dcrat | 170584ecdd7e1e945137980f722d2d68e7abc00b3534fe0c823d7ffcdf9afc72

Analysis

max time kernel
135s
max time network
104s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
26/05/2024, 17:11

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
170584ecdd7e1e945137980f722d2d68e7abc00b3534fe0c823d7ffcdf9afc72.exe
Size 2.0MB
Sample240526-vqb42aed82
SHA256 170584ecdd7e1e945137980f722d2d68e7abc00b3534fe0c823d7ffcdf9afc72
MD5 c7896f2fb48758469fb32a4d48beb2e4
SHA1 7afd3cd18b112b652a8fb1caff6318ee2733933c
SHA512 32180a11022af678fb98b300ab6a588b54dc4cc3e2d308d55049b0b8ff99d84a05aae191b046c6916540e97ed4fc6b1513b8af3564aae6192347782197c9f33d
SSDEEP 24576:0n2XTCHM4xT9V3XzsHhVmatCELYIXVelAtgbHHd:iaTUv0jmtEttc
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

dcrat infostealer persistence rat

Malware Config

Signatures

DcRat 30 IoCs

DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

rat infostealer dcrat

pid	Process
1920	schtasks.exe
996	schtasks.exe
4372	schtasks.exe
1164	schtasks.exe
2868	schtasks.exe
4868	schtasks.exe
1476	schtasks.exe
5036	schtasks.exe
3712	schtasks.exe
3536	schtasks.exe
608	schtasks.exe
3192	schtasks.exe
2268	schtasks.exe
2896	schtasks.exe
4036	schtasks.exe
968	schtasks.exe
4008	schtasks.exe
1420	schtasks.exe
4584	schtasks.exe
3460	schtasks.exe
1760	schtasks.exe
5012	schtasks.exe
4656	schtasks.exe
2088	schtasks.exe
2992	schtasks.exe
3584	schtasks.exe
2504	schtasks.exe
3724	schtasks.exe
2076	schtasks.exe
3288	schtasks.exe

