dcrat | 1193157e2a338dbe8d057b125d36fffd2c05be694c1bfdaaf49d52e30bd08ebd

Analysis

max time kernel
143s
max time network
153s
platform
windows10-ltsc 2021_x64
resource
win10ltsc2021-20250217-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20250217-enlocale:en-usos:windows10-ltsc 2021-x64system
submitted
11/03/2025, 16:14

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
coderoom-main/nbyosapefdkhasd.exe
Size 830KB
Sample250311-tp2gvsxpv2
SHA256 708b90620e944806d2ad832646b09f6b94d64935fb1eb6c056ac6da6049055d4
MD5 bac01e445ee98d0f5786cbe5db0b5af1
SHA1 c425da1b35f88971c74396faea1456eb2e57c1ab
SHA512 494a4add1138834bd48817f99a2726b3cd80c1800bc036da44517063562e6de2a0a2ba90e810538e2482f47e6317609f8d36a4954a69280355f006b9e6276a68
SSDEEP 12288:RPl1fce/+C4pmDH5ejE3wKI5wzuuGhP/Sknk7HtxCxXGLzz+Y3Q9TEbuX61+:RdJSpMEjn19qNaDX61+
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

dcrat discovery execution infostealer persistence rat

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat
Dcrat family
dcrat

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Users\\Admin\\AppData\\Local\\staticfile.exe\""	nbyosapefdkhasd.exe

Process spawned unexpected child process 3 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	380	1264	schtasks.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3348	1264	schtasks.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2152	1264	schtasks.exe	84

DCRat payload 2 IoCs

rat

resource	yara_rule
behavioral18/memory/5000-1-0x0000000000200000-0x00000000002D6000-memory.dmp	family_dcrat_v2
behavioral18/files/0x0013000000027c1d-56.dat	family_dcrat_v2

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
1260	powershell.exe

Checks computer location settings 2 TTPs 5 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2501448743-3279416841-701563739-1000\Control Panel\International\Geo\Nation	staticfile.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2501448743-3279416841-701563739-1000\Control Panel\International\Geo\Nation	staticfile.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2501448743-3279416841-701563739-1000\Control Panel\International\Geo\Nation	staticfile.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2501448743-3279416841-701563739-1000\Control Panel\International\Geo\Nation	staticfile.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2501448743-3279416841-701563739-1000\Control Panel\International\Geo\Nation	nbyosapefdkhasd.exe

Executes dropped EXE 5 IoCs

pid	Process
3224	staticfile.exe
4756	staticfile.exe
1392	staticfile.exe
3780	staticfile.exe
4112	staticfile.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2501448743-3279416841-701563739-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\staticfile = "\"C:\\Users\\Admin\\AppData\\Local\\staticfile.exe\""	nbyosapefdkhasd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\staticfile = "\"C:\\Users\\Admin\\AppData\\Local\\staticfile.exe\""	nbyosapefdkhasd.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	\??\c:\Windows\System32\CSCB309E4F6E86D4F17AAB5ACA22F408C6B.TMP	csc.exe
File created	\??\c:\Windows\System32\cnkhao.exe	csc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 3 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
5100	PING.EXE
1064	PING.EXE
4668	PING.EXE

Modifies registry class 5 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2501448743-3279416841-701563739-1000_Classes\Local Settings	staticfile.exe
Key created	\REGISTRY\USER\S-1-5-21-2501448743-3279416841-701563739-1000_Classes\Local Settings	nbyosapefdkhasd.exe
Key created	\REGISTRY\USER\S-1-5-21-2501448743-3279416841-701563739-1000_Classes\Local Settings	staticfile.exe
Key created	\REGISTRY\USER\S-1-5-21-2501448743-3279416841-701563739-1000_Classes\Local Settings	staticfile.exe
Key created	\REGISTRY\USER\S-1-5-21-2501448743-3279416841-701563739-1000_Classes\Local Settings	staticfile.exe

