dcrat | 486d063b3d47cd17e561a7ebba200fa0bbd3212057bd13294e36cf0e76c062d7

Analysis

max time kernel
93s
max time network
141s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
02/01/2025, 01:06

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
688169df79b2edd7a3e3c154177012c0.exe
Size 2.4MB
Sample250102-bf3pfswrhj
SHA256 486d063b3d47cd17e561a7ebba200fa0bbd3212057bd13294e36cf0e76c062d7
MD5 688169df79b2edd7a3e3c154177012c0
SHA1 deee392f0676d1b86763421a11ed574dfa344ae3
SHA512 d0b8ec4c6c12dc9b1803653d73d5e129fd8783b4a60cfa0a797703a4ca834e521f415f31af2c91717bff89ac61b6234058ab3cabbb1539b660855eb904d578b3
SSDEEP 24576:M2G/nvxW3WcFDPvgpYEgL6aL2UPwqfm8b2diBT4qhB0WeyYAmmdISxCndhaUmbK+:MbA3vyYEaKCTBBkJmOQealLg1/+LNxp
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

dcrat discovery infostealer rat

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat
Dcrat family
dcrat

Process spawned unexpected child process 30 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4872	2388	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	468	2388	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1476	2388	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4800	2388	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4464	2388	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2776	2388	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3180	2388	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1124	2388	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5028	2388	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1976	2388	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4744	2388	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	212	2388	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	548	2388	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2308	2388	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3764	2388	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4664	2388	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4492	2388	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	640	2388	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	768	2388	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	884	2388	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	452	2388	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4056	2388	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	720	2388	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3200	2388	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3636	2388	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2368	2388	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2008	2388	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2156	2388	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	380	2388	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4556	2388	schtasks.exe	90

DCRat payload 2 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral2/files/0x0007000000023c73-15.dat	dcrat
behavioral2/memory/2376-17-0x0000000000DA0000-0x0000000000FC4000-memory.dmp	dcrat

Checks computer location settings 2 TTPs 3 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation	688169df79b2edd7a3e3c154177012c0.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation	WScript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation	Comserver.exe

Executes dropped EXE 2 IoCs

pid	Process
2376	Comserver.exe
4364	TextInputHost.exe

Drops file in Program Files directory 5 IoCs

description	ioc	Process
File created	C:\Program Files\Windows Portable Devices\csrss.exe	Comserver.exe
File opened for modification	C:\Program Files\Windows Portable Devices\csrss.exe	Comserver.exe
File created	C:\Program Files\Windows Portable Devices\886983d96e3d3e	Comserver.exe
File created	C:\Program Files (x86)\Windows Sidebar\System.exe	Comserver.exe
File created	C:\Program Files (x86)\Windows Sidebar\27d1bcfc3c54e0	Comserver.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File created	C:\Windows\es-ES\fontdrvhost.exe	Comserver.exe
File created	C:\Windows\es-ES\5b884080fd4f94	Comserver.exe
File created	C:\Windows\Help\Windows\RuntimeBroker.exe	Comserver.exe
File created	C:\Windows\Help\Windows\9e8d7a4ca61bd9	Comserver.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	688169df79b2edd7a3e3c154177012c0.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings	688169df79b2edd7a3e3c154177012c0.exe
Key created	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings	Comserver.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 30 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
3636	schtasks.exe
2008	schtasks.exe
380	schtasks.exe
4872	schtasks.exe
3180	schtasks.exe
4056	schtasks.exe
3200	schtasks.exe
4664	schtasks.exe
4492	schtasks.exe
2368	schtasks.exe
4800	schtasks.exe
4464	schtasks.exe
548	schtasks.exe
3764	schtasks.exe
768	schtasks.exe
720	schtasks.exe
2156	schtasks.exe
4744	schtasks.exe
4556	schtasks.exe
468	schtasks.exe
1476	schtasks.exe
1976	schtasks.exe
2308	schtasks.exe
1124	schtasks.exe
640	schtasks.exe
884	schtasks.exe
2776	schtasks.exe
5028	schtasks.exe
212	schtasks.exe
452	schtasks.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2376	Comserver.exe
4364	TextInputHost.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2376	Comserver.exe
Token: SeDebugPrivilege	4364	TextInputHost.exe

