dcrat | 581a31b1ddaa6eea7b78a57b4615d8def8c688aeb0dd38da8a0ef3d248e88892

Analysis

max time kernel
51s
max time network
51s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
16/06/2024, 23:56

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2f555468f2b76f26648ae61c418ead8a.exe
Size 3.0MB
Sample240616-3y1flaydnk
SHA256 581a31b1ddaa6eea7b78a57b4615d8def8c688aeb0dd38da8a0ef3d248e88892
MD5 2f555468f2b76f26648ae61c418ead8a
SHA1 94b1a5f05715682d6bd747c4a8029006490d88d2
SHA512 cf3525c782d997b4deb9049fa818548e9860c296cd1875a742db1d50e02f7cbf84f10a7df64348637dfde5d3b3092de64144bb99563d20c18fd80aa20ac4f618
SSDEEP 49152:gbA30ablFFJ7XBanm45XjhjuyXlt4+3oNBGsCornEsYwmve86irCrHEOz:gb2blFFJ945XtjLVt4tJ/pmNHerT
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

dcrat infostealer rat

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat

Process spawned unexpected child process 18 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2332	3156	schtasks.exe	92
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4576	3156	schtasks.exe	92
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4744	3156	schtasks.exe	92
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2644	3156	schtasks.exe	92
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4524	3156	schtasks.exe	92
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3088	3156	schtasks.exe	92
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1532	3156	schtasks.exe	92
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3756	3156	schtasks.exe	92
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1272	3156	schtasks.exe	92
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	884	3156	schtasks.exe	92
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5012	3156	schtasks.exe	92
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	440	3156	schtasks.exe	92
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2260	3156	schtasks.exe	92
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4480	3156	schtasks.exe	92
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4256	3156	schtasks.exe	92
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4016	3156	schtasks.exe	92
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2792	3156	schtasks.exe	92
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3524	3156	schtasks.exe	92

DCRat payload 4 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral2/files/0x000900000002328e-4.dat	dcrat
behavioral2/memory/116-17-0x0000000000400000-0x0000000000712000-memory.dmp	dcrat
behavioral2/files/0x000700000002340f-46.dat	dcrat
behavioral2/memory/4504-49-0x0000000000B00000-0x0000000000BF6000-memory.dmp	dcrat

Checks computer location settings 2 TTPs 4 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation	2f555468f2b76f26648ae61c418ead8a.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation	DCRatBuild.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation	WScript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation	containerbrokerSvc.exe

Executes dropped EXE 4 IoCs

pid	Process
1696	DCRatBuild.exe
1552	Everything-1.4.1.1024.x64-Setup.exe
4504	containerbrokerSvc.exe
2136	conhost.exe

Loads dropped DLL 5 IoCs

pid	Process
1552	Everything-1.4.1.1024.x64-Setup.exe
1552	Everything-1.4.1.1024.x64-Setup.exe
1552	Everything-1.4.1.1024.x64-Setup.exe
1552	Everything-1.4.1.1024.x64-Setup.exe
1552	Everything-1.4.1.1024.x64-Setup.exe

Drops file in Program Files directory 5 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Windows Mail\22eafd247d37c3	containerbrokerSvc.exe
File created	C:\Program Files\Windows Security\BrowserCore\en-US\conhost.exe	containerbrokerSvc.exe
File opened for modification	C:\Program Files\Windows Security\BrowserCore\en-US\conhost.exe	containerbrokerSvc.exe
File created	C:\Program Files\Windows Security\BrowserCore\en-US\088424020bedd6	containerbrokerSvc.exe
File created	C:\Program Files (x86)\Windows Mail\TextInputHost.exe	containerbrokerSvc.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\ModemLogs\smss.exe	containerbrokerSvc.exe
File created	C:\Windows\ModemLogs\69ddcba757bf72	containerbrokerSvc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 18 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
4576	schtasks.exe
3088	schtasks.exe
5012	schtasks.exe
3524	schtasks.exe
4256	schtasks.exe
4016	schtasks.exe
4744	schtasks.exe
1272	schtasks.exe
884	schtasks.exe
440	schtasks.exe
4480	schtasks.exe
2332	schtasks.exe
2260	schtasks.exe
2644	schtasks.exe
4524	schtasks.exe
1532	schtasks.exe
3756	schtasks.exe
2792	schtasks.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000_Classes\Local Settings	DCRatBuild.exe
Key created	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000_Classes\Local Settings	containerbrokerSvc.exe

