dcrat | 4575b7b370f08a7a93c394c149d5e3a543befca7e88a69eb47ad21cf34dbba63

Analysis

max time kernel
42s
max time network
47s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
21-01-2025 00:39

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

nixware.exe
Size

31.6MB
MD5

d0781ada3269f987c794530ff0506cd7
SHA1

adf41b03527fa9689951f17f0ae78f9de857a294
SHA256

f33a361478ccaf4357b7b8eb2ba785669cff5c22325de0287430e75d5a8826c8
SHA512

f86e0a0fa7c9979b73dbb74611704a29e7e585a2b23ef64ac268ad19b6d1dd446b1d822384ff1a24d1dd4de48da3b5d2952c7e80dcc2072d29e12fcd7103faa1
SSDEEP

24576:wTbBv5rUWed4A4kaY+Rv9HpWYAzA3K0UYGDRMo4I+J6UPoy5CTEjroZKpazt1tff:iBNpApOVz5CTEjroZm47SFdVDHNhsZ

Score

10^/10

dcrat discovery execution infostealer rat

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat
Dcrat family
dcrat

Process spawned unexpected child process 18 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1680	692	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4920	692	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3220	692	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2860	692	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4496	692	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3328	692	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4668	692	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1636	692	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3508	692	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5116	692	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4752	692	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3672	692	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1244	692	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1048	692	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1748	692	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4616	692	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2988	692	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2764	692	schtasks.exe	89

Command and Scripting Interpreter: PowerShell 1 TTPs 6 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
5076	powershell.exe
4764	powershell.exe
1252	powershell.exe
1300	powershell.exe
4308	powershell.exe
2900	powershell.exe

Checks computer location settings 2 TTPs 3 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Control Panel\International\Geo\Nation	nixware.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Control Panel\International\Geo\Nation	WScript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Control Panel\International\Geo\Nation	MscomponentdriverCrt.exe

Executes dropped EXE 2 IoCs

pid	Process
1968	MscomponentdriverCrt.exe
3988	System.exe

Drops file in Program Files directory 4 IoCs

description	ioc	Process
File created	C:\Program Files\Windows Security\BrowserCore\en-US\smss.exe	MscomponentdriverCrt.exe
File created	C:\Program Files\Windows Security\BrowserCore\en-US\69ddcba757bf72	MscomponentdriverCrt.exe
File created	C:\Program Files\Windows Media Player\uk-UA\System.exe	MscomponentdriverCrt.exe
File created	C:\Program Files\Windows Media Player\uk-UA\27d1bcfc3c54e0	MscomponentdriverCrt.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nixware.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
4072	PING.EXE

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000_Classes\Local Settings	nixware.exe
Key created	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000_Classes\Local Settings	MscomponentdriverCrt.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
4072	PING.EXE

