db9597f7ff23a2578d412a4944a24ebdf195d574d93c3b50ac378d94339f113c

Analysis

max time kernel
76s
platform
windows11-21h2_x64
resource
win11-20250313-en
resource tags

arch:x64arch:x86image:win11-20250313-enlocale:en-usos:windows11-21h2-x64system
submitted
28/03/2025, 21:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Dark Crystal.7z
Size

66.6MB
MD5

3f5abd9acf8fcb1c124de0a0fada0694
SHA1

7d7404bfa6109b396dc350791fdde5cbb8b391f0
SHA256

db9597f7ff23a2578d412a4944a24ebdf195d574d93c3b50ac378d94339f113c
SHA512

fb70dfcc95b2e516eb8672d56bf440c9eb16d758f315e33f5300ffc5a9e77ba3a979cb65e2a76996afdd80c09b3f8e089bfa7adcf4e5eb36ac2e4b75f799bafa
SSDEEP

1572864:YLBYbNxWozTORN6Svw/3xMqYhCC99P7tFi9PS54nhf84:2BixURNxYJMqYhZvjtFi1E4nhf84

Score

8^/10

discovery

Malware Config

Signatures

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\drivers\etc\hosts	Patcher.exe

Executes dropped EXE 2 IoCs

pid	Process
900	Patcher.exe
380	DCRat.exe

Loads dropped DLL 4 IoCs

pid	Process
900	Patcher.exe
900	Patcher.exe
900	Patcher.exe
900	Patcher.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
900	Patcher.exe
900	Patcher.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DCRat.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Patcher.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeRestorePrivilege	2052	7zFM.exe
Token: 35	2052	7zFM.exe
Token: SeSecurityPrivilege	2052	7zFM.exe
Token: SeIncreaseQuotaPrivilege	2944	WMIC.exe
Token: SeSecurityPrivilege	2944	WMIC.exe
Token: SeTakeOwnershipPrivilege	2944	WMIC.exe
Token: SeLoadDriverPrivilege	2944	WMIC.exe
Token: SeSystemProfilePrivilege	2944	WMIC.exe
Token: SeSystemtimePrivilege	2944	WMIC.exe
Token: SeProfSingleProcessPrivilege	2944	WMIC.exe
Token: SeIncBasePriorityPrivilege	2944	WMIC.exe
Token: SeCreatePagefilePrivilege	2944	WMIC.exe
Token: SeBackupPrivilege	2944	WMIC.exe
Token: SeRestorePrivilege	2944	WMIC.exe
Token: SeShutdownPrivilege	2944	WMIC.exe
Token: SeDebugPrivilege	2944	WMIC.exe
Token: SeSystemEnvironmentPrivilege	2944	WMIC.exe
Token: SeRemoteShutdownPrivilege	2944	WMIC.exe
Token: SeUndockPrivilege	2944	WMIC.exe
Token: SeManageVolumePrivilege	2944	WMIC.exe
Token: 33	2944	WMIC.exe
Token: 34	2944	WMIC.exe
Token: 35	2944	WMIC.exe
Token: 36	2944	WMIC.exe
Token: SeIncreaseQuotaPrivilege	2944	WMIC.exe
Token: SeSecurityPrivilege	2944	WMIC.exe
Token: SeTakeOwnershipPrivilege	2944	WMIC.exe
Token: SeLoadDriverPrivilege	2944	WMIC.exe
Token: SeSystemProfilePrivilege	2944	WMIC.exe
Token: SeSystemtimePrivilege	2944	WMIC.exe
Token: SeProfSingleProcessPrivilege	2944	WMIC.exe
Token: SeIncBasePriorityPrivilege	2944	WMIC.exe
Token: SeCreatePagefilePrivilege	2944	WMIC.exe
Token: SeBackupPrivilege	2944	WMIC.exe
Token: SeRestorePrivilege	2944	WMIC.exe
Token: SeShutdownPrivilege	2944	WMIC.exe
Token: SeDebugPrivilege	2944	WMIC.exe
Token: SeSystemEnvironmentPrivilege	2944	WMIC.exe
Token: SeRemoteShutdownPrivilege	2944	WMIC.exe
Token: SeUndockPrivilege	2944	WMIC.exe
Token: SeManageVolumePrivilege	2944	WMIC.exe
Token: 33	2944	WMIC.exe
Token: 34	2944	WMIC.exe
Token: 35	2944	WMIC.exe
Token: 36	2944	WMIC.exe
Token: SeIncreaseQuotaPrivilege	2196	WMIC.exe
Token: SeSecurityPrivilege	2196	WMIC.exe
Token: SeTakeOwnershipPrivilege	2196	WMIC.exe
Token: SeLoadDriverPrivilege	2196	WMIC.exe
Token: SeSystemProfilePrivilege	2196	WMIC.exe
Token: SeSystemtimePrivilege	2196	WMIC.exe
Token: SeProfSingleProcessPrivilege	2196	WMIC.exe
Token: SeIncBasePriorityPrivilege	2196	WMIC.exe
Token: SeCreatePagefilePrivilege	2196	WMIC.exe
Token: SeBackupPrivilege	2196	WMIC.exe
Token: SeRestorePrivilege	2196	WMIC.exe
Token: SeShutdownPrivilege	2196	WMIC.exe
Token: SeDebugPrivilege	2196	WMIC.exe
Token: SeSystemEnvironmentPrivilege	2196	WMIC.exe
Token: SeRemoteShutdownPrivilege	2196	WMIC.exe
Token: SeUndockPrivilege	2196	WMIC.exe
Token: SeManageVolumePrivilege	2196	WMIC.exe
Token: 33	2196	WMIC.exe
Token: 34	2196	WMIC.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
2052	7zFM.exe
2052	7zFM.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
5724	javaw.exe
5724	javaw.exe

Suspicious use of WriteProcessMemory 28 IoCs

description	pid	Process	procid_target
PID 380 wrote to memory of 5724	380	DCRat.exe	91
PID 380 wrote to memory of 5724	380	DCRat.exe	91
PID 5724 wrote to memory of 2660	5724	javaw.exe	92
PID 5724 wrote to memory of 2660	5724	javaw.exe	92
PID 2660 wrote to memory of 2944	2660	cmd.exe	94
PID 2660 wrote to memory of 2944	2660	cmd.exe	94
PID 5724 wrote to memory of 2416	5724	javaw.exe	96
PID 5724 wrote to memory of 2416	5724	javaw.exe	96
PID 5724 wrote to memory of 720	5724	javaw.exe	98
PID 5724 wrote to memory of 720	5724	javaw.exe	98
PID 720 wrote to memory of 2196	720	cmd.exe	100
PID 720 wrote to memory of 2196	720	cmd.exe	100
PID 5724 wrote to memory of 2460	5724	javaw.exe	101
PID 5724 wrote to memory of 2460	5724	javaw.exe	101
PID 2460 wrote to memory of 4300	2460	cmd.exe	103
PID 2460 wrote to memory of 4300	2460	cmd.exe	103
PID 5724 wrote to memory of 4804	5724	javaw.exe	104
PID 5724 wrote to memory of 4804	5724	javaw.exe	104
PID 4804 wrote to memory of 1760	4804	cmd.exe	106
PID 4804 wrote to memory of 1760	4804	cmd.exe	106
PID 5724 wrote to memory of 4412	5724	javaw.exe	107
PID 5724 wrote to memory of 4412	5724	javaw.exe	107
PID 4412 wrote to memory of 4716	4412	cmd.exe	109
PID 4412 wrote to memory of 4716	4412	cmd.exe	109
PID 5724 wrote to memory of 8	5724	javaw.exe	110
PID 5724 wrote to memory of 8	5724	javaw.exe	110
PID 8 wrote to memory of 2904	8	cmd.exe	112
PID 8 wrote to memory of 2904	8	cmd.exe	112

