dcrat | 3c5d4007aabc7835b586d15313645af2e823dfad1d487cad46453dc3474e2693

Analysis

max time kernel
60s
max time network
62s
platform
windows10-2004_x64
resource
win10v2004-20250314-en
resource tags

arch:x64arch:x86image:win10v2004-20250314-enlocale:en-usos:windows10-2004-x64system
submitted
22/03/2025, 20:17

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

85c94c7c76edef200af7308df08946171efa15cc64e34da0235a6582538fe75f.exe
Size

1.6MB
MD5

c87ae2c7c0c0a77294bdf61219b952f5
SHA1

009d29952e3cec0966402de8b8ffeb264c78a956
SHA256

85c94c7c76edef200af7308df08946171efa15cc64e34da0235a6582538fe75f
SHA512

b7477f968f2356dd08991668b6feb01bb878bad59a6b3857b0a226b1e246852ba0c40214c502e757b01bbd9fc130f9e0cad033a12ada3f1c6f42767b9b813c7c
SSDEEP

24576:qsm8JijftfWIqZpyh/X6bSmV2GKz1oncoiF9GFwUvpHk3tSfEybcswrJ4gOEGEk:qD8Jijt+xpS/ekYmLGdhEAf7bCcjE

Score

10^/10

dcrat execution infostealer rat

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat
Dcrat family
dcrat

Process spawned unexpected child process 12 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4104	3932	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2460	3932	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4644	3932	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4488	3932	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4508	3932	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4588	3932	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4620	3932	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4524	3932	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4608	3932	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4732	3932	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4876	3932	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5096	3932	schtasks.exe	87

DCRat payload 3 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral14/memory/1244-1-0x0000000000920000-0x0000000000AC2000-memory.dmp	dcrat
behavioral14/files/0x0008000000024335-29.dat	dcrat
behavioral14/files/0x000b000000024335-51.dat	dcrat

Command and Scripting Interpreter: PowerShell 1 TTPs 5 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
6036	powershell.exe
380	powershell.exe
5144	powershell.exe
3596	powershell.exe
4088	powershell.exe

Checks computer location settings 2 TTPs 5 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3975168204-1612096350-4002976354-1000\Control Panel\International\Geo\Nation	Registry.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3975168204-1612096350-4002976354-1000\Control Panel\International\Geo\Nation	Registry.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3975168204-1612096350-4002976354-1000\Control Panel\International\Geo\Nation	85c94c7c76edef200af7308df08946171efa15cc64e34da0235a6582538fe75f.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3975168204-1612096350-4002976354-1000\Control Panel\International\Geo\Nation	Registry.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3975168204-1612096350-4002976354-1000\Control Panel\International\Geo\Nation	Registry.exe

Executes dropped EXE 4 IoCs

pid	Process
1012	Registry.exe
1112	Registry.exe
2980	Registry.exe
2856	Registry.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 5 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3975168204-1612096350-4002976354-1000_Classes\Local Settings	Registry.exe
Key created	\REGISTRY\USER\S-1-5-21-3975168204-1612096350-4002976354-1000_Classes\Local Settings	Registry.exe
Key created	\REGISTRY\USER\S-1-5-21-3975168204-1612096350-4002976354-1000_Classes\Local Settings	85c94c7c76edef200af7308df08946171efa15cc64e34da0235a6582538fe75f.exe
Key created	\REGISTRY\USER\S-1-5-21-3975168204-1612096350-4002976354-1000_Classes\Local Settings	Registry.exe
Key created	\REGISTRY\USER\S-1-5-21-3975168204-1612096350-4002976354-1000_Classes\Local Settings	Registry.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 12 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4588	schtasks.exe
4620	schtasks.exe
4524	schtasks.exe
4876	schtasks.exe
4644	schtasks.exe
4608	schtasks.exe
4732	schtasks.exe
5096	schtasks.exe
4104	schtasks.exe
2460	schtasks.exe
4488	schtasks.exe
4508	schtasks.exe

Suspicious behavior: EnumeratesProcesses 26 IoCs

pid	Process
1244	85c94c7c76edef200af7308df08946171efa15cc64e34da0235a6582538fe75f.exe
1244	85c94c7c76edef200af7308df08946171efa15cc64e34da0235a6582538fe75f.exe
1244	85c94c7c76edef200af7308df08946171efa15cc64e34da0235a6582538fe75f.exe
1244	85c94c7c76edef200af7308df08946171efa15cc64e34da0235a6582538fe75f.exe
1244	85c94c7c76edef200af7308df08946171efa15cc64e34da0235a6582538fe75f.exe
1244	85c94c7c76edef200af7308df08946171efa15cc64e34da0235a6582538fe75f.exe
1244	85c94c7c76edef200af7308df08946171efa15cc64e34da0235a6582538fe75f.exe
3596	powershell.exe
3596	powershell.exe
5144	powershell.exe
5144	powershell.exe
380	powershell.exe
380	powershell.exe
6036	powershell.exe
6036	powershell.exe
4088	powershell.exe
4088	powershell.exe
3596	powershell.exe
4088	powershell.exe
6036	powershell.exe
5144	powershell.exe
380	powershell.exe
1012	Registry.exe
1112	Registry.exe
2980	Registry.exe
2856	Registry.exe

