dcrat | 01ffe9d6f323a1dafd7dbe75338596cb03cdbe970cdc964543ae03006c1ece85

Analysis

max time kernel
58s
max time network
65s
platform
windows10-2004_x64
resource
win10v2004-20250314-en
resource tags

arch:x64arch:x86image:win10v2004-20250314-enlocale:en-usos:windows10-2004-x64system
submitted
22/03/2025, 19:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1f824bf7c73eeef309d3a30fff4e924f91870de0fc5990adc2d0a1a42284f567.exe
Size

1.6MB
MD5

2c4dbe075f37719580a096bf67bf048e
SHA1

71673f7af94683985e875f3db73cbf1a5509228e
SHA256

1f824bf7c73eeef309d3a30fff4e924f91870de0fc5990adc2d0a1a42284f567
SHA512

6d5bed3e46aa8e02d678c0a3f1ff6be56b776980af341e9ef84d9febaad843dfa2df28083ff6d8dcad9e74d4724ee1f09190b093c9bb3d1cb78068ca219d3c70
SSDEEP

24576:6sm8JijftfWIqZpyh/X6bSmV2GKz1oncoiF9GFwUvpHk3tSfEybcswrJ4gOEGEk:6D8Jijt+xpS/ekYmLGdhEAf7bCcjE

Score

10^/10

dcrat execution infostealer rat

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat
Dcrat family
dcrat

Process spawned unexpected child process 6 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2788	4008	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3028	4008	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1544	4008	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3232	4008	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4572	4008	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5040	4008	schtasks.exe	88

DCRat payload 3 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral26/memory/3652-1-0x0000000000220000-0x00000000003C2000-memory.dmp	dcrat
behavioral26/files/0x0013000000023f42-28.dat	dcrat
behavioral26/files/0x000a0000000240dd-47.dat	dcrat

Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
2472	powershell.exe
2752	powershell.exe
4748	powershell.exe

Checks computer location settings 2 TTPs 6 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-869607583-2483572573-2297019986-1000\Control Panel\International\Geo\Nation	taskhostw.exe
Key value queried	\REGISTRY\USER\S-1-5-21-869607583-2483572573-2297019986-1000\Control Panel\International\Geo\Nation	1f824bf7c73eeef309d3a30fff4e924f91870de0fc5990adc2d0a1a42284f567.exe
Key value queried	\REGISTRY\USER\S-1-5-21-869607583-2483572573-2297019986-1000\Control Panel\International\Geo\Nation	taskhostw.exe
Key value queried	\REGISTRY\USER\S-1-5-21-869607583-2483572573-2297019986-1000\Control Panel\International\Geo\Nation	taskhostw.exe
Key value queried	\REGISTRY\USER\S-1-5-21-869607583-2483572573-2297019986-1000\Control Panel\International\Geo\Nation	taskhostw.exe
Key value queried	\REGISTRY\USER\S-1-5-21-869607583-2483572573-2297019986-1000\Control Panel\International\Geo\Nation	taskhostw.exe

Executes dropped EXE 5 IoCs

pid	Process
3972	taskhostw.exe
2004	taskhostw.exe
2884	taskhostw.exe
4472	taskhostw.exe
3960	taskhostw.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 6 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-869607583-2483572573-2297019986-1000_Classes\Local Settings	taskhostw.exe
Key created	\REGISTRY\USER\S-1-5-21-869607583-2483572573-2297019986-1000_Classes\Local Settings	taskhostw.exe
Key created	\REGISTRY\USER\S-1-5-21-869607583-2483572573-2297019986-1000_Classes\Local Settings	taskhostw.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	1f824bf7c73eeef309d3a30fff4e924f91870de0fc5990adc2d0a1a42284f567.exe
Key created	\REGISTRY\USER\S-1-5-21-869607583-2483572573-2297019986-1000_Classes\Local Settings	taskhostw.exe
Key created	\REGISTRY\USER\S-1-5-21-869607583-2483572573-2297019986-1000_Classes\Local Settings	taskhostw.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 6 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
3232	schtasks.exe
4572	schtasks.exe
5040	schtasks.exe
2788	schtasks.exe
3028	schtasks.exe
1544	schtasks.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
3652	1f824bf7c73eeef309d3a30fff4e924f91870de0fc5990adc2d0a1a42284f567.exe
2752	powershell.exe
4748	powershell.exe
2752	powershell.exe
4748	powershell.exe
2472	powershell.exe
2472	powershell.exe
3972	taskhostw.exe
2004	taskhostw.exe
2884	taskhostw.exe
4472	taskhostw.exe
3960	taskhostw.exe