C:\Program Files\7-Zip\7zFM.exe
"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\Dark Crystal.7z"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:2052

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:2772

C:\Users\Admin\Desktop\Dark Crystal\Patcher\Patcher.exe
"C:\Users\Admin\Desktop\Dark Crystal\Patcher\Patcher.exe"
1⤵
- Drops file in Drivers directory
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
PID:900

C:\Users\Admin\Desktop\Dark Crystal\DCRat\DCRat.exe
"C:\Users\Admin\Desktop\Dark Crystal\DCRat\DCRat.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:380
- C:\Program Files\Java\jre-1.8\bin\javaw.exe
  "C:\Program Files\Java\jre-1.8\bin\javaw.exe" -Dprism.dirtyopts=false -Dfile.encoding=UTF-8 -classpath "lib\.;lib\..;lib\IIlIllIIlIllllIIIlIIlllIIIIIlIlllIIIIllllllIlIIlllIlIlIlllIIIlIIllIIIIlIllIlIlIlIlIlIIlllIlllIIllIIllIlIlllIlIIlllIIIIll.jar;lib\IIllIIIIIlIlIIlIIIllIllllIIIlllIIIlIlIIlIlIllllIIlIIllIlIlIllIIIIIlIlllllllIIIIlIIlIIllIIIlIlIlllIIIIllllIllIIIIIIlIllII.jar;lib\IlIIIIllIIIIIIIIIllIlIllIIIlIIllIIlIIllIIlIlIIIIIIIIIIlllIIlIllIIIlIlIllIllIlIlIlIlIllIlIllIlllIIllIlIllIlIIlllIIIIIlIlI.jar;lib\IlIlIIIIIIlIIIIIIllIlIIlIllIllIlIIIlIllllIlIlllIIlIIllIllIIlIlllIIIllllIlIllIIIIIIIIIlIIlIllIIllIIlIllIIIIlIIllIllllIlIl.jar;lib\IllIIIIIIIlllIIIlIlIllIIIIIllIllIlIIlIllIlIIlIllIIlIlIlIlllllllIIlllllllIIlIIIlIlIlIIlIllllIlllIIllllIIlllllIllIIIlIlIlI.jar;lib\IllIIIIIIlIIIIIlIllIIIIlIlIIIIlIIllIIllIIlIlllIlIlIlIIIlllllIlllIllIIIlllllIlIlIlIlllIlIIllIlIIlIlIIllIlIIllIlIlIIIlIIIl.jar;lib\IlllIIlllllIIllIIIlIIlIlIlIllllIlllIllllIIIIIlIllIIIIllIIlllIllIlIlIlIIIIllIllIIllllllIllIIlllIIIlIllllIlIllIIIIIIIIlIll.jar;lib\lIIIIIIllIllllllIIlllIlIIIIlIIllllIIIIIIIIllIIIIIlIIIIIIIlllIIIIIIlIIIlIlIlIlIlIllIllIlIllIlIlIIllIlIIIIlllIllIIllIIlIIl.jar;lib\lIIlIIlllIIIIIIlllIllIIIlIlIllIlllIlIllIllllIllIIIlIlIIIlIllIllIIlllIlllllIIIlIIlIIlIIIlIlllIIllIIIIlllIIIIlIIlllIlllllI.jar;lib\lIlllIIlIIlllIIllIIIlIIIIIlIlIlIIIIlIllIIlllIlllIllIlllIlIlIlllIIllIIllIIIlIllIIIlllIlllllIlIlIIlIIIIIllllIlIllIIllIllII.jar;lib\lIllllIllIlIIlIlIlllIIIllIIIIlIIllIllllIIlIIIIIlIIIlIIIIIIIIIIIIIIllIllIIlIlIlIlllllIlllllIIIIIIlIlIIIlIIllllIlIIIlIlllI.jar;lib\lIlllllIIlIllIllllIIIIlIIlIIIIIllIlllIIlIIllIllIIIlIIlllIllIIlllIIIlllIllllllllllIlIIIlIIlIllIIllIlllIlIlIIIIIIlllllIIlI.jar;lib\llIIIlllIIIllIIIIllIllIIlIIIlIllIlIIIIlIlIlIIllIIIlIIIlIIlllIIlIlIIIlIllllIIIIlIllIllllIlllIIlIIIIllIlIlIIlIIIllllllllIl.jar;lib\llIlIlIIIIIIllIllIIllIIlIlIlIllIIlllllIIlIIIIlIIIIIllIlIlIIIlIlIllllIlIlllIIlllIllIIIlIllllIIIllllIlllllIIIIIIllIlIIlIIl.jar;lib\llIlIlIIlllIllIlllIlIIIlIIIIlllIIIllIllllIIIIIIIIlllIlIIlllIIllIIllIlIIIllIIIIlIIlIllllIlIlllIllIIIIlIIlllIlIlIllIIlIllI.jar;lib\llIlIllIllIllIlIlllIlllIIIllllllIlIIlIllIlIlIlllIllIIIIIlllIIlIIlIllllIIIlllIllIIlIIIIIIlIlIIllIIIIlIlllIllIIlIlllIIIllI.jar" org.develnext.jphp.ext.javafx.FXLauncher
  2⤵
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:5724
- - C:\Windows\System32\cmd.exe
    C:\Windows\System32\cmd.exe /c C:\Windows\System32\wbem\wmic.exe baseboard get Manufacturer
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2660
  - - C:\Windows\System32\wbem\WMIC.exe
      C:\Windows\System32\wbem\wmic.exe baseboard get Manufacturer
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:2944
- - C:\Windows\System32\cmd.exe
    C:\Windows\System32\cmd.exe /c USERPROFILE
    3⤵
    PID:2416
- - C:\Windows\System32\cmd.exe
    C:\Windows\System32\cmd.exe /c C:\Windows\System32\wbem\wmic.exe baseboard get Product
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:720
  - - C:\Windows\System32\wbem\WMIC.exe
      C:\Windows\System32\wbem\wmic.exe baseboard get Product
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:2196
- - C:\Windows\System32\cmd.exe
    C:\Windows\System32\cmd.exe /c C:\Windows\System32\wbem\wmic.exe CPU get ProcessorId
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2460
  - - C:\Windows\System32\wbem\WMIC.exe
      C:\Windows\System32\wbem\wmic.exe CPU get ProcessorId
      4⤵
      PID:4300
- - C:\Windows\System32\cmd.exe
    C:\Windows\System32\cmd.exe /c C:\Windows\System32\wbem\wmic.exe diskdrive where 'Index=0' get 'serialnumber'
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4804
  - - C:\Windows\System32\wbem\WMIC.exe
      C:\Windows\System32\wbem\wmic.exe diskdrive where 'Index=0' get 'serialnumber'
      4⤵
      PID:1760
- - C:\Windows\System32\cmd.exe
    C:\Windows\System32\cmd.exe /c C:\Windows\System32\wbem\wmic.exe Path Win32_VideoController Get VideoProcessor
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4412
  - - C:\Windows\System32\wbem\WMIC.exe
      C:\Windows\System32\wbem\wmic.exe Path Win32_VideoController Get VideoProcessor
      4⤵
      PID:4716
- - C:\Windows\System32\cmd.exe
    C:\Windows\System32\cmd.exe /c C:\Windows\System32\wbem\wmic.exe diskdrive where 'Index=0' get 'size'
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:8
  - - C:\Windows\System32\wbem\WMIC.exe
      C:\Windows\System32\wbem\wmic.exe diskdrive where 'Index=0' get 'size'
      4⤵
      PID:2904