Suspicious use of AdjustPrivilegeToken 10 IoCs

description	pid	Process
Token: SeDebugPrivilege	1244	85c94c7c76edef200af7308df08946171efa15cc64e34da0235a6582538fe75f.exe
Token: SeDebugPrivilege	3596	powershell.exe
Token: SeDebugPrivilege	5144	powershell.exe
Token: SeDebugPrivilege	4088	powershell.exe
Token: SeDebugPrivilege	380	powershell.exe
Token: SeDebugPrivilege	6036	powershell.exe
Token: SeDebugPrivilege	1012	Registry.exe
Token: SeDebugPrivilege	1112	Registry.exe
Token: SeDebugPrivilege	2980	Registry.exe
Token: SeDebugPrivilege	2856	Registry.exe

Suspicious use of WriteProcessMemory 38 IoCs

description	pid	Process	procid_target
PID 1244 wrote to memory of 5144	1244	85c94c7c76edef200af7308df08946171efa15cc64e34da0235a6582538fe75f.exe	103
PID 1244 wrote to memory of 5144	1244	85c94c7c76edef200af7308df08946171efa15cc64e34da0235a6582538fe75f.exe	103
PID 1244 wrote to memory of 3596	1244	85c94c7c76edef200af7308df08946171efa15cc64e34da0235a6582538fe75f.exe	104
PID 1244 wrote to memory of 3596	1244	85c94c7c76edef200af7308df08946171efa15cc64e34da0235a6582538fe75f.exe	104
PID 1244 wrote to memory of 380	1244	85c94c7c76edef200af7308df08946171efa15cc64e34da0235a6582538fe75f.exe	105
PID 1244 wrote to memory of 380	1244	85c94c7c76edef200af7308df08946171efa15cc64e34da0235a6582538fe75f.exe	105
PID 1244 wrote to memory of 6036	1244	85c94c7c76edef200af7308df08946171efa15cc64e34da0235a6582538fe75f.exe	107
PID 1244 wrote to memory of 6036	1244	85c94c7c76edef200af7308df08946171efa15cc64e34da0235a6582538fe75f.exe	107
PID 1244 wrote to memory of 4088	1244	85c94c7c76edef200af7308df08946171efa15cc64e34da0235a6582538fe75f.exe	108
PID 1244 wrote to memory of 4088	1244	85c94c7c76edef200af7308df08946171efa15cc64e34da0235a6582538fe75f.exe	108
PID 1244 wrote to memory of 4108	1244	85c94c7c76edef200af7308df08946171efa15cc64e34da0235a6582538fe75f.exe	113
PID 1244 wrote to memory of 4108	1244	85c94c7c76edef200af7308df08946171efa15cc64e34da0235a6582538fe75f.exe	113
PID 4108 wrote to memory of 2708	4108	cmd.exe	115
PID 4108 wrote to memory of 2708	4108	cmd.exe	115
PID 4108 wrote to memory of 1012	4108	cmd.exe	117
PID 4108 wrote to memory of 1012	4108	cmd.exe	117
PID 1012 wrote to memory of 6016	1012	Registry.exe	119
PID 1012 wrote to memory of 6016	1012	Registry.exe	119
PID 1012 wrote to memory of 1384	1012	Registry.exe	120
PID 1012 wrote to memory of 1384	1012	Registry.exe	120
PID 6016 wrote to memory of 1112	6016	WScript.exe	122
PID 6016 wrote to memory of 1112	6016	WScript.exe	122
PID 1112 wrote to memory of 2792	1112	Registry.exe	123
PID 1112 wrote to memory of 2792	1112	Registry.exe	123
PID 1112 wrote to memory of 4296	1112	Registry.exe	124
PID 1112 wrote to memory of 4296	1112	Registry.exe	124
PID 2792 wrote to memory of 2980	2792	WScript.exe	132
PID 2792 wrote to memory of 2980	2792	WScript.exe	132
PID 2980 wrote to memory of 3056	2980	Registry.exe	133
PID 2980 wrote to memory of 3056	2980	Registry.exe	133
PID 2980 wrote to memory of 5244	2980	Registry.exe	134
PID 2980 wrote to memory of 5244	2980	Registry.exe	134
PID 3056 wrote to memory of 2856	3056	WScript.exe	135
PID 3056 wrote to memory of 2856	3056	WScript.exe	135
PID 2856 wrote to memory of 3740	2856	Registry.exe	136
PID 2856 wrote to memory of 3740	2856	Registry.exe	136
PID 2856 wrote to memory of 4308	2856	Registry.exe	137
PID 2856 wrote to memory of 4308	2856	Registry.exe	137

