlient.execlient.exe

pid process

2320 datalog.exe
2720 svchost.exe
4172 datalog.exe
1584 svchost.exe
3260 svchost.exe
948 client.exe
3020 client.exe
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral2/memory/3260-45-0x0000000000400000-0x000000000041D000-memory.dmp	upx
behavioral2/memory/3260-44-0x0000000000400000-0x000000000041D000-memory.dmp	upx
behavioral2/memory/3260-42-0x0000000000400000-0x000000000041D000-memory.dmp	upx

Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs

collection

Email Collection

T1114

Processes:

svchost.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts	svchost.exe

Accesses Microsoft Outlook profiles 1 TTPs 1 IoCs

collection

Email Collection

T1114

Processes:

svchost.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook	svchost.exe

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

svchost.exeREG.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Update = "C:\\Users\\Admin\\AppData\\Roaming\\svchost.exe"	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Update = "C:\\Users\\Admin\\AppData\\Roaming\\svchost.exe"	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Client Monitor = "cmd /c \"start \"Client Monitor\" \"C:\\Program Files (x86)\\Client\\client.exe\""	REG.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Suspicious use of SetThreadContext 1 IoCs

Processes:

svchost.exe

description pid process target process

PID 2720 set thread context of 3260 2720 svchost.exe svchost.exe

description	pid	process	target process
PID 2720 set thread context of 3260	2720	svchost.exe	svchost.exe

Drops file in Program Files directory 2 IoCs

Processes:

datalog.exe

description	ioc	process
File created	C:\Program Files (x86)\Client\client.exe	datalog.exe
File opened for modification	C:\Program Files (x86)\Client\client.exe	datalog.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task/Job
T1053

Processes:

schtasks.exe

pid process

2840 schtasks.exe

pid	process
2840	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

datalog.exesvchost.execmd.execlient.exe

pid	process
2320	datalog.exe
2320	datalog.exe
2320	datalog.exe
2320	datalog.exe
2320	datalog.exe
2320	datalog.exe
2320	datalog.exe
2320	datalog.exe
2320	datalog.exe
2320	datalog.exe
2720	svchost.exe
2720	svchost.exe
2320	datalog.exe
2320	datalog.exe
2320	datalog.exe
2320	datalog.exe
2320	datalog.exe
2320	datalog.exe
2320	datalog.exe
2320	datalog.exe
2320	datalog.exe
2320	datalog.exe
2320	datalog.exe
2320	datalog.exe
2320	datalog.exe
2320	datalog.exe
2320	datalog.exe
2320	datalog.exe
2320	datalog.exe
2320	datalog.exe
2320	datalog.exe
2320	datalog.exe
2268	cmd.exe
2268	cmd.exe
2320	datalog.exe
2320	datalog.exe
2320	datalog.exe
2320	datalog.exe
2320	datalog.exe
2320	datalog.exe
2320	datalog.exe
2320	datalog.exe
2320	datalog.exe
2320	datalog.exe
2320	datalog.exe
2320	datalog.exe
2320	datalog.exe
2320	datalog.exe
2320	datalog.exe
2320	datalog.exe
2320	datalog.exe
2320	datalog.exe
2320	datalog.exe
2320	datalog.exe
2320	datalog.exe
2320	datalog.exe
948	client.exe
948	client.exe
2320	datalog.exe
2320	datalog.exe
2320	datalog.exe
2320	datalog.exe
2320	datalog.exe
2320	datalog.exe

Suspicious use of AdjustPrivilegeToken 51 IoCs

Processes:

