Overview

overview

10

Static

static

3

afe966f7d7...1N.exe

windows7-x64

10

afe966f7d7...1N.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    148s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    03-11-2024 13:41

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    afe966f7d7d027792cc718eba58d9ee3e7b2929e9cb3eed8902537d8c375e081N.exe

  • Size

    1.9MB

  • MD5

    38c14805a17436bc0118dfaa6547eec0

  • SHA1

    77ee261fd0d14577058bd1114bfd4a34aa0990e6

  • SHA256

    afe966f7d7d027792cc718eba58d9ee3e7b2929e9cb3eed8902537d8c375e081

  • SHA512

    bfec5fa0c4d45ebcc26bf18f3ccf0ea9b6bc6de62ce1ddfc012ef69f42c2bf45d90a3dc5f6537e62e6d0e30247eb0c2b5495249b01d0b158b6a73dd29e657754

  • SSDEEP

    24576:W7/weHc1lJq2tB/pw97SSwEWJSwDFrs7+6pa7gv6a9MrYetY5Q62xo2CPV84uMY1:qqpji7SxFgz7XM7metv6s2N8W

Score
10/10
dcratdiscoveryexecutioninfostealerpersistenceratspywarestealer

Malware Config

Signatures

  • DcRat

    DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

    ratinfostealerdcrat
  • Dcrat family
    dcrat
  • Modifies WinLogon for persistence 2 TTPs 6 IoCs
    persistence
  • Process spawned unexpected child process 18 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • Command and Scripting Interpreter: PowerShell 1 TTPs 17 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 1 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Adds Run key to start application 2 TTPs 12 IoCs
    persistence
  • Drops file in System32 directory 3 IoCs
  • Drops file in Program Files directory 12 IoCs
  • Drops file in Windows directory 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

    Adversaries may check for Internet connectivity on compromised systems.