Suspicious use of WriteProcessMemory 17 IoCs

description	pid	Process	procid_target
PID 2576 wrote to memory of 4504	2576	688169df79b2edd7a3e3c154177012c0.exe	83
PID 2576 wrote to memory of 4504	2576	688169df79b2edd7a3e3c154177012c0.exe	83
PID 2576 wrote to memory of 4504	2576	688169df79b2edd7a3e3c154177012c0.exe	83
PID 2576 wrote to memory of 5108	2576	688169df79b2edd7a3e3c154177012c0.exe	84
PID 2576 wrote to memory of 5108	2576	688169df79b2edd7a3e3c154177012c0.exe	84
PID 2576 wrote to memory of 5108	2576	688169df79b2edd7a3e3c154177012c0.exe	84
PID 4504 wrote to memory of 3052	4504	WScript.exe	92
PID 4504 wrote to memory of 3052	4504	WScript.exe	92
PID 4504 wrote to memory of 3052	4504	WScript.exe	92
PID 3052 wrote to memory of 2376	3052	cmd.exe	94
PID 3052 wrote to memory of 2376	3052	cmd.exe	94
PID 2376 wrote to memory of 3548	2376	Comserver.exe	127
PID 2376 wrote to memory of 3548	2376	Comserver.exe	127
PID 3548 wrote to memory of 3236	3548	cmd.exe	129
PID 3548 wrote to memory of 3236	3548	cmd.exe	129
PID 3548 wrote to memory of 4364	3548	cmd.exe	135
PID 3548 wrote to memory of 4364	3548	cmd.exe	135

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\688169df79b2edd7a3e3c154177012c0.exe
"C:\Users\Admin\AppData\Local\Temp\688169df79b2edd7a3e3c154177012c0.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2576
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\FontDll\fe8pRFyRbXbMmhAeUdD.vbe"
  2⤵
  - Checks computer location settings
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4504
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\FontDll\QLqJH9vBkenIEb.bat" "
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3052
  - - C:\FontDll\Comserver.exe
      "C:\FontDll\Comserver.exe"
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Drops file in Program Files directory
      Drops file in Windows directory
      Modifies registry class
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:2376
    - - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\cdzG029cAu.bat"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:3548
      - C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        6⤵
        
        PID:3236
      - C:\Users\All Users\USOShared\TextInputHost.exe
        
        "C:\Users\All Users\USOShared\TextInputHost.exe"
        6⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4364
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\FontDll\file.vbs"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5108

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 14 /tr "'C:\Program Files\Windows Portable Devices\csrss.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4872

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Program Files\Windows Portable Devices\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:468

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 8 /tr "'C:\Program Files\Windows Portable Devices\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1476

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 5 /tr "'C:\Program Files (x86)\Windows Sidebar\System.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4800

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "System" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Sidebar\System.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4464

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 9 /tr "'C:\Program Files (x86)\Windows Sidebar\System.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2776

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 7 /tr "'C:\Recovery\WindowsRE\smss.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3180

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smss" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\smss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1124

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 11 /tr "'C:\Recovery\WindowsRE\smss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5028

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 12 /tr "'C:\Users\Public\AccountPictures\csrss.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1976

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Users\Public\AccountPictures\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4744

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 9 /tr "'C:\Users\Public\AccountPictures\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:212

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "cmdc" /sc MINUTE /mo 9 /tr "'C:\Recovery\WindowsRE\cmd.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:548

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "cmd" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\cmd.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2308

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "cmdc" /sc MINUTE /mo 14 /tr "'C:\Recovery\WindowsRE\cmd.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3764

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 14 /tr "'C:\Windows\es-ES\fontdrvhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4664

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\Windows\es-ES\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4492

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 13 /tr "'C:\Windows\es-ES\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:640

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "TextInputHostT" /sc MINUTE /mo 5 /tr "'C:\Users\All Users\USOShared\TextInputHost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:768

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "TextInputHost" /sc ONLOGON /tr "'C:\Users\All Users\USOShared\TextInputHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:884

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "TextInputHostT" /sc MINUTE /mo 5 /tr "'C:\Users\All Users\USOShared\TextInputHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:452

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 9 /tr "'C:\Recovery\WindowsRE\sppsvc.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4056

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvc" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\sppsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:720

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 13 /tr "'C:\Recovery\WindowsRE\sppsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3200

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 10 /tr "'C:\Windows\Help\Windows\RuntimeBroker.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3636

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Windows\Help\Windows\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2368

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 5 /tr "'C:\Windows\Help\Windows\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2008