Total order confirmation April 10 2017.exesvchost.exesvchost.exedatalog.exe

description	pid	process
Token: SeDebugPrivilege	2944	Total order confirmation April 10 2017.exe
Token: SeDebugPrivilege	2720	svchost.exe
Token: SeImpersonatePrivilege	3260	svchost.exe
Token: SeTcbPrivilege	3260	svchost.exe
Token: SeChangeNotifyPrivilege	3260	svchost.exe
Token: SeCreateTokenPrivilege	3260	svchost.exe
Token: SeBackupPrivilege	3260	svchost.exe
Token: SeRestorePrivilege	3260	svchost.exe
Token: SeIncreaseQuotaPrivilege	3260	svchost.exe
Token: SeAssignPrimaryTokenPrivilege	3260	svchost.exe
Token: SeImpersonatePrivilege	3260	svchost.exe
Token: SeTcbPrivilege	3260	svchost.exe
Token: SeChangeNotifyPrivilege	3260	svchost.exe
Token: SeCreateTokenPrivilege	3260	svchost.exe
Token: SeBackupPrivilege	3260	svchost.exe
Token: SeRestorePrivilege	3260	svchost.exe
Token: SeIncreaseQuotaPrivilege	3260	svchost.exe
Token: SeAssignPrimaryTokenPrivilege	3260	svchost.exe
Token: SeImpersonatePrivilege	3260	svchost.exe
Token: SeTcbPrivilege	3260	svchost.exe
Token: SeChangeNotifyPrivilege	3260	svchost.exe
Token: SeCreateTokenPrivilege	3260	svchost.exe
Token: SeBackupPrivilege	3260	svchost.exe
Token: SeRestorePrivilege	3260	svchost.exe
Token: SeIncreaseQuotaPrivilege	3260	svchost.exe
Token: SeAssignPrimaryTokenPrivilege	3260	svchost.exe
Token: SeImpersonatePrivilege	3260	svchost.exe
Token: SeTcbPrivilege	3260	svchost.exe
Token: SeChangeNotifyPrivilege	3260	svchost.exe
Token: SeCreateTokenPrivilege	3260	svchost.exe
Token: SeBackupPrivilege	3260	svchost.exe
Token: SeRestorePrivilege	3260	svchost.exe
Token: SeIncreaseQuotaPrivilege	3260	svchost.exe
Token: SeAssignPrimaryTokenPrivilege	3260	svchost.exe
Token: SeImpersonatePrivilege	3260	svchost.exe
Token: SeTcbPrivilege	3260	svchost.exe
Token: SeChangeNotifyPrivilege	3260	svchost.exe
Token: SeCreateTokenPrivilege	3260	svchost.exe
Token: SeBackupPrivilege	3260	svchost.exe
Token: SeRestorePrivilege	3260	svchost.exe
Token: SeIncreaseQuotaPrivilege	3260	svchost.exe
Token: SeAssignPrimaryTokenPrivilege	3260	svchost.exe
Token: SeImpersonatePrivilege	3260	svchost.exe
Token: SeTcbPrivilege	3260	svchost.exe
Token: SeChangeNotifyPrivilege	3260	svchost.exe
Token: SeCreateTokenPrivilege	3260	svchost.exe
Token: SeBackupPrivilege	3260	svchost.exe
Token: SeRestorePrivilege	3260	svchost.exe
Token: SeIncreaseQuotaPrivilege	3260	svchost.exe
Token: SeAssignPrimaryTokenPrivilege	3260	svchost.exe
Token: SeDebugPrivilege	2320	datalog.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

datalog.exe

pid process

2320 datalog.exe

Suspicious use of WriteProcessMemory 49 IoCs

Processes:

