Overview

overview

10

Static

static

10

77416f272b...45.exe

windows7-x64

10

77416f272b...45.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    150s
  • max time network
    148s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    22-01-2025 03:30

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    77416f272b5f9f86a13038caf163f2a2a7c65e4e0281e43cbd745ebff9256845.exe

  • Size

    2.2MB

  • MD5

    4456822b2b827ac37495bd31b427a67a

  • SHA1

    201a118a38334aa4d971753dee890f2d15777c46

  • SHA256

    77416f272b5f9f86a13038caf163f2a2a7c65e4e0281e43cbd745ebff9256845

  • SHA512

    cb1e84f52bc25984422981e6c3b76ad2c3eebe895434a677ebdac9a676eeb4c46b1e1aed43161e4a3c4ba0a16da764d8f3b5d5823cb99f2d934738f1478e4213

  • SSDEEP

    49152:631tZUmbFNH1wLJDPqTo9lIS/MXU2F4/1l5eQ7K6:6ltZUE6NDyTo9lv2F+VvK6

Score
10/10
dcratdefense_evasioninfostealerpersistencerattrojan

Malware Config

Signatures

  • DcRat

    DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

    ratinfostealerdcrat
  • Dcrat family
    dcrat
  • Modifies WinLogon for persistence 2 TTPs 9 IoCs
    persistence
  • Process spawned unexpected child process 27 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • UAC bypass 3 TTPs 12 IoCs
    defense_evasiontrojan
  • DCRat payload 5 IoCs

    Detects payload of DCRat, commonly dropped by NSIS installers.