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\7zE408B8887\Dark Crystal\DCRat\plugins\Chat_native\icon.png

Filesize
2KB

MD5
a8e72c0e27750ce36da3110126c38afe

SHA1
e96bc3555f8ed8e715af94d492965b4e6597563c

SHA256
a4f7e5adde35c1979fbf2cc44b37e2907ec963468443e34262b207dd3dab81b8

SHA512
e43e2c6abb6006c783331cb8b0e290560bb65f7cfd0e113bbddb31a6978aee31fb39a2b22b38ef83f27d512152329d066bc270e640e8900b2746a2a4e0b4dd48

Download Submit
C:\Users\Admin\Desktop\Dark Crystal\DCRat\DCRat.exe

Filesize
72KB

MD5
2c7d37e90dd8ab57d06dad5bc7956885

SHA1
da789c107c4c68b8250b6589e45e5a3cf7a9a143

SHA256
5ede5d774ab65f25357cf5a1fa5e354f6f2a9868651a0fa717485802b21b1939

SHA512
e74ae891771bfd9c6fcdfbe8e4f33f0d5f7c3457cd84b257500cdaf8fa8b16fe458a18db9b3a60591465982fc2871f4c3f2e7541c765f00a0516f805e7e9ca0f

Download Submit
C:\Users\Admin\Desktop\Dark Crystal\DCRat\design\BrowsersStealer_native_table.json

Filesize
646B

MD5
1636bd49096db0da8950830bb7623fc2

SHA1
33cc39b80f61310a538434e649638ffce1deb509

SHA256
48cff9a838321e3e94c09850e2a0066f983483e5392cf34f0bb8dee06243e239

SHA512
14cfd3db019e0e56b15121e4794290ea3cb576d3aa707b086be404c234593a1ab5a257fe70b7b29c786be7601136d7891536f7f22209e14aae9f8fb7dfefd76b

Download Submit
C:\Users\Admin\Desktop\Dark Crystal\DCRat\design\ClientsStealer_native_table.json

Filesize
553B

MD5
f7ea715546229414175cbc3af4edd19b

SHA1
fba5a0f8f02c988022dedba68dd6c13b4ddf7b16

SHA256
04f3b9197836b371bbe41b8a697d38279eefb0e05fb35b120f8f10d41ad56da7

SHA512
64d1559c6870c875d93a6b89fca6921754b74a4c59e16a4ec16931cebd079d38202f3533aed18d97747edd95a45623c62ae5f6feee884ecc437d2b8f17e78026

Download Submit
C:\Users\Admin\Desktop\Dark Crystal\DCRat\design\CryptoStealer_table.json

Filesize
446B

MD5
e69d33901ca6529a591a98f81664da41

SHA1
0c94aac3e2ac893ffad0090a1f233e411c7fd9fa

SHA256
c1a7a5a414823dae75a841b06ed22350ab0074dd53f94c5aceb2b7654199d1bd

SHA512
bcea9947002502d3c95e067fa0dbe8176fc9c230c1b542b0d6ab0a13f54c88a77d4bac744fd7862d7d3eb7a4e535cc9c800f88108fdcf75d49f1b2f98f8d5858

Download Submit
C:\Users\Admin\Desktop\Dark Crystal\DCRat\design\DomainsHighlighter_table.json

Filesize
334B

MD5
45bbe0574eb17da50ed046de225eb471

SHA1
de4b472e72b646862f4e905d83c754f8920fa8ab

SHA256
b961bef437da8148e48155b0afd5c832f419fd0584c2031e4bac711afcd7f30a

SHA512
43ed8651f296053302ffb52c7beec077a8ce9c8919300ef8067dc19d6190304a2c32330ab657cb336d52707d3155bdbe8aa3a305dfd7bca3a58f4e4946c5dec9

Download Submit
C:\Users\Admin\Desktop\Dark Crystal\DCRat\design\FileGrabber_table.json

Filesize
325B

MD5
25b6b283950d5a4cc9bfeb23f3216ef7

SHA1
7aa08acc053c6eb7cdfd8dab17bf18f0c8e1eb17

SHA256
523788f164bc16b35f38322fd24db68c1fb271b97f90f2702ca1ccea3d803082

SHA512
5fc3ee6e472923bb36c22d5d203b5365c46bf6a5de633697a7a25b9ed84c3c58e48f7b22fb2c79187525b941714ea3473aaf422452d20ad29d5954564590a2b4

Download Submit
C:\Users\Admin\Desktop\Dark Crystal\DCRat\design\Keylogger_native_table.json

Filesize
226B

MD5
dc775737035388a3f4e8710e2eaa534d

SHA1
7021f397a6aa0f05ae538e052213c3a70bc3e6e6

SHA256
78baf226b6baf5f0f5fbe0c25831e5d533a436ed497237c336c0aec6ec5e19c2

SHA512
223ab881e2360b0ef0f25bc46aaada8544f13e9f6bf049121c6905682000cf32f98fef51b51ecd1a467183022276cf8e665812198857ad64b9edbc97a23d20c0

Download Submit
C:\Users\Admin\Desktop\Dark Crystal\DCRat\design\PluginsLoader_native.json

Filesize
1KB

MD5
f95369232ea564572d22588b40e51f25

SHA1
a49d68690973e83c382e39ef6c962e37a1236751

SHA256
fc4c68781b2343805da72ff8f8cec9882a1d36d8f3cacaa8707391589f6be262

SHA512
e5a96f0caee17274096f7b4bd5bcfd8e85cc1c56c1cd3a5b93431736bf7bacbe1cd18cacba1f8689f0b7447cb26745e23845502596c2b42e901997f5619fca17

Download Submit
C:\Users\Admin\Desktop\Dark Crystal\DCRat\lib\IIlIllIIlIllllIIIlIIlllIIIIIlIlllIIIIllllllIlIIlllIlIlIlllIIIlIIllIIIIlIllIlIlIlIlIlIIlllIlllIIllIIllIlIlllIlIIlllIIIIll.jar

Filesize
688KB

MD5
6696368a09c7f8fed4ea92c4e5238cee

SHA1
f89c282e557d1207afd7158b82721c3d425736a7

SHA256
c25d7a7b8f0715729bccb817e345f0fdd668dd4799c8dab1a4db3d6a37e7e3e4

SHA512
0ab24f07f956e3cdcd9d09c3aa4677ff60b70d7a48e7179a02e4ff9c0d2c7a1fc51624c3c8a5d892644e9f36f84f7aaf4aa6d2c9e1c291c88b3cff7568d54f76

Download Submit
C:\Users\Admin\Desktop\Dark Crystal\DCRat\lib\IIllIIIIIlIlIIlIIIllIllllIIIlllIIIlIlIIlIlIllllIIlIIllIlIlIllIIIIIlIlllllllIIIIlIIlIIllIIIlIlIlllIIIIllllIllIIIIIIlIllII.jar