Modifies WinLogon for persistence 2 TTPs 10 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Recovery\\WindowsRE\\170584ecdd7e1e945137980f722d2d68e7abc00b3534fe0c823d7ffcdf9afc72.exe\", \"C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Setup Files\\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\\winlogon.exe\", \"C:\\Recovery\\WindowsRE\\StartMenuExperienceHost.exe\", \"C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\RuntimeBroker.exe\", \"C:\\Windows\\uk-UA\\System.exe\", \"C:\\Windows\\Offline Web Pages\\170584ecdd7e1e945137980f722d2d68e7abc00b3534fe0c823d7ffcdf9afc72.exe\", \"C:\\Recovery\\WindowsRE\\wininit.exe\""	170584ecdd7e1e945137980f722d2d68e7abc00b3534fe0c823d7ffcdf9afc72.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Recovery\\WindowsRE\\170584ecdd7e1e945137980f722d2d68e7abc00b3534fe0c823d7ffcdf9afc72.exe\", \"C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Setup Files\\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\\winlogon.exe\", \"C:\\Recovery\\WindowsRE\\StartMenuExperienceHost.exe\""	170584ecdd7e1e945137980f722d2d68e7abc00b3534fe0c823d7ffcdf9afc72.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Recovery\\WindowsRE\\170584ecdd7e1e945137980f722d2d68e7abc00b3534fe0c823d7ffcdf9afc72.exe\", \"C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Setup Files\\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\\winlogon.exe\", \"C:\\Recovery\\WindowsRE\\StartMenuExperienceHost.exe\", \"C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\RuntimeBroker.exe\", \"C:\\Windows\\uk-UA\\System.exe\""	170584ecdd7e1e945137980f722d2d68e7abc00b3534fe0c823d7ffcdf9afc72.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Recovery\\WindowsRE\\170584ecdd7e1e945137980f722d2d68e7abc00b3534fe0c823d7ffcdf9afc72.exe\", \"C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Setup Files\\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\\winlogon.exe\", \"C:\\Recovery\\WindowsRE\\StartMenuExperienceHost.exe\", \"C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\RuntimeBroker.exe\""	170584ecdd7e1e945137980f722d2d68e7abc00b3534fe0c823d7ffcdf9afc72.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Recovery\\WindowsRE\\170584ecdd7e1e945137980f722d2d68e7abc00b3534fe0c823d7ffcdf9afc72.exe\", \"C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Setup Files\\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\\winlogon.exe\", \"C:\\Recovery\\WindowsRE\\StartMenuExperienceHost.exe\", \"C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\RuntimeBroker.exe\", \"C:\\Windows\\uk-UA\\System.exe\", \"C:\\Windows\\Offline Web Pages\\170584ecdd7e1e945137980f722d2d68e7abc00b3534fe0c823d7ffcdf9afc72.exe\""	170584ecdd7e1e945137980f722d2d68e7abc00b3534fe0c823d7ffcdf9afc72.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Recovery\\WindowsRE\\170584ecdd7e1e945137980f722d2d68e7abc00b3534fe0c823d7ffcdf9afc72.exe\", \"C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Setup Files\\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\\winlogon.exe\", \"C:\\Recovery\\WindowsRE\\StartMenuExperienceHost.exe\", \"C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\RuntimeBroker.exe\", \"C:\\Windows\\uk-UA\\System.exe\", \"C:\\Windows\\Offline Web Pages\\170584ecdd7e1e945137980f722d2d68e7abc00b3534fe0c823d7ffcdf9afc72.exe\", \"C:\\Recovery\\WindowsRE\\wininit.exe\", \"C:\\Windows\\L2Schemas\\SppExtComObj.exe\""	170584ecdd7e1e945137980f722d2d68e7abc00b3534fe0c823d7ffcdf9afc72.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Recovery\\WindowsRE\\170584ecdd7e1e945137980f722d2d68e7abc00b3534fe0c823d7ffcdf9afc72.exe\", \"C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Setup Files\\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\\winlogon.exe\", \"C:\\Recovery\\WindowsRE\\StartMenuExperienceHost.exe\", \"C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\RuntimeBroker.exe\", \"C:\\Windows\\uk-UA\\System.exe\", \"C:\\Windows\\Offline Web Pages\\170584ecdd7e1e945137980f722d2d68e7abc00b3534fe0c823d7ffcdf9afc72.exe\", \"C:\\Recovery\\WindowsRE\\wininit.exe\", \"C:\\Windows\\L2Schemas\\SppExtComObj.exe\", \"C:\\Recovery\\WindowsRE\\RuntimeBroker.exe\""	170584ecdd7e1e945137980f722d2d68e7abc00b3534fe0c823d7ffcdf9afc72.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Recovery\\WindowsRE\\170584ecdd7e1e945137980f722d2d68e7abc00b3534fe0c823d7ffcdf9afc72.exe\", \"C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Setup Files\\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\\winlogon.exe\", \"C:\\Recovery\\WindowsRE\\StartMenuExperienceHost.exe\", \"C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\RuntimeBroker.exe\", \"C:\\Windows\\uk-UA\\System.exe\", \"C:\\Windows\\Offline Web Pages\\170584ecdd7e1e945137980f722d2d68e7abc00b3534fe0c823d7ffcdf9afc72.exe\", \"C:\\Recovery\\WindowsRE\\wininit.exe\", \"C:\\Windows\\L2Schemas\\SppExtComObj.exe\", \"C:\\Recovery\\WindowsRE\\RuntimeBroker.exe\", \"C:\\Users\\Default User\\dllhost.exe\""	170584ecdd7e1e945137980f722d2d68e7abc00b3534fe0c823d7ffcdf9afc72.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Recovery\\WindowsRE\\170584ecdd7e1e945137980f722d2d68e7abc00b3534fe0c823d7ffcdf9afc72.exe\""	170584ecdd7e1e945137980f722d2d68e7abc00b3534fe0c823d7ffcdf9afc72.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Recovery\\WindowsRE\\170584ecdd7e1e945137980f722d2d68e7abc00b3534fe0c823d7ffcdf9afc72.exe\", \"C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Setup Files\\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\\winlogon.exe\""	170584ecdd7e1e945137980f722d2d68e7abc00b3534fe0c823d7ffcdf9afc72.exe