    discovery
  • Modifies registry class 1 IoCs
  • Runs ping.exe 1 TTPs 1 IoCs
  • Scheduled Task/Job: Scheduled Task 1 TTPs 18 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistenceexecution
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 19 IoCs
  • Suspicious use of WriteProcessMemory 46 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\afe966f7d7d027792cc718eba58d9ee3e7b2929e9cb3eed8902537d8c375e081N.exe
    "C:\Users\Admin\AppData\Local\Temp\afe966f7d7d027792cc718eba58d9ee3e7b2929e9cb3eed8902537d8c375e081N.exe"
    1⤵
    • Modifies WinLogon for persistence
    • Checks computer location settings
    • Adds Run key to start application
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2132
    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
      "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\2cx1geds\2cx1geds.cmdline"
      2⤵
      • Drops file in System32 directory
      • Suspicious use of WriteProcessMemory
      PID:3032
      • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES8C81.tmp" "c:\Windows\System32\CSC86B6BC3312C049D9AB57A2F289A5AE4.TMP"
        3⤵
          PID:4816
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:/'
        2⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious use of AdjustPrivilegeToken
        PID:1736
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:/$Recycle.Bin/'
        2⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious use of AdjustPrivilegeToken
        PID:4984
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Documents and Settings/'
        2⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious use of AdjustPrivilegeToken
        PID:1016
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:/PerfLogs/'
        2⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious use of AdjustPrivilegeToken
        PID:4456
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files/'
        2⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious use of AdjustPrivilegeToken
        PID:460
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files (x86)/'
        2⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious use of AdjustPrivilegeToken
        PID:4756
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:/ProgramData/'
        2⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious use of AdjustPrivilegeToken
        PID:4508
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Recovery/'
        2⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious use of AdjustPrivilegeToken
        PID:1408
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:/System Volume Information/'
        2⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious use of AdjustPrivilegeToken
        PID:1144
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Users/'
        2⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious use of AdjustPrivilegeToken
        PID:2992
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Windows/'
        2⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious use of AdjustPrivilegeToken
        PID:1432
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Uninstall Information\fontdrvhost.exe'
        2⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious use of AdjustPrivilegeToken
        PID:656
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Common Files\DESIGNER\lsass.exe'
        2⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious use of AdjustPrivilegeToken
        PID:1568
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Windows Media Player\Registry.exe'
        2⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious use of AdjustPrivilegeToken
        PID:4624
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Adobe\Acrobat Reader DC\dwm.exe'
        2⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious use of AdjustPrivilegeToken
        PID:2468
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Windows NT\Accessories\backgroundTaskHost.exe'
        2⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious use of AdjustPrivilegeToken
        PID:3180
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\afe966f7d7d027792cc718eba58d9ee3e7b2929e9cb3eed8902537d8c375e081N.exe'
        2⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious use of AdjustPrivilegeToken
        PID:4308
      • C:\Windows\System32\cmd.exe
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\QLldoiUmft.bat"
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:2124
        • C:\Windows\system32\chcp.com
          chcp 65001
          3⤵
            PID:5872
          • C:\Windows\system32\PING.EXE
            ping -n 10 localhost
            3⤵
            • System Network Configuration Discovery: Internet Connection Discovery
            • Runs ping.exe
            PID:1040
          • C:\Program Files\Uninstall Information\fontdrvhost.exe
            "C:\Program Files\Uninstall Information\fontdrvhost.exe"
            3⤵
            • Executes dropped EXE
            • Suspicious behavior: GetForegroundWindowSpam
            • Suspicious use of AdjustPrivilegeToken
            PID:4152
      • C:\Windows\system32\schtasks.exe
        schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 5 /tr "'C:\Program Files\Uninstall Information\fontdrvhost.exe'" /f
        1⤵
        • Process spawned unexpected child process
        • Scheduled Task/Job: Scheduled Task
        PID:4476