Filesize
1.5MB

MD5
9ea3f51be2154e9b797e575153310a19

SHA1
feaf787cd94bb60e8bfacad21b4346c358b55c0a

SHA256
97758e611a82fc721ab1a7d2542b3ec33b1124e03b4c4798720a4c3756470ed0

SHA512
a5cace6e7069909a2aa8bacbe5e8dca61ecb195f4696a7467a0d1ee0f7f6043afcb27c43c1e1b496cf14aa4dde9e2d61352145840bac3bcb996b0bf2c047db37

Download Submit
C:\Users\Admin\Desktop\Dark Crystal\DCRat\lib\IlIIIIllIIIIIIIIIllIlIllIIIlIIllIIlIIllIIlIlIIIIIIIIIIlllIIlIllIIIlIlIllIllIlIlIlIlIllIlIllIlllIIllIlIllIlIIlllIIIIIlIlI.jar

Filesize
16KB

MD5
b50e2c75f5f0e1094e997de8a2a2d0ca

SHA1
d789eb689c091536ea6a01764bada387841264cb

SHA256
cf4068ebb5ecd47adec92afba943aea4eb2fee40871330d064b69770cccb9e23

SHA512
57d8ac613805edada6aeba7b55417fd7d41c93913c56c4c2c1a8e8a28bbb7a05aade6e02b70a798a078dc3c747967da242c6922b342209874f3caf7312670cb0

Download Submit
C:\Users\Admin\Desktop\Dark Crystal\DCRat\lib\IlIlIIIIIIlIIIIIIllIlIIlIllIllIlIIIlIllllIlIlllIIlIIllIllIIlIlllIIIllllIlIllIIIIIIIIIlIIlIllIIllIIlIllIIIIlIIllIllllIlIl.jar

Filesize
2.3MB

MD5
6316f84bc78d40b138dab1adc978ca5d

SHA1
b12ea05331ad89a9b09937367ebc20421f17b9ff

SHA256
d637e3326f87a173abd5f51ac98906a3237b9e511d07d31d6aafcf43f33dac17

SHA512
1cdca01ed9c2bc607207c8c51f4b532f4153e94b3846308332eccae25f9c5fddf8279e3063f44a75dd43d696eab0f9f340f9bf2f3ec805ab0f2f1de5135a426c

Download Submit
C:\Users\Admin\Desktop\Dark Crystal\DCRat\lib\IllIIIIIIIlllIIIlIlIllIIIIIllIllIlIIlIllIlIIlIllIIlIlIlIlllllllIIlllllllIIlIIIlIlIlIIlIllllIlllIIllllIIlllllIllIIIlIlIlI.jar

Filesize
103KB

MD5
b47c87129ff035cbf60ad5fd15b9ce32

SHA1
8819ba0dbd3f9f2df2a3b18554d31386925dcabe

SHA256
c25b377d6776b3c6c538340cae263c4c3dea7c4f94961bbe323ff79c569fce3c

SHA512
d022b363dc6e4e183ae6ea44b5019d088bddf63b4f85ce4676775388c76df01e3e8a63a0ca03f0e4f1191c121a28393a5da47cd7dc05d84d12722f4835909cd6

Download Submit
C:\Users\Admin\Desktop\Dark Crystal\DCRat\lib\IllIIIIIIlIIIIIlIllIIIIlIlIIIIlIIllIIllIIlIlllIlIlIlIIIlllllIlllIllIIIlllllIlIlIlIlllIlIIllIlIIlIlIIllIlIIllIlIlIIIlIIIl.jar

Filesize
31KB

MD5
6c7ed18ba835a47b32bac14d83c90bc1

SHA1
6a8237ae3f6cccd788aa47b2ecc22f580e810a01

SHA256
7f2f1bbfad38be1382913af2b7c2622470fa3af976fbd1f386c189af8ad136fa

SHA512
9670ede560347dffbbb0761e2de817ddbc426daa0fd97a53b1fd3c8a031dd6d5c2b0c6cebb21d1dffd23b45e504895736634939f75c39c48d580542ccd7ea66c

Download Submit
C:\Users\Admin\Desktop\Dark Crystal\DCRat\lib\IlllIIlllllIIllIIIlIIlIlIlIllllIlllIllllIIIIIlIllIIIIllIIlllIllIlIlIlIIIIllIllIIllllllIllIIlllIIIlIllllIlIllIIIIIIIIlIll.jar

Filesize
19KB

MD5
0a79304556a1289aa9e6213f574f3b08

SHA1
7ee3bde3b1777bf65d4f62ce33295556223a26cd

SHA256
434e57fffc7df0b725c1d95cabafdcdb83858ccb3e5e728a74d3cf33a0ca9c79

SHA512
1560703d0c162d73c99cef9e8ddc050362e45209cc8dea6a34a49e2b6f99aae462eae27ba026bdb29433952b6696896bb96998a0f6ac0a3c1dbbb2f6ebc26a7e

Download Submit
C:\Users\Admin\Desktop\Dark Crystal\DCRat\lib\lIIIIIIllIllllllIIlllIlIIIIlIIllllIIIIIIIIllIIIIIlIIIIIIIlllIIIIIIlIIIlIlIlIlIlIllIllIlIllIlIlIIllIlIIIIlllIllIIllIIlIIl.jar

Filesize
12KB

MD5
3e5e8cccff7ff343cbfe22588e569256

SHA1
66756daa182672bff27e453eed585325d8cc2a7a

SHA256
0f26584763ef1c5ec07d1f310f0b6504bc17732f04e37f4eb101338803be0dc4

SHA512
8ea5f31e25c3c48ee21c51abe9146ee2a270d603788ec47176c16acac15dad608eef4fa8ca0f34a1bbc6475c29e348bd62b0328e73d2e1071aaa745818867522

Download Submit
C:\Users\Admin\Desktop\Dark Crystal\DCRat\lib\lIIlIIlllIIIIIIlllIllIIIlIlIllIlllIlIllIllllIllIIIlIlIIIlIllIllIIlllIlllllIIIlIIlIIlIIIlIlllIIllIIIIlllIIIIlIIlllIlllllI.jar

Filesize
250KB

MD5
fe734f7ab030363362fe3d3ba5e8f913

SHA1
2e9d54e3b410557c51c3ea101d66efbb5266b80a

SHA256
03ead999502aefbf1380bd2e9c4a407acb7a92a7b2fe61f6995aba3fca85efd4

SHA512
303ecea5f3f1130f473cde0d78270090290b6f13311bf7459282257ac3097b2b6086db461183f2d8c97a9101372155bf59bbfa12a74925136d0a2a615b648b2a

Download Submit
C:\Users\Admin\Desktop\Dark Crystal\DCRat\lib\lIlllIIlIIlllIIllIIIlIIIIIlIlIlIIIIlIllIIlllIlllIllIlllIlIlIlllIIllIIllIIIlIllIIIlllIlllllIlIlIIlIIIIIllllIlIllIIllIllII.jar

Filesize
40.9MB

MD5
a79962478f0c9e68ee23bbc73e625f44

SHA1
dc36757e451b0e245b480dfd19414272f2c71e81

SHA256
5f1a6feb4982237110d8e8a01abe3db4cbc66722eb685411738fc77f4f4d2b09

SHA512
356ec49dc32cc1126fbc601c1d5a04acdd1c15ee2bd4c24b0e34d4740446743a1102c255741a65c3055f9ee8575368386ec37babc8ef9ef412a787f0ac2e67f5