Suspicious use of AdjustPrivilegeToken 9 IoCs

description	pid	Process
Token: SeDebugPrivilege	3652	1f824bf7c73eeef309d3a30fff4e924f91870de0fc5990adc2d0a1a42284f567.exe
Token: SeDebugPrivilege	4748	powershell.exe
Token: SeDebugPrivilege	2752	powershell.exe
Token: SeDebugPrivilege	2472	powershell.exe
Token: SeDebugPrivilege	3972	taskhostw.exe
Token: SeDebugPrivilege	2004	taskhostw.exe
Token: SeDebugPrivilege	2884	taskhostw.exe
Token: SeDebugPrivilege	4472	taskhostw.exe
Token: SeDebugPrivilege	3960	taskhostw.exe

Suspicious use of WriteProcessMemory 36 IoCs

description	pid	Process	procid_target
PID 3652 wrote to memory of 2472	3652	1f824bf7c73eeef309d3a30fff4e924f91870de0fc5990adc2d0a1a42284f567.exe	95
PID 3652 wrote to memory of 2472	3652	1f824bf7c73eeef309d3a30fff4e924f91870de0fc5990adc2d0a1a42284f567.exe	95
PID 3652 wrote to memory of 2752	3652	1f824bf7c73eeef309d3a30fff4e924f91870de0fc5990adc2d0a1a42284f567.exe	96
PID 3652 wrote to memory of 2752	3652	1f824bf7c73eeef309d3a30fff4e924f91870de0fc5990adc2d0a1a42284f567.exe	96
PID 3652 wrote to memory of 4748	3652	1f824bf7c73eeef309d3a30fff4e924f91870de0fc5990adc2d0a1a42284f567.exe	97
PID 3652 wrote to memory of 4748	3652	1f824bf7c73eeef309d3a30fff4e924f91870de0fc5990adc2d0a1a42284f567.exe	97
PID 3652 wrote to memory of 3972	3652	1f824bf7c73eeef309d3a30fff4e924f91870de0fc5990adc2d0a1a42284f567.exe	101
PID 3652 wrote to memory of 3972	3652	1f824bf7c73eeef309d3a30fff4e924f91870de0fc5990adc2d0a1a42284f567.exe	101
PID 3972 wrote to memory of 1372	3972	taskhostw.exe	102
PID 3972 wrote to memory of 1372	3972	taskhostw.exe	102
PID 3972 wrote to memory of 4252	3972	taskhostw.exe	103
PID 3972 wrote to memory of 4252	3972	taskhostw.exe	103
PID 1372 wrote to memory of 2004	1372	WScript.exe	110
PID 1372 wrote to memory of 2004	1372	WScript.exe	110
PID 2004 wrote to memory of 4872	2004	taskhostw.exe	113
PID 2004 wrote to memory of 4872	2004	taskhostw.exe	113
PID 2004 wrote to memory of 3444	2004	taskhostw.exe	114
PID 2004 wrote to memory of 3444	2004	taskhostw.exe	114
PID 4872 wrote to memory of 2884	4872	WScript.exe	116
PID 4872 wrote to memory of 2884	4872	WScript.exe	116
PID 2884 wrote to memory of 60	2884	taskhostw.exe	119
PID 2884 wrote to memory of 60	2884	taskhostw.exe	119
PID 2884 wrote to memory of 5064	2884	taskhostw.exe	120
PID 2884 wrote to memory of 5064	2884	taskhostw.exe	120
PID 60 wrote to memory of 4472	60	WScript.exe	121
PID 60 wrote to memory of 4472	60	WScript.exe	121
PID 4472 wrote to memory of 2564	4472	taskhostw.exe	122
PID 4472 wrote to memory of 2564	4472	taskhostw.exe	122
PID 4472 wrote to memory of 2496	4472	taskhostw.exe	123
PID 4472 wrote to memory of 2496	4472	taskhostw.exe	123
PID 2564 wrote to memory of 3960	2564	WScript.exe	125
PID 2564 wrote to memory of 3960	2564	WScript.exe	125
PID 3960 wrote to memory of 8	3960	taskhostw.exe	126
PID 3960 wrote to memory of 8	3960	taskhostw.exe	126
PID 3960 wrote to memory of 4960	3960	taskhostw.exe	127
PID 3960 wrote to memory of 4960	3960	taskhostw.exe	127