Suspicious behavior: EnumeratesProcesses 7 IoCs

pid	Process
4504	containerbrokerSvc.exe
4504	containerbrokerSvc.exe
4504	containerbrokerSvc.exe
4504	containerbrokerSvc.exe
4504	containerbrokerSvc.exe
4504	containerbrokerSvc.exe
2136	conhost.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	4504	containerbrokerSvc.exe
Token: SeDebugPrivilege	2136	conhost.exe

Suspicious use of WriteProcessMemory 20 IoCs

description	pid	Process	procid_target
PID 116 wrote to memory of 1696	116	2f555468f2b76f26648ae61c418ead8a.exe	83
PID 116 wrote to memory of 1696	116	2f555468f2b76f26648ae61c418ead8a.exe	83
PID 116 wrote to memory of 1696	116	2f555468f2b76f26648ae61c418ead8a.exe	83
PID 116 wrote to memory of 1552	116	2f555468f2b76f26648ae61c418ead8a.exe	85
PID 116 wrote to memory of 1552	116	2f555468f2b76f26648ae61c418ead8a.exe	85
PID 116 wrote to memory of 1552	116	2f555468f2b76f26648ae61c418ead8a.exe	85
PID 1696 wrote to memory of 1224	1696	DCRatBuild.exe	87
PID 1696 wrote to memory of 1224	1696	DCRatBuild.exe	87
PID 1696 wrote to memory of 1224	1696	DCRatBuild.exe	87
PID 1224 wrote to memory of 4928	1224	WScript.exe	89
PID 1224 wrote to memory of 4928	1224	WScript.exe	89
PID 1224 wrote to memory of 4928	1224	WScript.exe	89
PID 4928 wrote to memory of 4504	4928	cmd.exe	91
PID 4928 wrote to memory of 4504	4928	cmd.exe	91
PID 4504 wrote to memory of 2692	4504	containerbrokerSvc.exe	111
PID 4504 wrote to memory of 2692	4504	containerbrokerSvc.exe	111
PID 2692 wrote to memory of 5000	2692	cmd.exe	113
PID 2692 wrote to memory of 5000	2692	cmd.exe	113
PID 2692 wrote to memory of 2136	2692	cmd.exe	114
PID 2692 wrote to memory of 2136	2692	cmd.exe	114

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\2f555468f2b76f26648ae61c418ead8a.exe
"C:\Users\Admin\AppData\Local\Temp\2f555468f2b76f26648ae61c418ead8a.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:116
- C:\Users\Admin\AppData\Local\Temp\DCRatBuild.exe
  "C:\Users\Admin\AppData\Local\Temp\DCRatBuild.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:1696
- - C:\Windows\SysWOW64\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\comsurrogatecommon\h6khYLQAm3C9Gvan2yaD6Idxz.vbe"
    3⤵
    - Checks computer location settings
    - Suspicious use of WriteProcessMemory
    PID:1224
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\comsurrogatecommon\ndyJqdcK3gAQnUI3h5cTrzbsXo5.bat" "
      4⤵
      Suspicious use of WriteProcessMemory
      PID:4928
    - - C:\comsurrogatecommon\containerbrokerSvc.exe
        
        "C:\comsurrogatecommon\containerbrokerSvc.exe"
        5⤵
        Checks computer location settings
        Executes dropped EXE
        Drops file in Program Files directory
        Drops file in Windows directory
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4504
      - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\Zcu3tEkZRd.bat"
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:2692
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        7⤵
        
        PID:5000
        
        C:\Program Files\Windows Security\BrowserCore\en-US\conhost.exe
        
        "C:\Program Files\Windows Security\BrowserCore\en-US\conhost.exe"
        7⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2136
- C:\Users\Admin\AppData\Local\Temp\Everything-1.4.1.1024.x64-Setup.exe
  "C:\Users\Admin\AppData\Local\Temp\Everything-1.4.1.1024.x64-Setup.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:1552

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 12 /tr "'C:\Program Files\Windows Security\BrowserCore\en-US\conhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2332

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhost" /sc ONLOGON /tr "'C:\Program Files\Windows Security\BrowserCore\en-US\conhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4576

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 11 /tr "'C:\Program Files\Windows Security\BrowserCore\en-US\conhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4744

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "TextInputHostT" /sc MINUTE /mo 11 /tr "'C:\Program Files (x86)\Windows Mail\TextInputHost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2644

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "TextInputHost" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Mail\TextInputHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4524

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "TextInputHostT" /sc MINUTE /mo 6 /tr "'C:\Program Files (x86)\Windows Mail\TextInputHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3088