Download Submit
C:\Users\Admin\Desktop\Dark Crystal\DCRat\lib\lIllllIllIlIIlIlIlllIIIllIIIIlIIllIllllIIlIIIIIlIIIlIIIIIIIIIIIIIIllIllIIlIlIlIlllllIlllllIIIIIIlIlIIIlIIllllIlIIIlIlllI.jar

Filesize
226KB

MD5
5134a2350f58890ffb9db0b40047195d

SHA1
751f548c85fa49f330cecbb1875893f971b33c4e

SHA256
2d43eb5ea9e133d2ee2405cc14f5ee08951b8361302fdd93494a3a997b508d32

SHA512
c3cdaf66a99e6336abc80ff23374f6b62ac95ab2ae874c9075805e91d849b18e3f620cc202b4978fc92b73d98de96089c8714b1dd096b2ae1958cfa085715f7a

Download Submit
C:\Users\Admin\Desktop\Dark Crystal\DCRat\lib\lIlllllIIlIllIllllIIIIlIIlIIIIIllIlllIIlIIllIllIIIlIIlllIllIIlllIIIlllIllllllllllIlIIIlIIlIllIIllIlllIlIlIIIIIIlllllIIlI.jar

Filesize
16KB

MD5
fde38932b12fc063451af6613d4470cc

SHA1
bc08c114681a3afc05fb8c0470776c3eae2eefeb

SHA256
9967ea3c3d1aee8db5a723f714fba38d2fc26d8553435ab0e1d4e123cd211830

SHA512
0f211f81101ced5fff466f2aab0e6c807bb18b23bc4928fe664c60653c99fa81b34edf5835fcc3affb34b0df1fa61c73a621df41355e4d82131f94fcc0b0e839

Download Submit
C:\Users\Admin\Desktop\Dark Crystal\DCRat\lib\llIIIlllIIIllIIIIllIllIIlIIIlIllIlIIIIlIlIlIIllIIIlIIIlIIlllIIlIlIIIlIllllIIIIlIllIllllIlllIIlIIIIllIlIlIIlIIIllllllllIl.jar

Filesize
549KB

MD5
55b846c68a6cbaa2344342d8d7f0c779

SHA1
cb82af503d6d515a9fac3ec6adfb5a1a36eb6e46

SHA256
bb3bde3c3729767432620b0e865dbc1b517132ce3dbfd69a817f2bc617ff031f

SHA512
16a04125f44c0844dc7b39b13aef6ce4006e0c97a8f2b3ca160e2f623f5e4a9f439862270cb4cd8be80a5766c69fda0ca454c50310e5a579abfdf976b4b030a8

Download Submit
C:\Users\Admin\Desktop\Dark Crystal\DCRat\lib\llIlIlIIIIIIllIllIIllIIlIlIlIllIIlllllIIlIIIIlIIIIIllIlIlIIIlIlIllllIlIlllIIlllIllIIIlIllllIIIllllIlllllIIIIIIllIlIIlIIl.jar

Filesize
19KB

MD5
fc6a26acdce0acd2d56904e17bc79f0e

SHA1
2e63d25e9ac5ac594e6b66103b88a0b8228a4dbe

SHA256
2759150bc72303fe10e6dfab84087a77bafa22af97b4f4760f4466d96adca806

SHA512
3f74f96b9ebb51c5d2237585eba0a838a4f601a9af8260cbe2ee68b9c321fb7aaf90f91506df133f873952d9ca5064ceacbf39fef8bfa0457c6e7b716fe1223c

Download Submit
C:\Users\Admin\Desktop\Dark Crystal\DCRat\lib\llIlIlIIlllIllIlllIlIIIlIIIIlllIIIllIllllIIIIIIIIlllIlIIlllIIllIIllIlIIIllIIIIlIIlIllllIlIlllIllIIIIlIIlllIlIlIllIIlIllI.jar

Filesize
50KB

MD5
d093f94c050d5900795de8149cb84817

SHA1
54058dda5c9e66a22074590072c8a48559bba1fb

SHA256
4bec0794a0d69debe2f955bf495ea7c0858ad84cb0d2d549cacb82e70c060cba

SHA512
3faaa415fba5745298981014d0042e8e01850fccaac22f92469765fd8c56b920da877ff3138a629242d9c52e270e7e2ce89e7c69f6902859f48ea0359842e2fb

Download Submit
C:\Users\Admin\Desktop\Dark Crystal\DCRat\lib\llIlIllIllIllIlIlllIlllIIIllllllIlIIlIllIlIlIlllIllIIIIIlllIIlIIlIllllIIIlllIllIIlIIIIIIlIlIIllIIIIlIlllIllIIlIlllIIIllI.jar

Filesize
262KB

MD5
cf99a6b63f45f7f20963e43b55766d26

SHA1
9e2f86dff86eb065fb6fcf776da8b148ebb21e60

SHA256
e29ee818b2e7ef9fb3ebae9a49a3d6613f18ea2b756a305eecf8a7fe083d1972

SHA512
af7302d350d45837e207dcc91bd95e5891b62f19c682a7443d65feeee0aa6f3d0040c9a67a990cd9a81dfc6b899ffabbb01b44bda830d5bb48332419e2b65930

Download Submit
C:\Users\Admin\Desktop\Dark Crystal\DCRat\plugins\Audio_native.plg

Filesize
134B

MD5
8ac7b72bc99bf0963d72f1e6f5cb3daf

SHA1
bdb16c87ae2ec6e3a029f5317816a70ddade3857

SHA256
90aef04ca6ae7221a44b45e50d8a9a9e1bff6e4ed17c5883fe0c6560c8db5206

SHA512
3958443b7e73135b310db53bc7cd4da871ce3ddcce0fbad5c77405f36af38474e50ee3d4748bec2e7b1207b36b5a3695ab1006fc37071bb28ad8e32b59dab6bb

Download Submit
C:\Users\Admin\Desktop\Dark Crystal\DCRat\plugins\Audio_native\configuration.json

Filesize
154B

MD5
27b29dfa53c8bdc9112efc58149ad8ca

SHA1
739e9d401e13aebb90f30af0c090a115ca10849d

SHA256
0e70b651580562952f265ad855607c9b118492aa4abaa52d995bc0b10c1ed603

SHA512
08bbee207c35880ce818b422af2f8847c6ba1ee0360bb947e141e8ae2a12c1e2fb0aaca0a63c99a705b01d7c482d2277d7740754195ae2ac69f0be39ec9ccb08

Download Submit
C:\Users\Admin\Desktop\Dark Crystal\DCRat\plugins\Autorun_native.plg

Filesize
120B

MD5
a3a068663e768c251433ae27ff6b1267

SHA1
414e98bee4fdfefa632681cea326f75656fb1502

SHA256
6507b86f8289eb0649bdfac6303d7101c266731556c40b35944932519216b5c3

SHA512
da5c4a737896e6e2891e757a1dedad0a82d28c84a41c8299c1e225d85c02410ae9bfe53f2da8797d4d44aa61da42c94f39bf312c3c59014b5e51975e63e95121

Download Submit
C:\Users\Admin\Desktop\Dark Crystal\DCRat\plugins\Autorun_native\configuration.json

