dcrat | 2e8b7a738ae3982c77f5751b4be096be2841167625190c245b7fb1858cd4ccd5

Analysis

max time kernel
148s
max time network
134s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
21/08/2026, 11:12

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
exe.exe
Size 2.9MB
Sample260821-nav4msydrh
SHA256 2e8b7a738ae3982c77f5751b4be096be2841167625190c245b7fb1858cd4ccd5
MD5 9fe596f4a179c407569978a18985a0c1
SHA1 ca42f33c912302e49fa3542f7978962f947419f3
SHA512 77d0d7f7b0365091dc6152a3b69d03a98d3bd24ce958a063f81eae807a08a3d1ca13e81393bf51abf29a18c925d86f49eedd40a6461eea270d678393d7d6bdea
SSDEEP 24576:zTbBv5rUfzpCTn72tmNlgEJMA+uCw7sULqP3NJV08P5Np6JZlP6+cO7TT63:tBA8Tn72tm3mA+IUP0lL2
TLSH
T1D8E5A12439EE102DF1B3BFB59BD47596DA6EBE73370B544E1090238A4633A41DED123A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery execution dcrat infostealer rat

Malware Config

Signatures

Family: DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat

DCRat payload 2 IoCs

rat

resource	yara_rule
behavioral2/files/0x000e00000001c4c3-12.dat	family_dcrat_v2
behavioral2/memory/5620-14-0x0000000000070000-0x00000000002DC000-memory.dmp	family_dcrat_v2

Command and Scripting Interpreter: PowerShell 1 TTPs 6 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
396	powershell.exe
3736	powershell.exe
3380	powershell.exe
3540	powershell.exe
5712	powershell.exe
5392	powershell.exe

Executes dropped EXE 2 IoCs

pid	Process
5620	bridgeagentWebRef.exe
5592	Registry.exe

Looks up external IP address via web service 1 TTPs 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

discovery

Internet Connection Discovery

T1016.001

flow	ioc
3	ipinfo.io
1	ipinfo.io

Executes a VBScript file via the Windows Script Host. 1 TTPs 1 IoCs

execution

Visual Basic

T1059.005

pid	Process
5664	WScript.exe

Drops file in Program Files directory 6 IoCs

description	ioc	Process
File created	C:\Program Files\Windows Photo Viewer\de-DE\Idle.exe	bridgeagentWebRef.exe
File created	C:\Program Files\Windows Photo Viewer\de-DE\6ccacd8608530f	bridgeagentWebRef.exe
File created	C:\Program Files (x86)\Windows Media Player\en-US\SearchHost.exe	bridgeagentWebRef.exe
File created	C:\Program Files (x86)\Windows Media Player\en-US\cfa885d449487c	bridgeagentWebRef.exe
File created	C:\Program Files (x86)\Microsoft.NET\Primary Interop Assemblies\services.exe	bridgeagentWebRef.exe
File created	C:\Program Files (x86)\Microsoft.NET\Primary Interop Assemblies\c5b4cb5e9653cc	bridgeagentWebRef.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\Prefetch\ee2ad38f3d4382	bridgeagentWebRef.exe
File created	C:\Windows\Prefetch\Registry.exe	bridgeagentWebRef.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 2 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5944	cmd.exe
420	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	exe.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
3412	PING.EXE

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Local Settings	exe.exe
Key created	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Local Settings	bridgeagentWebRef.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
3412	PING.EXE