Process spawned unexpected child process 30 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1420	3716	schtasks.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4372	3716	schtasks.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3584	3716	schtasks.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3724	3716	schtasks.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2868	3716	schtasks.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1920	3716	schtasks.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4656	3716	schtasks.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5012	3716	schtasks.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2268	3716	schtasks.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3460	3716	schtasks.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2504	3716	schtasks.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3712	3716	schtasks.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1164	3716	schtasks.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2896	3716	schtasks.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3536	3716	schtasks.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4584	3716	schtasks.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2088	3716	schtasks.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	608	3716	schtasks.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4008	3716	schtasks.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3192	3716	schtasks.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4868	3716	schtasks.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	996	3716	schtasks.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1476	3716	schtasks.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2076	3716	schtasks.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2992	3716	schtasks.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1760	3716	schtasks.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5036	3716	schtasks.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4036	3716	schtasks.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	968	3716	schtasks.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3288	3716	schtasks.exe	84

DCRat payload 3 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral2/memory/2724-0-0x0000000000E40000-0x000000000104C000-memory.dmp	dcrat
behavioral2/files/0x0007000000023421-23.dat	dcrat
behavioral2/files/0x0007000000022ac3-120.dat	dcrat

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation	170584ecdd7e1e945137980f722d2d68e7abc00b3534fe0c823d7ffcdf9afc72.exe

