dcrat | 6c6d5ba17c53f8eb5c280fc6945f4c4254dee1cdb8600f3a70dfdc64d67f4ec5

Analysis

max time kernel
149s
max time network
157s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
11-01-2025 06:43

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

rat.exe
Size

1.6MB
MD5

3d8e2b72bd850e6d45114d61462b9f33
SHA1

c78aa9851c20a26ee2dc8a91b90f8edcdb46dc77
SHA256

6c6d5ba17c53f8eb5c280fc6945f4c4254dee1cdb8600f3a70dfdc64d67f4ec5
SHA512

0b57f0522e37f44bbb0c54387a7622da5282be555799148de7d6a2f1ca29ec9b5477a00169d9a1e7a678fc2d22802fdaddae7e66a1b12ab8d807b0cd0d6bb484
SSDEEP

24576:U2G/nvxW3Ww0t0ioe8kK14eZeOBQE2iT5tH9DieCUHcOTz21ABA:UbA300irKJUbs9D3CeP6A2

Score

10^/10

dcrat discovery execution infostealer rat

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat
Dcrat family
dcrat

Process spawned unexpected child process 15 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2292	2768	schtasks.exe	33
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2832	2768	schtasks.exe	33
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2924	2768	schtasks.exe	33
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2732	2768	schtasks.exe	33
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2120	2768	schtasks.exe	33
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2152	2768	schtasks.exe	33
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2652	2768	schtasks.exe	33
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1616	2768	schtasks.exe	33
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1748	2768	schtasks.exe	33
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2964	2768	schtasks.exe	33
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1992	2768	schtasks.exe	33
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1984	2768	schtasks.exe	33
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1532	2768	schtasks.exe	33
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2500	2768	schtasks.exe	33
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2968	2768	schtasks.exe	33

DCRat payload 3 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral1/files/0x0007000000016c10-11.dat	dcrat
behavioral1/memory/1476-13-0x0000000001320000-0x0000000001474000-memory.dmp	dcrat
behavioral1/memory/2228-71-0x0000000000AB0000-0x0000000000C04000-memory.dmp	dcrat

Command and Scripting Interpreter: PowerShell 1 TTPs 6 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
1900	powershell.exe
776	powershell.exe
1072	powershell.exe
2096	powershell.exe
3008	powershell.exe
2184	powershell.exe

Executes dropped EXE 2 IoCs

pid	Process
1476	chainFontbroker.exe
2228	conhost.exe

Loads dropped DLL 2 IoCs

pid	Process
2432	cmd.exe
2432	cmd.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Looks up external IP address via web service 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
6	ipinfo.io
7	ipinfo.io

Drops file in Program Files directory 5 IoCs

description	ioc	Process
File created	C:\Program Files\Windows Mail\de-DE\5940a34987c991	chainFontbroker.exe
File created	C:\Program Files\Windows Defender\de-DE\lsm.exe	chainFontbroker.exe
File created	C:\Program Files\Windows Defender\de-DE\101b941d020240	chainFontbroker.exe
File created	C:\Program Files\Windows Mail\de-DE\dllhost.exe	chainFontbroker.exe
File opened for modification	C:\Program Files\Windows Mail\de-DE\dllhost.exe	chainFontbroker.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rat.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 34 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{6DFF8501-CFE7-11EF-8121-F6D98E36DBEF} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 903ff145f463db01	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000c0b13a6e66d84740b32fa53fa91c210f00000000020000000000106600000001000020000000f2b8d295bd4180a6979ef2fe6ce8386abc3410f94db6ac7dea9c44e19ee712d3000000000e8000000002000020000000c6a8e8e8a88d02f188e898fc3afdf5644a3e66295f77ad265ab9f4cf6052bc9090000000140dec102d65f74c2a36beaa6b2f34aa3505b7cb69aa96119b1dc3fa74857ac00cb6582f7f0372ca8bbdac4a1920ec8bc3fb079c94db8c31b18d04566dc84723f7a63a338750d0c17804779b448ccfa57b118f49e3cfb565631785441489a703d3751b71b525692f3d8c994fa4faa99fe6dc66992358fe7c60fdd86dcb31a948a7803922743806667462f568e531107c400000009fa9e55235e1150bc93577867529076c17a82676f1dc21bcece96fff6ea57032e184d8df941a8c7b2f5b7b02b2059f655f63556996c500351324003d2d372983	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "442739706"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000c0b13a6e66d84740b32fa53fa91c210f00000000020000000000106600000001000020000000bd57a6369ebbff9c183c3c9fbc9ad28a38ae75c213b70c5186511bf86937347d000000000e80000000020000200000006aaea1f4b238a57711db1f934aabdf3fbd2b2664008ff7b9156ab59991fce6b52000000008a6e97356a2234471751e3801091b0766189d4d7a4615a41a02863c7c3f00f44000000009433eff6348ab1920ce36782281047587962df100e81671f2c339b3a07a1f4227ef8d65f9d11ae30e72aab4d6a49f5bb63320ec8a535819e05ec89b5a946b27	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE