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
5620	bridgeagentWebRef.exe
5620	bridgeagentWebRef.exe
5620	bridgeagentWebRef.exe
5620	bridgeagentWebRef.exe
5620	bridgeagentWebRef.exe
5620	bridgeagentWebRef.exe
5620	bridgeagentWebRef.exe
5620	bridgeagentWebRef.exe
5620	bridgeagentWebRef.exe
5620	bridgeagentWebRef.exe
5620	bridgeagentWebRef.exe
5620	bridgeagentWebRef.exe
5620	bridgeagentWebRef.exe
5620	bridgeagentWebRef.exe
5620	bridgeagentWebRef.exe
5620	bridgeagentWebRef.exe
5620	bridgeagentWebRef.exe
5620	bridgeagentWebRef.exe
5620	bridgeagentWebRef.exe
5620	bridgeagentWebRef.exe
5620	bridgeagentWebRef.exe
5620	bridgeagentWebRef.exe
5620	bridgeagentWebRef.exe
5620	bridgeagentWebRef.exe
5620	bridgeagentWebRef.exe
5620	bridgeagentWebRef.exe
5620	bridgeagentWebRef.exe
5620	bridgeagentWebRef.exe
5620	bridgeagentWebRef.exe
5620	bridgeagentWebRef.exe
5620	bridgeagentWebRef.exe
5620	bridgeagentWebRef.exe
5620	bridgeagentWebRef.exe
5620	bridgeagentWebRef.exe
5620	bridgeagentWebRef.exe
5620	bridgeagentWebRef.exe
5620	bridgeagentWebRef.exe
5620	bridgeagentWebRef.exe
5620	bridgeagentWebRef.exe
5620	bridgeagentWebRef.exe
5620	bridgeagentWebRef.exe
5620	bridgeagentWebRef.exe
5620	bridgeagentWebRef.exe
5620	bridgeagentWebRef.exe
5620	bridgeagentWebRef.exe
5620	bridgeagentWebRef.exe
5620	bridgeagentWebRef.exe
5620	bridgeagentWebRef.exe
5620	bridgeagentWebRef.exe
5620	bridgeagentWebRef.exe
5620	bridgeagentWebRef.exe
5620	bridgeagentWebRef.exe
5620	bridgeagentWebRef.exe
5620	bridgeagentWebRef.exe
5620	bridgeagentWebRef.exe
5620	bridgeagentWebRef.exe
5620	bridgeagentWebRef.exe
5620	bridgeagentWebRef.exe
5620	bridgeagentWebRef.exe
5620	bridgeagentWebRef.exe
5620	bridgeagentWebRef.exe
5620	bridgeagentWebRef.exe
5620	bridgeagentWebRef.exe
5620	bridgeagentWebRef.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	5620	bridgeagentWebRef.exe
Token: SeDebugPrivilege	5712	powershell.exe
Token: SeDebugPrivilege	3380	powershell.exe
Token: SeDebugPrivilege	5392	powershell.exe
Token: SeDebugPrivilege	3540	powershell.exe
Token: SeDebugPrivilege	3736	powershell.exe
Token: SeDebugPrivilege	396	powershell.exe
Token: SeIncreaseQuotaPrivilege	5392	powershell.exe
Token: SeSecurityPrivilege	5392	powershell.exe
Token: SeTakeOwnershipPrivilege	5392	powershell.exe
Token: SeLoadDriverPrivilege	5392	powershell.exe
Token: SeSystemProfilePrivilege	5392	powershell.exe
Token: SeSystemtimePrivilege	5392	powershell.exe
Token: SeProfSingleProcessPrivilege	5392	powershell.exe
Token: SeIncBasePriorityPrivilege	5392	powershell.exe
Token: SeCreatePagefilePrivilege	5392	powershell.exe
Token: SeBackupPrivilege	5392	powershell.exe
Token: SeRestorePrivilege	5392	powershell.exe
Token: SeShutdownPrivilege	5392	powershell.exe
Token: SeDebugPrivilege	5392	powershell.exe
Token: SeSystemEnvironmentPrivilege	5392	powershell.exe
