Overview

overview

10

Static

static

10

15b0fdd584...83.exe

windows7-x64

10

15b0fdd584...83.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    150s
  • max time network
    143s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    27/06/2024, 00:46

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    15b0fdd5848422711c6ce152d01e3f83.exe
  • Size 1.7MB
  • Sample240627-a4mgpswdpl
  • SHA256 6b415af659470e76f2e7fd163dc72d040746e6aaa4da4503fe8946675dffe25c
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
dcratevasioninfostealerrattrojan

Malware Config

Signatures

  • DcRat

    DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

    ratinfostealerdcrat
  • Process spawned unexpected child process 12 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • UAC bypass 3 TTPs 45 IoCs
    evasiontrojan
  • DCRat payload 2 IoCs

    Detects payload of DCRat, commonly dropped by NSIS installers.

    rat
  • Checks computer location settings 2 TTPs 15 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 14 IoCs
  • Checks whether UAC is enabled 1 TTPs 30 IoCs
    evasiontrojan
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 14 IoCs
  • Drops file in Program Files directory 3 IoCs
  • Drops file in Windows directory 5 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies registry class 15 IoCs
  • Scheduled Task/Job: Scheduled Task 1 TTPs 12 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistenceexecution
  • Suspicious behavior: EnumeratesProcesses 19 IoCs
  • Suspicious use of AdjustPrivilegeToken 15 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • System policy modification 1 TTPs 45 IoCs
    evasion
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\15b0fdd5848422711c6ce152d01e3f83.exe
    "C:\Users\Admin\AppData\Local\Temp\15b0fdd5848422711c6ce152d01e3f83.exe"
    1⤵
    • UAC bypass
    • Checks computer location settings
    • Checks whether UAC is enabled
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    • System policy modification
    PID:4496
    • C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\i2mPmkraeF.bat"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:3768
      • C:\Windows\system32\w32tm.exe
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        3⤵
          PID:2952
        • C:\Windows\INF\UGatherer\services.exe
          "C:\Windows\INF\UGatherer\services.exe"
          3⤵
          • UAC bypass
          • Checks computer location settings
          • Executes dropped EXE
          • Checks whether UAC is enabled
          • Modifies registry class
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          • System policy modification
          PID:1336
          • C:\Windows\System32\cmd.exe
            "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\sWs9jrlB8v.bat"
            4⤵
            • Suspicious use of WriteProcessMemory
            PID:2676
            • C:\Windows\system32\w32tm.exe
              w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
              5⤵
                PID:1228
              • C:\Windows\INF\UGatherer\services.exe
                "C:\Windows\INF\UGatherer\services.exe"
                5⤵
                • UAC bypass
                • Checks computer location settings
                • Executes dropped EXE
                • Checks whether UAC is enabled
                • Modifies registry class
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of AdjustPrivilegeToken
                • Suspicious use of WriteProcessMemory
                • System policy modification
                PID:2708
                • C:\Windows\System32\cmd.exe
                  "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\yJyIm7wr5G.bat"
                  6⤵
                  • Suspicious use of WriteProcessMemory
                  PID:1736
                  • C:\Windows\system32\w32tm.exe
                    w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                    7⤵
                      PID:4184
                    • C:\Windows\INF\UGatherer\services.exe
                      "C:\Windows\INF\UGatherer\services.exe"
                      7⤵
                      • UAC bypass
                      • Checks computer location settings
                      • Executes dropped EXE
                      • Checks whether UAC is enabled
                      • Modifies registry class
                      • Suspicious behavior: EnumeratesProcesses
                      • Suspicious use of AdjustPrivilegeToken
                      • Suspicious use of WriteProcessMemory
                      • System policy modification
                      PID:780
                      • C:\Windows\System32\cmd.exe
                        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\Re4gxnF4du.bat"
                        8⤵
                        • Suspicious use of WriteProcessMemory
                        PID:648
                        • C:\Windows\system32\w32tm.exe
                          w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                          9⤵
                            PID:208
                          • C:\Windows\INF\UGatherer\services.exe
                            "C:\Windows\INF\UGatherer\services.exe"
                            9⤵
                            • UAC bypass
                            • Checks computer location settings
                            • Executes dropped EXE
                            • Checks whether UAC is enabled
                            • Modifies registry class
                            • Suspicious behavior: EnumeratesProcesses
                            • Suspicious use of AdjustPrivilegeToken
                            • Suspicious use of WriteProcessMemory
                            • System policy modification
                            PID:1636
                            • C:\Windows\System32\cmd.exe
                              "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\eUivgxqvfs.bat"
                              10⤵
                              • Suspicious use of WriteProcessMemory
                              PID:1624
                              • C:\Windows\system32\w32tm.exe
                                w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                                11⤵
                                  PID:3368
                                • C:\Windows\INF\UGatherer\services.exe
                                  "C:\Windows\INF\UGatherer\services.exe"
                                  11⤵
                                  • UAC bypass
                                  • Checks computer location settings
                                  • Executes dropped EXE
                                  • Checks whether UAC is enabled
                                  • Modifies registry class
                                  • Suspicious behavior: EnumeratesProcesses
                                  • Suspicious use of AdjustPrivilegeToken
                                  • Suspicious use of WriteProcessMemory
                                  • System policy modification
                                  PID:652
                                  • C:\Windows\System32\cmd.exe
                                    "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\mTJ33xL03H.bat"
                                    12⤵
                                    • Suspicious use of WriteProcessMemory
                                    PID:932
                                    • C:\Windows\system32\w32tm.exe
                                      w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                                      13⤵
                                        PID:1504
                                      • C:\Windows\INF\UGatherer\services.exe