Modifies system certificate store 2 TTPs 2 IoCs

evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8	conhost.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 0400000001000000100000000cd2f9e0da1773e9ed864da5e370e74e14000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e80f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f631900000001000000100000002fe1f70bb05d7c92335bc5e05b984da620000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827	conhost.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 15 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2924	schtasks.exe
2964	schtasks.exe
1992	schtasks.exe
2832	schtasks.exe
2732	schtasks.exe
1532	schtasks.exe
2500	schtasks.exe
2968	schtasks.exe
2292	schtasks.exe
2120	schtasks.exe
2152	schtasks.exe
2652	schtasks.exe
1616	schtasks.exe
1748	schtasks.exe
1984	schtasks.exe

Suspicious behavior: EnumeratesProcesses 24 IoCs

pid	Process
1476	chainFontbroker.exe
1476	chainFontbroker.exe
1476	chainFontbroker.exe
3008	powershell.exe
1072	powershell.exe
1900	powershell.exe
2184	powershell.exe
2096	powershell.exe
776	powershell.exe
2228	conhost.exe
2228	conhost.exe
2228	conhost.exe
2228	conhost.exe
2228	conhost.exe
2228	conhost.exe
2228	conhost.exe
2228	conhost.exe
2228	conhost.exe
2228	conhost.exe
2228	conhost.exe
2228	conhost.exe
2228	conhost.exe
2228	conhost.exe
2228	conhost.exe

Suspicious use of AdjustPrivilegeToken 8 IoCs

description	pid	Process
Token: SeDebugPrivilege	1476	chainFontbroker.exe
Token: SeDebugPrivilege	3008	powershell.exe
Token: SeDebugPrivilege	1072	powershell.exe
Token: SeDebugPrivilege	1900	powershell.exe
Token: SeDebugPrivilege	2184	powershell.exe
Token: SeDebugPrivilege	2096	powershell.exe
Token: SeDebugPrivilege	776	powershell.exe
Token: SeDebugPrivilege	2228	conhost.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2556	iexplore.exe

Suspicious use of SetWindowsHookEx 7 IoCs

pid	Process
2228	conhost.exe
2556	iexplore.exe
2556	iexplore.exe
2180	IEXPLORE.EXE
2180	IEXPLORE.EXE
2180	IEXPLORE.EXE
2180	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 40 IoCs