Token: SeRemoteShutdownPrivilege	5392	powershell.exe
Token: SeUndockPrivilege	5392	powershell.exe
Token: SeManageVolumePrivilege	5392	powershell.exe
Token: 33	5392	powershell.exe
Token: 34	5392	powershell.exe
Token: 35	5392	powershell.exe
Token: 36	5392	powershell.exe
Token: SeIncreaseQuotaPrivilege	3736	powershell.exe
Token: SeSecurityPrivilege	3736	powershell.exe
Token: SeTakeOwnershipPrivilege	3736	powershell.exe
Token: SeLoadDriverPrivilege	3736	powershell.exe
Token: SeSystemProfilePrivilege	3736	powershell.exe
Token: SeSystemtimePrivilege	3736	powershell.exe
Token: SeProfSingleProcessPrivilege	3736	powershell.exe
Token: SeIncBasePriorityPrivilege	3736	powershell.exe
Token: SeCreatePagefilePrivilege	3736	powershell.exe
Token: SeBackupPrivilege	3736	powershell.exe
Token: SeRestorePrivilege	3736	powershell.exe
Token: SeShutdownPrivilege	3736	powershell.exe
Token: SeDebugPrivilege	3736	powershell.exe
Token: SeSystemEnvironmentPrivilege	3736	powershell.exe
Token: SeRemoteShutdownPrivilege	3736	powershell.exe
Token: SeUndockPrivilege	3736	powershell.exe
Token: SeManageVolumePrivilege	3736	powershell.exe
Token: 33	3736	powershell.exe
Token: 34	3736	powershell.exe
Token: 35	3736	powershell.exe
Token: 36	3736	powershell.exe
Token: SeIncreaseQuotaPrivilege	396	powershell.exe
Token: SeSecurityPrivilege	396	powershell.exe
Token: SeTakeOwnershipPrivilege	396	powershell.exe
Token: SeLoadDriverPrivilege	396	powershell.exe
Token: SeSystemProfilePrivilege	396	powershell.exe
Token: SeSystemtimePrivilege	396	powershell.exe
Token: SeProfSingleProcessPrivilege	396	powershell.exe
Token: SeIncBasePriorityPrivilege	396	powershell.exe
Token: SeCreatePagefilePrivilege	396	powershell.exe
Token: SeBackupPrivilege	396	powershell.exe
Token: SeRestorePrivilege	396	powershell.exe
Token: SeShutdownPrivilege	396	powershell.exe
Token: SeDebugPrivilege	396	powershell.exe
Token: SeSystemEnvironmentPrivilege	396	powershell.exe
Token: SeRemoteShutdownPrivilege	396	powershell.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 5604 wrote to memory of 5664	5604	exe.exe	89
PID 5664 wrote to memory of 5944	5664	WScript.exe	90
PID 5944 wrote to memory of 5092	5944	cmd.exe	92
PID 5944 wrote to memory of 5620	5944	cmd.exe	94
PID 5620 wrote to memory of 3736	5620	bridgeagentWebRef.exe	95
PID 5620 wrote to memory of 3380	5620	bridgeagentWebRef.exe	96
PID 5620 wrote to memory of 3540	5620	bridgeagentWebRef.exe	97
PID 5620 wrote to memory of 5712	5620	bridgeagentWebRef.exe	98
PID 5620 wrote to memory of 5392	5620	bridgeagentWebRef.exe	99
PID 5620 wrote to memory of 396	5620	bridgeagentWebRef.exe	100
PID 5620 wrote to memory of 420	5620	bridgeagentWebRef.exe	107
PID 420 wrote to memory of 5000	420	cmd.exe	109
PID 420 wrote to memory of 3412	420	cmd.exe	111
PID 420 wrote to memory of 5592	420	cmd.exe	112