                                        "C:\Windows\INF\UGatherer\services.exe"
                                        13⤵
                                        • UAC bypass
                                        • Checks computer location settings
                                        • Executes dropped EXE
                                        • Checks whether UAC is enabled
                                        • Modifies registry class
                                        • Suspicious behavior: EnumeratesProcesses
                                        • Suspicious use of AdjustPrivilegeToken
                                        • Suspicious use of WriteProcessMemory
                                        • System policy modification
                                        PID:1100
                                        • C:\Windows\System32\cmd.exe
                                          "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\38GCmEMl12.bat"
                                          14⤵
                                          • Suspicious use of WriteProcessMemory
                                          PID:1868
                                          • C:\Windows\system32\w32tm.exe
                                            w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                                            15⤵
                                              PID:2688
                                            • C:\Windows\INF\UGatherer\services.exe
                                              "C:\Windows\INF\UGatherer\services.exe"
                                              15⤵
                                              • UAC bypass
                                              • Checks computer location settings
                                              • Executes dropped EXE
                                              • Checks whether UAC is enabled
                                              • Modifies registry class
                                              • Suspicious behavior: EnumeratesProcesses
                                              • Suspicious use of AdjustPrivilegeToken
                                              • Suspicious use of WriteProcessMemory
                                              • System policy modification
                                              PID:2324
                                              • C:\Windows\System32\cmd.exe
                                                "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\E3sOpJujjE.bat"
                                                16⤵
                                                • Suspicious use of WriteProcessMemory
                                                PID:1224
                                                • C:\Windows\system32\w32tm.exe
                                                  w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                                                  17⤵
                                                    PID:3712
                                                  • C:\Windows\INF\UGatherer\services.exe
                                                    "C:\Windows\INF\UGatherer\services.exe"
                                                    17⤵
                                                    • UAC bypass
                                                    • Checks computer location settings
                                                    • Executes dropped EXE
                                                    • Checks whether UAC is enabled
                                                    • Modifies registry class
                                                    • Suspicious behavior: EnumeratesProcesses
                                                    • Suspicious use of AdjustPrivilegeToken
                                                    • Suspicious use of WriteProcessMemory
                                                    • System policy modification
                                                    PID:1228
                                                    • C:\Windows\System32\cmd.exe
                                                      "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\xEoBbgPmrR.bat"
                                                      18⤵
                                                      • Suspicious use of WriteProcessMemory
                                                      PID:1800
                                                      • C:\Windows\system32\w32tm.exe
                                                        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                                                        19⤵
                                                          PID:1832
                                                        • C:\Windows\INF\UGatherer\services.exe
                                                          "C:\Windows\INF\UGatherer\services.exe"
                                                          19⤵
                                                          • UAC bypass
                                                          • Checks computer location settings
                                                          • Executes dropped EXE
                                                          • Checks whether UAC is enabled
                                                          • Modifies registry class
                                                          • Suspicious behavior: EnumeratesProcesses
                                                          • Suspicious use of AdjustPrivilegeToken
                                                          • Suspicious use of WriteProcessMemory
                                                          • System policy modification
                                                          PID:3924
                                                          • C:\Windows\System32\cmd.exe
                                                            "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\UZ6jdsJyxg.bat"
                                                            20⤵
                                                            • Suspicious use of WriteProcessMemory
                                                            PID:1364
                                                            • C:\Windows\system32\w32tm.exe
                                                              w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                                                              21⤵
                                                                PID:2544
                                                              • C:\Windows\INF\UGatherer\services.exe
                                                                "C:\Windows\INF\UGatherer\services.exe"
                                                                21⤵
                                                                • UAC bypass
                                                                • Checks computer location settings
                                                                • Executes dropped EXE
                                                                • Checks whether UAC is enabled
                                                                • Modifies registry class
                                                                • Suspicious behavior: EnumeratesProcesses
                                                                • Suspicious use of AdjustPrivilegeToken
                                                                • Suspicious use of WriteProcessMemory
