dcrat | 7e71c79883eb025596762b4e0bf86b447039079dfe510ccf13a383b612575fa6

Analysis

max time kernel
102s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20250314-en
resource tags

arch:x64arch:x86image:win10v2004-20250314-enlocale:en-usos:windows10-2004-x64system
submitted
22/03/2025, 06:25

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3d81f411b0ec1ac7d861358e145db4ba.exe
Size

999KB
MD5

3d81f411b0ec1ac7d861358e145db4ba
SHA1

4b945e693bc455840912fc5b5f155c36501d235e
SHA256

72b49e4d9aa54af40111e35d0d4bcb4a7a313c4f2f5c5f33c3b7a093b7f4fc0e
SHA512

216c654e895ec5065b7d724f5421184e2a3445f4b801f0ebcc3ce34676e2d89240f22af079fd7a7d074af3567ee483ebe2f6b40bfea224956ff00f5d326894fe
SSDEEP

12288:H9pLLk45WSSY1BX6f4bIS7rMNetPfC9Vs6IFGs0jxAqXj9xPSI0dzNgCoD7WX+Iu:H9pP5WS3lrMNyC9TJPCXBi

Score

10^/10

dcrat infostealer persistence rat

Malware Config

Signatures

DcRat 49 IoCs

DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

rat infostealer dcrat

description	ioc	pid	Process
		3588	schtasks.exe
		1524	schtasks.exe
		5880	schtasks.exe
		4756	schtasks.exe
		4752	schtasks.exe
		5048	schtasks.exe
		4692	schtasks.exe
		4628	schtasks.exe
		1964	schtasks.exe
		4192	schtasks.exe
		3488	schtasks.exe
		4492	schtasks.exe
		1428	schtasks.exe
		3736	schtasks.exe
		5292	schtasks.exe
		5112	schtasks.exe
		2484	schtasks.exe
		5188	schtasks.exe
		3524	schtasks.exe
		864	schtasks.exe
		4892	schtasks.exe
		4764	schtasks.exe
		5192	schtasks.exe
		468	schtasks.exe
		4380	schtasks.exe
		5768	schtasks.exe
		3460	schtasks.exe
		2828	schtasks.exe
File created	C:\Program Files\WindowsPowerShell\Modules\PSReadline\2.0.0\en\66fc9ff0ee96c2		3d81f411b0ec1ac7d861358e145db4ba.exe
		5724	schtasks.exe
		2852	schtasks.exe
		4528	schtasks.exe
		2448	schtasks.exe
		1900	schtasks.exe
		5232	schtasks.exe
		848	schtasks.exe
		2636	schtasks.exe
		5352	schtasks.exe
		3892	schtasks.exe
		5568	schtasks.exe
		3276	schtasks.exe
		5560	schtasks.exe
		4664	schtasks.exe
		4612	schtasks.exe
		4196	schtasks.exe
		4136	schtasks.exe
		3656	schtasks.exe
		4828	schtasks.exe
		5728	schtasks.exe