description	pid	Process	procid_target
PID 2604 wrote to memory of 1952	2604	rat.exe	29
PID 2604 wrote to memory of 1952	2604	rat.exe	29
PID 2604 wrote to memory of 1952	2604	rat.exe	29
PID 2604 wrote to memory of 1952	2604	rat.exe	29
PID 1952 wrote to memory of 2432	1952	WScript.exe	30
PID 1952 wrote to memory of 2432	1952	WScript.exe	30
PID 1952 wrote to memory of 2432	1952	WScript.exe	30
PID 1952 wrote to memory of 2432	1952	WScript.exe	30
PID 2432 wrote to memory of 1476	2432	cmd.exe	32
PID 2432 wrote to memory of 1476	2432	cmd.exe	32
PID 2432 wrote to memory of 1476	2432	cmd.exe	32
PID 2432 wrote to memory of 1476	2432	cmd.exe	32
PID 1476 wrote to memory of 3008	1476	chainFontbroker.exe	49
PID 1476 wrote to memory of 3008	1476	chainFontbroker.exe	49
PID 1476 wrote to memory of 3008	1476	chainFontbroker.exe	49
PID 1476 wrote to memory of 2184	1476	chainFontbroker.exe	50
PID 1476 wrote to memory of 2184	1476	chainFontbroker.exe	50
PID 1476 wrote to memory of 2184	1476	chainFontbroker.exe	50
PID 1476 wrote to memory of 1900	1476	chainFontbroker.exe	51
PID 1476 wrote to memory of 1900	1476	chainFontbroker.exe	51
PID 1476 wrote to memory of 1900	1476	chainFontbroker.exe	51
PID 1476 wrote to memory of 776	1476	chainFontbroker.exe	52
PID 1476 wrote to memory of 776	1476	chainFontbroker.exe	52
PID 1476 wrote to memory of 776	1476	chainFontbroker.exe	52
PID 1476 wrote to memory of 1072	1476	chainFontbroker.exe	53
PID 1476 wrote to memory of 1072	1476	chainFontbroker.exe	53
PID 1476 wrote to memory of 1072	1476	chainFontbroker.exe	53
PID 1476 wrote to memory of 2096	1476	chainFontbroker.exe	54
PID 1476 wrote to memory of 2096	1476	chainFontbroker.exe	54
PID 1476 wrote to memory of 2096	1476	chainFontbroker.exe	54
PID 1476 wrote to memory of 2228	1476	chainFontbroker.exe	61
PID 1476 wrote to memory of 2228	1476	chainFontbroker.exe	61
PID 1476 wrote to memory of 2228	1476	chainFontbroker.exe	61
PID 2228 wrote to memory of 2556	2228	conhost.exe	62
PID 2228 wrote to memory of 2556	2228	conhost.exe	62
PID 2228 wrote to memory of 2556	2228	conhost.exe	62
PID 2556 wrote to memory of 2180	2556	iexplore.exe	63
PID 2556 wrote to memory of 2180	2556	iexplore.exe	63
PID 2556 wrote to memory of 2180	2556	iexplore.exe	63
PID 2556 wrote to memory of 2180	2556	iexplore.exe	63

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\rat.exe
"C:\Users\Admin\AppData\Local\Temp\rat.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2604
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\serverBrowserInto\e7YzxotfSKS1PBhA1Cqs.vbe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1952
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c ""C:\serverBrowserInto\Rskh2iY941tkqLaIfZaT1Ha9Hc6.bat" "
    3⤵
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2432
  - - C:\serverBrowserInto\chainFontbroker.exe
      "C:\serverBrowserInto\chainFontbroker.exe"
      4⤵
      Executes dropped EXE
      Drops file in Program Files directory
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:1476
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\serverBrowserInto\chainFontbroker.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3008
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Windows Mail\de-DE\dllhost.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2184
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\31f19e42-8726-11ef-be9a-dab21757c799\chainFontbroker.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1900
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\MSOCache\All Users\{90140000-001A-0409-0000-0000000FF1CE}-C\dwm.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:776
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Windows Defender\de-DE\lsm.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1072
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\Downloads\conhost.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2096
    - - C:\Users\Admin\Downloads\conhost.exe
        
        "C:\Users\Admin\Downloads\conhost.exe"
        5⤵
        Executes dropped EXE
        Modifies system certificate store
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:2228
      - C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe" http://localhost:12839/
        6⤵
        Modifies Internet Explorer settings
        Suspicious use of FindShellTrayWindow
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:2556
        
        C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2556 CREDAT:275457 /prefetch:2
        7⤵
        System Location Discovery: System Language Discovery
        Modifies Internet Explorer settings
        Suspicious use of SetWindowsHookEx
        
        PID:2180

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 5 /tr "'C:\Program Files\Windows Mail\de-DE\dllhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2292

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Program Files\Windows Mail\de-DE\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2832

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 8 /tr "'C:\Program Files\Windows Mail\de-DE\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2924

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "chainFontbrokerc" /sc MINUTE /mo 7 /tr "'C:\Recovery\31f19e42-8726-11ef-be9a-dab21757c799\chainFontbroker.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2732

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "chainFontbroker" /sc ONLOGON /tr "'C:\Recovery\31f19e42-8726-11ef-be9a-dab21757c799\chainFontbroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2120

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "chainFontbrokerc" /sc MINUTE /mo 10 /tr "'C:\Recovery\31f19e42-8726-11ef-be9a-dab21757c799\chainFontbroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2152

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 10 /tr "'C:\MSOCache\All Users\{90140000-001A-0409-0000-0000000FF1CE}-C\dwm.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2652

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwm" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-001A-0409-0000-0000000FF1CE}-C\dwm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1616

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 11 /tr "'C:\MSOCache\All Users\{90140000-001A-0409-0000-0000000FF1CE}-C\dwm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1748