    rat
  • Drops file in Drivers directory 1 IoCs
  • Checks computer location settings 2 TTPs 4 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 3 IoCs
  • Adds Run key to start application 2 TTPs 18 IoCs
    persistence
  • Checks whether UAC is enabled 1 TTPs 8 IoCs
    defense_evasiontrojan
  • Drops file in Program Files directory 30 IoCs
  • Drops file in Windows directory 10 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies registry class 4 IoCs
  • Scheduled Task/Job: Scheduled Task 1 TTPs 27 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistenceexecution
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of WriteProcessMemory 22 IoCs
  • System policy modification 1 TTPs 12 IoCs
    defense_evasion
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\77416f272b5f9f86a13038caf163f2a2a7c65e4e0281e43cbd745ebff9256845.exe
    "C:\Users\Admin\AppData\Local\Temp\77416f272b5f9f86a13038caf163f2a2a7c65e4e0281e43cbd745ebff9256845.exe"
    1⤵
    • Modifies WinLogon for persistence
    • UAC bypass
    • Drops file in Drivers directory
    • Checks computer location settings
    • Adds Run key to start application
    • Checks whether UAC is enabled
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    • System policy modification
    PID:2416
    • C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\z7lFEPwavQ.bat"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:3024
      • C:\Windows\system32\w32tm.exe
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        3⤵
          PID:3112
        • C:\Recovery\WindowsRE\77416f272b5f9f86a13038caf163f2a2a7c65e4e0281e43cbd745ebff9256845.exe
          "C:\Recovery\WindowsRE\77416f272b5f9f86a13038caf163f2a2a7c65e4e0281e43cbd745ebff9256845.exe"
          3⤵
          • UAC bypass
          • Checks computer location settings
          • Executes dropped EXE
          • Checks whether UAC is enabled
          • Modifies registry class
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          • System policy modification
          PID:3544
          • C:\Windows\System32\WScript.exe
            "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\13d4c88d-0add-4f5d-b4a7-58564616f671.vbs"
            4⤵
            • Suspicious use of WriteProcessMemory
            PID:4896
            • C:\Recovery\WindowsRE\77416f272b5f9f86a13038caf163f2a2a7c65e4e0281e43cbd745ebff9256845.exe
              C:\Recovery\WindowsRE\77416f272b5f9f86a13038caf163f2a2a7c65e4e0281e43cbd745ebff9256845.exe
              5⤵
              • UAC bypass
              • Checks computer location settings
              • Executes dropped EXE
              • Checks whether UAC is enabled
              • Modifies registry class
              • Suspicious use of AdjustPrivilegeToken
              • Suspicious use of WriteProcessMemory
              • System policy modification
              PID:836
              • C:\Windows\System32\WScript.exe
                "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\1b56e4b7-5259-4472-9c8d-5e6b1f9e1e83.vbs"
                6⤵
                • Suspicious use of WriteProcessMemory
                PID:3520
                • C:\Recovery\WindowsRE\77416f272b5f9f86a13038caf163f2a2a7c65e4e0281e43cbd745ebff9256845.exe
                  C:\Recovery\WindowsRE\77416f272b5f9f86a13038caf163f2a2a7c65e4e0281e43cbd745ebff9256845.exe
                  7⤵
                  • UAC bypass
                  • Checks computer location settings
                  • Executes dropped EXE
                  • Checks whether UAC is enabled
                  • Modifies registry class
                  • Suspicious use of AdjustPrivilegeToken
                  • Suspicious use of WriteProcessMemory
                  • System policy modification
                  PID:5068
                  • C:\Windows\System32\WScript.exe
                    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\cc8a3174-b531-4a41-b3eb-77bff0b97865.vbs"
                    8⤵
                      PID:1512
                    • C:\Windows\System32\WScript.exe
                      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\fa25225a-295b-435c-a665-c2dd5473c591.vbs"
                      8⤵
                        PID:920
                  • C:\Windows\System32\WScript.exe
                    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\6875d03f-0f96-4ed4-a76b-e9a7b80779b7.vbs"
                    6⤵
                      PID:3472
                • C:\Windows\System32\WScript.exe
                  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\c20489b7-0531-44a0-8480-1f65272a3195.vbs"
                  4⤵