Executes dropped EXE 1 IoCs

pid	Process
4456	dllhost.exe

Adds Run key to start application 2 TTPs 20 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RuntimeBroker = "\"C:\\Recovery\\WindowsRE\\RuntimeBroker.exe\""	170584ecdd7e1e945137980f722d2d68e7abc00b3534fe0c823d7ffcdf9afc72.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dllhost = "\"C:\\Users\\Default User\\dllhost.exe\""	170584ecdd7e1e945137980f722d2d68e7abc00b3534fe0c823d7ffcdf9afc72.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\winlogon = "\"C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Setup Files\\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\\winlogon.exe\""	170584ecdd7e1e945137980f722d2d68e7abc00b3534fe0c823d7ffcdf9afc72.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\winlogon = "\"C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Setup Files\\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\\winlogon.exe\""	170584ecdd7e1e945137980f722d2d68e7abc00b3534fe0c823d7ffcdf9afc72.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\StartMenuExperienceHost = "\"C:\\Recovery\\WindowsRE\\StartMenuExperienceHost.exe\""	170584ecdd7e1e945137980f722d2d68e7abc00b3534fe0c823d7ffcdf9afc72.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RuntimeBroker = "\"C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\RuntimeBroker.exe\""	170584ecdd7e1e945137980f722d2d68e7abc00b3534fe0c823d7ffcdf9afc72.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\System = "\"C:\\Windows\\uk-UA\\System.exe\""	170584ecdd7e1e945137980f722d2d68e7abc00b3534fe0c823d7ffcdf9afc72.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RuntimeBroker = "\"C:\\Recovery\\WindowsRE\\RuntimeBroker.exe\""	170584ecdd7e1e945137980f722d2d68e7abc00b3534fe0c823d7ffcdf9afc72.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RuntimeBroker = "\"C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\RuntimeBroker.exe\""	170584ecdd7e1e945137980f722d2d68e7abc00b3534fe0c823d7ffcdf9afc72.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\170584ecdd7e1e945137980f722d2d68e7abc00b3534fe0c823d7ffcdf9afc72 = "\"C:\\Windows\\Offline Web Pages\\170584ecdd7e1e945137980f722d2d68e7abc00b3534fe0c823d7ffcdf9afc72.exe\""	170584ecdd7e1e945137980f722d2d68e7abc00b3534fe0c823d7ffcdf9afc72.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\wininit = "\"C:\\Recovery\\WindowsRE\\wininit.exe\""	170584ecdd7e1e945137980f722d2d68e7abc00b3534fe0c823d7ffcdf9afc72.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SppExtComObj = "\"C:\\Windows\\L2Schemas\\SppExtComObj.exe\""	170584ecdd7e1e945137980f722d2d68e7abc00b3534fe0c823d7ffcdf9afc72.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SppExtComObj = "\"C:\\Windows\\L2Schemas\\SppExtComObj.exe\""	170584ecdd7e1e945137980f722d2d68e7abc00b3534fe0c823d7ffcdf9afc72.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\170584ecdd7e1e945137980f722d2d68e7abc00b3534fe0c823d7ffcdf9afc72 = "\"C:\\Recovery\\WindowsRE\\170584ecdd7e1e945137980f722d2d68e7abc00b3534fe0c823d7ffcdf9afc72.exe\""	170584ecdd7e1e945137980f722d2d68e7abc00b3534fe0c823d7ffcdf9afc72.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dllhost = "\"C:\\Users\\Default User\\dllhost.exe\""	170584ecdd7e1e945137980f722d2d68e7abc00b3534fe0c823d7ffcdf9afc72.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\170584ecdd7e1e945137980f722d2d68e7abc00b3534fe0c823d7ffcdf9afc72 = "\"C:\\Recovery\\WindowsRE\\170584ecdd7e1e945137980f722d2d68e7abc00b3534fe0c823d7ffcdf9afc72.exe\""	170584ecdd7e1e945137980f722d2d68e7abc00b3534fe0c823d7ffcdf9afc72.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\StartMenuExperienceHost = "\"C:\\Recovery\\WindowsRE\\StartMenuExperienceHost.exe\""	170584ecdd7e1e945137980f722d2d68e7abc00b3534fe0c823d7ffcdf9afc72.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\System = "\"C:\\Windows\\uk-UA\\System.exe\""	170584ecdd7e1e945137980f722d2d68e7abc00b3534fe0c823d7ffcdf9afc72.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\170584ecdd7e1e945137980f722d2d68e7abc00b3534fe0c823d7ffcdf9afc72 = "\"C:\\Windows\\Offline Web Pages\\170584ecdd7e1e945137980f722d2d68e7abc00b3534fe0c823d7ffcdf9afc72.exe\""	170584ecdd7e1e945137980f722d2d68e7abc00b3534fe0c823d7ffcdf9afc72.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\wininit = "\"C:\\Recovery\\WindowsRE\\wininit.exe\""	170584ecdd7e1e945137980f722d2d68e7abc00b3534fe0c823d7ffcdf9afc72.exe

Drops file in Program Files directory 5 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Setup Files\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\winlogon.exe	170584ecdd7e1e945137980f722d2d68e7abc00b3534fe0c823d7ffcdf9afc72.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Setup Files\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\cc11b995f2a76d	170584ecdd7e1e945137980f722d2d68e7abc00b3534fe0c823d7ffcdf9afc72.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Setup Files\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\RCX59EB.tmp	170584ecdd7e1e945137980f722d2d68e7abc00b3534fe0c823d7ffcdf9afc72.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Setup Files\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\RCX59EC.tmp	170584ecdd7e1e945137980f722d2d68e7abc00b3534fe0c823d7ffcdf9afc72.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Setup Files\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\winlogon.exe	170584ecdd7e1e945137980f722d2d68e7abc00b3534fe0c823d7ffcdf9afc72.exe