Dcrat family
dcrat

Modifies WinLogon for persistence 2 TTPs 12 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files\\WindowsPowerShell\\Modules\\PSReadline\\2.0.0\\en\\sihost.exe\", \"C:\\ProgramData\\Adobe\\Setup\\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\\System.exe\""	3d81f411b0ec1ac7d861358e145db4ba.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files\\WindowsPowerShell\\Modules\\PSReadline\\2.0.0\\en\\sihost.exe\", \"C:\\ProgramData\\Adobe\\Setup\\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\\System.exe\", \"C:\\60739cf6f660743813\\services.exe\", \"C:\\900323d723f1dd1206\\csrss.exe\""	3d81f411b0ec1ac7d861358e145db4ba.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files\\WindowsPowerShell\\Modules\\PSReadline\\2.0.0\\en\\sihost.exe\", \"C:\\ProgramData\\Adobe\\Setup\\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\\System.exe\", \"C:\\60739cf6f660743813\\services.exe\", \"C:\\900323d723f1dd1206\\csrss.exe\", \"C:\\900323d723f1dd1206\\sysmon.exe\""	3d81f411b0ec1ac7d861358e145db4ba.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files\\WindowsPowerShell\\Modules\\PSReadline\\2.0.0\\en\\sihost.exe\", \"C:\\ProgramData\\Adobe\\Setup\\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\\System.exe\", \"C:\\60739cf6f660743813\\services.exe\", \"C:\\900323d723f1dd1206\\csrss.exe\", \"C:\\900323d723f1dd1206\\sysmon.exe\", \"C:\\ProgramData\\Start Menu\\OfficeClickToRun.exe\""	3d81f411b0ec1ac7d861358e145db4ba.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files\\WindowsPowerShell\\Modules\\PSReadline\\2.0.0\\en\\sihost.exe\", \"C:\\ProgramData\\Adobe\\Setup\\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\\System.exe\", \"C:\\60739cf6f660743813\\services.exe\", \"C:\\900323d723f1dd1206\\csrss.exe\", \"C:\\900323d723f1dd1206\\sysmon.exe\", \"C:\\ProgramData\\Start Menu\\OfficeClickToRun.exe\", \"C:\\Users\\Public\\Music\\csrss.exe\", \"C:\\Program Files\\Uninstall Information\\csrss.exe\""	3d81f411b0ec1ac7d861358e145db4ba.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files\\WindowsPowerShell\\Modules\\PSReadline\\2.0.0\\en\\sihost.exe\", \"C:\\ProgramData\\Adobe\\Setup\\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\\System.exe\", \"C:\\60739cf6f660743813\\services.exe\", \"C:\\900323d723f1dd1206\\csrss.exe\", \"C:\\900323d723f1dd1206\\sysmon.exe\", \"C:\\ProgramData\\Start Menu\\OfficeClickToRun.exe\", \"C:\\Users\\Public\\Music\\csrss.exe\", \"C:\\Program Files\\Uninstall Information\\csrss.exe\", \"C:\\Recovery\\WindowsRE\\OfficeClickToRun.exe\""	3d81f411b0ec1ac7d861358e145db4ba.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files\\WindowsPowerShell\\Modules\\PSReadline\\2.0.0\\en\\sihost.exe\", \"C:\\ProgramData\\Adobe\\Setup\\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\\System.exe\", \"C:\\60739cf6f660743813\\services.exe\", \"C:\\900323d723f1dd1206\\csrss.exe\", \"C:\\900323d723f1dd1206\\sysmon.exe\", \"C:\\ProgramData\\Start Menu\\OfficeClickToRun.exe\", \"C:\\Users\\Public\\Music\\csrss.exe\", \"C:\\Program Files\\Uninstall Information\\csrss.exe\", \"C:\\Recovery\\WindowsRE\\OfficeClickToRun.exe\", \"C:\\Users\\Default User\\OfficeClickToRun.exe\", \"C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\RuntimeBroker.exe\", \"C:\\Recovery\\WindowsRE\\unsecapp.exe\""	3d81f411b0ec1ac7d861358e145db4ba.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files\\WindowsPowerShell\\Modules\\PSReadline\\2.0.0\\en\\sihost.exe\", \"C:\\ProgramData\\Adobe\\Setup\\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\\System.exe\", \"C:\\60739cf6f660743813\\services.exe\""	3d81f411b0ec1ac7d861358e145db4ba.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files\\WindowsPowerShell\\Modules\\PSReadline\\2.0.0\\en\\sihost.exe\", \"C:\\ProgramData\\Adobe\\Setup\\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\\System.exe\", \"C:\\60739cf6f660743813\\services.exe\", \"C:\\900323d723f1dd1206\\csrss.exe\", \"C:\\900323d723f1dd1206\\sysmon.exe\", \"C:\\ProgramData\\Start Menu\\OfficeClickToRun.exe\", \"C:\\Users\\Public\\Music\\csrss.exe\""	3d81f411b0ec1ac7d861358e145db4ba.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files\\WindowsPowerShell\\Modules\\PSReadline\\2.0.0\\en\\sihost.exe\", \"C:\\ProgramData\\Adobe\\Setup\\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\\System.exe\", \"C:\\60739cf6f660743813\\services.exe\", \"C:\\900323d723f1dd1206\\csrss.exe\", \"C:\\900323d723f1dd1206\\sysmon.exe\", \"C:\\ProgramData\\Start Menu\\OfficeClickToRun.exe\", \"C:\\Users\\Public\\Music\\csrss.exe\", \"C:\\Program Files\\Uninstall Information\\csrss.exe\", \"C:\\Recovery\\WindowsRE\\OfficeClickToRun.exe\", \"C:\\Users\\Default User\\OfficeClickToRun.exe\""	3d81f411b0ec1ac7d861358e145db4ba.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files\\WindowsPowerShell\\Modules\\PSReadline\\2.0.0\\en\\sihost.exe\", \"C:\\ProgramData\\Adobe\\Setup\\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\\System.exe\", \"C:\\60739cf6f660743813\\services.exe\", \"C:\\900323d723f1dd1206\\csrss.exe\", \"C:\\900323d723f1dd1206\\sysmon.exe\", \"C:\\ProgramData\\Start Menu\\OfficeClickToRun.exe\", \"C:\\Users\\Public\\Music\\csrss.exe\", \"C:\\Program Files\\Uninstall Information\\csrss.exe\", \"C:\\Recovery\\WindowsRE\\OfficeClickToRun.exe\", \"C:\\Users\\Default User\\OfficeClickToRun.exe\", \"C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\RuntimeBroker.exe\""	3d81f411b0ec1ac7d861358e145db4ba.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files\\WindowsPowerShell\\Modules\\PSReadline\\2.0.0\\en\\sihost.exe\""	3d81f411b0ec1ac7d861358e145db4ba.exe