Filesize
177B

MD5
25f49a2d7ccbbf6dc38aa096d300fb96

SHA1
0613a4747d39ded5a679f79dd5083da36a85dd3f

SHA256
355bd7c67cd14e4f2e687aef644eb33deb3b52b8502a6a9622c06067d8a5885c

SHA512
9a8485d9e564e0e9dd507f525fbe7fc80e2f9436e2371ccdb71b4cc99df5218d6889423e53f10cf73a26aa20c96ce48257a66bb1b60614541ac1d5190cba0069

Download Submit
C:\Users\Admin\Desktop\Dark Crystal\DCRat\plugins\BrowsersStealer_native.plg

Filesize
146B

MD5
c961b23e2ea7ae8b9ef0dbbf89858828

SHA1
4abf9cac5fd6b4921a46e14e7a4572a50b88c430

SHA256
b3ffa55519f1c9c57c7d712aff8e9c52b06c5b9dfab1fc6113a79b734ba5a211

SHA512
f818449a12c20132c28309cb6c7301847e8d27544966038915ee5d5dd2f391cf29a0a47c4f9da3ecfc126337bbf63fe82cd511b2887cc8dfa291718bf62e7643

Download Submit
C:\Users\Admin\Desktop\Dark Crystal\DCRat\plugins\BrowsersStealer_native\configuration.json

Filesize
164B

MD5
a6bf5267dc19edb590fe2f3f3b22181d

SHA1
939974f8abfc21d5130902e85a35e6be9a7c78d1

SHA256
86d09d372465eabb63483cf983455efcdfac168d40f401ea4699db05f0cf1d96

SHA512
2a10d9611abc6b26a9c2abd2312578adc75704159327c33ea4026ad0342b3dd2ddd2f809b7b1619704887797f7241a14b558c32e8d5532b1212cc0e424014703

Download Submit
C:\Users\Admin\Desktop\Dark Crystal\DCRat\plugins\CMD_native.plg

Filesize
128B

MD5
4629063bdef75a733472882f7d043118

SHA1
37c017a596e97d2cb8a854cb9dffa62ee151053e

SHA256
6a251d511466b148dffaa608afd752399eed02a79fc6e1c9ee305d1aec473781

SHA512
2fa246addeaf31f09c22cf9ebbbd852317167276832908f85d300dd0a1dcca2c962cd40f1c95fc085278e86bf8bcb2f40892f76e59c3e9a84ea7130ef81f9528

Download Submit
C:\Users\Admin\Desktop\Dark Crystal\DCRat\plugins\CMD_native\configuration.json

Filesize
152B

MD5
3df4e2d044af857fab8bdb9c46a565e4

SHA1
f5dbdeb6c1e8c5fd6a7019dc1c60bd197ec80db0

SHA256
676a72640659bd910f3a0764695a27f47648bb47a52c82d17672dbac2caba65d

SHA512
73dcabb1e4bb60b6f92052144b4d1fe06a5a095df9a6b82186fa7c3732869f4cb2d10668d2f3625e457b7b9dc27c884dc90d89e9f74bea32bfdfe5d943c5d127

Download Submit
C:\Users\Admin\Desktop\Dark Crystal\DCRat\plugins\Chat_native.plg

Filesize
131B

MD5
784309ece3edf0be434916dbe3ef827e

SHA1
ac618954e4c98897b03508b2b5eb94704325ac75

SHA256
39b1a342bd729c5e7a9fc38485c1a34b223840b16c55da51dd6119b0b9859f64

SHA512
65cf0f23f8a5496eb57ef08cdfab5c1162c10cf18ee6bb7478a5e742a34794bff7d963cfdf5aa047657c1934dcc876fd7add217db9e9c511d61fd2f5b1edd8b0

Download Submit
C:\Users\Admin\Desktop\Dark Crystal\DCRat\plugins\Chat_native\configuration.json

Filesize
153B

MD5
78fe0b20fb0683bc13739513cf826f2f

SHA1
2afa83e9ff6495260ccc27829e8539762c8de3ea

SHA256
2d5abb9269144f96a3126aa02ad5a5108989e83583f22acfcdbb1fb7319d5aa5

SHA512
9c1560e50723a09e1ab04cf922295bc7c180e1c35dae1089964ff94051b231af797897e3612ca5f24dd73247340e11ee4f20be506ab25afdf219e8fa67eb9bb1

Download Submit
C:\Users\Admin\Desktop\Dark Crystal\DCRat\plugins\ClientsStealer_native.plg

Filesize
143B

MD5
e8e671b4d9266af293efd3dc106b1a6d

SHA1
cef9ff0b5b23767a049062c1b18fbeeb60250f56

SHA256
3048fee32fd98c549f3568f14dd9985c776dfde3f6dfd4772c74f05a7212835e

SHA512
3e4f8e3afb018e2fee400b56ae7310a87b2ccd141fbb5d5f7c2a6e9b3f69d1a0a1bf12a3bb7c7633fca7215e4f8238f50d07fd60d7fb0cc0a14d6d14678653fa

Download Submit
C:\Users\Admin\Desktop\Dark Crystal\DCRat\plugins\ClientsStealer_native\configuration.json

Filesize
163B

MD5
d3b2e0627432012083215387f96d9ef9

SHA1
207ab0e6d4bac1a996a1ba327c5153527729cd0e

SHA256
cb9a59527f96f79a509b9c2ce18ed4dca46656f225add8148d81005f85e4b8c8

SHA512
a112539e8ff035cc558532f51a854cdfbb3ac65ca0819639129d337d3d2577c20234634b3bb6e09cc737a43a7c36f1c75756a6e87e26ede951052b3926b10d3f

Download Submit
C:\Users\Admin\Desktop\Dark Crystal\DCRat\plugins\Code_native.plg

Filesize
131B

MD5
f085b0bbe5365f543baff07b40713274

SHA1
f16346d8a880ee61386af264107320b6f917cf62

SHA256
7bb29808fe64c6c36904aad6439b23291ce12c8cc45bcaa7be5942c7062e1fe8

SHA512
222c4dbdb3681a23b2ce94b88dc40213f60a1a48691b0253fbbc12d1114f8121080e8f07864de9915e35560f14700ec53200a304726559db39a0453e9a937c3c

Download Submit
C:\Users\Admin\Desktop\Dark Crystal\DCRat\plugins\Code_native\configuration.json

Filesize
153B

MD5
64114564fd2ac6a6715f16ed470345b6

SHA1
ecabc2a7ddcb0230bec547c118a252a05a9780ec

SHA256
23b8f658205d40e7d04ef1a2089466de1bc80ab5a336b6953551f7ed29370c17

SHA512
267d396ae26d4de8c573b52fdeb2ec82977ba8918b1c14aadd53a2567c61f759bffea417bebe4e4ca9d8c70933ac95b3bb594383154d373e6cc78927f30d6272

Download Submit
C:\Users\Admin\Desktop\Dark Crystal\DCRat\plugins\Common_native.plg

Filesize
137B

MD5
7a38e79f706f9169e4f842e7d58c60ac

SHA1
9eee0de07688701618d4bf60543816683a74dcf8

SHA256
deb95e89516c7cb405f20cd83e74b58b2b31f1ab3c062e2b3b4529618ed3b122

SHA512
4bf57bc8d4b8b34db49b18fb09c1c42a0406a3ca1fea4390a873af8bd2ebedd6d1d993d6921b76bc52ccf47a2428a2a20f7918691259683c18d6c4edcf5b1efd

Download Submit
C:\Users\Admin\Desktop\Dark Crystal\DCRat\plugins\Common_native\configuration.json