Runs ping.exe 1 TTPs 3 IoCs

Remote System Discovery

T1018

pid	Process
5100	PING.EXE
1064	PING.EXE
4668	PING.EXE

Scheduled Task/Job: Scheduled Task 1 TTPs 3 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
3348	schtasks.exe
2152	schtasks.exe
380	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
5000	nbyosapefdkhasd.exe
5000	nbyosapefdkhasd.exe
5000	nbyosapefdkhasd.exe
5000	nbyosapefdkhasd.exe
5000	nbyosapefdkhasd.exe
5000	nbyosapefdkhasd.exe
5000	nbyosapefdkhasd.exe
5000	nbyosapefdkhasd.exe
5000	nbyosapefdkhasd.exe
5000	nbyosapefdkhasd.exe
5000	nbyosapefdkhasd.exe
5000	nbyosapefdkhasd.exe
5000	nbyosapefdkhasd.exe
5000	nbyosapefdkhasd.exe
5000	nbyosapefdkhasd.exe
5000	nbyosapefdkhasd.exe
5000	nbyosapefdkhasd.exe
5000	nbyosapefdkhasd.exe
5000	nbyosapefdkhasd.exe
5000	nbyosapefdkhasd.exe
5000	nbyosapefdkhasd.exe
5000	nbyosapefdkhasd.exe
5000	nbyosapefdkhasd.exe
5000	nbyosapefdkhasd.exe
5000	nbyosapefdkhasd.exe
5000	nbyosapefdkhasd.exe
5000	nbyosapefdkhasd.exe
5000	nbyosapefdkhasd.exe
5000	nbyosapefdkhasd.exe
5000	nbyosapefdkhasd.exe
5000	nbyosapefdkhasd.exe
5000	nbyosapefdkhasd.exe
5000	nbyosapefdkhasd.exe
5000	nbyosapefdkhasd.exe
5000	nbyosapefdkhasd.exe
5000	nbyosapefdkhasd.exe
5000	nbyosapefdkhasd.exe
5000	nbyosapefdkhasd.exe
5000	nbyosapefdkhasd.exe
5000	nbyosapefdkhasd.exe
5000	nbyosapefdkhasd.exe
5000	nbyosapefdkhasd.exe
5000	nbyosapefdkhasd.exe
5000	nbyosapefdkhasd.exe
5000	nbyosapefdkhasd.exe
5000	nbyosapefdkhasd.exe
5000	nbyosapefdkhasd.exe
5000	nbyosapefdkhasd.exe
5000	nbyosapefdkhasd.exe
5000	nbyosapefdkhasd.exe
5000	nbyosapefdkhasd.exe
5000	nbyosapefdkhasd.exe
5000	nbyosapefdkhasd.exe
5000	nbyosapefdkhasd.exe
5000	nbyosapefdkhasd.exe
5000	nbyosapefdkhasd.exe
5000	nbyosapefdkhasd.exe
5000	nbyosapefdkhasd.exe
5000	nbyosapefdkhasd.exe
5000	nbyosapefdkhasd.exe
5000	nbyosapefdkhasd.exe
5000	nbyosapefdkhasd.exe
5000	nbyosapefdkhasd.exe
5000	nbyosapefdkhasd.exe

Suspicious use of AdjustPrivilegeToken 28 IoCs

description	pid	Process
Token: SeDebugPrivilege	5000	nbyosapefdkhasd.exe
Token: SeDebugPrivilege	1260	powershell.exe
Token: SeIncreaseQuotaPrivilege	1260	powershell.exe
Token: SeSecurityPrivilege	1260	powershell.exe
Token: SeTakeOwnershipPrivilege	1260	powershell.exe
Token: SeLoadDriverPrivilege	1260	powershell.exe
Token: SeSystemProfilePrivilege	1260	powershell.exe
Token: SeSystemtimePrivilege	1260	powershell.exe
Token: SeProfSingleProcessPrivilege	1260	powershell.exe
Token: SeIncBasePriorityPrivilege	1260	powershell.exe
Token: SeCreatePagefilePrivilege	1260	powershell.exe
Token: SeBackupPrivilege	1260	powershell.exe
Token: SeRestorePrivilege	1260	powershell.exe
Token: SeShutdownPrivilege	1260	powershell.exe
Token: SeDebugPrivilege	1260	powershell.exe
Token: SeSystemEnvironmentPrivilege	1260	powershell.exe
Token: SeRemoteShutdownPrivilege	1260	powershell.exe
Token: SeUndockPrivilege	1260	powershell.exe
Token: SeManageVolumePrivilege	1260	powershell.exe
Token: 33	1260	powershell.exe
Token: 34	1260	powershell.exe
Token: 35	1260	powershell.exe
Token: 36	1260	powershell.exe
Token: SeDebugPrivilege	3224	staticfile.exe
Token: SeDebugPrivilege	4756	staticfile.exe
Token: SeDebugPrivilege	1392	staticfile.exe
Token: SeDebugPrivilege	3780	staticfile.exe
Token: SeDebugPrivilege	4112	staticfile.exe