Process spawned unexpected child process 48 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4752	4584	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4612	4584	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4492	4584	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2828	4584	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5048	4584	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4628	4584	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4692	4584	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4756	4584	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	864	4584	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4664	4584	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4892	4584	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4764	4584	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1964	4584	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	848	4584	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4192	4584	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3488	4584	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5568	4584	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1428	4584	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3736	4584	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5292	4584	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5112	4584	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4196	4584	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5192	4584	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5724	4584	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4136	4584	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3656	4584	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2484	4584	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4828	4584	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5728	4584	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	468	4584	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2636	4584	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5188	4584	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2852	4584	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3524	4584	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4528	4584	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3276	4584	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1524	4584	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3588	4584	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2448	4584	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4380	4584	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5560	4584	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5768	4584	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3460	4584	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1900	4584	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5232	4584	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5880	4584	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5352	4584	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3892	4584	schtasks.exe	87

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1062200478-553497403-3857448183-1000\Control Panel\International\Geo\Nation	3d81f411b0ec1ac7d861358e145db4ba.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1062200478-553497403-3857448183-1000\Control Panel\International\Geo\Nation	3d81f411b0ec1ac7d861358e145db4ba.exe

Executes dropped EXE 2 IoCs

pid	Process
808	3d81f411b0ec1ac7d861358e145db4ba.exe
1672	OfficeClickToRun.exe

Adds Run key to start application 2 TTPs 12 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sihost = "\"C:\\Program Files\\WindowsPowerShell\\Modules\\PSReadline\\2.0.0\\en\\sihost.exe\""	3d81f411b0ec1ac7d861358e145db4ba.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\services = "\"C:\\60739cf6f660743813\\services.exe\""	3d81f411b0ec1ac7d861358e145db4ba.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\900323d723f1dd1206\\csrss.exe\""	3d81f411b0ec1ac7d861358e145db4ba.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sysmon = "\"C:\\900323d723f1dd1206\\sysmon.exe\""	3d81f411b0ec1ac7d861358e145db4ba.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OfficeClickToRun = "\"C:\\ProgramData\\Start Menu\\OfficeClickToRun.exe\""	3d81f411b0ec1ac7d861358e145db4ba.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Users\\Public\\Music\\csrss.exe\""	3d81f411b0ec1ac7d861358e145db4ba.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OfficeClickToRun = "\"C:\\Users\\Default User\\OfficeClickToRun.exe\""	3d81f411b0ec1ac7d861358e145db4ba.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\unsecapp = "\"C:\\Recovery\\WindowsRE\\unsecapp.exe\""	3d81f411b0ec1ac7d861358e145db4ba.