Filesize
155B

MD5
95089808e2bc839604c455731996f8e0

SHA1
63528ba2da349a9412aa4ad6f9a657d3c6c4165a

SHA256
9798a0842677c687c4eb35d84a95ae34224e7bff0462a7361769e02360b01d2e

SHA512
195fb5dd62bebba1cb61f34bf87ac61b3c0931f302ecc85fa10e99932edea9f928f930564b8407b6b8ac6e3d5c5b6b709a9ad09ac047ceb967f7f88c4c90e037

Download Submit
C:\Users\Admin\Desktop\Dark Crystal\DCRat\plugins\CryptoStealer.plg

Filesize
172B

MD5
163fe7452399acb591716d660a84af43

SHA1
f893924a05ba156452dfcd2cef69787699e87fb3

SHA256
35a7642b16a055a987b5c0af6805b8ffbadf9dbec07f9633150e9aab2bfebee6

SHA512
f330dab2d54236475d8b3d7f8ca8cc2972dc45a351e8f0dd9830e80ee5252e1f96bb758e1004c8de310f7b49b5e807625d1bf609753e27950ee73be53c1ad0c6

Download Submit
C:\Users\Admin\Desktop\Dark Crystal\DCRat\plugins\CryptoStealer\configuration.json

Filesize
175B

MD5
0a5dfad2ffa3b0fffd63d201a17ba41d

SHA1
6d7498e0bc4a651e282a40fb6bd9aa859bddda88

SHA256
338dd48d443a28c1b9cac2b13dd27db41f72f8d0f32746e1bc00603f81acbf6b

SHA512
f61865a1361560aca9841a0dbf53ce9eb992d4c27f9cba16350aaf4c36c236a6f6215b0ba38a6cd66e402b3e5be13ecde61df82278a3a3addddc541f7d25f031

Download Submit
C:\Users\Admin\Desktop\Dark Crystal\DCRat\plugins\DomainsHighlighter.plg

Filesize
181B

MD5
1a0eb1ba9734e28f4e56cdc1e50d45b0

SHA1
94f1630048de700b5d6a05c599d27c11ac8d9c91

SHA256
a1fe11a8efe2f72024d20dbf33a718d17b607684c7b8d2a3d30420237bc4aac4

SHA512
fbe5a04268c2e28594904154352cd6b60f407956b5818a0d346879a9c1d7114a6430347657ae02963d4bb158d94de2b11745f6f150ca4249cf6e51ad0b90cf33

Download Submit
C:\Users\Admin\Desktop\Dark Crystal\DCRat\plugins\DomainsHighlighter\configuration.json

Filesize
185B

MD5
f807f991df3a924e3d840703cc69a0ed

SHA1
81459583af0d0e1376ef85c53039ea90d459d81b

SHA256
cec1d4f7f5c81dfb212234855f42fea02561e6b6580860074853ceee1cdf26ac

SHA512
449ae092e1bc8155fe5b4ab256c322933776e6da139723762098e8afd85dcd6d1ad8f9b666e642f5840ac7b948a1e14b93350c26c2af54eb30cf84b0f99fb6b8

Download Submit
C:\Users\Admin\Desktop\Dark Crystal\DCRat\plugins\FileGrabber.plg

Filesize
181B

MD5
67785737ebee5895b964f0cf0f9d7816

SHA1
7473fcec1ef769769a3d0b25abed0ee250cade32

SHA256
611cdd2b040f33e01126ed65b5bed7f81d86ab27362265a8ee41bf23956515b8

SHA512
3ead8ff131414437212807416504a765ad4b4d43e5ae2e34c931ea73eb0b55b22e00c3584b41723dec944231880d421ca48ee8e6cd3c5671e217add29d3b7092

Download Submit
C:\Users\Admin\Desktop\Dark Crystal\DCRat\plugins\FileGrabber\configuration.json

Filesize
171B

MD5
1eb10aa566dca3e370ccc7c614f74ed1

SHA1
093c11d185a7bddc00b6db83ebbcf4501ad879ca

SHA256
577f6fc8ecde7b244cb22db64cfa4849f3a1c577a98c9350cbaec863aa87621b

SHA512
abb609446a6b3abf52b2e5f172e8aa2e4195a6b341811c1e8779f1a42592151b1e60b64d57d53ce958ba1d9ebf8fc74490662186618d783121880798c5e456ca

Download Submit
C:\Users\Admin\Desktop\Dark Crystal\DCRat\plugins\FileManager_native.plg

Filesize
154B

MD5
8a1c44ece7e46eaca58e3ad2767f2fe3

SHA1
f70447ee75ed7d218654aaf0f085561209352db2

SHA256
88f3b5540e2ad220225894955e6cf05d4c46ece38c67b597e46f9ad3924f4fba

SHA512
4815f3464c53dc8a9b8f04dba10005b180809579af31c0f3681492b9d87ca4937c91719fe9296bbc19c149adaf4b84c4022af18cfc1e0b533122efffc39bdf09

Download Submit
C:\Users\Admin\Desktop\Dark Crystal\DCRat\plugins\FileManager_native\configuration.json

Filesize
160B

MD5
761e69e04cf0019bb57409cbeebec0bb

SHA1
4dfde249c9deca8dbc84162df71a9789d12eb87c

SHA256
f5ea910df747890070605afbdf0bc582001d7eace14187a4809b9c73feb10f3e

SHA512
4983b8f8243d4acb6cc03f44b585cf12c86b6bd34df3b176c44cff64d9757ba6278d221edb970d27aea5910a831743b9a94b08e3ebc554b7ebaaaaa383392e2a

Download Submit
C:\Users\Admin\Desktop\Dark Crystal\DCRat\plugins\ForceAdmin.plg

Filesize
191B

MD5
a49b7db6725658b29881173f748a93b6

SHA1
aed674294ba9f833e75194a990cc861a3e54da44

SHA256
0093ee4152a54954914e4eca70fabb7f0e4b0bf032edb5f44f7a25420322dd09

SHA512
dc0bbd216e5ebbd36c9b12e4092b2a9e84e7bb9b05a05f7934cef6ea66983c601cf8045b8f07155ed8fedfa570c93dafda67068f2adfc2cd46c2da397cf18db0

Download Submit
C:\Users\Admin\Desktop\Dark Crystal\DCRat\plugins\ForceAdmin\configuration.json

Filesize
152B

MD5
3feeeaa04e23d80c113eeea1e318f3ff

SHA1
a72ff5e15f500e7cda9694ee83b04c752c0422c4

SHA256
0086dd54110698ed0a2365dec397c968d1ca71b608bb0eb89e7de7746349e39b

SHA512
4a4399649066353ce6b19976b50f67a3b62bec4905afa776900522a7f55f4f050aa68ef76f4b72873447a0aa9e551e04d699d477ac8d5baf1ffe9e33a3d742ae

Download Submit
C:\Users\Admin\Desktop\Dark Crystal\DCRat\plugins\Fun_native.plg

Filesize
128B

MD5
0bee4971d216e821978d17e011c12b77

SHA1
6174992174087a26d3956a9aa4a171b229e2128f

SHA256
a9c1ad17732a655b559ff069442c8c850a46ab5e29470e20588e52f75074311c

SHA512
661c1241b2da849a4509bfb62b16b50bfe8c94d5e769e65076de46420ae2e7c66c4dc7a883b4a232aba629fd2a4c59338f2e1578cd0a67dd55044d6d6ee51540

Download Submit
C:\Users\Admin\Desktop\Dark Crystal\DCRat\plugins\Fun_native\configuration.json