Scheduled Task/Job: Scheduled Task 1 TTPs 18 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
3220	schtasks.exe
4496	schtasks.exe
3328	schtasks.exe
1748	schtasks.exe
4920	schtasks.exe
2860	schtasks.exe
3672	schtasks.exe
2988	schtasks.exe
2764	schtasks.exe
1680	schtasks.exe
4668	schtasks.exe
1636	schtasks.exe
1048	schtasks.exe
4616	schtasks.exe
3508	schtasks.exe
5116	schtasks.exe
4752	schtasks.exe
1244	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1968	MscomponentdriverCrt.exe
1968	MscomponentdriverCrt.exe
1968	MscomponentdriverCrt.exe
1968	MscomponentdriverCrt.exe
1968	MscomponentdriverCrt.exe
1968	MscomponentdriverCrt.exe
1968	MscomponentdriverCrt.exe
1968	MscomponentdriverCrt.exe
1968	MscomponentdriverCrt.exe
1968	MscomponentdriverCrt.exe
1968	MscomponentdriverCrt.exe
1968	MscomponentdriverCrt.exe
1968	MscomponentdriverCrt.exe
1968	MscomponentdriverCrt.exe
1968	MscomponentdriverCrt.exe
1968	MscomponentdriverCrt.exe
1968	MscomponentdriverCrt.exe
1968	MscomponentdriverCrt.exe
1968	MscomponentdriverCrt.exe
1968	MscomponentdriverCrt.exe
1968	MscomponentdriverCrt.exe
1968	MscomponentdriverCrt.exe
1968	MscomponentdriverCrt.exe
1968	MscomponentdriverCrt.exe
1968	MscomponentdriverCrt.exe
1968	MscomponentdriverCrt.exe
1968	MscomponentdriverCrt.exe
1968	MscomponentdriverCrt.exe
1968	MscomponentdriverCrt.exe
1968	MscomponentdriverCrt.exe
1968	MscomponentdriverCrt.exe
1968	MscomponentdriverCrt.exe
1968	MscomponentdriverCrt.exe
1968	MscomponentdriverCrt.exe
1968	MscomponentdriverCrt.exe
1968	MscomponentdriverCrt.exe
1968	MscomponentdriverCrt.exe
1968	MscomponentdriverCrt.exe
1968	MscomponentdriverCrt.exe
1968	MscomponentdriverCrt.exe
1968	MscomponentdriverCrt.exe
1968	MscomponentdriverCrt.exe
1968	MscomponentdriverCrt.exe
1968	MscomponentdriverCrt.exe
1968	MscomponentdriverCrt.exe
1968	MscomponentdriverCrt.exe
1968	MscomponentdriverCrt.exe
1968	MscomponentdriverCrt.exe
1968	MscomponentdriverCrt.exe
1968	MscomponentdriverCrt.exe
1968	MscomponentdriverCrt.exe
1968	MscomponentdriverCrt.exe
1968	MscomponentdriverCrt.exe
1968	MscomponentdriverCrt.exe
1968	MscomponentdriverCrt.exe
1968	MscomponentdriverCrt.exe
1968	MscomponentdriverCrt.exe
1968	MscomponentdriverCrt.exe
1968	MscomponentdriverCrt.exe
1968	MscomponentdriverCrt.exe
1968	MscomponentdriverCrt.exe
1968	MscomponentdriverCrt.exe
1968	MscomponentdriverCrt.exe
1968	MscomponentdriverCrt.exe

Suspicious use of AdjustPrivilegeToken 8 IoCs

description	pid	Process
Token: SeDebugPrivilege	1968	MscomponentdriverCrt.exe
Token: SeDebugPrivilege	1300	powershell.exe
Token: SeDebugPrivilege	5076	powershell.exe
Token: SeDebugPrivilege	4764	powershell.exe
Token: SeDebugPrivilege	4308	powershell.exe
Token: SeDebugPrivilege	1252	powershell.exe
Token: SeDebugPrivilege	2900	powershell.exe
Token: SeDebugPrivilege	3988	System.exe

Suspicious use of WriteProcessMemory 28 IoCs

description	pid	Process	procid_target
PID 4564 wrote to memory of 2364	4564	nixware.exe	83
PID 4564 wrote to memory of 2364	4564	nixware.exe	83
PID 4564 wrote to memory of 2364	4564	nixware.exe	83
PID 2364 wrote to memory of 2328	2364	WScript.exe	97
PID 2364 wrote to memory of 2328	2364	WScript.exe	97
PID 2364 wrote to memory of 2328	2364	WScript.exe	97
PID 2328 wrote to memory of 1968	2328	cmd.exe	99
PID 2328 wrote to memory of 1968	2328	cmd.exe	99
PID 1968 wrote to memory of 2900	1968	MscomponentdriverCrt.exe	118
PID 1968 wrote to memory of 2900	1968	MscomponentdriverCrt.exe	118
PID 1968 wrote to memory of 4308	1968	MscomponentdriverCrt.exe	119
PID 1968 wrote to memory of 4308	1968	MscomponentdriverCrt.exe	119
PID 1968 wrote to memory of 1300	1968	MscomponentdriverCrt.exe	120
PID 1968 wrote to memory of 1300	1968	MscomponentdriverCrt.exe	120
PID 1968 wrote to memory of 1252	1968	MscomponentdriverCrt.exe	122
PID 1968 wrote to memory of 1252	1968	MscomponentdriverCrt.exe	122
PID 1968 wrote to memory of 4764	1968	MscomponentdriverCrt.exe	123
PID 1968 wrote to memory of 4764	1968	MscomponentdriverCrt.exe	123
PID 1968 wrote to memory of 5076	1968	MscomponentdriverCrt.exe	124
PID 1968 wrote to memory of 5076	1968	MscomponentdriverCrt.exe	124
PID 1968 wrote to memory of 3188	1968	MscomponentdriverCrt.exe	130
PID 1968 wrote to memory of 3188	1968	MscomponentdriverCrt.exe	130
PID 3188 wrote to memory of 3948	3188	cmd.exe	132
PID 3188 wrote to memory of 3948	3188	cmd.exe	132
PID 3188 wrote to memory of 4072	3188	cmd.exe	133
PID 3188 wrote to memory of 4072	3188	cmd.exe	133
PID 3188 wrote to memory of 3988	3188	cmd.exe	138
PID 3188 wrote to memory of 3988	3188	cmd.exe	138