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsml" /sc MINUTE /mo 10 /tr "'C:\Program Files\Windows Defender\de-DE\lsm.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2964

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsm" /sc ONLOGON /tr "'C:\Program Files\Windows Defender\de-DE\lsm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1992

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsml" /sc MINUTE /mo 8 /tr "'C:\Program Files\Windows Defender\de-DE\lsm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1984

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 14 /tr "'C:\Users\Admin\Downloads\conhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1532

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhost" /sc ONLOGON /tr "'C:\Users\Admin\Downloads\conhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2500

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 6 /tr "'C:\Users\Admin\Downloads\conhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2968

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
38d06bfdeec9ed31eb839cb9b058666b

SHA1
dd6d08c50b0d7265d89282901cbe0612ab1dbd4b

SHA256
e553d24293cfb81d1fd6e0fbe0a13dbd16e1e606927e28d92d7181f60b95f19c

SHA512
d602cb59186277e13c882ce1e36296e00db56d95fa396e6ceb2bc8744df570bd7f51a96c2ed66a65833488af3705da7117c95a80ef697d0635ec256808dbe265

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ae6a1c5ccdbc97ed95f26785b9c473e5

SHA1
7ab51dd5add4586dc85b922aad3049df05bc7020

SHA256
1caed59fb96c2ed639d9343a0a197880d3b3fb6a3f5c9f1bd5195b4e4ff8cda9

SHA512
474251b9fa2737d49fc2cfb6afb692d3a13460387ac43256abd16e0ed521d893fda9a87e7116f7df1a534930443dbe56c342a31c7504d9f22781113e254cab14

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
bccad0285074ba61a81c18528a0c7fb0

SHA1
a5572f4e76afe1833cf5d59695668d28e45b8aac

SHA256
99efa0d3eb6ea794e27d3ff7c2c7f2fcaabcec1881686fd6089eafdc11c26b88

SHA512
40fabf848240044ff435d39f06d6c26ddc988d7f305b332f7111a33c32405b4da2edaa419d2bd1ffed9852f4c34380355ce6ea1c89c9cd9f8f55a7dfe4a17117

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0641cc1bd23930d20e6d0b043125894e

SHA1
da255bbfcaea33748db6ab3d01f7bca3a53e1726

SHA256
c8998940e81239d8249a9aebe1b8bff90e207a481689bbd5601b847da48e82d1

SHA512
bd34c08686b608b283ad4dc74f42ba7ccb0a2bf957239f964eb81fcea3a5a69854aaaceafb638831e5f02aa4420135f214af4603180539a92d1d28c207d5a631

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
793e3884508689229fe8e2b704450882

SHA1
3479cbbcbf6e8847ddc49aa345114d83dfa1a0d8

SHA256
ad8cc2819a2ff3c1c33196bc951f1a506c60be42a387381b3d2a04c747d2581a

SHA512
614ef403276669199e7fdcd53b273ffc831c4b61a87f31f304661332b2378bd59b66d46c0506062e292cd307e2563b383286531d8b45e682422e2a9443ab7798

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
10cfcc8209ed3c364adafb6d2a4a86ec

SHA1
0e4ec3cd10968babd102167f2d9ba0cdaf60a5e3

SHA256
4a54d956dca871866242428227b29a452ef2e7dfa872ceb827a601b1fc9f8058

SHA512
0f94b11070f6c983ad2ab4e69e840a915821fc04107f91ca39b7dcc3707b8f0e079361471778c3aabe4d953f5cec1d60aabf66cbbc7808e8703bff3c66eed6d9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5026344b9a2187067cb95d69dc0a6899

SHA1
9aa3f3e5db9c5417449fa21d3bca6512bd8cff95

SHA256
ff6039374a91d46bcf305677ccd0a7be60a0d799ea61f65672e8eff159d724bd

SHA512
41a83d2a34237dec118383e4565c464e147bada1d9461f5d78814520e6a2e9e9f25ea852553c24bd1af23ff869e4f4dfbe279ae311f45e091fe3af58edbcd9b3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8a1d7e2433d3a70af1bc6b9f1e7c9bc0

SHA1
488b45343c347556fb5d8f5b6faaa0fc3ea055b5

SHA256
9078159b93c1fa43717524f3149f73cfd95b34c07cd8e1668848ee6f8f95c993

SHA512
9b6c8af0dc04c2e90b67a6de7eb2a85ccc007e30976085a5bf578b4c14a31bb50d7859ab023706233afc2eb90531cc8855e259894b3651c9e086e94790e4ae06