                                                                • System policy modification
                                                                PID:3912
                                                                • C:\Windows\System32\cmd.exe
                                                                  "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\yQKAuQiBIV.bat"
                                                                  22⤵
                                                                  • Suspicious use of WriteProcessMemory
                                                                  PID:1728
                                                                  • C:\Windows\system32\w32tm.exe
                                                                    w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                                                                    23⤵
                                                                      PID:3620
                                                                    • C:\Windows\INF\UGatherer\services.exe
                                                                      "C:\Windows\INF\UGatherer\services.exe"
                                                                      23⤵
                                                                      • UAC bypass
                                                                      • Checks computer location settings
                                                                      • Executes dropped EXE
                                                                      • Checks whether UAC is enabled
                                                                      • Modifies registry class
                                                                      • Suspicious behavior: EnumeratesProcesses
                                                                      • Suspicious use of AdjustPrivilegeToken
                                                                      • System policy modification
                                                                      PID:2448
                                                                      • C:\Windows\System32\cmd.exe
                                                                        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\Nm0aad8I0L.bat"
                                                                        24⤵
                                                                          PID:2084
                                                                          • C:\Windows\system32\w32tm.exe
                                                                            w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                                                                            25⤵
                                                                              PID:2520
                                                                            • C:\Windows\INF\UGatherer\services.exe
                                                                              "C:\Windows\INF\UGatherer\services.exe"
                                                                              25⤵
                                                                              • UAC bypass
                                                                              • Checks computer location settings
                                                                              • Executes dropped EXE
                                                                              • Checks whether UAC is enabled
                                                                              • Modifies registry class
                                                                              • Suspicious behavior: EnumeratesProcesses
                                                                              • Suspicious use of AdjustPrivilegeToken
                                                                              • System policy modification
                                                                              PID:3628
                                                                              • C:\Windows\System32\cmd.exe
                                                                                "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\cYhs0sn2L6.bat"
                                                                                26⤵
                                                                                  PID:4000
                                                                                  • C:\Windows\system32\w32tm.exe
                                                                                    w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                                                                                    27⤵
                                                                                      PID:452
                                                                                    • C:\Windows\INF\UGatherer\services.exe
                                                                                      "C:\Windows\INF\UGatherer\services.exe"
                                                                                      27⤵
                                                                                      • UAC bypass
                                                                                      • Checks computer location settings
                                                                                      • Executes dropped EXE
                                                                                      • Checks whether UAC is enabled
                                                                                      • Modifies registry class
                                                                                      • Suspicious behavior: EnumeratesProcesses
                                                                                      • Suspicious use of AdjustPrivilegeToken
                                                                                      • System policy modification
                                                                                      PID:4704
                                                                                      • C:\Windows\System32\cmd.exe
                                                                                        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\qRj2XQE6t6.bat"
                                                                                        28⤵
                                                                                          PID:2432
                                                                                          • C:\Windows\system32\w32tm.exe
                                                                                            w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                                                                                            29⤵
                                                                                              PID:4884
                                                                                            • C:\Windows\INF\UGatherer\services.exe
                                                                                              "C:\Windows\INF\UGatherer\services.exe"
                                                                                              29⤵
                                                                                              • UAC bypass