                    PID:4492
            • C:\Windows\system32\schtasks.exe
              schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 9 /tr "'C:\Program Files (x86)\Microsoft.NET\Primary Interop Assemblies\wininit.exe'" /f
              1⤵
              • Process spawned unexpected child process
              • Scheduled Task/Job: Scheduled Task
              PID:1880
            • C:\Windows\system32\schtasks.exe
              schtasks.exe /create /tn "wininit" /sc ONLOGON /tr "'C:\Program Files (x86)\Microsoft.NET\Primary Interop Assemblies\wininit.exe'" /rl HIGHEST /f
              1⤵
              • Process spawned unexpected child process
              • Scheduled Task/Job: Scheduled Task
              PID:4436
            • C:\Windows\system32\schtasks.exe
              schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 6 /tr "'C:\Program Files (x86)\Microsoft.NET\Primary Interop Assemblies\wininit.exe'" /rl HIGHEST /f
              1⤵
              • Process spawned unexpected child process
              • Scheduled Task/Job: Scheduled Task
              PID:2836
            • C:\Windows\system32\schtasks.exe
              schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 13 /tr "'C:\Program Files (x86)\Microsoft\RuntimeBroker.exe'" /f
              1⤵
              • Process spawned unexpected child process
              • Scheduled Task/Job: Scheduled Task
              PID:1984
            • C:\Windows\system32\schtasks.exe
              schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Program Files (x86)\Microsoft\RuntimeBroker.exe'" /rl HIGHEST /f
              1⤵
              • Process spawned unexpected child process
              • Scheduled Task/Job: Scheduled Task
              PID:3576
            • C:\Windows\system32\schtasks.exe
              schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 5 /tr "'C:\Program Files (x86)\Microsoft\RuntimeBroker.exe'" /rl HIGHEST /f
              1⤵
              • Process spawned unexpected child process
              • Scheduled Task/Job: Scheduled Task
              PID:1968
            • C:\Windows\system32\schtasks.exe
              schtasks.exe /create /tn "upfcu" /sc MINUTE /mo 8 /tr "'C:\Program Files\Java\jdk-1.8\jre\upfc.exe'" /f
              1⤵
              • Process spawned unexpected child process
              • Scheduled Task/Job: Scheduled Task
              PID:1640
            • C:\Windows\system32\schtasks.exe
              schtasks.exe /create /tn "upfc" /sc ONLOGON /tr "'C:\Program Files\Java\jdk-1.8\jre\upfc.exe'" /rl HIGHEST /f
              1⤵
              • Process spawned unexpected child process
              • Scheduled Task/Job: Scheduled Task
              PID:1916
            • C:\Windows\system32\schtasks.exe
              schtasks.exe /create /tn "upfcu" /sc MINUTE /mo 8 /tr "'C:\Program Files\Java\jdk-1.8\jre\upfc.exe'" /rl HIGHEST /f
              1⤵
              • Process spawned unexpected child process
              • Scheduled Task/Job: Scheduled Task
              PID:2160
            • C:\Windows\system32\schtasks.exe
              schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 10 /tr "'C:\Program Files\Crashpad\System.exe'" /f
              1⤵
              • Process spawned unexpected child process
              • Scheduled Task/Job: Scheduled Task
              PID:3696
            • C:\Windows\system32\schtasks.exe
              schtasks.exe /create /tn "System" /sc ONLOGON /tr "'C:\Program Files\Crashpad\System.exe'" /rl HIGHEST /f
              1⤵
              • Process spawned unexpected child process
              • Scheduled Task/Job: Scheduled Task
              PID:3752
            • C:\Windows\system32\schtasks.exe
              schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 10 /tr "'C:\Program Files\Crashpad\System.exe'" /rl HIGHEST /f
              1⤵
              • Process spawned unexpected child process
              • Scheduled Task/Job: Scheduled Task
              PID:1352
            • C:\Windows\system32\schtasks.exe
              schtasks.exe /create /tn "77416f272b5f9f86a13038caf163f2a2a7c65e4e0281e43cbd745ebff92568457" /sc MINUTE /mo 9 /tr "'C:\Recovery\WindowsRE\77416f272b5f9f86a13038caf163f2a2a7c65e4e0281e43cbd745ebff9256845.exe'" /f
              1⤵
              • Process spawned unexpected child process
              • Scheduled Task/Job: Scheduled Task
              PID:464
            • C:\Windows\system32\schtasks.exe
              schtasks.exe /create /tn "77416f272b5f9f86a13038caf163f2a2a7c65e4e0281e43cbd745ebff9256845" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\77416f272b5f9f86a13038caf163f2a2a7c65e4e0281e43cbd745ebff9256845.exe'" /rl HIGHEST /f