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\nixware.exe
"C:\Users\Admin\AppData\Local\Temp\nixware.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4564
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\MsBrowserhostMonitor\EElezqrlKIBLzguwSkxb8radmQlbhJP.vbe"
  2⤵
  - Checks computer location settings
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2364
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\MsBrowserhostMonitor\g6ESkS5wG8dtposA7kriVV.bat" "
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2328
  - - C:\MsBrowserhostMonitor\MscomponentdriverCrt.exe
      "C:\MsBrowserhostMonitor/MscomponentdriverCrt.exe"
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Drops file in Program Files directory
      Modifies registry class
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:1968
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Windows Media Player\uk-UA\System.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious use of AdjustPrivilegeToken
        
        PID:2900
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\MsBrowserhostMonitor\sppsvc.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious use of AdjustPrivilegeToken
        
        PID:4308
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\MsBrowserhostMonitor\wininit.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious use of AdjustPrivilegeToken
        
        PID:1300
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Windows Security\BrowserCore\en-US\smss.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious use of AdjustPrivilegeToken
        
        PID:1252
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\MsBrowserhostMonitor\TrustedInstaller.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious use of AdjustPrivilegeToken
        
        PID:4764
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\MsBrowserhostMonitor\MscomponentdriverCrt.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious use of AdjustPrivilegeToken
        
        PID:5076
    - - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\iyX6UYvse3.bat"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:3188
      - C:\Windows\system32\chcp.com
        
        chcp 65001
        6⤵
        
        PID:3948
      - C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        6⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:4072
      - C:\Program Files\Windows Media Player\uk-UA\System.exe
        
        "C:\Program Files\Windows Media Player\uk-UA\System.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:3988

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 6 /tr "'C:\Program Files\Windows Media Player\uk-UA\System.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1680

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "System" /sc ONLOGON /tr "'C:\Program Files\Windows Media Player\uk-UA\System.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4920

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 13 /tr "'C:\Program Files\Windows Media Player\uk-UA\System.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3220

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 8 /tr "'C:\MsBrowserhostMonitor\sppsvc.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2860

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvc" /sc ONLOGON /tr "'C:\MsBrowserhostMonitor\sppsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4496

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 6 /tr "'C:\MsBrowserhostMonitor\sppsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3328

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 13 /tr "'C:\MsBrowserhostMonitor\wininit.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4668

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininit" /sc ONLOGON /tr "'C:\MsBrowserhostMonitor\wininit.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1636

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 14 /tr "'C:\MsBrowserhostMonitor\wininit.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3508

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 9 /tr "'C:\Program Files\Windows Security\BrowserCore\en-US\smss.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5116

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smss" /sc ONLOGON /tr "'C:\Program Files\Windows Security\BrowserCore\en-US\smss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4752

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 12 /tr "'C:\Program Files\Windows Security\BrowserCore\en-US\smss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3672

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "TrustedInstallerT" /sc MINUTE /mo 6 /tr "'C:\MsBrowserhostMonitor\TrustedInstaller.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1244

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "TrustedInstaller" /sc ONLOGON /tr "'C:\MsBrowserhostMonitor\TrustedInstaller.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1048

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "TrustedInstallerT" /sc MINUTE /mo 10 /tr "'C:\MsBrowserhostMonitor\TrustedInstaller.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1748

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "MscomponentdriverCrtM" /sc MINUTE /mo 10 /tr "'C:\MsBrowserhostMonitor\MscomponentdriverCrt.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4616

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "MscomponentdriverCrt" /sc ONLOGON /tr "'C:\MsBrowserhostMonitor\MscomponentdriverCrt.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2988

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "MscomponentdriverCrtM" /sc MINUTE /mo 12 /tr "'C:\MsBrowserhostMonitor\MscomponentdriverCrt.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2764

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\MsBrowserhostMonitor\EElezqrlKIBLzguwSkxb8radmQlbhJP.vbe