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\System = "\"C:\\ProgramData\\Adobe\\Setup\\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\\System.exe\""	3d81f411b0ec1ac7d861358e145db4ba.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Program Files\\Uninstall Information\\csrss.exe\""	3d81f411b0ec1ac7d861358e145db4ba.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OfficeClickToRun = "\"C:\\Recovery\\WindowsRE\\OfficeClickToRun.exe\""	3d81f411b0ec1ac7d861358e145db4ba.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RuntimeBroker = "\"C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\RuntimeBroker.exe\""	3d81f411b0ec1ac7d861358e145db4ba.exe

Drops file in Program Files directory 11 IoCs

description	ioc	Process
File created	C:\Program Files\WindowsPowerShell\Modules\PSReadline\2.0.0\en\sihost.exe	3d81f411b0ec1ac7d861358e145db4ba.exe
File opened for modification	C:\Program Files\WindowsPowerShell\Modules\PSReadline\2.0.0\en\sihost.exe	3d81f411b0ec1ac7d861358e145db4ba.exe
File created	C:\Program Files\Uninstall Information\886983d96e3d3e	3d81f411b0ec1ac7d861358e145db4ba.exe
File created	C:\Program Files (x86)\WindowsPowerShell\Modules\RuntimeBroker.exe	3d81f411b0ec1ac7d861358e145db4ba.exe
File created	C:\Program Files (x86)\WindowsPowerShell\Modules\9e8d7a4ca61bd9	3d81f411b0ec1ac7d861358e145db4ba.exe
File opened for modification	C:\Program Files\Uninstall Information\csrss.exe	3d81f411b0ec1ac7d861358e145db4ba.exe
File created	C:\Program Files\WindowsPowerShell\Modules\PSReadline\2.0.0\en\66fc9ff0ee96c2	3d81f411b0ec1ac7d861358e145db4ba.exe
File opened for modification	C:\Program Files\WindowsPowerShell\Modules\PSReadline\2.0.0\en\RCX5A95.tmp	3d81f411b0ec1ac7d861358e145db4ba.exe
File opened for modification	C:\Program Files\WindowsPowerShell\Modules\PSReadline\2.0.0\en\RCX5A96.tmp	3d81f411b0ec1ac7d861358e145db4ba.exe
File created	C:\Program Files\Uninstall Information\csrss.exe	3d81f411b0ec1ac7d861358e145db4ba.exe
File opened for modification	C:\Program Files (x86)\WindowsPowerShell\Modules\RuntimeBroker.exe	3d81f411b0ec1ac7d861358e145db4ba.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1062200478-553497403-3857448183-1000_Classes\Local Settings	3d81f411b0ec1ac7d861358e145db4ba.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 48 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
3524	schtasks.exe
3588	schtasks.exe
1900	schtasks.exe
4612	schtasks.exe
4492	schtasks.exe
848	schtasks.exe
4192	schtasks.exe
2484	schtasks.exe
2636	schtasks.exe
5188	schtasks.exe
4528	schtasks.exe
5048	schtasks.exe
4664	schtasks.exe
4892	schtasks.exe
4136	schtasks.exe
1524	schtasks.exe
4380	schtasks.exe
5560	schtasks.exe
5352	schtasks.exe
4692	schtasks.exe
4756	schtasks.exe
5192	schtasks.exe
2448	schtasks.exe
4752	schtasks.exe
5568	schtasks.exe
3656	schtasks.exe
468	schtasks.exe
5880	schtasks.exe
1964	schtasks.exe
1428	schtasks.exe
5112	schtasks.exe
4828	schtasks.exe
5728	schtasks.exe
2852	schtasks.exe
5768	schtasks.exe
5232	schtasks.exe
3736	schtasks.exe
4196	schtasks.exe
5724	schtasks.exe
3892	schtasks.exe
2828	schtasks.exe
4628	schtasks.exe
864	schtasks.exe
4764	schtasks.exe
3488	schtasks.exe
5292	schtasks.exe
3276	schtasks.exe
3460	schtasks.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
388	3d81f411b0ec1ac7d861358e145db4ba.exe
388	3d81f411b0ec1ac7d861358e145db4ba.exe
388	3d81f411b0ec1ac7d861358e145db4ba.exe
388	3d81f411b0ec1ac7d861358e145db4ba.exe
388	3d81f411b0ec1ac7d861358e145db4ba.exe
388	3d81f411b0ec1ac7d861358e145db4ba.exe
388	3d81f411b0ec1ac7d861358e145db4ba.exe
388	3d81f411b0ec1ac7d861358e145db4ba.exe
388	3d81f411b0ec1ac7d861358e145db4ba.exe
388	3d81f411b0ec1ac7d861358e145db4ba.exe
388	3d81f411b0ec1ac7d861358e145db4ba.exe
808	3d81f411b0ec1ac7d861358e145db4ba.exe
808	3d81f411b0ec1ac7d861358e145db4ba.exe
808	3d81f411b0ec1ac7d861358e145db4ba.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	388	3d81f411b0ec1ac7d861358e145db4ba.exe
Token: SeDebugPrivilege	808	3d81f411b0ec1ac7d861358e145db4ba.exe
Token: SeDebugPrivilege	1672	OfficeClickToRun.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 388 wrote to memory of 808	388	3d81f411b0ec1ac7d861358e145db4ba.exe	100
PID 388 wrote to memory of 808	388	3d81f411b0ec1ac7d861358e145db4ba.exe	100
PID 808 wrote to memory of 1648	808	3d81f411b0ec1ac7d861358e145db4ba.exe	140
PID 808 wrote to memory of 1648	808	3d81f411b0ec1ac7d861358e145db4ba.exe	140
PID 1648 wrote to memory of 3356	1648	cmd.exe	142
PID 1648 wrote to memory of 3356	1648	cmd.exe	142
PID 1648 wrote to memory of 1672	1648	cmd.exe	144
PID 1648 wrote to memory of 1672	1648	cmd.exe	144