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\1f824bf7c73eeef309d3a30fff4e924f91870de0fc5990adc2d0a1a42284f567.exe
"C:\Users\Admin\AppData\Local\Temp\1f824bf7c73eeef309d3a30fff4e924f91870de0fc5990adc2d0a1a42284f567.exe"
1⤵
- Checks computer location settings
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3652
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\1f824bf7c73eeef309d3a30fff4e924f91870de0fc5990adc2d0a1a42284f567.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2472
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\Saved Games\taskhostw.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2752
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\Videos\fontdrvhost.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4748
- C:\Users\Admin\Saved Games\taskhostw.exe
  "C:\Users\Admin\Saved Games\taskhostw.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3972
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\d10e5b27-3575-4b8f-9a3c-8ab68fcc5784.vbs"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1372
  - - C:\Users\Admin\Saved Games\taskhostw.exe
      "C:\Users\Admin\Saved Games\taskhostw.exe"
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Modifies registry class
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:2004
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\55c8db03-cc92-4151-b023-35cc054f0b2b.vbs"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:4872
      - C:\Users\Admin\Saved Games\taskhostw.exe
        
        "C:\Users\Admin\Saved Games\taskhostw.exe"
        6⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2884
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\986290dd-c3cc-43dd-8617-6dafd16b3dc4.vbs"
        7⤵
        Suspicious use of WriteProcessMemory
        
        PID:60
        
        C:\Users\Admin\Saved Games\taskhostw.exe
        
        "C:\Users\Admin\Saved Games\taskhostw.exe"
        8⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4472
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\06e1fe0f-4981-4c16-b13f-31259a6775a3.vbs"
        9⤵
        Suspicious use of WriteProcessMemory
        
        PID:2564
        
        C:\Users\Admin\Saved Games\taskhostw.exe
        
        "C:\Users\Admin\Saved Games\taskhostw.exe"
        10⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3960
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\8934f0ac-3a61-4767-8921-5d0f00c35f88.vbs"
        11⤵
        
        PID:8
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\77c98f8b-86cc-46a4-8442-28292ed224cd.vbs"
        11⤵
        
        PID:4960
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\76913030-b8df-4304-bc57-a861add51cf3.vbs"
        9⤵
        
        PID:2496
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\98ec2585-e11c-44d9-914f-900bec82abef.vbs"
        7⤵
        
        PID:5064
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\f8f209d6-46a4-4ff9-b376-958790a9d97b.vbs"
        5⤵
        
        PID:3444
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\cef98ba2-e4e0-4a10-b34d-3a23795ddbb9.vbs"
    3⤵
    PID:4252

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostwt" /sc MINUTE /mo 12 /tr "'C:\Users\Admin\Saved Games\taskhostw.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2788

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostw" /sc ONLOGON /tr "'C:\Users\Admin\Saved Games\taskhostw.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3028

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostwt" /sc MINUTE /mo 13 /tr "'C:\Users\Admin\Saved Games\taskhostw.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1544

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 6 /tr "'C:\Users\Admin\Videos\fontdrvhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3232

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\Users\Admin\Videos\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4572

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 10 /tr "'C:\Users\Admin\Videos\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5040

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
d85ba6ff808d9e5444a4b369f5bc2730

SHA1
31aa9d96590fff6981b315e0b391b575e4c0804a

SHA256
84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

SHA512
8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\taskhostw.exe.log

Filesize
1KB

MD5
3690a1c3b695227a38625dcf27bd6dac

SHA1
c2ed91e98b120681182904fa2c7cd504e5c4b2f5

SHA256
2ca8df156dba033c5b3ae4009e3be14dcdc6b9be53588055efd0864a1ab8ff73

SHA512
15ebfe05c0317f844e957ac02842a60b01f00ddca981e888e547056d0e30c97829bc4a2a46ce43034b3346f7cf5406c7c41c2a830f0abc47c8d2fd2ef00cb2c1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
029fbf628b046653ab7ff10b31deeeb2

