dcrat | 249f9bd035685660ae45fc4138334e744c30ce7e1038c140a98529b90c4270c5

Analysis

max time kernel
92s
max time network
143s
platform
windows10-2004_x64
resource
win10v2004-20250314-en
resource tags

arch:x64arch:x86image:win10v2004-20250314-enlocale:en-usos:windows10-2004-x64system
submitted
22/03/2025, 06:17

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

df04d21f8f4edc307cb444b18e8f201c.exe
Size

999KB
MD5

df04d21f8f4edc307cb444b18e8f201c
SHA1

9008920285ae41fe099cbfd11baa15e3909d140f
SHA256

51ef466bd86c5e96bff1611da1f13ec2691923618e9db5c490f6104cb95cd6d1
SHA512

a8e76e398d3de32aef34e3d424d52dd33a073a261958ddc8b6dff62941288aaf359e1d3604de025f021789f2eb70b932cb69f09e4b6aa79e5ff3528d4315c52c
SSDEEP

12288:P9pLLk45WSSY1BX6f4bIS7rMNetPfC9Vs6IFGs0jxAqXj9xPSI0dzNgCoD7WX+Iu:P9pP5WS3lrMNyC9TJPCXBi

Score

10^/10

dcrat infostealer persistence rat

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat
Dcrat family
dcrat

Modifies WinLogon for persistence 2 TTPs 6 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Users\\Public\\csrss.exe\", \"C:\\ProgramData\\regid.1991-06.com.microsoft\\System.exe\", \"C:\\Windows\\addins\\OfficeClickToRun.exe\""	df04d21f8f4edc307cb444b18e8f201c.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Users\\Public\\csrss.exe\", \"C:\\ProgramData\\regid.1991-06.com.microsoft\\System.exe\", \"C:\\Windows\\addins\\OfficeClickToRun.exe\", \"C:\\ProgramData\\Adobe\\Setup\\upfc.exe\""	df04d21f8f4edc307cb444b18e8f201c.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Users\\Public\\csrss.exe\", \"C:\\ProgramData\\regid.1991-06.com.microsoft\\System.exe\", \"C:\\Windows\\addins\\OfficeClickToRun.exe\", \"C:\\ProgramData\\Adobe\\Setup\\upfc.exe\", \"C:\\Program Files\\Windows Multimedia Platform\\wininit.exe\""	df04d21f8f4edc307cb444b18e8f201c.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Users\\Public\\csrss.exe\", \"C:\\ProgramData\\regid.1991-06.com.microsoft\\System.exe\", \"C:\\Windows\\addins\\OfficeClickToRun.exe\", \"C:\\ProgramData\\Adobe\\Setup\\upfc.exe\", \"C:\\Program Files\\Windows Multimedia Platform\\wininit.exe\", \"C:\\Recovery\\WindowsRE\\explorer.exe\""	df04d21f8f4edc307cb444b18e8f201c.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Users\\Public\\csrss.exe\""	df04d21f8f4edc307cb444b18e8f201c.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Users\\Public\\csrss.exe\", \"C:\\ProgramData\\regid.1991-06.com.microsoft\\System.exe\""	df04d21f8f4edc307cb444b18e8f201c.exe

Process spawned unexpected child process 24 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1332	1096	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4496	1096	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	448	1096	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2912	1096	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3092	1096	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2028	1096	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3148	1096	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3680	1096	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3920	1096	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3752	1096	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4164	1096	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4244	1096	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1640	1096	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3484	1096	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4344	1096	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2656	1096	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5108	1096	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1984	1096	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3968	1096	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1164	1096	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2172	1096	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5064	1096	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1532	1096	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3572	1096	schtasks.exe	89

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3218366390-1258052702-4267193707-1000\Control Panel\International\Geo\Nation	df04d21f8f4edc307cb444b18e8f201c.exe