                                                                                              • Checks computer location settings
                                                                                              • Executes dropped EXE
                                                                                              • Checks whether UAC is enabled
                                                                                              • Modifies registry class
                                                                                              • Suspicious behavior: EnumeratesProcesses
                                                                                              • Suspicious use of AdjustPrivilegeToken
                                                                                              • System policy modification
                                                                                              PID:2896
                                                                                              • C:\Windows\System32\cmd.exe
                                                                                                "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\38GCmEMl12.bat"
                                                                                                30⤵
                                                                                                  PID:2100
                                                                                                  • C:\Windows\system32\w32tm.exe
                                                                                                    w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                                                                                                    31⤵
                                                                                                      PID:2968
                                        • C:\Windows\system32\schtasks.exe
                                          schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 6 /tr "'C:\Program Files\7-Zip\dllhost.exe'" /f
                                          1⤵
                                          • Process spawned unexpected child process
                                          • Scheduled Task/Job: Scheduled Task
                                          PID:392
                                        • C:\Windows\system32\schtasks.exe
                                          schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Program Files\7-Zip\dllhost.exe'" /rl HIGHEST /f
                                          1⤵
                                          • Process spawned unexpected child process
                                          • Scheduled Task/Job: Scheduled Task
                                          PID:2448
                                        • C:\Windows\system32\schtasks.exe
                                          schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 14 /tr "'C:\Program Files\7-Zip\dllhost.exe'" /rl HIGHEST /f
                                          1⤵
                                          • Process spawned unexpected child process
                                          • Scheduled Task/Job: Scheduled Task
                                          PID:2804
                                        • C:\Windows\system32\schtasks.exe
                                          schtasks.exe /create /tn "RegistryR" /sc MINUTE /mo 5 /tr "'C:\Recovery\WindowsRE\Registry.exe'" /f
                                          1⤵
                                          • Process spawned unexpected child process
                                          • Scheduled Task/Job: Scheduled Task
                                          PID:4772
                                        • C:\Windows\system32\schtasks.exe
                                          schtasks.exe /create /tn "Registry" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\Registry.exe'" /rl HIGHEST /f
                                          1⤵
                                          • Process spawned unexpected child process
                                          • Scheduled Task/Job: Scheduled Task
                                          PID:2824
                                        • C:\Windows\system32\schtasks.exe
                                          schtasks.exe /create /tn "RegistryR" /sc MINUTE /mo 6 /tr "'C:\Recovery\WindowsRE\Registry.exe'" /rl HIGHEST /f
                                          1⤵
                                          • Process spawned unexpected child process
                                          • Scheduled Task/Job: Scheduled Task
                                          PID:1256
                                        • C:\Windows\system32\schtasks.exe
                                          schtasks.exe /create /tn "servicess" /sc MINUTE /mo 7 /tr "'C:\Windows\INF\UGatherer\services.exe'" /f
                                          1⤵
                                          • Process spawned unexpected child process
                                          • Scheduled Task/Job: Scheduled Task
                                          PID:4788
                                        • C:\Windows\system32\schtasks.exe
                                          schtasks.exe /create /tn "services" /sc ONLOGON /tr "'C:\Windows\INF\UGatherer\services.exe'" /rl HIGHEST /f
                                          1⤵
                                          • Process spawned unexpected child process
                                          • Scheduled Task/Job: Scheduled Task
                                          PID:3472
                                        • C:\Windows\system32\schtasks.exe
                                          schtasks.exe /create /tn "servicess" /sc MINUTE /mo 14 /tr "'C:\Windows\INF\UGatherer\services.exe'" /rl HIGHEST /f
                                          1⤵
                                          • Process spawned unexpected child process
                                          • Scheduled Task/Job: Scheduled Task
                                          PID:2204
                                        • C:\Windows\system32\schtasks.exe
                                          schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 8 /tr "'C:\Windows\ShellExperiences\lsass.exe'" /f
                                          1⤵
                                          • Process spawned unexpected child process
                                          • Scheduled Task/Job: Scheduled Task
                                          PID:3692
                                        • C:\Windows\system32\schtasks.exe
                                          schtasks.exe /create /tn "lsass" /sc ONLOGON /tr "'C:\Windows\ShellExperiences\lsass.exe'" /rl HIGHEST /f
                                          1⤵
                                          • Process spawned unexpected child process
                                          • Scheduled Task/Job: Scheduled Task
                                          PID:3800
                                        • C:\Windows\system32\schtasks.exe
                                          schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 11 /tr "'C:\Windows\ShellExperiences\lsass.exe'" /rl HIGHEST /f
                                          1⤵
                                          • Process spawned unexpected child process
                                          • Scheduled Task/Job: Scheduled Task
                                          PID:3860