C:\Users\Admin\AppData\Local\Temp\exe.exe
"C:\Users\Admin\AppData\Local\Temp\exe.exe"
1⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:5604
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\ComcontainerSession\QXOxC7m7bDPPkgkvCappPoYma6Hu9G9i3un0C9o5Lri5Xn.vbe"
  2⤵
  - Executes a VBScript file via the Windows Script Host.
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5664
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ComcontainerSession\Bgs4QmuzpNkE3eFhZ7BSNDwJfhFcfUXAGAWI61Y9XalSRMbtbge.bat" "
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5944
  - - C:\Windows\SysWOW64\cmd.exe
      cmd
      4⤵
      System Location Discovery: System Language Discovery
      PID:5092
  - - C:\Users\Admin\AppData\Local\Temp\ComcontainerSession\bridgeagentWebRef.exe
      "C:\Users\Admin\AppData\Local\Temp\ComcontainerSession/bridgeagentWebRef.exe"
      4⤵
      Executes dropped EXE
      Drops file in Program Files directory
      Drops file in Windows directory
      Modifies registry class
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:5620
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\Prefetch\Registry.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious use of AdjustPrivilegeToken
        
        PID:3736
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Windows Media Player\en-US\SearchHost.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious use of AdjustPrivilegeToken
        
        PID:3380
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Windows Photo Viewer\de-DE\Idle.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious use of AdjustPrivilegeToken
        
        PID:3540
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Microsoft.NET\Primary Interop Assemblies\services.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious use of AdjustPrivilegeToken
        
        PID:5712
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\fontdrvhost.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious use of AdjustPrivilegeToken
        
        PID:5392
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\ComcontainerSession\bridgeagentWebRef.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious use of AdjustPrivilegeToken
        
        PID:396
    - - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\zB9IPyyWT1.bat"
        5⤵
        Executes a command shell one-liner
        Suspicious use of WriteProcessMemory
        
        PID:420
      - C:\Windows\system32\chcp.com
        
        chcp 65001
        6⤵
        
        PID:5000
      - C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        6⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:3412
      - C:\Windows\Prefetch\Registry.exe
        
        "C:\Windows\Prefetch\Registry.exe"
        6⤵
        Executes dropped EXE
        
        PID:5592

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Visual Basic

T1059.005

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Remote System Discovery

T1018

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 58245b535bb164e85943800b4154e0128260c1a510da112294f1c53edfbfbf07
MD5 47ad9cc420da0514ba1b00c8644623c3
SHA1 ae21313963068b048e67ea7211e2e3b62269795b
SHA512 9aedb22199721ad446e49421651fbdb3e1799bac3d3fae2e8f09644b650ad99fa60b1055e7f5b210d51e587ee1f71ee50c95ba81700a59efeec033da62e9627f
TLSH
T16F216833B3DD8614C89A413A10CDAC1036B6C7DB41DECFAB7B84E655A43F699CE61160
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 e56f4a38e0c60f0196c589e1952198368a10927e65ff24d1476ffafc489657f4
MD5 78b9021e0576c01ec958b87ec52832c1
SHA1 76df758d602c2d4cc4a4bfa0f3b435cae1ed3ffa
SHA512 4402163ed9623a392f120417ea0b5049bf0d76b88dd7f4fc70428ef7e76601f25bd534ae916ed9daba859fb6308d6f370712985ccd165f6393dbce7c5c507514
TLSH
T11F216833F3DD8614C89A413A10CDAC1036B6C7DB41DECFAB7B84E655A43F699CE61160
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 a976a31824c3a0cc2a6b0fd9ec6045c398d82990e5e96df2ad86ba09a9b05be5
MD5 66f9b690d4e5313231bc173ce7b2c029
SHA1 b0dbce2f97d8ca067ddde29c06272e56e38fa195
SHA512 8f0c4c220fc64928778bf68c853246126b44f40fcdc99aa2fdaa491797ce02783c8776fdd7bd3154544336f0466000a8b92c740ed0d0df75b8a6990da450650e
TLSH
T158216833B3DD8614C89A413A10CDAC1036B6C7DB41DECFAB7B84E655A43F699CE61160
MD5 SHA1 SHA512 TLSH