Total order confirmation April 10 2017.exesvchost.exesvchost.exedatalog.exe

description	pid	process	target process
PID 2944 wrote to memory of 2320	2944	Total order confirmation April 10 2017.exe	datalog.exe
PID 2944 wrote to memory of 2320	2944	Total order confirmation April 10 2017.exe	datalog.exe
PID 2944 wrote to memory of 2320	2944	Total order confirmation April 10 2017.exe	datalog.exe
PID 2944 wrote to memory of 2720	2944	Total order confirmation April 10 2017.exe	svchost.exe
PID 2944 wrote to memory of 2720	2944	Total order confirmation April 10 2017.exe	svchost.exe
PID 2944 wrote to memory of 2720	2944	Total order confirmation April 10 2017.exe	svchost.exe
PID 2720 wrote to memory of 4172	2720	svchost.exe	datalog.exe
PID 2720 wrote to memory of 4172	2720	svchost.exe	datalog.exe
PID 2720 wrote to memory of 4172	2720	svchost.exe	datalog.exe
PID 2720 wrote to memory of 1584	2720	svchost.exe	svchost.exe
PID 2720 wrote to memory of 1584	2720	svchost.exe	svchost.exe
PID 2720 wrote to memory of 1584	2720	svchost.exe	svchost.exe
PID 2720 wrote to memory of 3260	2720	svchost.exe	svchost.exe
PID 2720 wrote to memory of 3260	2720	svchost.exe	svchost.exe
PID 2720 wrote to memory of 3260	2720	svchost.exe	svchost.exe
PID 2720 wrote to memory of 3260	2720	svchost.exe	svchost.exe
PID 2720 wrote to memory of 3260	2720	svchost.exe	svchost.exe
PID 2720 wrote to memory of 3260	2720	svchost.exe	svchost.exe
PID 2720 wrote to memory of 3260	2720	svchost.exe	svchost.exe
PID 2720 wrote to memory of 3260	2720	svchost.exe	svchost.exe
PID 3260 wrote to memory of 2268	3260	svchost.exe	cmd.exe
PID 3260 wrote to memory of 2268	3260	svchost.exe	cmd.exe
PID 3260 wrote to memory of 2268	3260	svchost.exe	cmd.exe
PID 2320 wrote to memory of 2840	2320	datalog.exe	schtasks.exe
PID 2320 wrote to memory of 2840	2320	datalog.exe	schtasks.exe
PID 2320 wrote to memory of 2840	2320	datalog.exe	schtasks.exe
PID 2320 wrote to memory of 2720	2320	datalog.exe	svchost.exe
PID 2320 wrote to memory of 2720	2320	datalog.exe	svchost.exe
PID 2320 wrote to memory of 2720	2320	datalog.exe	svchost.exe
PID 2320 wrote to memory of 2720	2320	datalog.exe	svchost.exe
PID 2320 wrote to memory of 2720	2320	datalog.exe	svchost.exe
PID 2320 wrote to memory of 2268	2320	datalog.exe	cmd.exe
PID 2320 wrote to memory of 2268	2320	datalog.exe	cmd.exe
PID 2320 wrote to memory of 2268	2320	datalog.exe	cmd.exe
PID 2320 wrote to memory of 2268	2320	datalog.exe	cmd.exe
PID 2320 wrote to memory of 2268	2320	datalog.exe	cmd.exe
PID 2320 wrote to memory of 948	2320	datalog.exe	client.exe
PID 2320 wrote to memory of 948	2320	datalog.exe	client.exe
PID 2320 wrote to memory of 948	2320	datalog.exe	client.exe
PID 2320 wrote to memory of 948	2320	datalog.exe	client.exe
PID 2320 wrote to memory of 948	2320	datalog.exe	client.exe
PID 2320 wrote to memory of 1684	2320	datalog.exe	REG.exe
PID 2320 wrote to memory of 1684	2320	datalog.exe	REG.exe
PID 2320 wrote to memory of 1684	2320	datalog.exe	REG.exe
PID 2320 wrote to memory of 3020	2320	datalog.exe	client.exe
PID 2320 wrote to memory of 3020	2320	datalog.exe	client.exe
PID 2320 wrote to memory of 3020	2320	datalog.exe	client.exe
PID 2320 wrote to memory of 3020	2320	datalog.exe	client.exe
PID 2320 wrote to memory of 3020	2320	datalog.exe	client.exe

outlook_win_path 1 IoCs

Processes:

svchost.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook	svchost.exe

C:\Users\Admin\AppData\Local\Temp\Total order confirmation April 10 2017.exe
"C:\Users\Admin\AppData\Local\Temp\Total order confirmation April 10 2017.exe"
1⤵
- Luminosity
- Checks computer location settings
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2944