SHA1
93c2cb1905c8f5e71f5ea97a1e8a8c891eae077c

SHA256
85f6b0971e94daf9fd4e39413824f162851a9f5ce7f989bd92c903a4dbcbef26

SHA512
d4e3626dba2572bd1e53446b384962f955cc0c7e56a72cacf50a845d74714ec1020bcb0fdcc50636a1dfd4f08dc34143dbb5638dd90180df6aa31dab9228c98c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
87d9fe9e5ee685ff2b66e5396fcdcb99

SHA1
0ac74edba86591b97d1a7531c3d2e659f0843b7f

SHA256
f84df996802a7b65b0a58ecd1960f157bdc82f817bae81409eb4184e438ed9b8

SHA512
ce602ffb6822849af961afc13b972d0d344bbfaa50c5fe372cf475f424a9227f788ea64a1dfa9b96d8e01cfa2b7f0f9e695ea001ea37a6c7c235c86931d1cf3e

Download Submit
C:\Users\Admin\AppData\Local\Temp\06e1fe0f-4981-4c16-b13f-31259a6775a3.vbs

Filesize
716B

MD5
6cf1fb33244a9517c166fa55a42c27e4

SHA1
0bed4b85d1def932af6e35ccea00fc643e166175

SHA256
a4c7d7ebdd98e99e0f5624e4c9e82300d5a93a2b382c21f2c912247010569aeb

SHA512
92a6458b74c2183fc85556faa2725c1e36e8b25f7247ef3f6835f2612435c4f38616113a27207c9a116434a204744d4a7c841da1ab9b7068ee47bc172ff5a834

Download Submit
C:\Users\Admin\AppData\Local\Temp\55c8db03-cc92-4151-b023-35cc054f0b2b.vbs

Filesize
716B

MD5
d390e4695797f7b969d71f061c8ff1eb

SHA1
8fa08c25f9a8b7283384b218b152675b7a550e27

SHA256
236fb90a9a07820041a31929db0940d46172c60490adfddd408d8be4c3a6386e

SHA512
9537d1ed151b0b478b272d5915214a68e42a9d50b84af48de6bc6ceab8f36d26d8442c2cc5f34e41794496ce6669981905c5f02f476421251faec03c2284f475

Download Submit
C:\Users\Admin\AppData\Local\Temp\8934f0ac-3a61-4767-8921-5d0f00c35f88.vbs

Filesize
716B

MD5
6763b3940ec91a4714a562b7f5667c7e

SHA1
86839cdfbc67ea5e79b6e072f9baf908465a9542

SHA256
c46d52cb7ce43e2ff54382c5ea2b268819e385865901fce0f7242cfc906bdb92

SHA512
74a84253af126709b5a739e0f33eae5e99fb8c9dc636933cefa6c16b6264e893d054bffeebb3b41168e4177171890efc26faf1b2678b9e2a6c744df613295ea4

Download Submit
C:\Users\Admin\AppData\Local\Temp\986290dd-c3cc-43dd-8617-6dafd16b3dc4.vbs

Filesize
716B

MD5
3f0ad48e98b013e4d61659d629fd4236

SHA1
6d9eac54318767bdb4341b98111092e0caa74c9f

SHA256
56b962b3a5c481b8270bd8c33940bed0f835e95432d3d2ca1e885cd7924d789a

SHA512
e9a4cc47984ed8b92fc3e23bc1e3f87c83ba7fb85d1d93e87f4242f944adbac770f39b47ce825c0c09ecfc351ab112022ceaa38f13208e39a8dc3d3df0310197

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_b5vrte3l.vtk.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\cef98ba2-e4e0-4a10-b34d-3a23795ddbb9.vbs

Filesize
492B

MD5
bca45ea7e8ebce36fb86bafb201d68cb

SHA1
842c99a69073dc6c195bc1944ac15be3c12b7c9a

SHA256
783853797e7c35a8c993407f2712f7670459a8df5f2d459d288bcf6bfaaadba8

SHA512
46756bb0bfc045cac284e63a74be586883d4e29b24260e748a65d58e0e77cac56c02c2aa920ae1deeaec074607bd9f362c7058ee500c086691f8dbe6166045ea