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\85c94c7c76edef200af7308df08946171efa15cc64e34da0235a6582538fe75f.exe
"C:\Users\Admin\AppData\Local\Temp\85c94c7c76edef200af7308df08946171efa15cc64e34da0235a6582538fe75f.exe"
1⤵
- Checks computer location settings
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1244
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\85c94c7c76edef200af7308df08946171efa15cc64e34da0235a6582538fe75f.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5144
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\f170d29a37c9c9775251\OfficeClickToRun.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3596
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Default\PrintHood\spoolsv.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:380
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\WindowsRE\sppsvc.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:6036
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\Registry.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4088
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\xqMEPA9M3G.bat"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4108
- - C:\Windows\system32\w32tm.exe
    w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
    3⤵
    PID:2708
- - C:\Users\Admin\Registry.exe
    "C:\Users\Admin\Registry.exe"
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Modifies registry class
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:1012
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\708b4d37-ae68-43ca-bf62-222182aa8fed.vbs"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:6016
    - - C:\Users\Admin\Registry.exe
        
        C:\Users\Admin\Registry.exe
        5⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1112
      - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\6b1195eb-8882-41b3-938e-0f22c76ae8cf.vbs"
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:2792
        
        C:\Users\Admin\Registry.exe
        
        C:\Users\Admin\Registry.exe
        7⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2980
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\8c2f5efd-b570-48e0-9580-84fd2abd18dc.vbs"
        8⤵
        Suspicious use of WriteProcessMemory
        
        PID:3056
        
        C:\Users\Admin\Registry.exe
        
        C:\Users\Admin\Registry.exe
        9⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2856
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\d3523779-b33b-4c01-ae07-d3ed634e2e01.vbs"
        10⤵
        
        PID:3740
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\b7db13de-2650-4484-8e5c-ae371fd0dc75.vbs"
        10⤵
        
        PID:4308
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\93784b2f-ccb5-4f75-b1e2-4b120b8e59be.vbs"
        8⤵
        
        PID:5244
      - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\dc9f4e3b-d8a8-4672-95e4-af95c994abe0.vbs"
        6⤵
        
        PID:4296
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\f57a45d3-cbf3-4081-ad90-11bc404357fb.vbs"
      4⤵
      PID:1384

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OfficeClickToRunO" /sc MINUTE /mo 7 /tr "'C:\f170d29a37c9c9775251\OfficeClickToRun.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4104

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OfficeClickToRun" /sc ONLOGON /tr "'C:\f170d29a37c9c9775251\OfficeClickToRun.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2460

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OfficeClickToRunO" /sc MINUTE /mo 14 /tr "'C:\f170d29a37c9c9775251\OfficeClickToRun.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4644

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 13 /tr "'C:\Users\Default\PrintHood\spoolsv.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4488

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsv" /sc ONLOGON /tr "'C:\Users\Default\PrintHood\spoolsv.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4508

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 6 /tr "'C:\Users\Default\PrintHood\spoolsv.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4588

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 7 /tr "'C:\Recovery\WindowsRE\sppsvc.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4620

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvc" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\sppsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4524

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 8 /tr "'C:\Recovery\WindowsRE\sppsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4608

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RegistryR" /sc MINUTE /mo 5 /tr "'C:\Users\Admin\Registry.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4732

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Registry" /sc ONLOGON /tr "'C:\Users\Admin\Registry.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4876

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RegistryR" /sc MINUTE /mo 10 /tr "'C:\Users\Admin\Registry.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5096

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\Registry.exe.log

Filesize
1KB

MD5
3690a1c3b695227a38625dcf27bd6dac

SHA1
c2ed91e98b120681182904fa2c7cd504e5c4b2f5

SHA256
2ca8df156dba033c5b3ae4009e3be14dcdc6b9be53588055efd0864a1ab8ff73

SHA512
15ebfe05c0317f844e957ac02842a60b01f00ddca981e888e547056d0e30c97829bc4a2a46ce43034b3346f7cf5406c7c41c2a830f0abc47c8d2fd2ef00cb2c1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
d85ba6ff808d9e5444a4b369f5bc2730