Executes dropped EXE 1 IoCs

pid	Process
1944	explorer.exe

Adds Run key to start application 2 TTPs 6 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\System = "\"C:\\ProgramData\\regid.1991-06.com.microsoft\\System.exe\""	df04d21f8f4edc307cb444b18e8f201c.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OfficeClickToRun = "\"C:\\Windows\\addins\\OfficeClickToRun.exe\""	df04d21f8f4edc307cb444b18e8f201c.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\upfc = "\"C:\\ProgramData\\Adobe\\Setup\\upfc.exe\""	df04d21f8f4edc307cb444b18e8f201c.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\wininit = "\"C:\\Program Files\\Windows Multimedia Platform\\wininit.exe\""	df04d21f8f4edc307cb444b18e8f201c.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\explorer = "\"C:\\Recovery\\WindowsRE\\explorer.exe\""	df04d21f8f4edc307cb444b18e8f201c.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Users\\Public\\csrss.exe\""	df04d21f8f4edc307cb444b18e8f201c.exe

Drops file in Program Files directory 5 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Windows Multimedia Platform\wininit.exe	df04d21f8f4edc307cb444b18e8f201c.exe
File created	C:\Program Files\Windows Multimedia Platform\wininit.exe	df04d21f8f4edc307cb444b18e8f201c.exe
File created	C:\Program Files\Windows Multimedia Platform\56085415360792	df04d21f8f4edc307cb444b18e8f201c.exe
File opened for modification	C:\Program Files\Windows Multimedia Platform\RCXD098.tmp	df04d21f8f4edc307cb444b18e8f201c.exe
File opened for modification	C:\Program Files\Windows Multimedia Platform\RCXD107.tmp	df04d21f8f4edc307cb444b18e8f201c.exe

Drops file in Windows directory 5 IoCs

description	ioc	Process
File opened for modification	C:\Windows\addins\OfficeClickToRun.exe	df04d21f8f4edc307cb444b18e8f201c.exe
File created	C:\Windows\addins\OfficeClickToRun.exe	df04d21f8f4edc307cb444b18e8f201c.exe
File created	C:\Windows\addins\e6c9b481da804f	df04d21f8f4edc307cb444b18e8f201c.exe
File opened for modification	C:\Windows\addins\RCXCBA3.tmp	df04d21f8f4edc307cb444b18e8f201c.exe
File opened for modification	C:\Windows\addins\RCXCC11.tmp	df04d21f8f4edc307cb444b18e8f201c.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3218366390-1258052702-4267193707-1000_Classes\Local Settings	df04d21f8f4edc307cb444b18e8f201c.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 24 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
3920	schtasks.exe
3752	schtasks.exe
3484	schtasks.exe
2656	schtasks.exe
2172	schtasks.exe
1332	schtasks.exe
448	schtasks.exe
1640	schtasks.exe
3968	schtasks.exe
1164	schtasks.exe
1532	schtasks.exe
4496	schtasks.exe
2912	schtasks.exe
3092	schtasks.exe
4244	schtasks.exe
5064	schtasks.exe
2028	schtasks.exe
3680	schtasks.exe
4164	schtasks.exe
4344	schtasks.exe
5108	schtasks.exe
1984	schtasks.exe
3572	schtasks.exe
3148	schtasks.exe

Suspicious behavior: EnumeratesProcesses 5 IoCs

pid	Process
2968	df04d21f8f4edc307cb444b18e8f201c.exe
2968	df04d21f8f4edc307cb444b18e8f201c.exe
2968	df04d21f8f4edc307cb444b18e8f201c.exe
2968	df04d21f8f4edc307cb444b18e8f201c.exe
2968	df04d21f8f4edc307cb444b18e8f201c.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2968	df04d21f8f4edc307cb444b18e8f201c.exe
Token: SeDebugPrivilege	1944	explorer.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2968 wrote to memory of 1564	2968	df04d21f8f4edc307cb444b18e8f201c.exe	117
PID 2968 wrote to memory of 1564	2968	df04d21f8f4edc307cb444b18e8f201c.exe	117
PID 1564 wrote to memory of 2160	1564	cmd.exe	119
PID 1564 wrote to memory of 2160	1564	cmd.exe	119
PID 1564 wrote to memory of 1944	1564	cmd.exe	122
PID 1564 wrote to memory of 1944	1564	cmd.exe	122