                                        Network

                                              MITRE ATT&CK Enterprise v15

                                              Replay Monitor

                                              Loading Replay Monitor...

                                              Downloads

                                              services.exe.log
                                              • Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\services.exe.log
                                              • Size 1KB
                                              • SHA256 fd35f3609663bec79a5254866d1c47342fbde3f94808acff8c3eaa19b24f67e5
                                              • MD5 SHA1 SHA512
                                              Submit Download

                                              38GCmEMl12.bat
                                              • Path C:\Users\Admin\AppData\Local\Temp\38GCmEMl12.bat
                                              • Size 202B
                                              • SHA256 cd28a0cf5aea43c5d349ef850c1993a752ae2c792ae8d51cc52c58efd3d75d31
                                              • MD5 SHA1 SHA512
                                              Submit Download

                                              E3sOpJujjE.bat
                                              • Path C:\Users\Admin\AppData\Local\Temp\E3sOpJujjE.bat
                                              • Size 202B
                                              • SHA256 6e592b3803dd3b86b779e0eff16370a6000f79f9519e10417054eef969b35188
                                              • MD5 SHA1 SHA512
                                              Submit Download

                                              Nm0aad8I0L.bat
                                              • Path C:\Users\Admin\AppData\Local\Temp\Nm0aad8I0L.bat
                                              • Size 202B
                                              • SHA256 8f2af4ee794a240db93277d9d1aacb7e945033a4c0e2abf2e1f7d213565218f5
                                              • MD5 SHA1 SHA512
                                              Submit Download

                                              Re4gxnF4du.bat
                                              • Path C:\Users\Admin\AppData\Local\Temp\Re4gxnF4du.bat
                                              • Size 202B
                                              • SHA256 41a645eaf4b117cca05de3f64bb553aa060a2213b3a622cf6335771dc3926537
                                              • MD5 SHA1 SHA512
                                              Submit Download

                                              UZ6jdsJyxg.bat
                                              • Path C:\Users\Admin\AppData\Local\Temp\UZ6jdsJyxg.bat
                                              • Size 202B
                                              • SHA256 9122f65a655033c002f4fb4fdd4d1375d65ba42b51eeb1860970e9604dc7e0b5
                                              • MD5 SHA1 SHA512
                                              Submit Download

                                              cYhs0sn2L6.bat
                                              • Path C:\Users\Admin\AppData\Local\Temp\cYhs0sn2L6.bat
                                              • Size 202B
                                              • SHA256 51df924d3e7380b4df4b072306249b6c6bc8fbe341539498af8c0909d33096f9
                                              • MD5 SHA1 SHA512
                                              Submit Download

                                              eUivgxqvfs.bat
                                              • Path C:\Users\Admin\AppData\Local\Temp\eUivgxqvfs.bat
                                              • Size 202B
                                              • SHA256 53f2f521ad864f5aeff151f4097505e4188206797e9c2fa8037b5b0de7ad3f2c
                                              • MD5 SHA1 SHA512
                                              Submit Download

                                              i2mPmkraeF.bat
                                              • Path C:\Users\Admin\AppData\Local\Temp\i2mPmkraeF.bat
                                              • Size 202B
                                              • SHA256 c9f775df81e3802837bfad2f85e5a9067adf1f8911f6939c18c80de090153b06
                                              • MD5 SHA1 SHA512
                                              Submit Download

                                              mTJ33xL03H.bat
                                              • Path C:\Users\Admin\AppData\Local\Temp\mTJ33xL03H.bat
                                              • Size 202B
                                              • SHA256 f714918278859e2f67ce7f940c38e85a2edbd6cd1d52d692784894e7a9a97a55
                                              • MD5 SHA1 SHA512
                                              Submit Download

                                              qRj2XQE6t6.bat
                                              • Path C:\Users\Admin\AppData\Local\Temp\qRj2XQE6t6.bat
                                              • Size 202B
                                              • SHA256 9c87be411a7726a00d2d2b5ea398768a700b8ce6ec6b7e6581a4d2b91c9e4adc
                                              • MD5 SHA1 SHA512
                                              Submit Download

                                              sWs9jrlB8v.bat
                                              • Path C:\Users\Admin\AppData\Local\Temp\sWs9jrlB8v.bat
                                              • Size 202B
                                              • SHA256 f2546d9b61d0c56914ed684485977f9aa6b6a97acba2620f2fa4adb76510fc32
                                              • MD5 SHA1 SHA512
                                              Submit Download