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\3d81f411b0ec1ac7d861358e145db4ba.exe
"C:\Users\Admin\AppData\Local\Temp\3d81f411b0ec1ac7d861358e145db4ba.exe"
1⤵
- DcRat
- Modifies WinLogon for persistence
- Checks computer location settings
- Adds Run key to start application
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:388
- C:\Users\Admin\AppData\Local\Temp\3d81f411b0ec1ac7d861358e145db4ba.exe
  "C:\Users\Admin\AppData\Local\Temp\3d81f411b0ec1ac7d861358e145db4ba.exe"
  2⤵
  - Modifies WinLogon for persistence
  - Checks computer location settings
  - Executes dropped EXE
  - Adds Run key to start application
  - Drops file in Program Files directory
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:808
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\9iMPvVJ4No.bat"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1648
  - - C:\Windows\system32\w32tm.exe
      w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
      4⤵
      PID:3356
  - - C:\ProgramData\Start Menu\OfficeClickToRun.exe
      "C:\ProgramData\Start Menu\OfficeClickToRun.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of AdjustPrivilegeToken
      PID:1672

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sihost" /sc MINUTE /mo 13 /tr "'C:\Program Files\WindowsPowerShell\Modules\PSReadline\2.0.0\en\sihost.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4752

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sihost" /sc ONLOGON /tr "'C:\Program Files\WindowsPowerShell\Modules\PSReadline\2.0.0\en\sihost.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4612

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sihost" /sc ONSTART /tr "'C:\Program Files\WindowsPowerShell\Modules\PSReadline\2.0.0\en\sihost.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4492

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sihosts" /sc MINUTE /mo 6 /tr "'C:\Program Files\WindowsPowerShell\Modules\PSReadline\2.0.0\en\sihost.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2828