              1⤵
              • Process spawned unexpected child process
              • Scheduled Task/Job: Scheduled Task
              PID:3940
            • C:\Windows\system32\schtasks.exe
              schtasks.exe /create /tn "77416f272b5f9f86a13038caf163f2a2a7c65e4e0281e43cbd745ebff92568457" /sc MINUTE /mo 12 /tr "'C:\Recovery\WindowsRE\77416f272b5f9f86a13038caf163f2a2a7c65e4e0281e43cbd745ebff9256845.exe'" /rl HIGHEST /f
              1⤵
              • Process spawned unexpected child process
              • Scheduled Task/Job: Scheduled Task
              PID:3704
            • C:\Windows\system32\schtasks.exe
              schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 13 /tr "'C:\Program Files (x86)\Windows Photo Viewer\en-US\winlogon.exe'" /f
              1⤵
              • Process spawned unexpected child process
              • Scheduled Task/Job: Scheduled Task
              PID:3208
            • C:\Windows\system32\schtasks.exe
              schtasks.exe /create /tn "winlogon" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Photo Viewer\en-US\winlogon.exe'" /rl HIGHEST /f
              1⤵
              • Process spawned unexpected child process
              • Scheduled Task/Job: Scheduled Task
              PID:5040
            • C:\Windows\system32\schtasks.exe
              schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 11 /tr "'C:\Program Files (x86)\Windows Photo Viewer\en-US\winlogon.exe'" /rl HIGHEST /f
              1⤵
              • Process spawned unexpected child process
              • Scheduled Task/Job: Scheduled Task
              PID:4048
            • C:\Windows\system32\schtasks.exe
              schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 12 /tr "'C:\Program Files\Windows Multimedia Platform\fontdrvhost.exe'" /f
              1⤵
              • Process spawned unexpected child process
              • Scheduled Task/Job: Scheduled Task
              PID:400
            • C:\Windows\system32\schtasks.exe
              schtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\Program Files\Windows Multimedia Platform\fontdrvhost.exe'" /rl HIGHEST /f
              1⤵
              • Process spawned unexpected child process
              • Scheduled Task/Job: Scheduled Task
              PID:3144
            • C:\Windows\system32\schtasks.exe
              schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 6 /tr "'C:\Program Files\Windows Multimedia Platform\fontdrvhost.exe'" /rl HIGHEST /f
              1⤵
              • Process spawned unexpected child process
              • Scheduled Task/Job: Scheduled Task
              PID:2628
            • C:\Windows\system32\schtasks.exe
              schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 9 /tr "'C:\Windows\SchCache\winlogon.exe'" /f
              1⤵
              • Process spawned unexpected child process
              • Scheduled Task/Job: Scheduled Task
              PID:2932
            • C:\Windows\system32\schtasks.exe
              schtasks.exe /create /tn "winlogon" /sc ONLOGON /tr "'C:\Windows\SchCache\winlogon.exe'" /rl HIGHEST /f
              1⤵
              • Process spawned unexpected child process
              • Scheduled Task/Job: Scheduled Task
              PID:4024
            • C:\Windows\system32\schtasks.exe
              schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 14 /tr "'C:\Windows\SchCache\winlogon.exe'" /rl HIGHEST /f
              1⤵
              • Process spawned unexpected child process
              • Scheduled Task/Job: Scheduled Task
              PID:700
            • C:\Windows\system32\schtasks.exe
              schtasks.exe /create /tn "unsecappu" /sc MINUTE /mo 13 /tr "'C:\Windows\Performance\WinSAT\unsecapp.exe'" /f
              1⤵
              • Process spawned unexpected child process
              • Scheduled Task/Job: Scheduled Task
              PID:3832
            • C:\Windows\system32\schtasks.exe
              schtasks.exe /create /tn "unsecapp" /sc ONLOGON /tr "'C:\Windows\Performance\WinSAT\unsecapp.exe'" /rl HIGHEST /f
              1⤵
              • Process spawned unexpected child process
              • Scheduled Task/Job: Scheduled Task
              PID:1804
            • C:\Windows\system32\schtasks.exe
              schtasks.exe /create /tn "unsecappu" /sc MINUTE /mo 14 /tr "'C:\Windows\Performance\WinSAT\unsecapp.exe'" /rl HIGHEST /f
              1⤵
              • Process spawned unexpected child process
              • Scheduled Task/Job: Scheduled Task
              PID:4044