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\df04d21f8f4edc307cb444b18e8f201c.exe
"C:\Users\Admin\AppData\Local\Temp\df04d21f8f4edc307cb444b18e8f201c.exe"
1⤵
- Modifies WinLogon for persistence
- Checks computer location settings
- Adds Run key to start application
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2968
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\zlnKig63Gd.bat"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1564
- - C:\Windows\system32\w32tm.exe
    w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
    3⤵
    PID:2160
- - C:\Recovery\WindowsRE\explorer.exe
    "C:\Recovery\WindowsRE\explorer.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of AdjustPrivilegeToken
    PID:1944

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc MINUTE /mo 8 /tr "'C:\Users\Public\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1332

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Users\Public\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4496

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONSTART /tr "'C:\Users\Public\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:448

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 10 /tr "'C:\Users\Public\csrss.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2912

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "System" /sc MINUTE /mo 8 /tr "'C:\ProgramData\regid.1991-06.com.microsoft\System.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3092

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "System" /sc ONLOGON /tr "'C:\ProgramData\regid.1991-06.com.microsoft\System.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2028

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "System" /sc ONSTART /tr "'C:\ProgramData\regid.1991-06.com.microsoft\System.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3680

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 8 /tr "'C:\ProgramData\regid.1991-06.com.microsoft\System.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3148

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OfficeClickToRun" /sc MINUTE /mo 8 /tr "'C:\Windows\addins\OfficeClickToRun.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3920

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OfficeClickToRun" /sc ONLOGON /tr "'C:\Windows\addins\OfficeClickToRun.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4164

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OfficeClickToRun" /sc ONSTART /tr "'C:\Windows\addins\OfficeClickToRun.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3752

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OfficeClickToRunO" /sc MINUTE /mo 9 /tr "'C:\Windows\addins\OfficeClickToRun.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4344

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "upfc" /sc MINUTE /mo 8 /tr "'C:\ProgramData\Adobe\Setup\upfc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4244

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "upfc" /sc ONLOGON /tr "'C:\ProgramData\Adobe\Setup\upfc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3484

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "upfc" /sc ONSTART /tr "'C:\ProgramData\Adobe\Setup\upfc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1640

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "upfcu" /sc MINUTE /mo 13 /tr "'C:\ProgramData\Adobe\Setup\upfc.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2656

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininit" /sc MINUTE /mo 11 /tr "'C:\Program Files\Windows Multimedia Platform\wininit.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5108

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininit" /sc ONLOGON /tr "'C:\Program Files\Windows Multimedia Platform\wininit.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1984

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininit" /sc ONSTART /tr "'C:\Program Files\Windows Multimedia Platform\wininit.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1164

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 8 /tr "'C:\Program Files\Windows Multimedia Platform\wininit.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3968

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorer" /sc MINUTE /mo 5 /tr "'C:\Recovery\WindowsRE\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3572

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorer" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2172

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorer" /sc ONSTART /tr "'C:\Recovery\WindowsRE\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1532

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 12 /tr "'C:\Recovery\WindowsRE\explorer.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5064

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\Windows Multimedia Platform\wininit.exe

Filesize
999KB

MD5
d5bf1771334a06acd9de1400c445610e

SHA1
ff9c5c2f338ed17474a72a4fa52300d7cb22a2ac

SHA256
722450e834f17bcef317660027a9cbc9d493218278c17a795a0d90dc8b5e69f5

SHA512
bdb058d5119cb5fa5d66ff6b0a3dd3086365cbab0fde2ad4200ce7afa3e13aff35b3a7b25bbf4e0c9fdfea557ef64dd13936f055fa6d4b718729a71e990309f0