                                              xEoBbgPmrR.bat
                                              • Path C:\Users\Admin\AppData\Local\Temp\xEoBbgPmrR.bat
                                              • Size 202B
                                              • SHA256 ac15ddeea0113e7817da5d7b3ceefcd1487efe4e34d84a07ce6806ec5393dee5
                                              • MD5 SHA1 SHA512
                                              Submit Download

                                              yJyIm7wr5G.bat
                                              • Path C:\Users\Admin\AppData\Local\Temp\yJyIm7wr5G.bat
                                              • Size 202B
                                              • SHA256 bac830f015d52a33f20de21d58e4b911d4aac089125132946de8e8ed233f81dc
                                              • MD5 SHA1 SHA512
                                              Submit Download

                                              yQKAuQiBIV.bat
                                              • Path C:\Users\Admin\AppData\Local\Temp\yQKAuQiBIV.bat
                                              • Size 202B
                                              • SHA256 13a59e0d6ca408b36a95d1472082d7538c0316afff148bcb0450b0237bd737bd
                                              • MD5 SHA1 SHA512
                                              Submit Download

                                              services.exe
                                              • Path C:\Windows\INF\UGatherer\services.exe
                                              • Size 1.7MB
                                              • SHA256 6b415af659470e76f2e7fd163dc72d040746e6aaa4da4503fe8946675dffe25c
                                              • MD5 SHA1 SHA512 SSDEEP
                                              Submit Download

                                              memory/1228-87-0x000000001CD10000-0x000000001CE12000-memory.dmp
                                              Download

                                              memory/1636-58-0x000000001D840000-0x000000001D852000-memory.dmp
                                              Download

                                              memory/3912-97-0x000000001D3F0000-0x000000001D402000-memory.dmp
                                              Download

                                              memory/3924-94-0x000000001D1D0000-0x000000001D2D2000-memory.dmp
                                              Download

                                              memory/4496-10-0x000000001B110000-0x000000001B118000-memory.dmp
                                              Download

                                              memory/4496-0-0x00007FFE314C3000-0x00007FFE314C5000-memory.dmp
                                              Download

                                              memory/4496-19-0x000000001B920000-0x000000001B92C000-memory.dmp
                                              Download

                                              memory/4496-18-0x000000001B910000-0x000000001B91A000-memory.dmp
                                              Download

                                              memory/4496-16-0x000000001B8F0000-0x000000001B8FC000-memory.dmp
                                              Download

                                              memory/4496-17-0x000000001B900000-0x000000001B90E000-memory.dmp
                                              Download

                                              memory/4496-15-0x000000001B8E0000-0x000000001B8E8000-memory.dmp
                                              Download

                                              memory/4496-14-0x000000001B1C0000-0x000000001B1CC000-memory.dmp
                                              Download

                                              memory/4496-13-0x000000001BE10000-0x000000001C338000-memory.dmp
                                              Download

                                              memory/4496-12-0x000000001B190000-0x000000001B1A2000-memory.dmp
                                              Download

                                              memory/4496-11-0x000000001B120000-0x000000001B12C000-memory.dmp
                                              Download

                                              memory/4496-33-0x00007FFE314C0000-0x00007FFE31F81000-memory.dmp
                                              Download

                                              memory/4496-9-0x000000001B100000-0x000000001B10C000-memory.dmp
                                              Download

                                              memory/4496-8-0x000000001B0F0000-0x000000001B0FA000-memory.dmp
                                              Download

                                              memory/4496-5-0x000000001B0B0000-0x000000001B0C6000-memory.dmp
                                              Download

                                              memory/4496-7-0x000000001B0E0000-0x000000001B0F0000-memory.dmp
                                              Download

                                              memory/4496-6-0x000000001B0D0000-0x000000001B0D8000-memory.dmp
                                              Download

                                              memory/4496-4-0x000000001B140000-0x000000001B190000-memory.dmp
                                              Download

                                              memory/4496-3-0x0000000002770000-0x000000000278C000-memory.dmp
                                              Download

                                              memory/4496-2-0x00007FFE314C0000-0x00007FFE31F81000-memory.dmp
                                              Download

                                              memory/4496-1-0x00000000003E0000-0x0000000000596000-memory.dmp
                                              Download