C:\Users\Admin\AppData\Roaming\datalog.exe
"C:\Users\Admin\AppData\Roaming\datalog.exe"
2⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2320

C:\Windows\SysWOW64\schtasks.exe
schtasks /create /tn "Client Monitor" /tr "'C:\Program Files (x86)\Client\client.exe' /startup" /sc MINUTE /f /rl highest
3⤵
- Luminosity
- Creates scheduled task(s)
PID:2840

C:\Windows\SysWOW64\REG.exe
REG ADD "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce" /v "Client Monitor" /d "cmd /c """start """Client Monitor""" """C:\Program Files (x86)\Client\client.exe"""" /f /reg:64
3⤵
- Adds Run key to start application
PID:1684

C:\Users\Admin\AppData\Roaming\svchost.exe
"C:\Users\Admin\AppData\Roaming\svchost.exe"
2⤵
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2720

C:\Users\Admin\AppData\Roaming\datalog.exe
"C:\Users\Admin\AppData\Roaming\datalog.exe"
3⤵
- Executes dropped EXE
PID:4172

C:\Users\Admin\AppData\Roaming\svchost.exe
"C:\Users\Admin\AppData\Roaming\svchost.exe "
3⤵
- Executes dropped EXE
PID:1584

C:\Users\Admin\AppData\Roaming\svchost.exe
"C:\Users\Admin\AppData\Roaming\svchost.exe "
3⤵
- Checks computer location settings
- Executes dropped EXE
- Accesses Microsoft Outlook accounts
- Accesses Microsoft Outlook profiles
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- outlook_win_path
PID:3260

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\240625484.bat" "C:\Users\Admin\AppData\Roaming\svchost.exe" "
4⤵
- Suspicious behavior: EnumeratesProcesses
PID:2268

C:\Program Files (x86)\Client\client.exe
"C:\Program Files (x86)\Client\client.exe" /startup
1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:948

C:\Program Files (x86)\Client\client.exe
"C:\Program Files (x86)\Client\client.exe" /startup
1⤵
- Executes dropped EXE
PID:3020

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Defense Evasion

Modify Registry

T1112

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Email Collection

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\42B9A473B4DAF01285A36B4D3C7B1662_178C086B699FD6C56B804AF3EF759CB5
Filesize
471B

MD5
b401341fc85ff1df5516bfefd6966903

SHA1
56308be824e854fc85368b26d6252db4b49682b6

SHA256
fc2ecd873fa745b68f48544e085634c168f00a7027c36fec6bc4adddc3249073

SHA512
c26dd408ab05a9d83b5c3f4986f895f4eba73e957b1d6f2141e76ac14813ca636b674b5fe67bad4927f2048e4f0af72dbadcd059751bd476695e1d24131bbac4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\66AE3BFDF94A732B262342AD2154B86E_502BB733848926DD3139F2342144B39C
Filesize
471B

MD5
40efe1a83e4a4b9b0b6a15d324440c09

SHA1
3e8c2705ef0bea8646e64e367d4d2c094664313e

SHA256
5985a3230044b7432ea48d6dc23fcb215c39d04224f77ffa0a8b2481fe03d4de

SHA512
0aa1a219b42fbb95e99a5632791494246916f2c5dbc453cad2bf14a531ae91fd0d7f348b72ec35a97966e33b969b7fe356f1904a00b225926378838c082fa328

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\42B9A473B4DAF01285A36B4D3C7B1662_178C086B699FD6C56B804AF3EF759CB5
Filesize
404B