Drops file in Windows directory 21 IoCs

description	ioc	Process
File created	C:\Windows\LanguageOverlayCache\StartMenuExperienceHost.exe	170584ecdd7e1e945137980f722d2d68e7abc00b3534fe0c823d7ffcdf9afc72.exe
File created	C:\Windows\L2Schemas\e1ef82546f0b02	170584ecdd7e1e945137980f722d2d68e7abc00b3534fe0c823d7ffcdf9afc72.exe
File opened for modification	C:\Windows\Offline Web Pages\RCX629E.tmp	170584ecdd7e1e945137980f722d2d68e7abc00b3534fe0c823d7ffcdf9afc72.exe
File opened for modification	C:\Windows\uk-UA\RCX601C.tmp	170584ecdd7e1e945137980f722d2d68e7abc00b3534fe0c823d7ffcdf9afc72.exe
File opened for modification	C:\Windows\Offline Web Pages\170584ecdd7e1e945137980f722d2d68e7abc00b3534fe0c823d7ffcdf9afc72.exe	170584ecdd7e1e945137980f722d2d68e7abc00b3534fe0c823d7ffcdf9afc72.exe
File created	C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.PowerShel#\RuntimeBroker.exe	170584ecdd7e1e945137980f722d2d68e7abc00b3534fe0c823d7ffcdf9afc72.exe
File created	C:\Windows\Offline Web Pages\90ec6070a4c1a0	170584ecdd7e1e945137980f722d2d68e7abc00b3534fe0c823d7ffcdf9afc72.exe
File opened for modification	C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.PowerShel#\RuntimeBroker.exe	170584ecdd7e1e945137980f722d2d68e7abc00b3534fe0c823d7ffcdf9afc72.exe
File opened for modification	C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.PowerShel#\RCX5E17.tmp	170584ecdd7e1e945137980f722d2d68e7abc00b3534fe0c823d7ffcdf9afc72.exe
File opened for modification	C:\Windows\uk-UA\RCX601D.tmp	170584ecdd7e1e945137980f722d2d68e7abc00b3534fe0c823d7ffcdf9afc72.exe
File opened for modification	C:\Windows\L2Schemas\RCX6737.tmp	170584ecdd7e1e945137980f722d2d68e7abc00b3534fe0c823d7ffcdf9afc72.exe
File created	C:\Windows\Offline Web Pages\170584ecdd7e1e945137980f722d2d68e7abc00b3534fe0c823d7ffcdf9afc72.exe	170584ecdd7e1e945137980f722d2d68e7abc00b3534fe0c823d7ffcdf9afc72.exe
File created	C:\Windows\L2Schemas\SppExtComObj.exe	170584ecdd7e1e945137980f722d2d68e7abc00b3534fe0c823d7ffcdf9afc72.exe
File opened for modification	C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.PowerShel#\RCX5E16.tmp	170584ecdd7e1e945137980f722d2d68e7abc00b3534fe0c823d7ffcdf9afc72.exe
File opened for modification	C:\Windows\uk-UA\System.exe	170584ecdd7e1e945137980f722d2d68e7abc00b3534fe0c823d7ffcdf9afc72.exe
File opened for modification	C:\Windows\Offline Web Pages\RCX629F.tmp	170584ecdd7e1e945137980f722d2d68e7abc00b3534fe0c823d7ffcdf9afc72.exe