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Everything-1.4.1.1024.x64-SetupE" /sc MINUTE /mo 8 /tr "'C:\Recovery\WindowsRE\Everything-1.4.1.1024.x64-Setup.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1532

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Everything-1.4.1.1024.x64-Setup" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\Everything-1.4.1.1024.x64-Setup.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3756

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Everything-1.4.1.1024.x64-SetupE" /sc MINUTE /mo 5 /tr "'C:\Recovery\WindowsRE\Everything-1.4.1.1024.x64-Setup.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1272

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 14 /tr "'C:\Recovery\WindowsRE\RuntimeBroker.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:884

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:5012

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 11 /tr "'C:\Recovery\WindowsRE\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:440

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 6 /tr "'C:\comsurrogatecommon\RuntimeBroker.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2260

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\comsurrogatecommon\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4480

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 9 /tr "'C:\comsurrogatecommon\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4256

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 8 /tr "'C:\Windows\ModemLogs\smss.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4016

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smss" /sc ONLOGON /tr "'C:\Windows\ModemLogs\smss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2792

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 12 /tr "'C:\Windows\ModemLogs\smss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3524

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Scheduled Task/Job

T1053

Privilege Escalation

Scheduled Task/Job

T1053

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

DCRatBuild.exe

Path C:\Users\Admin\AppData\Local\Temp\DCRatBuild.exe
Size 1.2MB
SHA256 8ed1d39fa5617f5f79c94be770549a88452829b56c7a878af030baa1ae060f9b
MD5 1b0d74d91e3556b4296fdfa8e2026027
SHA1 99a9aefc118aac03355bdb3992ca91b37bb7ecd3
SHA512 fcb8e958b31363e1d6b0c483ef9367a1787abc9654b3d88f9f203db7303482db1547c7f9c52d94fc15144b593b546c25fb9cee6cbe833c36bece6cdbcd86c5a0
SSDEEP 24576:U2G/nvxW3Ww0tabI6F/knoJUn3UJS38hWgranv4:UbA30ablFFJ7XBanw
MD5 SHA1 SHA512 SSDEEP

Submit Download

Everything-1.4.1.1024.x64-Setup.exe

Path C:\Users\Admin\AppData\Local\Temp\Everything-1.4.1.1024.x64-Setup.exe
Size 1.8MB
SHA256 b2afe799584c913532c673f99ade45113bf5a5b605a964ce9fa837f563b6fc21
MD5 5036e609163e98f3ac06d5e82b677df8
SHA1 176db10a4cda7104f24eece2d87e1a664b7fb929
SHA512 40c4332e2e4132fc7f3a5f0738a67e7725b329c4a4b0643fbc65f5d1de3ca4b6bf7374c2a722ea05f01a5e2ddd458344289fdb39bbb092a0b64e63eb168313e4
SSDEEP 49152:W45XjhjuyXlt4+3oNBGsCornEsYwmve86irCrHEOP:W45XtjLVt4tJ/pmNHerv
MD5 SHA1 SHA512 SSDEEP

Submit Download

Zcu3tEkZRd.bat

Path C:\Users\Admin\AppData\Local\Temp\Zcu3tEkZRd.bat
Size 228B
SHA256 226b0d83e526566adfca03df0ad0819fa58f828717e6456edbb13027e627aea4
MD5 e17e6db400b47a2c16735d4791e96fd1
SHA1 30b05a5a377847f674a78ef89c54e10bff8eee4c
SHA512 2dba24998f034316aef7506d94c9cbeb9b507a5fa2dcdd0f8bc77d6bde2349420aedc4b68b17484c55d974af08e1f619e8722b8ccec7056f961443cb138ad879
MD5 SHA1 SHA512

Submit Download

InstallOptions.dll

Path C:\Users\Admin\AppData\Local\Temp\nso5016.tmp\InstallOptions.dll
Size 15KB
SHA256 c7fef6457989d97fecc0616a69947927da9d8c493f7905dc8475c748f044f3cf
MD5 ece25721125d55aa26cdfe019c871476
SHA1 b87685ae482553823bf95e73e790de48dc0c11ba
SHA512 4e384735d03c943f5eb3396bb3a9cb42c9d8a5479fe2871de5b8bc18db4bbd6e2c5f8fd71b6840512a7249e12a1c63e0e760417e4baa3dc30f51375588410480
SSDEEP 384:EXsC43tPegZ3eBaRwCPOYY7nNYXC06/Yosa:EXJTgZ3eBTCmrnNA5p
MD5 SHA1 SHA512 SSDEEP