Suspicious use of WriteProcessMemory 46 IoCs

description	pid	Process	procid_target
PID 5000 wrote to memory of 2052	5000	nbyosapefdkhasd.exe	88
PID 5000 wrote to memory of 2052	5000	nbyosapefdkhasd.exe	88
PID 2052 wrote to memory of 3580	2052	csc.exe	90
PID 2052 wrote to memory of 3580	2052	csc.exe	90
PID 5000 wrote to memory of 1260	5000	nbyosapefdkhasd.exe	91
PID 5000 wrote to memory of 1260	5000	nbyosapefdkhasd.exe	91
PID 5000 wrote to memory of 2240	5000	nbyosapefdkhasd.exe	93
PID 5000 wrote to memory of 2240	5000	nbyosapefdkhasd.exe	93
PID 2240 wrote to memory of 4052	2240	cmd.exe	95
PID 2240 wrote to memory of 4052	2240	cmd.exe	95
PID 2240 wrote to memory of 2392	2240	cmd.exe	96
PID 2240 wrote to memory of 2392	2240	cmd.exe	96
PID 2240 wrote to memory of 3224	2240	cmd.exe	101
PID 2240 wrote to memory of 3224	2240	cmd.exe	101
PID 3224 wrote to memory of 2080	3224	staticfile.exe	106
PID 3224 wrote to memory of 2080	3224	staticfile.exe	106
PID 2080 wrote to memory of 3188	2080	cmd.exe	108
PID 2080 wrote to memory of 3188	2080	cmd.exe	108
PID 2080 wrote to memory of 4900	2080	cmd.exe	109
PID 2080 wrote to memory of 4900	2080	cmd.exe	109
PID 2080 wrote to memory of 4756	2080	cmd.exe	110
PID 2080 wrote to memory of 4756	2080	cmd.exe	110
PID 4756 wrote to memory of 876	4756	staticfile.exe	111
PID 4756 wrote to memory of 876	4756	staticfile.exe	111
PID 876 wrote to memory of 2840	876	cmd.exe	113
PID 876 wrote to memory of 2840	876	cmd.exe	113
PID 876 wrote to memory of 5100	876	cmd.exe	114
PID 876 wrote to memory of 5100	876	cmd.exe	114
PID 876 wrote to memory of 1392	876	cmd.exe	115
PID 876 wrote to memory of 1392	876	cmd.exe	115
PID 1392 wrote to memory of 5000	1392	staticfile.exe	116
PID 1392 wrote to memory of 5000	1392	staticfile.exe	116
PID 5000 wrote to memory of 3888	5000	cmd.exe	118
PID 5000 wrote to memory of 3888	5000	cmd.exe	118
PID 5000 wrote to memory of 1064	5000	cmd.exe	119
PID 5000 wrote to memory of 1064	5000	cmd.exe	119
PID 5000 wrote to memory of 3780	5000	cmd.exe	120
PID 5000 wrote to memory of 3780	5000	cmd.exe	120
PID 3780 wrote to memory of 3428	3780	staticfile.exe	121
PID 3780 wrote to memory of 3428	3780	staticfile.exe	121
PID 3428 wrote to memory of 3148	3428	cmd.exe	123
PID 3428 wrote to memory of 3148	3428	cmd.exe	123
PID 3428 wrote to memory of 4668	3428	cmd.exe	124
PID 3428 wrote to memory of 4668	3428	cmd.exe	124
PID 3428 wrote to memory of 4112	3428	cmd.exe	125
PID 3428 wrote to memory of 4112	3428	cmd.exe	125