File created	C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.PowerShel#\9e8d7a4ca61bd9	170584ecdd7e1e945137980f722d2d68e7abc00b3534fe0c823d7ffcdf9afc72.exe
File created	C:\Windows\uk-UA\System.exe	170584ecdd7e1e945137980f722d2d68e7abc00b3534fe0c823d7ffcdf9afc72.exe
File created	C:\Windows\uk-UA\27d1bcfc3c54e0	170584ecdd7e1e945137980f722d2d68e7abc00b3534fe0c823d7ffcdf9afc72.exe
File opened for modification	C:\Windows\L2Schemas\RCX6736.tmp	170584ecdd7e1e945137980f722d2d68e7abc00b3534fe0c823d7ffcdf9afc72.exe
File opened for modification	C:\Windows\L2Schemas\SppExtComObj.exe	170584ecdd7e1e945137980f722d2d68e7abc00b3534fe0c823d7ffcdf9afc72.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 30 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
1476	schtasks.exe
1920	schtasks.exe
2088	schtasks.exe
4868	schtasks.exe
2992	schtasks.exe
3536	schtasks.exe
3192	schtasks.exe
996	schtasks.exe
3724	schtasks.exe
2896	schtasks.exe
3288	schtasks.exe
968	schtasks.exe
2504	schtasks.exe
4008	schtasks.exe
4036	schtasks.exe
5036	schtasks.exe
4372	schtasks.exe
2268	schtasks.exe
608	schtasks.exe
3584	schtasks.exe
2868	schtasks.exe
1164	schtasks.exe
4656	schtasks.exe
5012	schtasks.exe
4584	schtasks.exe
2076	schtasks.exe
1760	schtasks.exe
1420	schtasks.exe
3460	schtasks.exe
3712	schtasks.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000_Classes\Local Settings	170584ecdd7e1e945137980f722d2d68e7abc00b3534fe0c823d7ffcdf9afc72.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
2724	170584ecdd7e1e945137980f722d2d68e7abc00b3534fe0c823d7ffcdf9afc72.exe
2724	170584ecdd7e1e945137980f722d2d68e7abc00b3534fe0c823d7ffcdf9afc72.exe
2724	170584ecdd7e1e945137980f722d2d68e7abc00b3534fe0c823d7ffcdf9afc72.exe
2724	170584ecdd7e1e945137980f722d2d68e7abc00b3534fe0c823d7ffcdf9afc72.exe
2724	170584ecdd7e1e945137980f722d2d68e7abc00b3534fe0c823d7ffcdf9afc72.exe
4456	dllhost.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2724	170584ecdd7e1e945137980f722d2d68e7abc00b3534fe0c823d7ffcdf9afc72.exe
Token: SeDebugPrivilege	4456	dllhost.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2724 wrote to memory of 3976	2724	170584ecdd7e1e945137980f722d2d68e7abc00b3534fe0c823d7ffcdf9afc72.exe	123
PID 2724 wrote to memory of 3976	2724	170584ecdd7e1e945137980f722d2d68e7abc00b3534fe0c823d7ffcdf9afc72.exe	123
PID 3976 wrote to memory of 3188	3976	cmd.exe	125
PID 3976 wrote to memory of 3188	3976	cmd.exe	125
PID 3976 wrote to memory of 4456	3976	cmd.exe	128
PID 3976 wrote to memory of 4456	3976	cmd.exe	128