      • C:\Windows\system32\schtasks.exe
        schtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\Program Files\Uninstall Information\fontdrvhost.exe'" /rl HIGHEST /f
        1⤵
        • Process spawned unexpected child process
        • Scheduled Task/Job: Scheduled Task
        PID:2904
      • C:\Windows\system32\schtasks.exe
        schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 7 /tr "'C:\Program Files\Uninstall Information\fontdrvhost.exe'" /rl HIGHEST /f
        1⤵
        • Process spawned unexpected child process
        • Scheduled Task/Job: Scheduled Task
        PID:3420
      • C:\Windows\system32\schtasks.exe
        schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 11 /tr "'C:\Program Files\Common Files\DESIGNER\lsass.exe'" /f
        1⤵
        • Process spawned unexpected child process
        • Scheduled Task/Job: Scheduled Task
        PID:4912
      • C:\Windows\system32\schtasks.exe
        schtasks.exe /create /tn "lsass" /sc ONLOGON /tr "'C:\Program Files\Common Files\DESIGNER\lsass.exe'" /rl HIGHEST /f
        1⤵
        • Process spawned unexpected child process
        • Scheduled Task/Job: Scheduled Task
        PID:4040
      • C:\Windows\system32\schtasks.exe
        schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 7 /tr "'C:\Program Files\Common Files\DESIGNER\lsass.exe'" /rl HIGHEST /f
        1⤵
        • Process spawned unexpected child process
        • Scheduled Task/Job: Scheduled Task
        PID:4492
      • C:\Windows\system32\schtasks.exe
        schtasks.exe /create /tn "RegistryR" /sc MINUTE /mo 12 /tr "'C:\Program Files\Windows Media Player\Registry.exe'" /f
        1⤵
        • Process spawned unexpected child process
        • Scheduled Task/Job: Scheduled Task
        PID:3712
      • C:\Windows\system32\schtasks.exe
        schtasks.exe /create /tn "Registry" /sc ONLOGON /tr "'C:\Program Files\Windows Media Player\Registry.exe'" /rl HIGHEST /f
        1⤵
        • Process spawned unexpected child process
        • Scheduled Task/Job: Scheduled Task
        PID:2248
      • C:\Windows\system32\schtasks.exe
        schtasks.exe /create /tn "RegistryR" /sc MINUTE /mo 13 /tr "'C:\Program Files\Windows Media Player\Registry.exe'" /rl HIGHEST /f
        1⤵
        • Process spawned unexpected child process
        • Scheduled Task/Job: Scheduled Task
        PID:2720
      • C:\Windows\system32\schtasks.exe
        schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 12 /tr "'C:\Program Files (x86)\Adobe\Acrobat Reader DC\dwm.exe'" /f
        1⤵
        • Process spawned unexpected child process
        • Scheduled Task/Job: Scheduled Task
        PID:540
      • C:\Windows\system32\schtasks.exe
        schtasks.exe /create /tn "dwm" /sc ONLOGON /tr "'C:\Program Files (x86)\Adobe\Acrobat Reader DC\dwm.exe'" /rl HIGHEST /f
        1⤵
        • Process spawned unexpected child process
        • Scheduled Task/Job: Scheduled Task
        PID:3788
      • C:\Windows\system32\schtasks.exe
        schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 12 /tr "'C:\Program Files (x86)\Adobe\Acrobat Reader DC\dwm.exe'" /rl HIGHEST /f
        1⤵
        • Process spawned unexpected child process
        • Scheduled Task/Job: Scheduled Task
        PID:4956
      • C:\Windows\system32\schtasks.exe
        schtasks.exe /create /tn "backgroundTaskHostb" /sc MINUTE /mo 10 /tr "'C:\Program Files (x86)\Windows NT\Accessories\backgroundTaskHost.exe'" /f
        1⤵
        • Process spawned unexpected child process
        • Scheduled Task/Job: Scheduled Task
        PID:4860
      • C:\Windows\system32\schtasks.exe
        schtasks.exe /create /tn "backgroundTaskHost" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows NT\Accessories\backgroundTaskHost.exe'" /rl HIGHEST /f
        1⤵
        • Process spawned unexpected child process
        • Scheduled Task/Job: Scheduled Task
        PID:184
      • C:\Windows\system32\schtasks.exe
        schtasks.exe /create /tn "backgroundTaskHostb" /sc MINUTE /mo 7 /tr "'C:\Program Files (x86)\Windows NT\Accessories\backgroundTaskHost.exe'" /rl HIGHEST /f
        1⤵
        • Process spawned unexpected child process
        • Scheduled Task/Job: Scheduled Task
        PID:2388
      • C:\Windows\system32\schtasks.exe
        schtasks.exe /create /tn "afe966f7d7d027792cc718eba58d9ee3e7b2929e9cb3eed8902537d8c375e081Na" /sc MINUTE /mo 14 /tr "'C:\Users\Admin\AppData\Local\Temp\afe966f7d7d027792cc718eba58d9ee3e7b2929e9cb3eed8902537d8c375e081N.exe'" /f
        1⤵
        • Process spawned unexpected child process
        • Scheduled Task/Job: Scheduled Task
        PID:1548
      • C:\Windows\system32\schtasks.exe
        schtasks.exe /create /tn "afe966f7d7d027792cc718eba58d9ee3e7b2929e9cb3eed8902537d8c375e081N" /sc ONLOGON /tr "'C:\Users\Admin\AppData\Local\Temp\afe966f7d7d027792cc718eba58d9ee3e7b2929e9cb3eed8902537d8c375e081N.exe'" /rl HIGHEST /f
        1⤵
        • Process spawned unexpected child process
        • Scheduled Task/Job: Scheduled Task
        PID:3164
      • C:\Windows\system32\schtasks.exe
        schtasks.exe /create /tn "afe966f7d7d027792cc718eba58d9ee3e7b2929e9cb3eed8902537d8c375e081Na" /sc MINUTE /mo 5 /tr "'C:\Users\Admin\AppData\Local\Temp\afe966f7d7d027792cc718eba58d9ee3e7b2929e9cb3eed8902537d8c375e081N.exe'" /rl HIGHEST /f
        1⤵
        • Process spawned unexpected child process
        • Scheduled Task/Job: Scheduled Task
        PID:4640