SHA1
31aa9d96590fff6981b315e0b391b575e4c0804a

SHA256
84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

SHA512
8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
efa4168b73a5e8ae56d49bcac4d67861

SHA1
b3fe6b2d9fc05ad7892a2c8b96914764336b3067

SHA256
7aab157fba3a543647a38cc8729ffb962a58cc2093d94566c9e68ff73d134dca

SHA512
a1f305eac9c73c951f22e76f3904c1c6bb518b12d8a74bbea544c845f3d592e7915ec47d6531a3a4e669f6ab12311f3a632ff47a68f36370111d1c82cf8b6e99

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
555e68af1b8e33f84346bf2335e6191a

SHA1
fa078ed3a608f05ae2dd2db8ed52d6bafe8d510e

SHA256
91a76a2c6c73116293fb7e5bfb12b00ef8128a04fbbb44153f4fd63794b2b8ae

SHA512
6f3d5be098271b844d0cbd21d902e68ce80f0bcfa67e3fb507d11bacf15227d3e66397fec2691d7f3333194d4d2067ea416bcbb1d9739f661db3bab0259af44e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
084d49c16a0db5a169356315e8e97d83

SHA1
af662c8666ef7c52c9711c0f143e0b8620f27d19

SHA256
a374d799d8b4b9c2cac922c093a90cbaf6d0bda3155faf176c6f95b46b8f35d2

SHA512
c14524f55f0e58bb64a99298b82d995136a0057c2a7e4e972b9c90477871ae416063318ba8b7f43a4fc66ca8b21eca26505645c4d195fe3ab9419c8d35a459fb

Download Submit
C:\Users\Admin\AppData\Local\Temp\6b1195eb-8882-41b3-938e-0f22c76ae8cf.vbs

Filesize
703B

MD5
85819586dac30f86c6d5ec2741a8c7cf

SHA1
78c225ab9158f84ccaf621953a3c8edfdc411b9c

SHA256
dd0123a83d13d92f0dfbe8eb916d27649a2cc374b40128ad903f60a88d26c833

SHA512
d1778707274a0e9415b288855d9a3eae9f05f1fd67e8dbb95fef4e34554d365b1f4063f4c2a42153fa56cfbede27a525282e48bc9446c6945979541b2df17deb

Download Submit
C:\Users\Admin\AppData\Local\Temp\708b4d37-ae68-43ca-bf62-222182aa8fed.vbs

Filesize
703B

MD5
fb1679971fc8b47e21145c481db539a5

SHA1
54596b0eeb579ff68670f64ab1b2c3f2dc543301

SHA256
8127264dcbd86525ab411e468a45c898dfb092fe7c6859bdc0f710895a7dca74

SHA512
6e1e68ff044e535dedecd160e010f92e5aa7af21d1f2c7f0b2bc04570f2690e847bdebfae1140a516fd0e3a81e3e1c69c72c34c1ba44222246e2c0c127619dc4

Download Submit
C:\Users\Admin\AppData\Local\Temp\8c2f5efd-b570-48e0-9580-84fd2abd18dc.vbs

Filesize
703B

MD5
4dcd86a0e24167c8c8e3c792ff07d0af

SHA1
3bce836e52232e29591a7d79a439eef70667cc60

SHA256
9603dd9bd9eb8d7e05bb326063f3493b873368984f74dc4564bc1b02ca1ba0ff

SHA512
9d902da2d4cbd58ede8114adde734d30cfb8b30d6f715764c14af95f4a83e794d072eeb8525691ce601a4ba5b1f5df39a0b625a2481395c079c870dfe9b52d74

Download Submit
C:\Users\Admin\AppData\Local\Temp\RCXC8EE.tmp

Filesize
1.6MB

MD5
c87ae2c7c0c0a77294bdf61219b952f5

SHA1
009d29952e3cec0966402de8b8ffeb264c78a956

SHA256
85c94c7c76edef200af7308df08946171efa15cc64e34da0235a6582538fe75f

SHA512
b7477f968f2356dd08991668b6feb01bb878bad59a6b3857b0a226b1e246852ba0c40214c502e757b01bbd9fc130f9e0cad033a12ada3f1c6f42767b9b813c7c

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_ttfe5hxr.mza.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\d3523779-b33b-4c01-ae07-d3ed634e2e01.vbs