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\170584ecdd7e1e945137980f722d2d68e7abc00b3534fe0c823d7ffcdf9afc72.exe
"C:\Users\Admin\AppData\Local\Temp\170584ecdd7e1e945137980f722d2d68e7abc00b3534fe0c823d7ffcdf9afc72.exe"
1⤵
- Modifies WinLogon for persistence
- Checks computer location settings
- Adds Run key to start application
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2724
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\CM21Qg9nNg.bat"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3976
- - C:\Windows\system32\w32tm.exe
    w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
    3⤵
    PID:3188
- - C:\Users\Default User\dllhost.exe
    "C:\Users\Default User\dllhost.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4456

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "170584ecdd7e1e945137980f722d2d68e7abc00b3534fe0c823d7ffcdf9afc721" /sc MINUTE /mo 5 /tr "'C:\Recovery\WindowsRE\170584ecdd7e1e945137980f722d2d68e7abc00b3534fe0c823d7ffcdf9afc72.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1420

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "170584ecdd7e1e945137980f722d2d68e7abc00b3534fe0c823d7ffcdf9afc72" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\170584ecdd7e1e945137980f722d2d68e7abc00b3534fe0c823d7ffcdf9afc72.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4372

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "170584ecdd7e1e945137980f722d2d68e7abc00b3534fe0c823d7ffcdf9afc721" /sc MINUTE /mo 14 /tr "'C:\Recovery\WindowsRE\170584ecdd7e1e945137980f722d2d68e7abc00b3534fe0c823d7ffcdf9afc72.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3584

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 11 /tr "'C:\Program Files (x86)\Adobe\Acrobat Reader DC\Setup Files\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\winlogon.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3724

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogon" /sc ONLOGON /tr "'C:\Program Files (x86)\Adobe\Acrobat Reader DC\Setup Files\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\winlogon.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2868

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 9 /tr "'C:\Program Files (x86)\Adobe\Acrobat Reader DC\Setup Files\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\winlogon.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1920

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "StartMenuExperienceHostS" /sc MINUTE /mo 9 /tr "'C:\Recovery\WindowsRE\StartMenuExperienceHost.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4656

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "StartMenuExperienceHost" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\StartMenuExperienceHost.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:5012

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "StartMenuExperienceHostS" /sc MINUTE /mo 9 /tr "'C:\Recovery\WindowsRE\StartMenuExperienceHost.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2268

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 6 /tr "'C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.PowerShel#\RuntimeBroker.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3460

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.PowerShel#\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2504

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 5 /tr "'C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.PowerShel#\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3712

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 10 /tr "'C:\Windows\uk-UA\System.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1164

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "System" /sc ONLOGON /tr "'C:\Windows\uk-UA\System.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2896

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 10 /tr "'C:\Windows\uk-UA\System.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3536

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "170584ecdd7e1e945137980f722d2d68e7abc00b3534fe0c823d7ffcdf9afc721" /sc MINUTE /mo 9 /tr "'C:\Windows\Offline Web Pages\170584ecdd7e1e945137980f722d2d68e7abc00b3534fe0c823d7ffcdf9afc72.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4584

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "170584ecdd7e1e945137980f722d2d68e7abc00b3534fe0c823d7ffcdf9afc72" /sc ONLOGON /tr "'C:\Windows\Offline Web Pages\170584ecdd7e1e945137980f722d2d68e7abc00b3534fe0c823d7ffcdf9afc72.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2088

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "170584ecdd7e1e945137980f722d2d68e7abc00b3534fe0c823d7ffcdf9afc721" /sc MINUTE /mo 12 /tr "'C:\Windows\Offline Web Pages\170584ecdd7e1e945137980f722d2d68e7abc00b3534fe0c823d7ffcdf9afc72.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:608

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 6 /tr "'C:\Recovery\WindowsRE\wininit.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4008

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininit" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\wininit.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3192

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 13 /tr "'C:\Recovery\WindowsRE\wininit.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4868

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SppExtComObjS" /sc MINUTE /mo 10 /tr "'C:\Windows\L2Schemas\SppExtComObj.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:996

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SppExtComObj" /sc ONLOGON /tr "'C:\Windows\L2Schemas\SppExtComObj.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1476

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SppExtComObjS" /sc MINUTE /mo 7 /tr "'C:\Windows\L2Schemas\SppExtComObj.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2076

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 13 /tr "'C:\Recovery\WindowsRE\RuntimeBroker.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2992

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1760

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 8 /tr "'C:\Recovery\WindowsRE\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:5036

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 10 /tr "'C:\Users\Default User\dllhost.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4036

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Users\Default User\dllhost.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:968

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 5 /tr "'C:\Users\Default User\dllhost.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3288