Submit Download

Bgs4QmuzpNkE3eFhZ7BSNDwJfhFcfUXAGAWI61Y9XalSRMbtbge.bat

Path C:\Users\Admin\AppData\Local\Temp\ComcontainerSession\Bgs4QmuzpNkE3eFhZ7BSNDwJfhFcfUXAGAWI61Y9XalSRMbtbge.bat
Size 100B
SHA256 91461264aeeb1696f5b3b71037816bc44c727e4d9adf41dc7afb036723c42afd
MD5 83512b65e17b3726dda70c64fa8805d5
SHA1 0656b4aa0623a3372168d03f5790f47841f948da
SHA512 1304f672f36803c91544afef582158dd167d0ce51f35380260c75ef59db7ab11bd9c1b50180a714c5d4fa7422b29dc7c4c8c04c74fdaa888ba2ff29360680495
TLSH
T1A1B012D1E22AC030BE4015283D3724D337DF9046A451E9D1E018D5044188814131F141
MD5 SHA1 SHA512 TLSH

Submit Download

QXOxC7m7bDPPkgkvCappPoYma6Hu9G9i3un0C9o5Lri5Xn.vbe

Path C:\Users\Admin\AppData\Local\Temp\ComcontainerSession\QXOxC7m7bDPPkgkvCappPoYma6Hu9G9i3un0C9o5Lri5Xn.vbe
Size 249B
SHA256 41eeea84d2377000f2e61344c28b871b81f5a1a6b74bba0914904fd30bf19fa5
MD5 e213c6f84c97dbc423a190781d5fb103
SHA1 82b06acbe041e1d39df30f61b5d9b119ca93bf23
SHA512 9178cdc810b9a5d78d94000da84fdf92c352175c4dc323c32ea55a04e8fa1e4c3da48992464104bd00e5e287d4781dc4f89d78cdfac14e873da50dd08011458f
TLSH
T1F7D09520CDF3935494C80646E330AC3D1C40AF1AD3F8D13100F8D509C105147303C3E1
MD5 SHA1 SHA512 TLSH

Submit Download

bridgeagentWebRef.exe

Path C:\Users\Admin\AppData\Local\Temp\ComcontainerSession\bridgeagentWebRef.exe
Size 2.4MB
SHA256 9e3a4d73345f068d9a6142ca75b6d0ad17b68aa3187fd57fcc55157308adc554
MD5 e7e02b0ee625cc44711555fc32ab0b6f
SHA1 fed379603b4346281cf420229c79feef97d6ee23
SHA512 2373e2c3c308e2ef045867bc13c89ee7966be8d074f4fb2d42038a25fa93d7fd1501905e3d8b7856875196226575cb0dfe69a23e3228e193c91d961c5ba0f96b
SSDEEP 24576:ZCTn72tmNlgEJMA+uCw7sULqP3NJV08P5Np6JZlP6+cO7TT6:sTn72tm3mA+IUP0lL
TLSH
T1A2C57D2839EE502AF1B3EFB59BE47896D96FF673370B945D009103864713A41DEC263A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_m2nz0qjp.dyw.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_m2nz0qjp.dyw.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

zB9IPyyWT1.bat

Path C:\Users\Admin\AppData\Local\Temp\zB9IPyyWT1.bat
Size 160B
SHA256 8147bfe0a1215eb4144d1df939c9f585014a7f7fe1e42ab48b2750bcc44d4f93
MD5 3eff64721be93670e9426cf2c27b9988
SHA1 6c1397f2aa16aa61ca9c6797d9769926d971550f
SHA512 2cc899bfa465cf8ac4616883d07edb6b048c099eae37bafd4b71819a30cc4f57b366acdebf749eb41ef7344952befe1be5581b38a7885de528115f802b914e03
TLSH
T1D9C08C924482C21A0B30884628C67789B05B08D92E45EA0201144E58A68BD9C69EB5C3
MD5 SHA1 SHA512 TLSH