Filesize
703B

MD5
56978e437a92b83ca08eccea8c6e4c8d

SHA1
054e0161c795016245638efbe5bd9edb020b4293

SHA256
30be05e50bdff128a667f61be33ebad4c622bb7b32e82e8cc6b6024b200635bb

SHA512
4e2ab80c86ad2e6c9f9cf5a9784da53a7a54182fb7aafb4306ae8a5449cac013b22d1eecb455f4321b442d71fdfd67bb214fe9a370b55f35088a9d5ad403cffb

Download Submit
C:\Users\Admin\AppData\Local\Temp\f57a45d3-cbf3-4081-ad90-11bc404357fb.vbs

Filesize
479B

MD5
c71495b43d6ac911a7a3ad2dfcd6ed5b

SHA1
d696a7143af526e96d9fc087045a084592597b10

SHA256
22bd7f4c3a564a84ed1cebca7938c191527131d36b487306478ec00667f7b07b

SHA512
bcf9dbc353f0292ac193e7e16a867069c7a9870f3d1e6e41637d1152b4ce9782af25a46612b6ebf88320ec0b0c5b02374e89c9830f2373ad8e5ce01482117d67

Download Submit
C:\Users\Admin\AppData\Local\Temp\xqMEPA9M3G.bat

Filesize
192B

MD5
d611925b58c6127e5470423a3932bcd1

SHA1
85425dec7eb0be9363dca144efeacfd7d9956968

SHA256
d6fa8334e32ab262bcfeefb23b908637d033cbf350e32049b63b3de92d2dabcf

SHA512
0a28c1e0ca03fc395a4a70c3ddebbb638d7bc89619f28cfc0b0b94cc7b3c047b7faeca682f05e85b96d6762291b3ec6305c13173939ae4fb0bb532272705d57a

Download Submit
C:\Users\Default\AppData\Roaming\Microsoft\Windows\Printer Shortcuts\spoolsv.exe

Filesize
1.6MB

MD5
0a5e6b42613f06262e8c52264755e986

SHA1
b68dd9c1203ea8c9a24275da330ba698ce17a781

SHA256
04301894b15dddb361d52ccb41e1e74eca9e07a6381cc66ec9a9c72cb1d54650

SHA512
a361341b1ba1260af716658e22348bfb10098e4663f402b56b13096abf89275cf1e60cd0cd685759e4df821a6b0e6a654d4365bbec3810a19909502ef8093e2f

Download Submit
memory/1244-8-0x0000000002E50000-0x0000000002E60000-memory.dmp

Filesize
64KB

Download
memory/1244-9-0x000000001B680000-0x000000001B688000-memory.dmp

Filesize
32KB

Download
memory/1244-16-0x000000001B770000-0x000000001B77A000-memory.dmp

Filesize
40KB

Download
memory/1244-17-0x000000001B780000-0x000000001B78C000-memory.dmp

Filesize
48KB

Download
memory/1244-15-0x000000001B760000-0x000000001B768000-memory.dmp

Filesize
32KB

Download
memory/1244-12-0x000000001B730000-0x000000001B73A000-memory.dmp

Filesize
40KB

Download
memory/1244-1-0x0000000000920000-0x0000000000AC2000-memory.dmp

Filesize
1.6MB

Download
memory/1244-13-0x000000001B740000-0x000000001B74E000-memory.dmp

Filesize
56KB

Download
memory/1244-125-0x00007FFB95950000-0x00007FFB96411000-memory.dmp

Filesize
10.8MB

Download
memory/1244-14-0x000000001B750000-0x000000001B758000-memory.dmp

Filesize
32KB

Download
memory/1244-11-0x000000001B720000-0x000000001B72C000-memory.dmp

Filesize
48KB

Download
memory/1244-10-0x000000001B690000-0x000000001B69C000-memory.dmp

Filesize
48KB

Download
memory/1244-0-0x00007FFB95953000-0x00007FFB95955000-memory.dmp

Filesize
8KB

Download
memory/1244-6-0x0000000002E20000-0x0000000002E36000-memory.dmp

Filesize
88KB

Download
memory/1244-7-0x0000000002E40000-0x0000000002E48000-memory.dmp

Filesize
32KB

Download
memory/1244-4-0x000000001B630000-0x000000001B680000-memory.dmp

Filesize
320KB

Download
memory/1244-5-0x0000000002E10000-0x0000000002E20000-memory.dmp

Filesize
64KB

Download
memory/1244-3-0x0000000002DF0000-0x0000000002E0C000-memory.dmp

Filesize
112KB

Download
memory/1244-2-0x00007FFB95950000-0x00007FFB96411000-memory.dmp

Filesize
10.8MB

Download
memory/3596-81-0x00000228A2F50000-0x00000228A2F72000-memory.dmp

Filesize
136KB

Download