Submit Download

LangDLL.dll

Path C:\Users\Admin\AppData\Local\Temp\nso5016.tmp\LangDLL.dll
Size 5KB
SHA256 18e8b40ba22c7a1687bd16e8d585380bc2773fff5002d7d67e9485fcc0c51026
MD5 68b287f4067ba013e34a1339afdb1ea8
SHA1 45ad585b3cc8e5a6af7b68f5d8269c97992130b3
SHA512 06c38bbb07fb55256f3cdc24e77b3c8f3214f25bfd140b521a39d167113bf307a7e8d24e445d510bc5e4e41d33c9173bb14e3f2a38bc29a0e3d08c1f0dca4bdb
SSDEEP 48:S46+/nTKYKxbWsptIpBtWZ0iV8jAWiAJCvxft2O2B8mFofjLl:zFuPbOBtWZBV8jAWiAJCdv2Cm0L
MD5 SHA1 SHA512 SSDEEP

Submit Download

System.dll

Path C:\Users\Admin\AppData\Local\Temp\nso5016.tmp\System.dll
Size 12KB
SHA256 8dc562cda7217a3a52db898243de3e2ed68b80e62ddcb8619545ed0b4e7f65a8
MD5 cff85c549d536f651d4fb8387f1976f2
SHA1 d41ce3a5ff609df9cf5c7e207d3b59bf8a48530e
SHA512 531d6328daf3b86d85556016d299798fa06fefc81604185108a342d000e203094c8c12226a12bd6e1f89b0db501fb66f827b610d460b933bd4ab936ac2fd8a88
SSDEEP 192:Zjvco0qWTlt70m5Aj/lQ0sEWD/wtYbBHFNaDybC7y+XBz0QPi:FHQlt70mij/lQRv/9VMjzr
MD5 SHA1 SHA512 SSDEEP

Submit Download

containerbrokerSvc.exe

Path C:\comsurrogatecommon\containerbrokerSvc.exe
Size 953KB
SHA256 88a7db7ae820d84729ca9d9376848544bde2788f300d4303fd1b19c50c4c348d
MD5 30f9e0ff5a6f1343d0828e74f8d4d442
SHA1 b248379c85738a0deb8139f739a8fa7b343d876e
SHA512 9d4c4e1ad1cdadb295e029f0f71abf7a7679103c16ed05158f0feb491d403ebb69d1377352a2c25671bdfa53fde4d437a6cc1110b03f83ca9e6d14b693ecbe89
SSDEEP 12288:+HOeI6gu5/knmmIl6oUn3XkktACqvGhgzUJ8hWgXbriDf8nuv:+bI6F/knoJUn3UJS38hWgranv
MD5 SHA1 SHA512 SSDEEP

Submit Download

h6khYLQAm3C9Gvan2yaD6Idxz.vbe

Path C:\comsurrogatecommon\h6khYLQAm3C9Gvan2yaD6Idxz.vbe
Size 222B
SHA256 d178fab8fa489f9f67902f5b777145c321b6f614641c573edeb2da8f22127351
MD5 c2cebb18805a35aa4f1dc912dc6ff0d2
SHA1 6b32588c705ef239c1ed2f024d8eba13ac1bc50f
SHA512 0c4b01a735f064420916e11049a9f8b378a54d6e5cf24704e3f66f65be2696bfc88e6edf56b5887ef957991f7db1094f6283983fabc3c39c4f063e14b49dbeee
MD5 SHA1 SHA512

Submit Download

ndyJqdcK3gAQnUI3h5cTrzbsXo5.bat

Path C:\comsurrogatecommon\ndyJqdcK3gAQnUI3h5cTrzbsXo5.bat
Size 46B
SHA256 7211497c50c8ffc77a8ef893eca0cd8a6d39a5ed7cde524a9ec503758d0c4715
MD5 9847e6047e87392038dbd26b21c4de12
SHA1 eb898a87f645939df45449aabf80282be23ccd10
SHA512 c81e3e122d22b338aed653e51748c94d936555e4c00e77074e3f445f18af7eb641dede865165c3398b50bbf6c4b0fc5baaaba8fb6119e2a79dc3230f7030c633
MD5 SHA1 SHA512

Submit Download

memory/116-17-0x0000000000400000-0x0000000000712000-memory.dmp

Download

memory/4504-50-0x00000000013C0000-0x00000000013CE000-memory.dmp

Download

memory/4504-52-0x0000000002E30000-0x0000000002E3C000-memory.dmp

Download

memory/4504-51-0x0000000002CD0000-0x0000000002CD8000-memory.dmp

Download

memory/4504-49-0x0000000000B00000-0x0000000000BF6000-memory.dmp

Download