Submit Download

memory/396-96-0x00000225E7DF0000-0x00000225E7EE0000-memory.dmp

Download

memory/3380-93-0x0000017944E10000-0x0000017944F00000-memory.dmp

Download

memory/3540-102-0x0000024AF8B90000-0x0000024AF8C80000-memory.dmp

Download

memory/3736-92-0x000001ADC0800000-0x000001ADC08F0000-memory.dmp

Download

memory/5392-87-0x00000191EDE20000-0x00000191EDF10000-memory.dmp

Download

memory/5392-81-0x00000191ED6F0000-0x00000191ED6FA000-memory.dmp

Download

memory/5392-74-0x00000191ED820000-0x00000191ED8D2000-memory.dmp

Download

memory/5392-73-0x00000191ED6D0000-0x00000191ED6EE000-memory.dmp

Download

memory/5592-104-0x000000001B7F0000-0x000000001B898000-memory.dmp

Download

memory/5592-105-0x000000001B9A0000-0x000000001BA90000-memory.dmp

Download

memory/5592-106-0x000000001E9B0000-0x000000001EA24000-memory.dmp

Download

memory/5620-23-0x000000001B060000-0x000000001B072000-memory.dmp

Download

memory/5620-62-0x000000001B860000-0x000000001B908000-memory.dmp

Download

memory/5620-32-0x000000001B460000-0x000000001B4BA000-memory.dmp

Download

memory/5620-33-0x000000001B0C0000-0x000000001B0CE000-memory.dmp

Download

memory/5620-34-0x000000001B400000-0x000000001B410000-memory.dmp

Download

memory/5620-35-0x000000001B410000-0x000000001B41E000-memory.dmp

Download

memory/5620-36-0x000000001B420000-0x000000001B428000-memory.dmp

Download

memory/5620-37-0x000000001B4C0000-0x000000001B4D8000-memory.dmp

Download

memory/5620-38-0x000000001B430000-0x000000001B43C000-memory.dmp

Download

memory/5620-39-0x000000001B530000-0x000000001B57E000-memory.dmp

Download

memory/5620-47-0x000000001B860000-0x000000001B908000-memory.dmp

Download

memory/5620-48-0x000000001BE60000-0x000000001BED4000-memory.dmp

Download

memory/5620-30-0x000000001B080000-0x000000001B090000-memory.dmp

Download

memory/5620-14-0x0000000000070000-0x00000000002DC000-memory.dmp

Download

memory/5620-29-0x000000001B050000-0x000000001B05C000-memory.dmp

Download

memory/5620-31-0x000000001B090000-0x000000001B0A0000-memory.dmp

Download

memory/5620-63-0x000000001BE60000-0x000000001BED4000-memory.dmp

Download

memory/5620-28-0x000000001B930000-0x000000001BE58000-memory.dmp

Download

memory/5620-27-0x000000001B3E0000-0x000000001B3F2000-memory.dmp

Download

memory/5620-26-0x000000001B0A0000-0x000000001B0B6000-memory.dmp

Download

memory/5620-25-0x000000001B040000-0x000000001B050000-memory.dmp

Download

memory/5620-24-0x000000001ADD0000-0x000000001ADDC000-memory.dmp

Download

memory/5620-22-0x0000000002360000-0x000000000236E000-memory.dmp

Download

memory/5620-21-0x0000000002320000-0x0000000002330000-memory.dmp

Download

memory/5620-20-0x0000000002310000-0x0000000002320000-memory.dmp

Download

memory/5620-19-0x0000000002300000-0x0000000002310000-memory.dmp

Download

memory/5620-18-0x000000001ADE0000-0x000000001AE30000-memory.dmp

Download

memory/5620-15-0x0000000002330000-0x0000000002356000-memory.dmp

Download

memory/5620-17-0x000000001AD70000-0x000000001AD8C000-memory.dmp

Download

memory/5620-16-0x0000000000CD0000-0x0000000000CDE000-memory.dmp

Download

memory/5712-101-0x000001BEFF7A0000-0x000001BEFF890000-memory.dmp

Download

memory/5712-59-0x000001BEE7140000-0x000001BEE7162000-memory.dmp

Download