Filesize
152B

MD5
143816a3ed0fa2d30b0a80ce6c785de0

SHA1
a7068228cbfb78ddaa490000b1bb9f363176d592

SHA256
7585f3b80568c39c79e9dc7ee8e799e6d375f14e2e266751a4cfcc88aaf7676b

SHA512
c32c6b9ff9d91b8688eeb942c4c333b2bcad417dd3a3fcb1328240ee2e18b6e2bba44fb8dc9a463853ca9b290a90c1e739d34a1e775e86bab632d4398fd47a0a

Download Submit
C:\Users\Admin\Desktop\Dark Crystal\DCRat\plugins\HiddenRemoteDesktop_native.plg

Filesize
180B

MD5
5524b5d071453819ad18cf0d73a23ac6

SHA1
a6ba215d8fab4187e61630889cc2cee9b64167f3

SHA256
790bbd40fbe0e4c223ab96200c8f34489728c11256d6676fadaa237a0c4db46d

SHA512
55d958c781c708977fa0d7999abfc625cfb510b2c6c75aa4da51fcc42361d75914241e667cc7e178d8c519ff36c88f23ec404881100c844331d539e5f35e978c

Download Submit
C:\Users\Admin\Desktop\Dark Crystal\DCRat\plugins\HiddenRemoteDesktop_native\configuration.json

Filesize
168B

MD5
62e513368fcaa6ad41fe9bce46e6724f

SHA1
ab9afba8b9496120891f839a4c6d43dde9e59b08

SHA256
9f2f2d2e74c4fd2ed1a309ff6613ece4ca54e6c12aa8b85b0e63b7433cf4a995

SHA512
ef103ab652783ffc75e37e56325ca09e7f1c12fe5a0a2c284df09dfa6edffb9139bab0a4356d0cc41ea166d0bba5c9ec1b4a02ed0d2f41850b463e6f86295e44

Download Submit
C:\Users\Admin\Desktop\Dark Crystal\DCRat\settings.ccdb

Filesize
2KB

MD5
f0a12e9ea186d85e43da75ea61891856

SHA1
4b6fb6df2c399d90f5975ef748317425f9504e9d

SHA256
21c40cca98b825279eb521efa45e08481f9df02b0192c9543eb4d915f9988b79

SHA512
2b58fc6038e1849374fb3da8fd32b96841767de1b8274253e391cb09570a5cd6c4b704a16c0a4c83ba8d45bf271fa89105127bb404e6e8f91b83afbab7899bc4

Download Submit
C:\Users\Admin\Desktop\Dark Crystal\Patcher\Mono.Cecil.dll

Filesize
354KB

MD5
2f096535c228ab0d2082adfc01678481

SHA1
0e0dcb36aa56e7f99aa524cfb3c72e4918cc5b32

SHA256
c41bdb9ffd3c5f6e17d2382c1012d73703e035e3f1100245fdd4e08c8dc6eb5b

SHA512
9f54b9e85ef70afcb36569885de73bba704a8901c8ddbb5a35de6a1921d4d42f88026aea41ed77ec7a8041ee8a04efef817deda7dea0f29a716dab7a6ea7fd9e

Download Submit
C:\Users\Admin\Desktop\Dark Crystal\Patcher\Newtonsoft.Json.dll

Filesize
695KB

MD5
195ffb7167db3219b217c4fd439eedd6

SHA1
1e76e6099570ede620b76ed47cf8d03a936d49f8

SHA256
e1e27af7b07eeedf5ce71a9255f0422816a6fc5849a483c6714e1b472044fa9d

SHA512
56eb7f070929b239642dab729537dde2c2287bdb852ad9e80b5358c74b14bc2b2dded910d0e3b6304ea27eb587e5f19db0a92e1cbae6a70fb20b4ef05057e4ac

Download Submit
C:\Users\Admin\Desktop\Dark Crystal\Patcher\Patcher.exe

Filesize
1.3MB

MD5
8a0cff97f83483817fe61727ff3de7be

SHA1
85359a79acbd00872fce6c8905fe2d79388b7cb7

SHA256
60add3505ae3d6908981a0dedb8c26aa55916b9e8e7d833ab005a0a6f9792baa

SHA512
50c566e48e5ec4a9461e73dc38c8cff64747f5de3549cf453f77556ea3b220f33cd8eb69b62048a2f49c97c2cf574d645467caa1751eb1189c5b463779d0b417

Download Submit
memory/380-361-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/900-357-0x0000000074C0E000-0x0000000074C0F000-memory.dmp

Filesize
4KB

Download
memory/900-358-0x0000000074C00000-0x00000000753B1000-memory.dmp

Filesize
7.7MB

Download
memory/900-351-0x0000000009680000-0x00000000096E0000-memory.dmp

Filesize
384KB

Download
memory/900-355-0x0000000005120000-0x00000000051D2000-memory.dmp

Filesize
712KB

Download
memory/900-347-0x0000000004AB0000-0x0000000004AB1000-memory.dmp

Filesize
4KB

Download
memory/900-346-0x0000000074C00000-0x00000000753B1000-memory.dmp

Filesize
7.7MB

Download
memory/900-345-0x00000000003F0000-0x0000000000576000-memory.dmp

Filesize
1.5MB

Download
memory/900-344-0x0000000074C0E000-0x0000000074C0F000-memory.dmp

Filesize
4KB

Download
memory/5724-672-0x0000019CC82C0000-0x0000019CC92C0000-memory.dmp

Filesize
16.0MB

Download
memory/5724-662-0x0000019CC82C0000-0x0000019CC92C0000-memory.dmp

Filesize
16.0MB

Download
memory/5724-676-0x0000019CC82C0000-0x0000019CC92C0000-memory.dmp

Filesize
16.0MB

Download
memory/5724-466-0x0000019CC6A40000-0x0000019CC6A41000-memory.dmp

Filesize
4KB

Download
memory/5724-673-0x0000019CC82C0000-0x0000019CC92C0000-memory.dmp

Filesize
16.0MB

Download
memory/5724-665-0x0000019CC82C0000-0x0000019CC92C0000-memory.dmp

Filesize
16.0MB

Download
memory/5724-669-0x0000019CC6A40000-0x0000019CC6A41000-memory.dmp

Filesize
4KB

Download
memory/5724-385-0x0000019CC6A40000-0x0000019CC6A41000-memory.dmp

Filesize
4KB

Download
memory/5724-660-0x0000019CC82C0000-0x0000019CC92C0000-memory.dmp

Filesize
16.0MB

Download
memory/5724-664-0x0000019CC82C0000-0x0000019CC92C0000-memory.dmp

Filesize
16.0MB

Download
memory/5724-663-0x0000019CC82C0000-0x0000019CC92C0000-memory.dmp

Filesize
16.0MB

Download
memory/5724-661-0x0000019CC82C0000-0x0000019CC92C0000-memory.dmp

Filesize
16.0MB

Download
memory/5724-596-0x0000019CC6A40000-0x0000019CC6A41000-memory.dmp

Filesize
4KB

Download
memory/5724-572-0x0000019CC6A40000-0x0000019CC6A41000-memory.dmp

Filesize
4KB

Download
memory/5724-516-0x0000019CC6A40000-0x0000019CC6A41000-memory.dmp

Filesize
4KB

Download
memory/5724-475-0x0000019CC6A40000-0x0000019CC6A41000-memory.dmp

Filesize
4KB

Download