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\coderoom-main\nbyosapefdkhasd.exe
"C:\Users\Admin\AppData\Local\Temp\coderoom-main\nbyosapefdkhasd.exe"
1⤵
- Modifies WinLogon for persistence
- Checks computer location settings
- Adds Run key to start application
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5000
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\uac35gm2\uac35gm2.cmdline"
  2⤵
  - Drops file in System32 directory
  - Suspicious use of WriteProcessMemory
  PID:2052
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESD2F0.tmp" "c:\Windows\System32\CSCB309E4F6E86D4F17AAB5ACA22F408C6B.TMP"
    3⤵
    PID:3580
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\staticfile.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of AdjustPrivilegeToken
  PID:1260
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\RwNJlXfOv9.bat"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2240
- - C:\Windows\system32\chcp.com
    chcp 65001
    3⤵
    PID:4052
- - C:\Windows\system32\w32tm.exe
    w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
    3⤵
    PID:2392
- - C:\Users\Admin\AppData\Local\staticfile.exe
    "C:\Users\Admin\AppData\Local\staticfile.exe"
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Modifies registry class
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:3224
  - - C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\F0qtrCuOKA.bat"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:2080
    - - C:\Windows\system32\chcp.com
        
        chcp 65001
        5⤵
        
        PID:3188
    - - C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        5⤵
        
        PID:4900
    - - C:\Users\Admin\AppData\Local\staticfile.exe
        
        "C:\Users\Admin\AppData\Local\staticfile.exe"
        5⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4756
      - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\jD9ngJpyTM.bat"
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:876
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        7⤵
        
        PID:2840
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        7⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:5100
        
        C:\Users\Admin\AppData\Local\staticfile.exe
        
        "C:\Users\Admin\AppData\Local\staticfile.exe"
        7⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1392
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\yUaH2NNloo.bat"
        8⤵
        Suspicious use of WriteProcessMemory
        
        PID:5000
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        9⤵
        
        PID:3888
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        9⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:1064
        
        C:\Users\Admin\AppData\Local\staticfile.exe
        
        "C:\Users\Admin\AppData\Local\staticfile.exe"
        9⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3780
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\qPEz3ygwJT.bat"
        10⤵
        Suspicious use of WriteProcessMemory
        
        PID:3428
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        11⤵
        
        PID:3148
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        11⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:4668
        
        C:\Users\Admin\AppData\Local\staticfile.exe
        
        "C:\Users\Admin\AppData\Local\staticfile.exe"
        11⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:4112

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "staticfiles" /sc MINUTE /mo 5 /tr "'C:\Users\Admin\AppData\Local\staticfile.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3348

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "staticfile" /sc ONLOGON /tr "'C:\Users\Admin\AppData\Local\staticfile.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:380

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "staticfiles" /sc MINUTE /mo 13 /tr "'C:\Users\Admin\AppData\Local\staticfile.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2152

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

staticfile.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\staticfile.exe.log
Size 1KB
SHA256 fe0cfcd7729f9a68f46afcb3b105fdf637099b6043a41d9a27ed9bb5b281826a
MD5 61405cd7cb2bca4dfa54e14d1654ed7c
SHA1 bfc9618fcb1c1e0b7f0f7b3be5a6bd1a93bb992b
SHA512 5f705e9b17b94515f19c2b7da03d7af6e4a08032f1fad1b3d1e1a73b8a0c68b105cb964b9f66016dc9a7abac1ed83c21a29bdcda6efd734f4e0594aef34da733
MD5 SHA1 SHA512

Submit Download

F0qtrCuOKA.bat

Path C:\Users\Admin\AppData\Local\Temp\F0qtrCuOKA.bat
Size 219B
SHA256 80ff17cd41a6d37bd82222d29f1cbe0bf4f8748895897b4b9ca7ff40cd664d5a
MD5 ece38a71f6a426473ea64973cb90d111
SHA1 208ce8af6d825b9866192934be8526127d5c92ed
SHA512 1e29200e729440621769275942291e9257a4fd66de3bcaed947fb70dba866d08cad05ea6fa8490ad9a8530210316c0c0896c95494f16bf695e64561396884910
MD5 SHA1 SHA512

Submit Download

RESD2F0.tmp

Path C:\Users\Admin\AppData\Local\Temp\RESD2F0.tmp
Size 1KB
SHA256 75c922639dc7bb6d05c1ada6a6e6133f4a26c98ebecf62b107dc0d509e76825e
MD5 963b7f92758588b02714331a8cce2748
SHA1 16b8c359550abb7c4bcd05c575db09be76948087
SHA512 7fcf8ec53a110123cf48485cbd188bca4550a35e75470846776e0c2c3a8fbf8977042ee2046ebc46771917fd84cbbb712aa4cec07bccbe1d41647c3fcb20d47f
MD5 SHA1 SHA512