Download Submit
C:\Program Files\Windows Multimedia Platform\wininit.exe

Filesize
999KB

MD5
df04d21f8f4edc307cb444b18e8f201c

SHA1
9008920285ae41fe099cbfd11baa15e3909d140f

SHA256
51ef466bd86c5e96bff1611da1f13ec2691923618e9db5c490f6104cb95cd6d1

SHA512
a8e76e398d3de32aef34e3d424d52dd33a073a261958ddc8b6dff62941288aaf359e1d3604de025f021789f2eb70b932cb69f09e4b6aa79e5ff3528d4315c52c

Download Submit
C:\ProgramData\Adobe\Setup\upfc.exe

Filesize
999KB

MD5
ba63e66f08cf35f7694afcf680637db0

SHA1
08110284cb5fc216182d2404f35aa2dc6f9dd5ba

SHA256
987a5878d10a55ec6bcd30159cdcdce833371fdcda589879b7383a3575a6d346

SHA512
44b33b3d3a5953b9675c92f4749ceb0a71969a6fc8b84ed3ab103222ed2ab870bfcdeec3e598f226fc828e608d0b59eb08d17bce796602e6f9f02fb3da9a4a11

Download Submit
C:\Users\Admin\AppData\Local\Temp\zlnKig63Gd.bat

Filesize
198B

MD5
a86c55747fb186ada1b5759a2db79440

SHA1
fec77140dae8c4d30b00a4a66ade529793e81ab0

SHA256
5d235b5fc4276e48f14897b65a086f2e6d4b654833de583c3da1e84f82658eb2

SHA512
caee691b786564f613a26b3e5e32a8040c9c08b38c79ed31b2ab18750644e4dd083e4e898be4fea4f76f0800202d2a6c9bb58442bab6b3e45cb68351b033b113

Download Submit
C:\Windows\addins\OfficeClickToRun.exe

Filesize
999KB

MD5
b35862be2a9a0e1c499708dd1741a043

SHA1
189ea29e9c1541978b6519c70cc0ce18adc48c85

SHA256
de4dd8f5f37727da922b73929fc2c0b290644a3aeb58dc26918248b55d439898

SHA512
0001aa47460b5fb3155e4c35b1ef52f7686266f9c9363574a0da996c7322e4e10251484d5679b52147155fe1648bcc76e09ec599e77b60f54247d8c5bb8e1f74

Download Submit
memory/2968-4-0x000000001BA80000-0x000000001BAD0000-memory.dmp

Filesize
320KB

Download
memory/2968-7-0x000000001BA40000-0x000000001BA50000-memory.dmp

Filesize
64KB

Download
memory/2968-6-0x000000001BA30000-0x000000001BA40000-memory.dmp

Filesize
64KB

Download
memory/2968-8-0x000000001BA50000-0x000000001BA5C000-memory.dmp

Filesize
48KB

Download
memory/2968-9-0x000000001BA60000-0x000000001BA6E000-memory.dmp

Filesize
56KB

Download
memory/2968-10-0x000000001BA70000-0x000000001BA7C000-memory.dmp

Filesize
48KB

Download
memory/2968-11-0x000000001BAD0000-0x000000001BADC000-memory.dmp

Filesize
48KB

Download
memory/2968-3-0x00000000030F0000-0x000000000310C000-memory.dmp

Filesize
112KB

Download
memory/2968-0-0x00007FFBB5123000-0x00007FFBB5125000-memory.dmp

Filesize
8KB

Download
memory/2968-5-0x0000000002FD0000-0x0000000002FE0000-memory.dmp

Filesize
64KB

Download
memory/2968-2-0x00007FFBB5120000-0x00007FFBB5BE1000-memory.dmp

Filesize
10.8MB

Download
memory/2968-1-0x0000000000E20000-0x0000000000F20000-memory.dmp

Filesize
1024KB

Download
memory/2968-104-0x00007FFBB5120000-0x00007FFBB5BE1000-memory.dmp

Filesize
10.8MB

Download