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "System" /sc MINUTE /mo 9 /tr "'C:\ProgramData\Adobe\Setup\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\System.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5048

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "System" /sc ONLOGON /tr "'C:\ProgramData\Adobe\Setup\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\System.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4628

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "System" /sc ONSTART /tr "'C:\ProgramData\Adobe\Setup\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\System.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4692

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 12 /tr "'C:\ProgramData\Adobe\Setup\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\System.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4756

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "services" /sc MINUTE /mo 10 /tr "'C:\60739cf6f660743813\services.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:864

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "services" /sc ONLOGON /tr "'C:\60739cf6f660743813\services.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4764

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "services" /sc ONSTART /tr "'C:\60739cf6f660743813\services.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4892

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 8 /tr "'C:\60739cf6f660743813\services.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4664

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc MINUTE /mo 6 /tr "'C:\900323d723f1dd1206\csrss.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1964

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\900323d723f1dd1206\csrss.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:848

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONSTART /tr "'C:\900323d723f1dd1206\csrss.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4192

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 12 /tr "'C:\900323d723f1dd1206\csrss.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3488

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sysmon" /sc MINUTE /mo 9 /tr "'C:\900323d723f1dd1206\sysmon.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5568

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sysmon" /sc ONLOGON /tr "'C:\900323d723f1dd1206\sysmon.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1428

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sysmon" /sc ONSTART /tr "'C:\900323d723f1dd1206\sysmon.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3736

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sysmons" /sc MINUTE /mo 7 /tr "'C:\900323d723f1dd1206\sysmon.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5292

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OfficeClickToRun" /sc MINUTE /mo 8 /tr "'C:\ProgramData\Start Menu\OfficeClickToRun.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4196

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OfficeClickToRun" /sc ONLOGON /tr "'C:\ProgramData\Start Menu\OfficeClickToRun.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5112

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OfficeClickToRun" /sc ONSTART /tr "'C:\ProgramData\Start Menu\OfficeClickToRun.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5192

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OfficeClickToRunO" /sc MINUTE /mo 13 /tr "'C:\ProgramData\Start Menu\OfficeClickToRun.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5724

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc MINUTE /mo 13 /tr "'C:\Users\Public\Music\csrss.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3276

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Users\Public\Music\csrss.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4528

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONSTART /tr "'C:\Users\Public\Music\csrss.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4136

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 6 /tr "'C:\Users\Public\Music\csrss.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3656

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc MINUTE /mo 9 /tr "'C:\Program Files\Uninstall Information\csrss.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3524

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Program Files\Uninstall Information\csrss.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2852

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONSTART /tr "'C:\Program Files\Uninstall Information\csrss.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5188

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 7 /tr "'C:\Program Files\Uninstall Information\csrss.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4828

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OfficeClickToRun" /sc MINUTE /mo 9 /tr "'C:\Recovery\WindowsRE\OfficeClickToRun.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2484

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OfficeClickToRun" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\OfficeClickToRun.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2636

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OfficeClickToRun" /sc ONSTART /tr "'C:\Recovery\WindowsRE\OfficeClickToRun.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:468

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OfficeClickToRunO" /sc MINUTE /mo 8 /tr "'C:\Recovery\WindowsRE\OfficeClickToRun.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5728

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OfficeClickToRun" /sc MINUTE /mo 8 /tr "'C:\Users\Default User\OfficeClickToRun.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1524

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OfficeClickToRun" /sc ONLOGON /tr "'C:\Users\Default User\OfficeClickToRun.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3588

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OfficeClickToRun" /sc ONSTART /tr "'C:\Users\Default User\OfficeClickToRun.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2448

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OfficeClickToRunO" /sc MINUTE /mo 11 /tr "'C:\Users\Default User\OfficeClickToRun.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4380

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc MINUTE /mo 7 /tr "'C:\Program Files (x86)\WindowsPowerShell\Modules\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1900

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Program Files (x86)\WindowsPowerShell\Modules\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3460