Submit Download

RwNJlXfOv9.bat

Path C:\Users\Admin\AppData\Local\Temp\RwNJlXfOv9.bat
Size 219B
SHA256 88bba5d7bae94126556162dffd8796b3dec87b8ab5b6647bcc199e0162937783
MD5 6b81351bb5dd8fe20b0d55bedf413b14
SHA1 7ffd2367a46036367f937e3a2732528974908353
SHA512 e2fa5c3717b2a300580471491f2b22513d2d11f34c6320cc73792ffd468d318cb5c770f6d3c7802ec59d25079f9c028e9b6bca33eeca4e812b0e95cc0b0d6862
MD5 SHA1 SHA512

Submit Download

__PSScriptPolicyTest_lnbppvep.rvx.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_lnbppvep.rvx.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
MD5 SHA1 SHA512

Submit Download

jD9ngJpyTM.bat

Path C:\Users\Admin\AppData\Local\Temp\jD9ngJpyTM.bat
Size 171B
SHA256 0fecf3047eab7b812499af1f075382b9b22df52be1be096b95670df4d31f570a
MD5 d1d829da19811fa2227074bf8c18c46d
SHA1 955db275a12edae86bd824bc183ee011a9f9e7b7
SHA512 5f634b8331d5cfc4b9b393e9aad7543c5d44773fb15a3fe9a0bbaad8aaa8f15979f1b36b09175128dc02841729e41efb2bee589f2a9dd3790a5c9bbcd842b071
MD5 SHA1 SHA512

Submit Download

qPEz3ygwJT.bat

Path C:\Users\Admin\AppData\Local\Temp\qPEz3ygwJT.bat
Size 171B
SHA256 3f6aa66f155d502ccf252de1244dbe519c17644aaa9bae63eb45cab020768f0f
MD5 d4fcd14cab1c5d7e71d467d0ba8e733f
SHA1 c230c5188adc1ab4dd46f923cc5f980f33907762
SHA512 50eb5f3b417ca524ed2ef116d5ef82f06d0252524f49f0c6e2fa6fcc256b7a4a5585bf1015917f48b761c7ce1ed0c85e2e0c65bb0658629fb916dfc2a17ce39a
MD5 SHA1 SHA512

Submit Download

yUaH2NNloo.bat

Path C:\Users\Admin\AppData\Local\Temp\yUaH2NNloo.bat
Size 171B
SHA256 3fa20cc61913e372c01cea1d3178deda8487ee0a3f4c618498f6c99d0a1c900a
MD5 6ad2dccd60301df8eb46b8f742a9e061
SHA1 38f789ff9b0f45b6d1adbed2bc09c6be789f19d7
SHA512 58271a21d3348707fc3868a525f80ad2763a05c4aa0176bd00d0c74fbe15cb3c7bf7cfa512e007a9a717b66b52a2c314cfb7f00faaf8f07506b46a53c2adf6a5
MD5 SHA1 SHA512

Submit Download

staticfile.exe

Path C:\Users\Admin\AppData\Local\staticfile.exe
Size 830KB
SHA256 708b90620e944806d2ad832646b09f6b94d64935fb1eb6c056ac6da6049055d4
MD5 bac01e445ee98d0f5786cbe5db0b5af1
SHA1 c425da1b35f88971c74396faea1456eb2e57c1ab
SHA512 494a4add1138834bd48817f99a2726b3cd80c1800bc036da44517063562e6de2a0a2ba90e810538e2482f47e6317609f8d36a4954a69280355f006b9e6276a68
SSDEEP 12288:RPl1fce/+C4pmDH5ejE3wKI5wzuuGhP/Sknk7HtxCxXGLzz+Y3Q9TEbuX61+:RdJSpMEjn19qNaDX61+
MD5 SHA1 SHA512 SSDEEP

Submit Download

uac35gm2.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\uac35gm2\uac35gm2.0.cs
Size 375B
SHA256 68c25434c9155aed2cb20b7f365b8d5c35737f60729280e2badd513855027ff2
MD5 21f71d7b521340812e7d196bdbd0f1f8
SHA1 6d6f2b75d7c8e359cacaf21e442363f0875c4739
SHA512 715963a3696f2c2f87ae528733c869dd4692303f8824b358e38e794d2557ecd821eb538efe8bef38aa02df227666cccce370f5e46c889d806cbc77a6ed9a081f
MD5 SHA1 SHA512