      Network

      MITRE ATT&CK Enterprise v15

      Reconnaissance

      Resource Development

      Initial Access

      Execution

      Command and Scripting Interpreter

      1
      T1059

      PowerShell

      1
      T1059.001

      Scheduled Task/Job

      1
      T1053

      Scheduled Task

      1
      T1053.005

      Persistence

      Boot or Logon Autostart Execution

      2
      T1547

      Registry Run Keys / Startup Folder

      1
      T1547.001

      Winlogon Helper DLL

      1
      T1547.004

      Scheduled Task/Job

      1
      T1053

      Scheduled Task

      1
      T1053.005

      Privilege Escalation

      Boot or Logon Autostart Execution

      2
      T1547

      Registry Run Keys / Startup Folder

      1
      T1547.001

      Winlogon Helper DLL

      1
      T1547.004

      Scheduled Task/Job

      1
      T1053

      Scheduled Task

      1
      T1053.005

      Defense Evasion

      Modify Registry

      2
      T1112

      Credential Access

      Credentials from Password Stores

      1
      T1555

      Credentials from Web Browsers

      1
      T1555.003

      Unsecured Credentials

      1
      T1552

      Credentials In Files

      1
      T1552.001

      Discovery

      Query Registry

      2
      T1012

      Remote System Discovery

      1
      T1018

      System Information Discovery

      2
      T1082

      System Network Configuration Discovery

      1
      T1016

      Internet Connection Discovery

      1
      T1016.001

      Lateral Movement

      Collection

      Data from Local System

      1
      T1005

      Command and Control

      Exfiltration

      Impact

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Program Files\Uninstall Information\fontdrvhost.exe
        Filesize

        1.9MB

        MD5

        38c14805a17436bc0118dfaa6547eec0

        SHA1

        77ee261fd0d14577058bd1114bfd4a34aa0990e6

        SHA256

        afe966f7d7d027792cc718eba58d9ee3e7b2929e9cb3eed8902537d8c375e081

        SHA512

        bfec5fa0c4d45ebcc26bf18f3ccf0ea9b6bc6de62ce1ddfc012ef69f42c2bf45d90a3dc5f6537e62e6d0e30247eb0c2b5495249b01d0b158b6a73dd29e657754

        Download Submit

      • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
        Filesize

        2KB

        MD5

        d85ba6ff808d9e5444a4b369f5bc2730

        SHA1

        31aa9d96590fff6981b315e0b391b575e4c0804a

        SHA256

        84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

        SHA512

        8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

        Download Submit

      • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
        Filesize

        944B

        MD5

        cadef9abd087803c630df65264a6c81c

        SHA1

        babbf3636c347c8727c35f3eef2ee643dbcc4bd2

        SHA256

        cce65b73cdfe9304bcd5207913e8b60fb69faa20cd3b684f2b0343b755b99438

        SHA512

        7278aa87124abb382d9024a645e881e7b7cf1b84e8894943b36e018dbf0399e6858392f77980b599fa5488e2e21bf757a0702fe6419417edac93b68e0c2ec085

        Download Submit

      • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
        Filesize

        944B

        MD5

        3a6bad9528f8e23fb5c77fbd81fa28e8

        SHA1

        f127317c3bc6407f536c0f0600dcbcf1aabfba36

        SHA256

        986366767de5873f1b170a63f2a33ce05132d1afd90c8f5017afbca8ef1beb05

        SHA512

        846002154a0ece6f3e9feda6f115d3161dc21b3789525dd62ae1d9188495171293efdbe7be4710666dd8a15e66b557315b5a02918a741ed1d5f3ff0c515b98e2

        Download Submit

      • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
        Filesize

        944B

        MD5

        28d4235aa2e6d782751f980ceb6e5021

        SHA1

        f5d82d56acd642b9fc4b963f684fd6b78f25a140

        SHA256

        8c66720f953e82cfbd8f00543c42c0cf77c3d97787ec09cb3e1e2ba5819bd638

        SHA512

        dba1bd6600f5affcfdc33a59e7ac853ee5fdfafb8d1407a1768728bd4f66ef6b49437214716b7e33e3de91d7ce95709050a3dab4354dd62acaf1de28107017a2

        Download Submit

      • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
        Filesize

        944B

        MD5

        e243a38635ff9a06c87c2a61a2200656

        SHA1

        ecd95ed5bf1a9fbe96a8448fc2814a0210fa2afc

        SHA256

        af5782703f3f2d5a29fb313dae6680a64134db26064d4a321a3f23b75f6ca00f

        SHA512

        4418957a1b10eee44cf270c81816ae707352411c4f5ac14b6b61ab537c91480e24e0a0a2c276a6291081b4984c123cf673a45dcedb0ceeef682054ba0fc19cb4