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Scheduled Task/Job

T1053

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Scheduled Task/Job

T1053

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

wininit.exe

Path C:\Recovery\WindowsRE\wininit.exe
Size 2.0MB
SHA256 1c8c5804ecf2fd58eecaa5980a83dd72144a811514c88e9088d489957722bbd5
MD5 3acd36b2fa945458e344105958fd5021
SHA1 78968f8777a2b0e2fe00ce8de880e9296d34391c
SHA512 44fabb9363722076930a8b752ee0621bcb2b985f648413104b69980ea4b915608e0ca68405d7fd9ebd5eca83953547efdfb4d04ea3e6069ed4854431791d7e18
SSDEEP 24576:0n2XTCHM4xT9V3XzsHhVmatCELYIXVelAtgbHHd:iaTUv0jmtEttc
MD5 SHA1 SHA512 SSDEEP

Submit Download

CM21Qg9nNg.bat

Path C:\Users\Admin\AppData\Local\Temp\CM21Qg9nNg.bat
Size 198B
SHA256 0cd39e17e5bea52ee57748ff48a3505eb5cdde7447c52314372b44c7299cf3b1
MD5 66cda48c962af60f7b40473de098f18b
SHA1 fcb4ccf0b3e437b947d5c31dd5a96564806c7c6a
SHA512 aca1a3e16f630f0f8e015e642311feab3f76311264fe517ad52916fa52a3870899c2c752cb258284600e9d9d3b3ac589128202050ef3d77c09c0e17cb05651d1
MD5 SHA1 SHA512

Submit Download

System.exe

Path C:\Windows\uk-UA\System.exe
Size 2.0MB
SHA256 170584ecdd7e1e945137980f722d2d68e7abc00b3534fe0c823d7ffcdf9afc72
MD5 c7896f2fb48758469fb32a4d48beb2e4
SHA1 7afd3cd18b112b652a8fb1caff6318ee2733933c
SHA512 32180a11022af678fb98b300ab6a588b54dc4cc3e2d308d55049b0b8ff99d84a05aae191b046c6916540e97ed4fc6b1513b8af3564aae6192347782197c9f33d
SSDEEP 24576:0n2XTCHM4xT9V3XzsHhVmatCELYIXVelAtgbHHd:iaTUv0jmtEttc
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/2724-6-0x000000001BB80000-0x000000001BB90000-memory.dmp

Download

memory/2724-12-0x000000001C290000-0x000000001C29E000-memory.dmp

Download

memory/2724-0-0x0000000000E40000-0x000000000104C000-memory.dmp

Download

memory/2724-5-0x000000001BB70000-0x000000001BB78000-memory.dmp

Download

memory/2724-7-0x000000001BB90000-0x000000001BBA6000-memory.dmp

Download

memory/2724-8-0x000000001BC10000-0x000000001BC66000-memory.dmp

Download

memory/2724-9-0x000000001BBB0000-0x000000001BBBC000-memory.dmp

Download

memory/2724-10-0x000000001C270000-0x000000001C27C000-memory.dmp

Download

memory/2724-11-0x000000001C280000-0x000000001C28C000-memory.dmp

Download

memory/2724-4-0x000000001BBC0000-0x000000001BC10000-memory.dmp

Download

memory/2724-13-0x000000001C2A0000-0x000000001C2AE000-memory.dmp

Download

memory/2724-14-0x000000001C2B0000-0x000000001C2BA000-memory.dmp

Download

memory/2724-3-0x0000000003170000-0x000000000318C000-memory.dmp

Download

memory/2724-2-0x00007FF8B17D0000-0x00007FF8B2291000-memory.dmp

Download

memory/2724-162-0x00007FF8B17D0000-0x00007FF8B2291000-memory.dmp

Download

memory/2724-1-0x00007FF8B17D3000-0x00007FF8B17D5000-memory.dmp

Download

memory/4456-167-0x000000001BCC0000-0x000000001BD16000-memory.dmp

Download