Submit Download

uac35gm2.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\uac35gm2\uac35gm2.cmdline
Size 235B
SHA256 85d2c57a6ccbec19334b3e8f8bd76c04e590905eab7cf86da560fe11d9ca80bb
MD5 57aa002d3714cf7c09779db1649801a7
SHA1 83000d883d8145cfb20ffd69ecfc5dba213ca2f8
SHA512 3b72da3c2f172f2874c1259d107c5666920e78006d3a762f7a7a289a6abe54cec3eae57c43deb1ff77f244b385e9dc9b43d699b130717b0b2dc274368173b5ab
MD5 SHA1 SHA512

Submit Download

CSCB309E4F6E86D4F17AAB5ACA22F408C6B.TMP

Path \??\c:\Windows\System32\CSCB309E4F6E86D4F17AAB5ACA22F408C6B.TMP
Size 1KB
SHA256 f9dfbc19eb92450454bfc1d1e3f301a106c6451e167118f8fcd8290706d53dd2
MD5 e1c147672e68922e9738e4d2b1b57d92
SHA1 61065f6505a9053b9453614506fe4f1789965841
SHA512 259c742513f2456cbd7aa2a9a16edb4b02ca14ceed0e1f77d3524234df5cc630b955fb259594c891454c759446bc5cdefb0b625c33616396914fbbff4d605cd5
MD5 SHA1 SHA512

Submit Download

memory/1260-47-0x000001B87DAA0000-0x000001B87DAC2000-memory.dmp

Download

memory/1392-101-0x00000000013D0000-0x00000000013D8000-memory.dmp

Download

memory/1392-110-0x00000000013D0000-0x00000000013D8000-memory.dmp

Download

memory/3224-73-0x0000000002DE0000-0x0000000002DE8000-memory.dmp

Download

memory/3224-63-0x0000000002DE0000-0x0000000002DE8000-memory.dmp

Download

memory/3780-119-0x0000000002B00000-0x0000000002B08000-memory.dmp

Download

memory/3780-128-0x0000000002B00000-0x0000000002B08000-memory.dmp

Download

memory/4112-137-0x000000001AE90000-0x000000001AE98000-memory.dmp

Download

memory/4756-83-0x000000001C230000-0x000000001C238000-memory.dmp

Download

memory/4756-92-0x000000001C230000-0x000000001C238000-memory.dmp

Download

memory/5000-4-0x0000000000A80000-0x0000000000A8E000-memory.dmp

Download

memory/5000-52-0x00007FFC5F120000-0x00007FFC5FBE2000-memory.dmp

Download

memory/5000-0-0x00007FFC5F123000-0x00007FFC5F125000-memory.dmp

Download

memory/5000-2-0x00007FFC5F120000-0x00007FFC5FBE2000-memory.dmp

Download

memory/5000-21-0x00007FFC5F120000-0x00007FFC5FBE2000-memory.dmp

Download

memory/5000-1-0x0000000000200000-0x00000000002D6000-memory.dmp

Download

memory/5000-20-0x00007FFC5F120000-0x00007FFC5FBE2000-memory.dmp

Download

memory/5000-18-0x00007FFC5F120000-0x00007FFC5FBE2000-memory.dmp

Download

memory/5000-13-0x0000000000B30000-0x0000000000B3E000-memory.dmp

Download

memory/5000-17-0x0000000000CC0000-0x0000000000CCC000-memory.dmp

Download

memory/5000-15-0x0000000000B40000-0x0000000000B4C000-memory.dmp

Download

memory/5000-11-0x0000000000B50000-0x0000000000B68000-memory.dmp

Download

memory/5000-8-0x0000000000B00000-0x0000000000B1C000-memory.dmp

Download

memory/5000-9-0x0000000000CD0000-0x0000000000D20000-memory.dmp

Download

memory/5000-7-0x00007FFC5F120000-0x00007FFC5FBE2000-memory.dmp

Download

memory/5000-6-0x0000000000AB0000-0x0000000000ACC000-memory.dmp

Download