            Network

            MITRE ATT&CK Enterprise v15

            Reconnaissance

            Resource Development

            Initial Access

            Execution

            Scheduled Task/Job

            1
            T1053

            Scheduled Task

            1
            T1053.005

            Persistence

            Boot or Logon Autostart Execution

            2
            T1547

            Registry Run Keys / Startup Folder

            1
            T1547.001

            Winlogon Helper DLL

            1
            T1547.004

            Scheduled Task/Job

            1
            T1053

            Scheduled Task

            1
            T1053.005

            Privilege Escalation

            Abuse Elevation Control Mechanism

            1
            T1548

            Bypass User Account Control

            1
            T1548.002

            Boot or Logon Autostart Execution

            2
            T1547

            Registry Run Keys / Startup Folder

            1
            T1547.001

            Winlogon Helper DLL

            1
            T1547.004

            Scheduled Task/Job

            1
            T1053

            Scheduled Task

            1
            T1053.005

            Defense Evasion

            Abuse Elevation Control Mechanism

            1
            T1548

            Bypass User Account Control

            1
            T1548.002

            Impair Defenses

            1
            T1562

            Disable or Modify Tools

            1
            T1562.001

            Modify Registry

            4
            T1112

            Credential Access

            Discovery

            Query Registry

            2
            T1012

            System Information Discovery

            3
            T1082

            Lateral Movement

            Collection

            Command and Control

            Exfiltration

            Impact

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            • C:\Program Files (x86)\Microsoft.NET\Primary Interop Assemblies\wininit.exe
              Filesize

              2.2MB

              MD5

              09f769d124496ed91eafd9994cb6e60d

              SHA1

              ca66fecc0c3220c7f183a1821a414d97f27aa4a3

              SHA256

              a9685f832bd68ef3b80281964482776e6a12d90896c51329b33853b9adb5e5e9

              SHA512

              b2c8f9e2f0b89972507ab13faa67ebe9b3025ebc7e6d52eab1bf40a6218513e88f41246ccaa75d8ef9464cab2bf2ce29f08e21e85ebe211ac574b9e0c2f2fb86

              Download Submit

            • C:\Program Files\Java\jdk-1.8\jre\upfc.exe
              Filesize

              2.2MB

              MD5

              624db0d78ccdab73efca96802da7375c

              SHA1

              8f845b1e653fba38e5a397f75e7bb679a14f13a7

              SHA256

              7aa8617446458d8136d458d3c8f5c5471f67d95c294502d85e3903ad9587ba17

              SHA512

              3a495e050b37c6c040fdf57ccc09a46c61840ae70764eed7ab88c5a90f577ab1bbc5e2474f946a96fa14130477c045a252bc5d66af07db48ec215f719adc5992

              Download Submit

            • C:\Recovery\WindowsRE\77416f272b5f9f86a13038caf163f2a2a7c65e4e0281e43cbd745ebff9256845.exe
              Filesize

              2.2MB

              MD5

              4456822b2b827ac37495bd31b427a67a

              SHA1

              201a118a38334aa4d971753dee890f2d15777c46

              SHA256

              77416f272b5f9f86a13038caf163f2a2a7c65e4e0281e43cbd745ebff9256845

              SHA512

              cb1e84f52bc25984422981e6c3b76ad2c3eebe895434a677ebdac9a676eeb4c46b1e1aed43161e4a3c4ba0a16da764d8f3b5d5823cb99f2d934738f1478e4213

              Download Submit

            • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\77416f272b5f9f86a13038caf163f2a2a7c65e4e0281e43cbd745ebff9256845.exe.log
              Filesize

              1KB

              MD5

              655010c15ea0ca05a6e5ddcd84986b98

              SHA1

              120bf7e516aeed462c07625fbfcdab5124ad05d3

              SHA256

              2b1ffeab025cc7c61c50e3e2e4c9253046d9174cf00181a8c1de733a4c0daa14

              SHA512

              e52c26718d7d1e979837b5ac626dde26920fe7413b8aa7be6f1be566a1b0f035582f4d313400e3ad6b92552abb1dfaf186b60b875fb955a2a94fd839fe841437

              Download Submit

            • C:\Users\Admin\AppData\Local\Temp\13d4c88d-0add-4f5d-b4a7-58564616f671.vbs
              Filesize

              766B

              MD5

              86588fca7a0ed2a2071196b8e984d458

              SHA1

              6c77bdd3cee503538c7ea0720478312b9903dce0

              SHA256

              7def0c44125b2f80677003a51d412622215ea852c9fea5293b2072a0648eb7ec

              SHA512

              9e55d7b23127bc15860ea9e1a49e527e8ea592b57a56cd2ef7061d6032116df1ead7062ed104b1d3e4d7db2997e4538b98a2de88cce7ca8ee34c6cb6976c2ceb