MD5
eb8732222a53fc2de1eefd8bf27c1a0a

SHA1
c3b96ef1890990dd4f84a4d702ec340e87e86c87

SHA256
865eaf9a4f46a9097e47ef9d6b860bfd9908ca478267349539c9bbe1ca3acb2b

SHA512
8571659f9d86461b3fb4dcf29aa1ebef540542740b4a39f87dcce601bc12776be026c49f13e0bf07c31fe65810b0a92cd8c374acd185a9d2ba57061d732428a7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\66AE3BFDF94A732B262342AD2154B86E_502BB733848926DD3139F2342144B39C
Filesize
404B

MD5
bffb1a911b40bc8eba0497cf9fcb8c38

SHA1
6e67f798cdf9a12328c96ceb15bd52a5ee505c8c

SHA256
442fdec288d20b7ef16d316f2eb270383adeb6c838c2376f1e091590866bcf45

SHA512
cc10146802de985f3719c23ee0330c77bbb9e3ba6b10c17c1ea2e1093ec39d9489e64c0083ee1e111f8d6a9fe864fc3cadc601a569026d0cd616b59648b4ed50

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v2.0_32\UsageLogs\client.exe.log
Filesize
588B

MD5
bbc3cfe1a58732a0477f72ea3d36c7bf

SHA1
fb801263330aa243f63270138ab467a627dffc2e

SHA256
9269d4383b8effa928b7b4a7b38ffa07587b23851f9430fbfe8e7284f845e722

SHA512
5bfdc6520a7a0884e3ccdf26ab0fe536327c9f3330f7f78bed2ed4c89fc31b04ad0c4b4bd6f8f1bca08ef04e46b833b798726dca7f40ccc27c871847ec041be4

Download Submit
C:\Users\Admin\AppData\Local\Temp\240625484.bat
Filesize
94B

MD5
3880eeb1c736d853eb13b44898b718ab

SHA1
4eec9d50360cd815211e3c4e6bdd08271b6ec8e6

SHA256
936d9411d5226b7c5a150ecaf422987590a8870c8e095e1caa072273041a86e7

SHA512
3eaa3dddd7a11942e75acd44208fbe3d3ff8f4006951cd970fb9ab748c160739409803450d28037e577443504707fc310c634e9dc54d0c25e8cfe6094f017c6b

Download Submit
C:\Users\Admin\AppData\Roaming\datalog.exe
Filesize
856KB

MD5
6f354cc37a8d6f4c0f2a252ca5830275

SHA1
f4f42bccbb5f3ae12e807fae97986e138d1b405d

SHA256
c76034635528117e1b8b59c9c549a58c17b2f63f13b0d92b015f462c38317942

SHA512
19f1ca7a911acd944f985c1b043cd9914633bf97d420064a5ed5baa9efff8cbb4721797ed27b4354e5912d2be2bfde690d2fa2faf28e4181bf0612c41446dc3f

Download Submit
C:\Users\Admin\AppData\Roaming\svchost.exe
Filesize
1.5MB

MD5
d31daa3adb9285b7024438799d3a7fc8

SHA1
3a4a3684c7a475bae5b47aad1ad750996add764b

SHA256
ebdb910c35ce8b21168a4bda0dae16b3a64f66670763be89a81e322d8ddab431

SHA512
9d3febe2e0603e0f6d040dff42b194fa2be309260724f9bfc879fd72990718145a239a6817b8fbcf1fd1c2e3209896c94282fc88e9bc61d064b393f0b271d8dc