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
906a3b1df6c1b183c78a61108b5b6456

SHA1
99c69d68df81cf1186c594322ce4f66d7db27877

SHA256
53d97031c2c0283cb7068359e5288310f1bb8097dc0d679e840a1039b7345797

SHA512
91945a886751d1f74d05aa353a42a5a7b14463cd5907f86aae3b60ad4d878804d565f5ec16171fee579c946967e248e9c4445dd1e87dc770200359b584549bee

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
30e4be543a4d85d4761d501f19b8ff47

SHA1
526e10edb4bc085ad6cbe061b7dd101046dd7901

SHA256
e24e6a94f5eba70f91f6fc3a887724a2c6a8408900554649d2c0259a46ce919d

SHA512
acbf9bbdec6fb3ca906e38515529e1387bfada76decda91c134bd0b011012eef7a210af803a2cf3470ec412efa6dfe1487a8aaf9d04a10cd036d23dfff42ed29

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8ecd3a3aa6a047f16b6075817550fad9

SHA1
e3b2ef6c5cb488138e1ecae252c1a5fd05212843

SHA256
eac07750065685cc40c505e082cd87e397f5ccc57c71f845d7fffbb25d3f8561

SHA512
d0d1a507d0bc82540ff47dbfd54db3b2458b6a6c4ea930d2ad7e3e838da57f7c531aa88c4f0cf2110c0a22df43d6984fd3f8b7f9e95d7be2860c43653d229a5e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6eeb133697fbfbb50ce55986360aee84

SHA1
36f09887336ad708b5de7e393c2ecf9adb3b5fa6

SHA256
413055b6e2e588274202f07249b4823a45d027df8f2ea7e42784eab155bc6578

SHA512
56a5b93f0844c79f315697291b9e97b320b9dbedee6b2fdb824102827d74b829e2ea57fe723ea4f6d15bd36923e82dd3e25ecb81bfa78920e447d20858c1e0d8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ff4e08d0fc5ed37ba59a75f8cb7a7698

SHA1
28df3f55995e8532970c45c8fe51b12d7f0de8b7

SHA256
9682b58f8328fad45e9f52ef824546e824ea3827ba3baca41339e722f5d24f7b

SHA512
abd7eaa16ba0368b59a14e6078cb93e6d6a3e591206f560754a9beca1f75fd22d7af1ad65cf4f2fdb9980950bd7656bf646ae1643e195f460eb248d58e2fb23a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a0aece30bd7d9541342507ec602ffe8a

SHA1
30028bc0fd1f39565273693764ec2a7a085b0470

SHA256
a0013761eedd6b013eca3ba5615e194699672ffc179b709b98689f1613ebd323

SHA512
303aa14e4c26196744259d5fab86c3332bf11f9be9f8b88212b0e9901cdbd6cdfc790848e5e2bfc9d5ca8c2fbd861e73c9183a3a4b2c50a139b772c92cb2a1bf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
de6060195d803832c1d5674ac27087a2

SHA1
c8cb215afb80862cff184ab9e44b5c319362bd2e

SHA256
64df9e7deab6b002deea2794bc0e7ca00ad6afc28115d0630fd1daff5bb471e5

SHA512
61fe10adf1a050669386fba26329ea5de2276ddd8d40c5e9a06c46a57dc31b92e6ae2e54c5e3d9319649b49447e2d1fc83761060a2c130ea9fa448e3c4f2498d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
818a380a36375fe1d57610e67ea617d6

SHA1
3d3f2ac8b5b39efdd45d7958900f294ac039e361

SHA256
d654c8e09c9c1884be16f9dedc3f3a07028c2edc95784bbf7778d838f8e5d2c4

SHA512
4040a24b4b05a3d4261ba911ab89e8fb5a2449cc2b2fe9ed9e1f224fbc01c80d6ca728f5c4a60a278e0aafa541286f9ddc06922e2ac03ca7757896c785ea0a17

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2031acaed11546143de1ebeb909ef0e4

SHA1
9a10d73d9a32ada7c4117ac5b536e63e2c23de30

SHA256
af0f4e95bf794ab5fe0ef261b3750c7321f058c86483396ac452a0006ff7b394

SHA512
5a328f56f249ad9067930eb204f1c39fc6f191e38c702f0054b3ff5fae35d0a1deae5e64078ec94b4e179df19608f835f52bb931fdff8a10f6d01a40d69be71d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
54811852883bfac3f3e47f8a7a09ae3d