              Download Submit

            • C:\Users\Admin\AppData\Local\Temp\1b56e4b7-5259-4472-9c8d-5e6b1f9e1e83.vbs
              Filesize

              765B

              MD5

              f969b0d81ccb9c5f6fea31ec97676173

              SHA1

              19fffae9d34c855bd6c2314a584067ae73a826d7

              SHA256

              4cf7195494995e79ca1f6d53a6aa2e25bc5eef075d3d3bc5a51521fc446854b4

              SHA512

              5d18f2201a2e6525f41690196970d71a981340c7991ffc7a5c6fe98fa39be75f32225c258cb35c3c49590ab75da62c8578c3751bc5ae0fca6181e7a19535a917

              Download Submit

            • C:\Users\Admin\AppData\Local\Temp\c20489b7-0531-44a0-8480-1f65272a3195.vbs
              Filesize

              542B

              MD5

              4fa736018a69b9435029c4cade36f19d

              SHA1

              ee396468635c6e41d56ef24c1a2e82a77f5d0a8e

              SHA256

              c1c79855927f9369da944996d9bd4b6be5d7539a0f6696637f8a011dc0db69a8

              SHA512

              15c351ad993e16654af8bb4968c25300fd886f62a88f496bc5b22d9df3f6395191c4ffae7dc1759a9057e175e5c4a8e06ce8fe65596045430994fbf3177a5aab

              Download Submit

            • C:\Users\Admin\AppData\Local\Temp\cc8a3174-b531-4a41-b3eb-77bff0b97865.vbs
              Filesize

              766B

              MD5

              ac4a0fa6507377bf3bb491b71ed3a523

              SHA1

              01d5cba3e8a87dc82d1d8d5b35e5462615be3ce4

              SHA256

              1119d44960b37b1567b9cd6603e53de41296c9de98912dd19f52c60cd11b7934

              SHA512

              4645312badbe90f5a44f23fb1b607026a2ceddc96aa8c42ec9ffd4c77f9df174f5458cfe4178bb76bdd17e8eb6a1d618151b214e0129a9c7a9f81b4fee3b893b

              Download Submit

            • C:\Users\Admin\AppData\Local\Temp\z7lFEPwavQ.bat
              Filesize

              255B

              MD5

              1bc2848f08f57a215d350c7d4b7ff0ec

              SHA1

              8aa9a3b48f35a0f393c9ca0df58373755c7843b4

              SHA256

              06a216cdbb55cabaf7d127ada7afeebd29b21fcacd234412cc4ac3212bdeb263

              SHA512

              d631ef5fb120c42cd21ad38507e2b19cf18c3d17936411d857707d0d3f6351060533ab94be72425b298e183b026a0b73787d28f9eecf54868a59a4c3938cce08

              Download Submit

            • C:\Windows\Performance\WinSAT\unsecapp.exe
              Filesize

              2.2MB

              MD5

              19d7487cd3ff71e5f0c6b70de531df31

              SHA1

              802ec8f81553c85cfcd20fe2890512b2b276db86

              SHA256

              9187a65cd8264a362ab4bc624faeb208c6d5dcd5e3ea88d0031e6803b718caf9

              SHA512

              03ba9b503a157c974a0b2bceee0c581d11c9dc98452d19283a95c22227fad0c5e9be4999db5bec11f02299cfe2f25783b0f1217f0de7ad3f2e7bde5c47923cdb