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONSTART /tr "'C:\Program Files (x86)\WindowsPowerShell\Modules\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5560

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 9 /tr "'C:\Program Files (x86)\WindowsPowerShell\Modules\RuntimeBroker.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5768

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "unsecapp" /sc MINUTE /mo 8 /tr "'C:\Recovery\WindowsRE\unsecapp.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5352

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "unsecapp" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\unsecapp.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5880

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "unsecapp" /sc ONSTART /tr "'C:\Recovery\WindowsRE\unsecapp.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5232

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "unsecappu" /sc MINUTE /mo 10 /tr "'C:\Recovery\WindowsRE\unsecapp.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3892

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\3d81f411b0ec1ac7d861358e145db4ba.exe.log

Filesize
1KB

MD5
7800fca2323a4130444c572374a030f4

SHA1
40c9b8e0e5e7d72a5293f4010f2ccf21e637b4aa

SHA256
29f5645ac14353ac460858f52c856548f3aeb144b09eef672a6b4849bafe742e

SHA512
c8a7ad930b8c07007c7a67d8c32a2a4a401dcc34ab966e0e80901655fcbe1f5c95b72a195e6381b1de56c2c987eeab093d8e89891bec9e9684785c5d824b3554

Download Submit
C:\Users\Admin\AppData\Local\Temp\9iMPvVJ4No.bat

Filesize
210B

MD5
1f6b8c015b36076af8cbabd2f2a2ae84

SHA1
079f9824db211f5fdb3664d08cbe739282144bd6

SHA256
113370e893038c91cd6ed0c11ec4ddde5c741211ca3ac9a5a083009d385a7b9e

SHA512
e6d9bef533bc004167f69013f07f46dd78b20c5e12da8afceed748a7478961c9000b039eb985df8a2db92be1b7107845eac120ebaa8803b4c467ef7bd40c0f67

Download Submit
C:\Users\Admin\AppData\Local\Temp\RCX5881.tmp

Filesize
999KB

MD5
3d81f411b0ec1ac7d861358e145db4ba

SHA1
4b945e693bc455840912fc5b5f155c36501d235e

SHA256
72b49e4d9aa54af40111e35d0d4bcb4a7a313c4f2f5c5f33c3b7a093b7f4fc0e

SHA512
216c654e895ec5065b7d724f5421184e2a3445f4b801f0ebcc3ce34676e2d89240f22af079fd7a7d074af3567ee483ebe2f6b40bfea224956ff00f5d326894fe

Download Submit
memory/388-5-0x0000000001490000-0x00000000014A0000-memory.dmp

Filesize
64KB

Download
memory/388-0-0x00007FFB5DEF3000-0x00007FFB5DEF5000-memory.dmp

Filesize
8KB

Download
memory/388-7-0x0000000001660000-0x0000000001670000-memory.dmp

Filesize
64KB

Download
memory/388-9-0x0000000002F50000-0x0000000002F5E000-memory.dmp

Filesize
56KB

Download
memory/388-11-0x0000000002F70000-0x0000000002F7C000-memory.dmp

Filesize
48KB

Download
memory/388-10-0x0000000002F60000-0x0000000002F6C000-memory.dmp

Filesize
48KB

Download
memory/388-8-0x0000000002F40000-0x0000000002F4C000-memory.dmp

Filesize
48KB

Download
memory/388-6-0x00000000014B0000-0x00000000014C0000-memory.dmp

Filesize
64KB

Download
memory/388-4-0x0000000002F90000-0x0000000002FE0000-memory.dmp

Filesize
320KB

Download
memory/388-3-0x0000000002F20000-0x0000000002F3C000-memory.dmp

Filesize
112KB

Download
memory/388-2-0x00007FFB5DEF0000-0x00007FFB5E9B1000-memory.dmp

Filesize
10.8MB

Download
memory/388-62-0x00007FFB5DEF0000-0x00007FFB5E9B1000-memory.dmp

Filesize
10.8MB

Download
memory/388-1-0x0000000000BF0000-0x0000000000CF0000-memory.dmp

Filesize
1024KB

Download