        Download Submit

      • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
        Filesize

        944B

        MD5

        5f0ddc7f3691c81ee14d17b419ba220d

        SHA1

        f0ef5fde8bab9d17c0b47137e014c91be888ee53

        SHA256

        a31805264b8b13ce4145f272cb2830728c186c46e314b48514d636866217add5

        SHA512

        2ce7c2a0833f581297c13dd88ccfcd36bf129d2b5d7718c52b1d67c97cbd8fc93abc085a040229a0fd712e880c690de7f6b996b0b47c46a091fabb7931be58d3

        Download Submit

      • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
        Filesize

        944B

        MD5

        ecceac16628651c18879d836acfcb062

        SHA1

        420502b3e5220a01586c59504e94aa1ee11982c9

        SHA256

        58238de09a8817ed9f894ed8e5bf06a897fd08e0b0bd77e508d37b2598edd2a9

        SHA512

        be3c7cb529cafb00f58790a6f8b35c4ff6db9f7f43a507d2218fd80cebc88413e46f71b1bc35b8afcc36b68f9409c946470d1e74a4fe225400eeb6f3f898f5b3

        Download Submit

      • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
        Filesize

        944B

        MD5

        aaaac7c68d2b7997ed502c26fd9f65c2

        SHA1

        7c5a3731300d672bf53c43e2f9e951c745f7fbdf

        SHA256

        8724dc2c3c8e8f17aeefae44a23741b1ea3b43c490fbc52fd61575ffe1cd82bb

        SHA512

        c526febd9430413b48bed976edd9a795793ad1f06c8ff4f6b768b4ad63f4d2f06b9da72d4fcfa7cb9530a64e2dc3554f5ad97fd0ab60129701d175f2724ef1ac

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\QLldoiUmft.bat
        Filesize

        182B

        MD5

        b82c6b107c1c6dc6de598fe6763c2221

        SHA1

        1e8264168e16406ca27c3b699091bb3b1334509d

        SHA256

        e110cd8cb25797978b891147d2f5514b633b4bfed20b46b9298020f8be39ff90

        SHA512

        6753879e0bf8301d2f2b59a0ed4bf3e69aa98c048a1cb716389f39d5842ee6cd17e17a6ab4e20db0e90e3a9c9562b9b47e76b34551a292c0abe07fa78e2682a4

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\RES8C81.tmp
        Filesize

        1KB

        MD5

        3f7173fec6d509fcceee67fb8f560aad

        SHA1

        dc55e7296d2d846f31f344324e4e61cc6c36ab00

        SHA256

        f9e6b1b1819396007609c350075d2478588cd64aeae058230d9de61a86f6cee8

        SHA512

        6b64b507bb51a66e38748f6c30e84dc4f130d083ce70938ee7f1f3eb760be560b47f53ca9017c01524649a9044b308c44ede0f027e12682bcc8de2d4fd8ba0f0

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_525qkcsz.2y4.ps1
        Filesize

        60B

        MD5

        d17fe0a3f47be24a6453e9ef58c94641

        SHA1

        6ab83620379fc69f80c0242105ddffd7d98d5d9d

        SHA256

        96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

        SHA512

        5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

        Download Submit

      • \??\c:\Users\Admin\AppData\Local\Temp\2cx1geds\2cx1geds.0.cs
        Filesize

        386B

        MD5

        be9d669af04836ce96523c030a361436

        SHA1

        6875e7b1c11396f9bf56f31b2d698a9c4913bfa6

        SHA256

        836400b3f432f9b8c09bffd1bf0e6b48398f2b675db7237f3d8e1b6ddd0bd097

        SHA512

        2acd8d45c4a8ab43be74d4e2fcd2caf62b10e5d6d7e4673b2fb95936e4a01587c1eec44ea3bc2934c4b9a4293ac699b9d58bee57b75a28ed5e9fac2bc0979ea0

        Download Submit

      • \??\c:\Users\Admin\AppData\Local\Temp\2cx1geds\2cx1geds.cmdline
        Filesize

        235B

        MD5

        9ec4ac713999497803c9796aec5776d6

        SHA1

        0cb20a3b0ae870d0e9866d3d84d85c11cdd9fa23

        SHA256

        1cdfeb067fa41dc97666d1586f577df9fdbc1e394990b59c0916e5f8b7cca096

        SHA512

        9de0abca7731aa427b89240326b45a9a87fa1149e3522dd379193277fda391228e6924eb82c242b17e1d463ca4ed7a8f1dd5336028508bc4ff215f8e310bd833