              Download Submit

            • memory/2416-17-0x000000001BDA0000-0x000000001BDA8000-memory.dmp

              Filesize

              32KB

              Download

            • memory/2416-16-0x000000001BD90000-0x000000001BD9C000-memory.dmp

              Filesize

              48KB

              Download

            • memory/2416-19-0x000000001BDB0000-0x000000001BDC2000-memory.dmp

              Filesize

              72KB

              Download

            • memory/2416-15-0x000000001BD80000-0x000000001BD88000-memory.dmp

              Filesize

              32KB

              Download

            • memory/2416-13-0x0000000003540000-0x000000000354A000-memory.dmp

              Filesize

              40KB

              Download

            • memory/2416-21-0x000000001BDE0000-0x000000001BDEC000-memory.dmp

              Filesize

              48KB

              Download

            • memory/2416-20-0x000000001CA30000-0x000000001CF58000-memory.dmp

              Filesize

              5.2MB

              Download

            • memory/2416-23-0x000000001C510000-0x000000001C51C000-memory.dmp

              Filesize

              48KB

              Download

            • memory/2416-22-0x000000001C500000-0x000000001C50C000-memory.dmp

              Filesize

              48KB

              Download

            • memory/2416-11-0x0000000003520000-0x0000000003528000-memory.dmp

              Filesize

              32KB

              Download

            • memory/2416-9-0x00000000034F0000-0x0000000003506000-memory.dmp

              Filesize

              88KB

              Download

            • memory/2416-6-0x000000001BD20000-0x000000001BD70000-memory.dmp

              Filesize

              320KB

              Download

            • memory/2416-29-0x000000001C760000-0x000000001C768000-memory.dmp

              Filesize

              32KB

              Download

            • memory/2416-30-0x000000001C770000-0x000000001C77C000-memory.dmp

              Filesize

              48KB

              Download

            • memory/2416-31-0x00007FFF66360000-0x00007FFF66E21000-memory.dmp

              Filesize

              10.8MB

              Download

            • memory/2416-28-0x000000001C750000-0x000000001C75C000-memory.dmp

              Filesize

              48KB

              Download

            • memory/2416-34-0x00007FFF66360000-0x00007FFF66E21000-memory.dmp

              Filesize

              10.8MB

              Download

            • memory/2416-0-0x00007FFF66363000-0x00007FFF66365000-memory.dmp

              Filesize

              8KB

              Download

            • memory/2416-27-0x000000001C740000-0x000000001C74E000-memory.dmp

              Filesize

              56KB

              Download

            • memory/2416-26-0x000000001C730000-0x000000001C738000-memory.dmp

              Filesize

              32KB

              Download

            • memory/2416-25-0x000000001C720000-0x000000001C72E000-memory.dmp

              Filesize

              56KB

              Download

            • memory/2416-24-0x000000001C790000-0x000000001C79A000-memory.dmp

              Filesize

              40KB

              Download

            • memory/2416-5-0x00000000034D0000-0x00000000034EC000-memory.dmp

              Filesize

              112KB

              Download

            • memory/2416-14-0x000000001BD70000-0x000000001BD7C000-memory.dmp

              Filesize

              48KB

              Download

            • memory/2416-12-0x0000000003530000-0x0000000003540000-memory.dmp

              Filesize

              64KB

              Download

            • memory/2416-10-0x0000000003510000-0x000000000351C000-memory.dmp

              Filesize

              48KB

              Download

            • memory/2416-166-0x00007FFF66360000-0x00007FFF66E21000-memory.dmp

              Filesize

              10.8MB

              Download

            • memory/2416-7-0x00000000019A0000-0x00000000019A8000-memory.dmp

              Filesize

              32KB

              Download

            • memory/2416-8-0x0000000003360000-0x0000000003370000-memory.dmp

              Filesize

              64KB

              Download

            • memory/2416-4-0x0000000001980000-0x000000000198E000-memory.dmp

              Filesize

              56KB

              Download

            • memory/2416-3-0x0000000001970000-0x000000000197E000-memory.dmp

              Filesize

              56KB

              Download

            • memory/2416-2-0x00007FFF66360000-0x00007FFF66E21000-memory.dmp

              Filesize

              10.8MB

              Download

            • memory/2416-1-0x0000000000F30000-0x000000000115E000-memory.dmp

              Filesize

              2.2MB

              Download

            • memory/5068-192-0x000000001BB60000-0x000000001BB72000-memory.dmp

              Filesize

              72KB

              Download