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 12 /tr "'C:\Users\Public\Desktop\dllhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2156

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Users\Public\Desktop\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:380

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 12 /tr "'C:\Users\Public\Desktop\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4556

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Comserver.exe

Path C:\FontDll\Comserver.exe
Size 2.1MB
SHA256 8143ab6b11bd194875aa96b694dfe569ed0158dc6b00f1c68f99a618682cc380
MD5 69e28c3b296161aa3a3958321f9e7960
SHA1 4755951625cdfed9c9dcd50859378dfbb94ffa79
SHA512 ecbce7438851dec93e70a15eb87b1dce20cb9adf4502e0b92eacf21fbe220db44b1b5619e6217e0ea6c0232fe3e4ac70fe9428061d59c921b97e80af85985bbb
SSDEEP 24576:vpYEgL6aL2UPwqfm8b2diBT4qhB0WeyYAmmdISxCndhaUmbKafYGWJ8c/V8RLNx8:RYEaKCTBBkJmOQealLg1/+LNx
MD5 SHA1 SHA512 SSDEEP

Submit Download

QLqJH9vBkenIEb.bat

Path C:\FontDll\QLqJH9vBkenIEb.bat
Size 26B
SHA256 6be168e75b3836a0de3d28c86598851ec65a4ae13d6b614c4e092fc37feaa339
MD5 63a2bdfc7f8a8cefda193948d275dbe6
SHA1 5e37ea1b3ad9b4aa467287538602af7d8c41a87f
SHA512 a3fc9c23087950bca440f4ab5b128c2493f20badf0e94439260eed43a47384683d703d3bc35b94effdf2be9888708d63f54112484a8437b05f6977478001ccf8
MD5 SHA1 SHA512

Submit Download

fe8pRFyRbXbMmhAeUdD.vbe

Path C:\FontDll\fe8pRFyRbXbMmhAeUdD.vbe
Size 198B
SHA256 17c5436f31c1716444d1e656f741956dc601b91161abfcd23ddc57b6996d6a57
MD5 99583f385f11a037b557d9ef45a3488d
SHA1 3f72c815265a238ca9992b05aca94e54f734e650
SHA512 6b3d9db138058cd13bbab2e96ee36ed192656650cc1c73baae07dab237eced9e5fac2e70e9177e9b861773cc50756ea43011269054c22d9e22bd051af5caaf65
MD5 SHA1 SHA512

Submit Download

file.vbs

Path C:\FontDll\file.vbs
Size 34B
SHA256 f1cccb5ae4aa51d293bd3c7d2a1a04cb7847d22c5db8e05ac64e9a6d7455aa0b
MD5 677cc4360477c72cb0ce00406a949c61
SHA1 b679e8c3427f6c5fc47c8ac46cd0e56c9424de05
SHA512 7cfe2cc92f9e659f0a15a295624d611b3363bd01eb5bcf9bc7681ea9b70b0564d192d570d294657c8dc2c93497fa3b4526c975a9bf35d69617c31d9936573c6a
MD5 SHA1 SHA512

Submit Download

cdzG029cAu.bat

Path C:\Users\Admin\AppData\Local\Temp\cdzG029cAu.bat
Size 211B
SHA256 4dd4b13d3ce25d4e95dc9f097d4a2e8d0710507b4d0a75b77f026ce962d6fe8f
MD5 5e3646581ba16d51611b30f05b77d5ad
SHA1 67d800a3a6a92ed241469bcc815855e3f573def2
SHA512 29e56b0209a6434289dba93671d7c76b4e59954c35e5413b334b981bfa99253a5c35524ad051102a2671dc9c14bec247bbea9d3b12c9de33eb651834f1ac6b6a
MD5 SHA1 SHA512

Submit Download

memory/2376-17-0x0000000000DA0000-0x0000000000FC4000-memory.dmp

Download

memory/2376-18-0x000000001BAC0000-0x000000001BADC000-memory.dmp

Download

memory/2376-19-0x000000001C2C0000-0x000000001C310000-memory.dmp

Download

memory/2376-20-0x000000001BAE0000-0x000000001BAF6000-memory.dmp

Download

memory/2376-21-0x000000001BB30000-0x000000001BB86000-memory.dmp

Download

memory/2376-22-0x000000001BB00000-0x000000001BB08000-memory.dmp

Download

memory/4364-52-0x000000001B7C0000-0x000000001B816000-memory.dmp

Download