Filesize
221B

MD5
1fc18ecdd0bacfef8e8363f6e558dbca

SHA1
9e25188c95f726964293d073b989ef6fdd38c151

SHA256
0cebba0cbbc37afdfd275fe4810f12b397c2160d0019c034bfd7c136f33760e5

SHA512
00dc44db67e1f7238ac5ca7e5f4b538c41fd23d157df0857bbcd50a2831cc8d60bd39e42aafd3f6ab6939e1d60567b9f1ba42c8a201171d148bbe39e677bb01e

Download Submit
C:\MsBrowserhostMonitor\MscomponentdriverCrt.exe

Filesize
31.1MB

MD5
ef755a7324e1a7d594675ddd9e2ad0f9

SHA1
2d098612aa16794f226e4c7049679af44144f860

SHA256
4f24e181932c4c8982ce9a05b9069003b73dda0f7bfcb5ccc7d1f460765ef5dd

SHA512
7e0cc803665e8dcfacdf10afa18bc3b75ad5e36d6481b9a6a0c0ed4b40ba4c729f875241a5464fd921580bfbcbc0b0c35e16df92cafacee0384a467f3c58e47d

Download Submit
C:\MsBrowserhostMonitor\g6ESkS5wG8dtposA7kriVV.bat

Filesize
100B

MD5
30cc56b4eec9e7a19401c3fe72824ade

SHA1
b780a8440717e489064633abd7b3dfea8b332978

SHA256
e4a31a425727324182e21b1850441c2a64f062ada252c69d96034de4af07f938

SHA512
c17441b536aa4e272d074899f211988020eaae65a2d8cb3b37d6df77d4a6d7a9cfd96b544e1169ae62b8da494f1d16f1989ffeacabcc321b3a2d09f7d139aec2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
d85ba6ff808d9e5444a4b369f5bc2730

SHA1
31aa9d96590fff6981b315e0b391b575e4c0804a

SHA256
84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

SHA512
8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
d28a889fd956d5cb3accfbaf1143eb6f

SHA1
157ba54b365341f8ff06707d996b3635da8446f7

SHA256
21e5d7ccf80a293e6ba30ed728846ca19c929c52b96e2c8d34e27cd2234f1d45

SHA512
0b6d88deb9be85722e6a78d5886d49f2caf407a59e128d2b4ed74c1356f9928c40048a62731959f2460e9ff9d9feee311043d2a37abe3bb92c2b76a44281478c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
cadef9abd087803c630df65264a6c81c

SHA1
babbf3636c347c8727c35f3eef2ee643dbcc4bd2

SHA256
cce65b73cdfe9304bcd5207913e8b60fb69faa20cd3b684f2b0343b755b99438

SHA512
7278aa87124abb382d9024a645e881e7b7cf1b84e8894943b36e018dbf0399e6858392f77980b599fa5488e2e21bf757a0702fe6419417edac93b68e0c2ec085

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_r3o4xeli.uqj.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\iyX6UYvse3.bat

Filesize
182B

MD5
59dfe8132238730d777cc584ff116a52

SHA1
46c6e08cf4b28351edf3e1dc878cb0c954a257fc

SHA256
81a4772acdb42ba4422b338c0d4c8ae937dd2594d329d2dc78499ac3ceb20d6d

SHA512
45fa202ff817ad1b1853fde9762201e631c0f708fa81cca37d56a7283544e1882febaf517e0af0c29a5efe56fe618cd9786daaa0f85581db0f4ad7be6082bcb0

Download Submit
memory/1300-38-0x000001D97EA00000-0x000001D97EA22000-memory.dmp

Filesize
136KB

Download
memory/1968-13-0x0000000000D60000-0x0000000000F3A000-memory.dmp

Filesize
1.9MB

Download
memory/1968-22-0x00000000030E0000-0x00000000030EC000-memory.dmp

Filesize
48KB

Download
memory/1968-20-0x000000001BAA0000-0x000000001BAB8000-memory.dmp

Filesize
96KB

Download
memory/1968-18-0x000000001BAF0000-0x000000001BB40000-memory.dmp

Filesize
320KB

Download
memory/1968-17-0x0000000003190000-0x00000000031AC000-memory.dmp

Filesize
112KB

Download
memory/1968-15-0x0000000001620000-0x000000000162E000-memory.dmp

Filesize
56KB

Download
memory/1968-12-0x00007FFAC84B3000-0x00007FFAC84B5000-memory.dmp

Filesize
8KB

Download
memory/3988-113-0x000000001B8D0000-0x000000001B9D2000-memory.dmp

Filesize
1.0MB

Download
memory/3988-114-0x000000001C4A0000-0x000000001C5B5000-memory.dmp

Filesize
1.1MB

Download