Download Submit
memory/948-71-0x00000000007E0000-0x00000000007F7000-memory.dmp

Filesize
92KB

Download
memory/948-70-0x00000000007E0000-0x00000000007F7000-memory.dmp

Filesize
92KB

Download
memory/948-76-0x00000000007E0000-0x00000000007F7000-memory.dmp

Filesize
92KB

Download
memory/948-73-0x00000000007E0000-0x00000000007F7000-memory.dmp

Filesize
92KB

Download
memory/948-72-0x00000000007C0000-0x00000000007C1000-memory.dmp

Filesize
4KB

Download
memory/948-69-0x00000000007E0000-0x00000000007F7000-memory.dmp

Filesize
92KB

Download
memory/2268-59-0x0000000000C70000-0x0000000000C87000-memory.dmp

Filesize
92KB

Download
memory/2268-58-0x0000000000C70000-0x0000000000C87000-memory.dmp

Filesize
92KB

Download
memory/2268-61-0x0000000000C50000-0x0000000000C51000-memory.dmp

Filesize
4KB

Download
memory/2268-62-0x0000000000C70000-0x0000000000C87000-memory.dmp

Filesize
92KB

Download
memory/2268-86-0x0000000000C70000-0x0000000000C87000-memory.dmp

Filesize
92KB

Download
memory/2268-60-0x0000000000C70000-0x0000000000C87000-memory.dmp

Filesize
92KB

Download
memory/2320-21-0x0000000074CB0000-0x0000000075261000-memory.dmp

Filesize
5.7MB

Download
memory/2320-36-0x0000000074CB0000-0x0000000075261000-memory.dmp

Filesize
5.7MB

Download
memory/2320-65-0x0000000074CB0000-0x0000000075261000-memory.dmp

Filesize
5.7MB

Download
memory/2320-64-0x0000000074CB0000-0x0000000075261000-memory.dmp

Filesize
5.7MB

Download
memory/2320-34-0x0000000074CB0000-0x0000000075261000-memory.dmp

Filesize
5.7MB

Download
memory/2720-39-0x0000000074CB0000-0x0000000075261000-memory.dmp

Filesize
5.7MB

Download
memory/2720-56-0x0000000005080000-0x0000000005097000-memory.dmp

Filesize
92KB

Download
memory/2720-55-0x00000000050A0000-0x00000000050A1000-memory.dmp

Filesize
4KB

Download
memory/2720-54-0x0000000005080000-0x0000000005097000-memory.dmp

Filesize
92KB

Download
memory/2720-53-0x0000000005080000-0x0000000005097000-memory.dmp

Filesize
92KB

Download
memory/2720-52-0x0000000005080000-0x0000000005097000-memory.dmp

Filesize
92KB

Download
memory/2720-66-0x0000000074CB0000-0x0000000075261000-memory.dmp

Filesize
5.7MB

Download
memory/2720-67-0x0000000074CB0000-0x0000000075261000-memory.dmp

Filesize
5.7MB

Download
memory/2720-38-0x0000000074CB0000-0x0000000075261000-memory.dmp

Filesize
5.7MB

Download
memory/2944-0-0x0000000074CB2000-0x0000000074CB3000-memory.dmp

Filesize
4KB

Download
memory/2944-37-0x0000000074CB0000-0x0000000075261000-memory.dmp

Filesize
5.7MB

Download
memory/2944-2-0x0000000074CB0000-0x0000000075261000-memory.dmp

Filesize
5.7MB

Download
memory/2944-1-0x0000000074CB0000-0x0000000075261000-memory.dmp

Filesize
5.7MB

Download
memory/3020-82-0x0000000000F60000-0x0000000000F61000-memory.dmp

Filesize
4KB

Download
memory/3020-81-0x0000000000C10000-0x0000000000C27000-memory.dmp

Filesize
92KB

Download
memory/3020-80-0x0000000000C10000-0x0000000000C27000-memory.dmp

Filesize
92KB

Download
memory/3020-79-0x0000000000C10000-0x0000000000C27000-memory.dmp

Filesize
92KB

Download
memory/3020-83-0x0000000000C10000-0x0000000000C27000-memory.dmp

Filesize
92KB

Download
memory/3020-85-0x0000000000C10000-0x0000000000C27000-memory.dmp

Filesize
92KB

Download
memory/3260-45-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download
memory/3260-44-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download
memory/3260-42-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download