SHA1
7a9340c92da945db241f2e0eb41218425f0bff2f

SHA256
5b5913a5943156073bd0ff9d00d325704ccff57f0ad8625e9294d0b0e95d6745

SHA512
0f666578084f4becfcd4f8296c3bb243ea4846cc651d748b293a0d986b3c8e529a7a9584d5ddc5a00b9fdf32b485ab2583a14faf9adb5f8d43c0d3043c0bccfa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab2E0.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar39F.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
7KB

MD5
87af9091af99c644b42279f2a5a9f7c2

SHA1
d08185a82216d92a11bb485465bf128298e47477

SHA256
0afe46118625deb03167fd482f7539445ad7957b11328b1904bda7db93476bd7

SHA512
295c876d45d68dc0ae4e167d1a759e87a4e87af36ef92c81451f50015f765f9213b755da2d7ccc71e2b6302f62c864b8ebe2a073cce0850c1a5ce048095b372f

Download Submit
C:\serverBrowserInto\Rskh2iY941tkqLaIfZaT1Ha9Hc6.bat

Filesize
42B

MD5
7098df22ae7e28aae230fd3d32d0ae92

SHA1
532360293037ea9542bef3bcee4260210647aafe

SHA256
62712fb192cb815fc15bbb981dbc2f7ed1aa0aede7e0ee132775b5d5bfc2c5cb

SHA512
acac3ac729680fdba30f8db7daa8cf8609a6540be558bb5c2a3a264e39bc79854e8fd4e2a4282c58445d79ded5c8e2df9999f5dc1e1adf599438a1d96cbecedf

Download Submit
C:\serverBrowserInto\e7YzxotfSKS1PBhA1Cqs.vbe

Filesize
221B

MD5
7e02609e94304f654ba265c01531d1c2

SHA1
47041b8e578394a0a9e9150598e28a58d72f8aff

SHA256
ea7526ec3517fd59b5d3dedb05e8888600ead35991184d750815d80b064ce00a

SHA512
2fef0763c75415af6e538f1f05fa88c5147729db1e3babb9c8d494db4ba54c06b7f550e803e7dcc8af336f5a3266711ecac32e20f1ed1477276c24d1e74c1c4e

Download Submit
\serverBrowserInto\chainFontbroker.exe

Filesize
1.3MB

MD5
240fac6e181957232e4e09596d54714f

SHA1
29a9c6eff91f79612b38f2f0277a2bf9ad851133

SHA256
6260051d6d855025e500947512e5903be100624032054219cbbd62c78af0b2e5

SHA512
9e09dadec874db913116e82f60891f74ec2356d483a1c265405bb92dc05fdc7fc27775293d380f649e1b8140811a3987941cdec4b84fdae9eae3f3c1febc17f0

Download Submit
memory/1072-56-0x0000000002290000-0x0000000002298000-memory.dmp

Filesize
32KB

Download
memory/1476-17-0x0000000000410000-0x0000000000422000-memory.dmp

Filesize
72KB

Download
memory/1476-22-0x0000000000570000-0x000000000057A000-memory.dmp

Filesize
40KB

Download
memory/1476-21-0x0000000000560000-0x0000000000568000-memory.dmp

Filesize
32KB

Download
memory/1476-20-0x0000000000550000-0x000000000055E000-memory.dmp

Filesize
56KB

Download
memory/1476-19-0x0000000000540000-0x0000000000548000-memory.dmp

Filesize
32KB

Download
memory/1476-18-0x0000000000420000-0x000000000042C000-memory.dmp

Filesize
48KB

Download
memory/1476-23-0x0000000000590000-0x000000000059C000-memory.dmp

Filesize
48KB

Download
memory/1476-16-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/1476-15-0x0000000000250000-0x0000000000266000-memory.dmp

Filesize
88KB

Download
memory/1476-14-0x0000000000140000-0x0000000000148000-memory.dmp

Filesize
32KB

Download
memory/1476-13-0x0000000001320000-0x0000000001474000-memory.dmp

Filesize
1.3MB

Download
memory/2228-71-0x0000000000AB0000-0x0000000000C04000-memory.dmp

Filesize
1.3MB

Download
memory/3008-50-0x000000001B3A0000-0x000000001B682000-memory.dmp

Filesize
2.9MB

Download