        Download Submit

      • \??\c:\Windows\System32\CSC86B6BC3312C049D9AB57A2F289A5AE4.TMP
        Filesize

        1KB

        MD5

        be99f41194f5159cc131a1a4353a0e0a

        SHA1

        f24e3bf06e777b4de8d072166cff693e43f2295c

        SHA256

        564d9051e5639603c83562a9ff2c2e478cc7e13d54faf39f761297bac78603bf

        SHA512

        51d1a50772bb7d689193e6a9b2e363185cf5438103644b2b68cf13e08274c5d99407b99f8cdc856143d28669f5ee4ee316041a8e33df42f55bfd181aa3f3c0f5

        Download Submit

      • memory/1408-61-0x0000014DFB980000-0x0000014DFB9A2000-memory.dmp

        Filesize

        136KB

        Download

      • memory/2132-54-0x000000001C960000-0x000000001C9AE000-memory.dmp

        Filesize

        312KB

        Download

      • memory/2132-12-0x000000001BD40000-0x000000001BD58000-memory.dmp

        Filesize

        96KB

        Download

      • memory/2132-0-0x00007FFBC4243000-0x00007FFBC4245000-memory.dmp

        Filesize

        8KB

        Download

      • memory/2132-30-0x00007FFBC4240000-0x00007FFBC4D01000-memory.dmp

        Filesize

        10.8MB

        Download

      • memory/2132-17-0x000000001BD00000-0x000000001BD0E000-memory.dmp

        Filesize

        56KB

        Download

      • memory/2132-19-0x000000001BD10000-0x000000001BD1C000-memory.dmp

        Filesize

        48KB

        Download

      • memory/2132-46-0x00007FFBC4240000-0x00007FFBC4D01000-memory.dmp

        Filesize

        10.8MB

        Download

      • memory/2132-47-0x00007FFBC4240000-0x00007FFBC4D01000-memory.dmp

        Filesize

        10.8MB

        Download

      • memory/2132-48-0x00007FFBC4240000-0x00007FFBC4D01000-memory.dmp

        Filesize

        10.8MB

        Download

      • memory/2132-15-0x00007FFBC4240000-0x00007FFBC4D01000-memory.dmp

        Filesize

        10.8MB

        Download

      • memory/2132-20-0x00007FFBC4240000-0x00007FFBC4D01000-memory.dmp

        Filesize

        10.8MB

        Download

      • memory/2132-35-0x00007FFBC4240000-0x00007FFBC4D01000-memory.dmp

        Filesize

        10.8MB

        Download

      • memory/2132-55-0x00007FFBC4240000-0x00007FFBC4D01000-memory.dmp

        Filesize

        10.8MB

        Download

      • memory/2132-14-0x00000000033C0000-0x00000000033CE000-memory.dmp

        Filesize

        56KB

        Download

      • memory/2132-10-0x000000001C1D0000-0x000000001C220000-memory.dmp

        Filesize

        320KB

        Download

      • memory/2132-9-0x000000001BD20000-0x000000001BD3C000-memory.dmp

        Filesize

        112KB

        Download

      • memory/2132-7-0x00007FFBC4240000-0x00007FFBC4D01000-memory.dmp

        Filesize

        10.8MB

        Download

      • memory/2132-6-0x00000000033B0000-0x00000000033BE000-memory.dmp

        Filesize

        56KB

        Download

      • memory/2132-4-0x00007FFBC4240000-0x00007FFBC4D01000-memory.dmp

        Filesize

        10.8MB

        Download

      • memory/2132-3-0x00007FFBC4240000-0x00007FFBC4D01000-memory.dmp

        Filesize

        10.8MB

        Download

      • memory/2132-2-0x00007FFBC4240000-0x00007FFBC4D01000-memory.dmp

        Filesize

        10.8MB

        Download

      • memory/2132-1-0x0000000000FE0000-0x00000000011D2000-memory.dmp

        Filesize

        1.9MB

        Download

      • memory/4152-255-0x000000001C380000-0x000000001C3CE000-memory.dmp

        Filesize

        312KB

        Download