Download Submit
C:\Users\Admin\AppData\Local\Temp\d10e5b27-3575-4b8f-9a3c-8ab68fcc5784.vbs

Filesize
716B

MD5
07b785c519e3fdd5e76f0796308f8c32

SHA1
e4e5efd9eda1a4dd0880492706afa7a541dd4cf4

SHA256
4fb690756eb0f3bd5c79d5434a546deb2f9683dfb9755a8975f9ba4ea401adce

SHA512
e2abec1d75393160de03487e88badcc35d7ba8aa4255c82f777f62d8477c2b2f7d000067beeee4a89fdacdd4296277583316707a6ea2b51871979a5d9cab7647

Download Submit
C:\Users\Admin\Saved Games\taskhostw.exe

Filesize
1.6MB

MD5
2c4dbe075f37719580a096bf67bf048e

SHA1
71673f7af94683985e875f3db73cbf1a5509228e

SHA256
1f824bf7c73eeef309d3a30fff4e924f91870de0fc5990adc2d0a1a42284f567

SHA512
6d5bed3e46aa8e02d678c0a3f1ff6be56b776980af341e9ef84d9febaad843dfa2df28083ff6d8dcad9e74d4724ee1f09190b093c9bb3d1cb78068ca219d3c70

Download Submit
C:\Users\Admin\Videos\fontdrvhost.exe

Filesize
1.6MB

MD5
d105b4d7801c85fdc7e8d1aa24e0320f

SHA1
720df7f2c33514426bd2c8dd4074b6a85809e29e

SHA256
e9bd21dc1ee5fcd57cea7c971d8fcb75dd3130422a16a49d74ee3c0b7d7b51f7

SHA512
fec753b4c4754010b0f7638eabf3112ecf513a78908a178d47ff49e19d9999023a42a6c09af9f603df404b43b9f46992623882873a855344937af148557478ed

Download Submit
memory/2752-92-0x000001E71AF30000-0x000001E71AF52000-memory.dmp

Filesize
136KB

Download
memory/3652-6-0x000000001B600000-0x000000001B616000-memory.dmp

Filesize
88KB

Download
memory/3652-9-0x000000001B690000-0x000000001B698000-memory.dmp

Filesize
32KB

Download
memory/3652-16-0x000000001B8B0000-0x000000001B8BA000-memory.dmp

Filesize
40KB

Download
memory/3652-17-0x000000001B8C0000-0x000000001B8CC000-memory.dmp

Filesize
48KB

Download
memory/3652-14-0x000000001B890000-0x000000001B898000-memory.dmp

Filesize
32KB

Download
memory/3652-13-0x000000001B880000-0x000000001B88E000-memory.dmp

Filesize
56KB

Download
memory/3652-12-0x000000001B870000-0x000000001B87A000-memory.dmp

Filesize
40KB

Download
memory/3652-11-0x000000001B860000-0x000000001B86C000-memory.dmp

Filesize
48KB

Download
memory/3652-10-0x000000001B6A0000-0x000000001B6AC000-memory.dmp

Filesize
48KB

Download
memory/3652-15-0x000000001B8A0000-0x000000001B8A8000-memory.dmp

Filesize
32KB

Download
memory/3652-0-0x00007FFAD0A43000-0x00007FFAD0A45000-memory.dmp

Filesize
8KB

Download
memory/3652-145-0x00007FFAD0A40000-0x00007FFAD1501000-memory.dmp

Filesize
10.8MB

Download
memory/3652-7-0x000000001B620000-0x000000001B628000-memory.dmp

Filesize
32KB

Download
memory/3652-8-0x000000001B630000-0x000000001B640000-memory.dmp

Filesize
64KB

Download
memory/3652-5-0x000000001B5F0000-0x000000001B600000-memory.dmp

Filesize
64KB

Download
memory/3652-4-0x000000001B640000-0x000000001B690000-memory.dmp

Filesize
320KB

Download
memory/3652-3-0x0000000002540000-0x000000000255C000-memory.dmp

Filesize
112KB

Download
memory/3652-2-0x00007FFAD0A40000-0x00007FFAD1501000-memory.dmp

Filesize
10.8MB

Download
memory/3652-1-0x0000000000220000-0x00000000003C2000-memory.dmp

Filesize
1.6MB

Download